xref: /freebsd/crypto/openssh/clientloop.c (revision edf8578117e8844e02c0121147f45e4609b30680)
1*edf85781SEd Maste /* $OpenBSD: clientloop.c,v 1.398 2023/09/10 03:51:55 djm Exp $ */
2511b41d2SMark Murray /*
3511b41d2SMark Murray  * Author: Tatu Ylonen <ylo@cs.hut.fi>
4511b41d2SMark Murray  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5511b41d2SMark Murray  *                    All rights reserved
6511b41d2SMark Murray  * The main loop for the interactive session (client side).
7511b41d2SMark Murray  *
8b66f2d16SKris Kennaway  * As far as I am concerned, the code I have written for this software
9b66f2d16SKris Kennaway  * can be used freely for any purpose.  Any derived versions of this
10b66f2d16SKris Kennaway  * software must be clearly marked as such, and if the derived work is
11b66f2d16SKris Kennaway  * incompatible with the protocol description in the RFC file, it must be
12b66f2d16SKris Kennaway  * called by a name other than "ssh" or "Secure Shell".
13b66f2d16SKris Kennaway  *
14b66f2d16SKris Kennaway  *
15b66f2d16SKris Kennaway  * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
16b66f2d16SKris Kennaway  *
17b66f2d16SKris Kennaway  * Redistribution and use in source and binary forms, with or without
18b66f2d16SKris Kennaway  * modification, are permitted provided that the following conditions
19b66f2d16SKris Kennaway  * are met:
20b66f2d16SKris Kennaway  * 1. Redistributions of source code must retain the above copyright
21b66f2d16SKris Kennaway  *    notice, this list of conditions and the following disclaimer.
22b66f2d16SKris Kennaway  * 2. Redistributions in binary form must reproduce the above copyright
23b66f2d16SKris Kennaway  *    notice, this list of conditions and the following disclaimer in the
24b66f2d16SKris Kennaway  *    documentation and/or other materials provided with the distribution.
25b66f2d16SKris Kennaway  *
26b66f2d16SKris Kennaway  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27b66f2d16SKris Kennaway  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28b66f2d16SKris Kennaway  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29b66f2d16SKris Kennaway  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30b66f2d16SKris Kennaway  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31b66f2d16SKris Kennaway  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32b66f2d16SKris Kennaway  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33b66f2d16SKris Kennaway  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34b66f2d16SKris Kennaway  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35b66f2d16SKris Kennaway  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36b66f2d16SKris Kennaway  *
37b66f2d16SKris Kennaway  *
38a04a10f8SKris Kennaway  * SSH2 support added by Markus Friedl.
39ae1f160dSDag-Erling Smørgrav  * Copyright (c) 1999, 2000, 2001 Markus Friedl.  All rights reserved.
40b66f2d16SKris Kennaway  *
41b66f2d16SKris Kennaway  * Redistribution and use in source and binary forms, with or without
42b66f2d16SKris Kennaway  * modification, are permitted provided that the following conditions
43b66f2d16SKris Kennaway  * are met:
44b66f2d16SKris Kennaway  * 1. Redistributions of source code must retain the above copyright
45b66f2d16SKris Kennaway  *    notice, this list of conditions and the following disclaimer.
46b66f2d16SKris Kennaway  * 2. Redistributions in binary form must reproduce the above copyright
47b66f2d16SKris Kennaway  *    notice, this list of conditions and the following disclaimer in the
48b66f2d16SKris Kennaway  *    documentation and/or other materials provided with the distribution.
49b66f2d16SKris Kennaway  *
50b66f2d16SKris Kennaway  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
51b66f2d16SKris Kennaway  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
52b66f2d16SKris Kennaway  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
53b66f2d16SKris Kennaway  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
54b66f2d16SKris Kennaway  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
55b66f2d16SKris Kennaway  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
56b66f2d16SKris Kennaway  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
57b66f2d16SKris Kennaway  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
58b66f2d16SKris Kennaway  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
59b66f2d16SKris Kennaway  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
60511b41d2SMark Murray  */
61511b41d2SMark Murray 
62511b41d2SMark Murray #include "includes.h"
63511b41d2SMark Murray 
64761efaa7SDag-Erling Smørgrav #include <sys/types.h>
65761efaa7SDag-Erling Smørgrav #include <sys/ioctl.h>
66761efaa7SDag-Erling Smørgrav #ifdef HAVE_SYS_STAT_H
67761efaa7SDag-Erling Smørgrav # include <sys/stat.h>
68761efaa7SDag-Erling Smørgrav #endif
69761efaa7SDag-Erling Smørgrav #ifdef HAVE_SYS_TIME_H
70761efaa7SDag-Erling Smørgrav # include <sys/time.h>
71761efaa7SDag-Erling Smørgrav #endif
72761efaa7SDag-Erling Smørgrav #include <sys/socket.h>
73761efaa7SDag-Erling Smørgrav 
74761efaa7SDag-Erling Smørgrav #include <ctype.h>
75761efaa7SDag-Erling Smørgrav #include <errno.h>
76761efaa7SDag-Erling Smørgrav #ifdef HAVE_PATHS_H
77761efaa7SDag-Erling Smørgrav #include <paths.h>
78761efaa7SDag-Erling Smørgrav #endif
791323ec57SEd Maste #ifdef HAVE_POLL_H
801323ec57SEd Maste #include <poll.h>
811323ec57SEd Maste #endif
82761efaa7SDag-Erling Smørgrav #include <signal.h>
83761efaa7SDag-Erling Smørgrav #include <stdio.h>
84761efaa7SDag-Erling Smørgrav #include <stdlib.h>
85761efaa7SDag-Erling Smørgrav #include <string.h>
8619261079SEd Maste #include <stdarg.h>
87761efaa7SDag-Erling Smørgrav #include <termios.h>
88761efaa7SDag-Erling Smørgrav #include <pwd.h>
89761efaa7SDag-Erling Smørgrav #include <unistd.h>
90bc5531deSDag-Erling Smørgrav #include <limits.h>
91761efaa7SDag-Erling Smørgrav 
92d4af9e69SDag-Erling Smørgrav #include "openbsd-compat/sys-queue.h"
93761efaa7SDag-Erling Smørgrav #include "xmalloc.h"
94511b41d2SMark Murray #include "ssh.h"
951e8db6e2SBrian Feldman #include "ssh2.h"
96511b41d2SMark Murray #include "packet.h"
97190cef3dSDag-Erling Smørgrav #include "sshbuf.h"
98a04a10f8SKris Kennaway #include "compat.h"
99a04a10f8SKris Kennaway #include "channels.h"
100a04a10f8SKris Kennaway #include "dispatch.h"
101190cef3dSDag-Erling Smørgrav #include "sshkey.h"
102761efaa7SDag-Erling Smørgrav #include "cipher.h"
1031e8db6e2SBrian Feldman #include "kex.h"
104eccfee6eSDag-Erling Smørgrav #include "myproposal.h"
1051e8db6e2SBrian Feldman #include "log.h"
106a0ee8cc6SDag-Erling Smørgrav #include "misc.h"
1071e8db6e2SBrian Feldman #include "readconf.h"
1081e8db6e2SBrian Feldman #include "clientloop.h"
109021d409fSDag-Erling Smørgrav #include "sshconnect.h"
1101e8db6e2SBrian Feldman #include "authfd.h"
1111e8db6e2SBrian Feldman #include "atomicio.h"
112d74d50a8SDag-Erling Smørgrav #include "sshpty.h"
113d74d50a8SDag-Erling Smørgrav #include "match.h"
114d74d50a8SDag-Erling Smørgrav #include "msg.h"
115bc5531deSDag-Erling Smørgrav #include "ssherr.h"
116bc5531deSDag-Erling Smørgrav #include "hostfile.h"
1175b9b2fafSBrian Feldman 
1181323ec57SEd Maste /* Permitted RSA signature algorithms for UpdateHostkeys proofs */
1191323ec57SEd Maste #define HOSTKEY_PROOF_RSA_ALGS	"rsa-sha2-512,rsa-sha2-256"
1201323ec57SEd Maste 
121*edf85781SEd Maste /* Uncertainty (in percent) of keystroke timing intervals */
122*edf85781SEd Maste #define SSH_KEYSTROKE_TIMING_FUZZ 10
123*edf85781SEd Maste 
1245b9b2fafSBrian Feldman /* import options */
1254899dde7SBrian Feldman extern Options options;
1264899dde7SBrian Feldman 
127d74d50a8SDag-Erling Smørgrav /* Control socket */
128b15c8340SDag-Erling Smørgrav extern int muxserver_sock; /* XXX use mux_client_cleanup() instead */
129d74d50a8SDag-Erling Smørgrav 
130511b41d2SMark Murray /*
131511b41d2SMark Murray  * Name of the host we are connecting to.  This is the name given on the
13219261079SEd Maste  * command line, or the Hostname specified for the user-supplied name in a
133511b41d2SMark Murray  * configuration file.
134511b41d2SMark Murray  */
135511b41d2SMark Murray extern char *host;
136511b41d2SMark Murray 
137511b41d2SMark Murray /*
13819261079SEd Maste  * If this field is not NULL, the ForwardAgent socket is this path and different
13919261079SEd Maste  * instead of SSH_AUTH_SOCK.
14019261079SEd Maste  */
14119261079SEd Maste extern char *forward_agent_sock_path;
14219261079SEd Maste 
14319261079SEd Maste /*
144511b41d2SMark Murray  * Flag to indicate that we have received a window change signal which has
145511b41d2SMark Murray  * not yet been processed.  This will cause a message indicating the new
146511b41d2SMark Murray  * window size to be sent to the server a little later.  This is volatile
147511b41d2SMark Murray  * because this is updated in a signal handler.
148511b41d2SMark Murray  */
149ae1f160dSDag-Erling Smørgrav static volatile sig_atomic_t received_window_change_signal = 0;
150ae1f160dSDag-Erling Smørgrav static volatile sig_atomic_t received_signal = 0;
151511b41d2SMark Murray 
152e2f6069cSDag-Erling Smørgrav /* Time when backgrounded control master using ControlPersist should exit */
153e2f6069cSDag-Erling Smørgrav static time_t control_persist_exit_time = 0;
154e2f6069cSDag-Erling Smørgrav 
155511b41d2SMark Murray /* Common data for the client loop code. */
156b15c8340SDag-Erling Smørgrav volatile sig_atomic_t quit_pending; /* Set non-zero to quit the loop. */
157511b41d2SMark Murray static int last_was_cr;		/* Last character was a newline. */
158d4af9e69SDag-Erling Smørgrav static int exit_status;		/* Used to store the command exit status. */
159190cef3dSDag-Erling Smørgrav static struct sshbuf *stderr_buffer;	/* Used for final exit message. */
160511b41d2SMark Murray static int connection_in;	/* Connection to server (input). */
161511b41d2SMark Murray static int connection_out;	/* Connection to server (output). */
1621e8db6e2SBrian Feldman static int need_rekeying;	/* Set to non-zero if rekeying is requested. */
163e2f6069cSDag-Erling Smørgrav static int session_closed;	/* In SSH2: login session closed. */
1644d3fc8b0SEd Maste static time_t x11_refuse_time;	/* If >0, refuse x11 opens after this time. */
16519261079SEd Maste static time_t server_alive_time;	/* Time to do server_alive_check */
166f374ba41SEd Maste static int hostkeys_update_complete;
167f374ba41SEd Maste static int session_setup_complete;
168a04a10f8SKris Kennaway 
16919261079SEd Maste static void client_init_dispatch(struct ssh *ssh);
170a04a10f8SKris Kennaway int	session_ident = -1;
171a04a10f8SKris Kennaway 
172d4af9e69SDag-Erling Smørgrav /* Track escape per proto2 channel */
173d4af9e69SDag-Erling Smørgrav struct escape_filter_ctx {
174d4af9e69SDag-Erling Smørgrav 	int escape_pending;
175d4af9e69SDag-Erling Smørgrav 	int escape_char;
176d74d50a8SDag-Erling Smørgrav };
177d74d50a8SDag-Erling Smørgrav 
178d4af9e69SDag-Erling Smørgrav /* Context for channel confirmation replies */
179d4af9e69SDag-Erling Smørgrav struct channel_reply_ctx {
180d4af9e69SDag-Erling Smørgrav 	const char *request_type;
181e146993eSDag-Erling Smørgrav 	int id;
182e146993eSDag-Erling Smørgrav 	enum confirm_action action;
183d4af9e69SDag-Erling Smørgrav };
184d4af9e69SDag-Erling Smørgrav 
185d4af9e69SDag-Erling Smørgrav /* Global request success/failure callbacks */
1864f52dfbbSDag-Erling Smørgrav /* XXX move to struct ssh? */
187d4af9e69SDag-Erling Smørgrav struct global_confirm {
188d4af9e69SDag-Erling Smørgrav 	TAILQ_ENTRY(global_confirm) entry;
189d4af9e69SDag-Erling Smørgrav 	global_confirm_cb *cb;
190d4af9e69SDag-Erling Smørgrav 	void *ctx;
191d4af9e69SDag-Erling Smørgrav 	int ref_count;
192d4af9e69SDag-Erling Smørgrav };
193d4af9e69SDag-Erling Smørgrav TAILQ_HEAD(global_confirms, global_confirm);
194d4af9e69SDag-Erling Smørgrav static struct global_confirms global_confirms =
195d4af9e69SDag-Erling Smørgrav     TAILQ_HEAD_INITIALIZER(global_confirms);
196d4af9e69SDag-Erling Smørgrav 
197190cef3dSDag-Erling Smørgrav void ssh_process_session2_setup(int, int, int, struct sshbuf *);
1981323ec57SEd Maste static void quit_message(const char *fmt, ...)
1991323ec57SEd Maste     __attribute__((__format__ (printf, 1, 2)));
2001323ec57SEd Maste 
2011323ec57SEd Maste static void
2021323ec57SEd Maste quit_message(const char *fmt, ...)
2031323ec57SEd Maste {
2041323ec57SEd Maste 	char *msg;
2051323ec57SEd Maste 	va_list args;
2061323ec57SEd Maste 	int r;
2071323ec57SEd Maste 
2081323ec57SEd Maste 	va_start(args, fmt);
2091323ec57SEd Maste 	xvasprintf(&msg, fmt, args);
2101323ec57SEd Maste 	va_end(args);
2111323ec57SEd Maste 
2121323ec57SEd Maste 	if ((r = sshbuf_putf(stderr_buffer, "%s\r\n", msg)) != 0)
2131323ec57SEd Maste 		fatal_fr(r, "sshbuf_putf");
2141323ec57SEd Maste 	quit_pending = 1;
2151323ec57SEd Maste }
216d74d50a8SDag-Erling Smørgrav 
217511b41d2SMark Murray /*
218511b41d2SMark Murray  * Signal handler for the window change signal (SIGWINCH).  This just sets a
219511b41d2SMark Murray  * flag indicating that the window has changed.
220511b41d2SMark Murray  */
221ae1f160dSDag-Erling Smørgrav static void
222511b41d2SMark Murray window_change_handler(int sig)
223511b41d2SMark Murray {
224511b41d2SMark Murray 	received_window_change_signal = 1;
225511b41d2SMark Murray }
226511b41d2SMark Murray 
227511b41d2SMark Murray /*
228511b41d2SMark Murray  * Signal handler for signals that cause the program to terminate.  These
229511b41d2SMark Murray  * signals must be trapped to restore terminal modes.
230511b41d2SMark Murray  */
231ae1f160dSDag-Erling Smørgrav static void
232511b41d2SMark Murray signal_handler(int sig)
233511b41d2SMark Murray {
234ae1f160dSDag-Erling Smørgrav 	received_signal = sig;
235ae1f160dSDag-Erling Smørgrav 	quit_pending = 1;
236511b41d2SMark Murray }
237511b41d2SMark Murray 
238511b41d2SMark Murray /*
239e2f6069cSDag-Erling Smørgrav  * Sets control_persist_exit_time to the absolute time when the
240e2f6069cSDag-Erling Smørgrav  * backgrounded control master should exit due to expiry of the
241e2f6069cSDag-Erling Smørgrav  * ControlPersist timeout.  Sets it to 0 if we are not a backgrounded
242e2f6069cSDag-Erling Smørgrav  * control master process, or if there is no ControlPersist timeout.
243e2f6069cSDag-Erling Smørgrav  */
244e2f6069cSDag-Erling Smørgrav static void
2454f52dfbbSDag-Erling Smørgrav set_control_persist_exit_time(struct ssh *ssh)
246e2f6069cSDag-Erling Smørgrav {
247e2f6069cSDag-Erling Smørgrav 	if (muxserver_sock == -1 || !options.control_persist
248e146993eSDag-Erling Smørgrav 	    || options.control_persist_timeout == 0) {
249e2f6069cSDag-Erling Smørgrav 		/* not using a ControlPersist timeout */
250e2f6069cSDag-Erling Smørgrav 		control_persist_exit_time = 0;
2514f52dfbbSDag-Erling Smørgrav 	} else if (channel_still_open(ssh)) {
252e2f6069cSDag-Erling Smørgrav 		/* some client connections are still open */
253e2f6069cSDag-Erling Smørgrav 		if (control_persist_exit_time > 0)
25419261079SEd Maste 			debug2_f("cancel scheduled exit");
255e2f6069cSDag-Erling Smørgrav 		control_persist_exit_time = 0;
256e2f6069cSDag-Erling Smørgrav 	} else if (control_persist_exit_time <= 0) {
257e2f6069cSDag-Erling Smørgrav 		/* a client connection has recently closed */
258e4a9863fSDag-Erling Smørgrav 		control_persist_exit_time = monotime() +
259e2f6069cSDag-Erling Smørgrav 			(time_t)options.control_persist_timeout;
26019261079SEd Maste 		debug2_f("schedule exit in %d seconds",
261e2f6069cSDag-Erling Smørgrav 		    options.control_persist_timeout);
262e2f6069cSDag-Erling Smørgrav 	}
263e2f6069cSDag-Erling Smørgrav 	/* else we are already counting down to the timeout */
264e2f6069cSDag-Erling Smørgrav }
265e2f6069cSDag-Erling Smørgrav 
266462c32cbSDag-Erling Smørgrav #define SSH_X11_VALID_DISPLAY_CHARS ":/.-_"
267462c32cbSDag-Erling Smørgrav static int
268462c32cbSDag-Erling Smørgrav client_x11_display_valid(const char *display)
269462c32cbSDag-Erling Smørgrav {
270462c32cbSDag-Erling Smørgrav 	size_t i, dlen;
271462c32cbSDag-Erling Smørgrav 
272acc1a9efSDag-Erling Smørgrav 	if (display == NULL)
273acc1a9efSDag-Erling Smørgrav 		return 0;
274acc1a9efSDag-Erling Smørgrav 
275462c32cbSDag-Erling Smørgrav 	dlen = strlen(display);
276462c32cbSDag-Erling Smørgrav 	for (i = 0; i < dlen; i++) {
277f7167e0eSDag-Erling Smørgrav 		if (!isalnum((u_char)display[i]) &&
278462c32cbSDag-Erling Smørgrav 		    strchr(SSH_X11_VALID_DISPLAY_CHARS, display[i]) == NULL) {
279462c32cbSDag-Erling Smørgrav 			debug("Invalid character '%c' in DISPLAY", display[i]);
280462c32cbSDag-Erling Smørgrav 			return 0;
281462c32cbSDag-Erling Smørgrav 		}
282462c32cbSDag-Erling Smørgrav 	}
283462c32cbSDag-Erling Smørgrav 	return 1;
284462c32cbSDag-Erling Smørgrav }
285462c32cbSDag-Erling Smørgrav 
286043840dfSDag-Erling Smørgrav #define SSH_X11_PROTO		"MIT-MAGIC-COOKIE-1"
287557f75e5SDag-Erling Smørgrav #define X11_TIMEOUT_SLACK	60
288acc1a9efSDag-Erling Smørgrav int
2894f52dfbbSDag-Erling Smørgrav client_x11_get_proto(struct ssh *ssh, const char *display,
2904f52dfbbSDag-Erling Smørgrav     const char *xauth_path, u_int trusted, u_int timeout,
2914f52dfbbSDag-Erling Smørgrav     char **_proto, char **_data)
292043840dfSDag-Erling Smørgrav {
2932f513db7SEd Maste 	char *cmd, line[512], xdisplay[512];
294acc1a9efSDag-Erling Smørgrav 	char xauthfile[PATH_MAX], xauthdir[PATH_MAX];
295043840dfSDag-Erling Smørgrav 	static char proto[512], data[512];
296043840dfSDag-Erling Smørgrav 	FILE *f;
297ca86bcf2SDag-Erling Smørgrav 	int got_data = 0, generated = 0, do_unlink = 0, r;
298043840dfSDag-Erling Smørgrav 	struct stat st;
299557f75e5SDag-Erling Smørgrav 	u_int now, x11_timeout_real;
300043840dfSDag-Erling Smørgrav 
301043840dfSDag-Erling Smørgrav 	*_proto = proto;
302043840dfSDag-Erling Smørgrav 	*_data = data;
303acc1a9efSDag-Erling Smørgrav 	proto[0] = data[0] = xauthfile[0] = xauthdir[0] = '\0';
304043840dfSDag-Erling Smørgrav 
305acc1a9efSDag-Erling Smørgrav 	if (!client_x11_display_valid(display)) {
306acc1a9efSDag-Erling Smørgrav 		if (display != NULL)
307acc1a9efSDag-Erling Smørgrav 			logit("DISPLAY \"%s\" invalid; disabling X11 forwarding",
308462c32cbSDag-Erling Smørgrav 			    display);
309acc1a9efSDag-Erling Smørgrav 		return -1;
310043840dfSDag-Erling Smørgrav 	}
311acc1a9efSDag-Erling Smørgrav 	if (xauth_path != NULL && stat(xauth_path, &st) == -1) {
312acc1a9efSDag-Erling Smørgrav 		debug("No xauth program.");
313acc1a9efSDag-Erling Smørgrav 		xauth_path = NULL;
314acc1a9efSDag-Erling Smørgrav 	}
315acc1a9efSDag-Erling Smørgrav 
316acc1a9efSDag-Erling Smørgrav 	if (xauth_path != NULL) {
317043840dfSDag-Erling Smørgrav 		/*
318043840dfSDag-Erling Smørgrav 		 * Handle FamilyLocal case where $DISPLAY does
319043840dfSDag-Erling Smørgrav 		 * not match an authorization entry.  For this we
320043840dfSDag-Erling Smørgrav 		 * just try "xauth list unix:displaynum.screennum".
321043840dfSDag-Erling Smørgrav 		 * XXX: "localhost" match to determine FamilyLocal
322043840dfSDag-Erling Smørgrav 		 *      is not perfect.
323043840dfSDag-Erling Smørgrav 		 */
324043840dfSDag-Erling Smørgrav 		if (strncmp(display, "localhost:", 10) == 0) {
325acc1a9efSDag-Erling Smørgrav 			if ((r = snprintf(xdisplay, sizeof(xdisplay), "unix:%s",
326acc1a9efSDag-Erling Smørgrav 			    display + 10)) < 0 ||
327acc1a9efSDag-Erling Smørgrav 			    (size_t)r >= sizeof(xdisplay)) {
32819261079SEd Maste 				error_f("display name too long");
329acc1a9efSDag-Erling Smørgrav 				return -1;
330acc1a9efSDag-Erling Smørgrav 			}
331043840dfSDag-Erling Smørgrav 			display = xdisplay;
332043840dfSDag-Erling Smørgrav 		}
333043840dfSDag-Erling Smørgrav 		if (trusted == 0) {
334557f75e5SDag-Erling Smørgrav 			/*
335acc1a9efSDag-Erling Smørgrav 			 * Generate an untrusted X11 auth cookie.
336acc1a9efSDag-Erling Smørgrav 			 *
337557f75e5SDag-Erling Smørgrav 			 * The authentication cookie should briefly outlive
338557f75e5SDag-Erling Smørgrav 			 * ssh's willingness to forward X11 connections to
339557f75e5SDag-Erling Smørgrav 			 * avoid nasty fail-open behaviour in the X server.
340557f75e5SDag-Erling Smørgrav 			 */
341acc1a9efSDag-Erling Smørgrav 			mktemp_proto(xauthdir, sizeof(xauthdir));
342acc1a9efSDag-Erling Smørgrav 			if (mkdtemp(xauthdir) == NULL) {
34319261079SEd Maste 				error_f("mkdtemp: %s", strerror(errno));
344acc1a9efSDag-Erling Smørgrav 				return -1;
345acc1a9efSDag-Erling Smørgrav 			}
346acc1a9efSDag-Erling Smørgrav 			do_unlink = 1;
347acc1a9efSDag-Erling Smørgrav 			if ((r = snprintf(xauthfile, sizeof(xauthfile),
348acc1a9efSDag-Erling Smørgrav 			    "%s/xauthfile", xauthdir)) < 0 ||
349acc1a9efSDag-Erling Smørgrav 			    (size_t)r >= sizeof(xauthfile)) {
35019261079SEd Maste 				error_f("xauthfile path too long");
351acc1a9efSDag-Erling Smørgrav 				rmdir(xauthdir);
352acc1a9efSDag-Erling Smørgrav 				return -1;
353acc1a9efSDag-Erling Smørgrav 			}
354acc1a9efSDag-Erling Smørgrav 
3552f513db7SEd Maste 			if (timeout == 0) {
3562f513db7SEd Maste 				/* auth doesn't time out */
3572f513db7SEd Maste 				xasprintf(&cmd, "%s -f %s generate %s %s "
3582f513db7SEd Maste 				    "untrusted 2>%s",
359557f75e5SDag-Erling Smørgrav 				    xauth_path, xauthfile, display,
3602f513db7SEd Maste 				    SSH_X11_PROTO, _PATH_DEVNULL);
3612f513db7SEd Maste 			} else {
3622f513db7SEd Maste 				/* Add some slack to requested expiry */
3632f513db7SEd Maste 				if (timeout < UINT_MAX - X11_TIMEOUT_SLACK)
3642f513db7SEd Maste 					x11_timeout_real = timeout +
3652f513db7SEd Maste 					    X11_TIMEOUT_SLACK;
3662f513db7SEd Maste 				else {
3672f513db7SEd Maste 					/* Don't overflow on long timeouts */
3682f513db7SEd Maste 					x11_timeout_real = UINT_MAX;
3692f513db7SEd Maste 				}
3702f513db7SEd Maste 				xasprintf(&cmd, "%s -f %s generate %s %s "
3712f513db7SEd Maste 				    "untrusted timeout %u 2>%s",
3722f513db7SEd Maste 				    xauth_path, xauthfile, display,
3732f513db7SEd Maste 				    SSH_X11_PROTO, x11_timeout_real,
3742f513db7SEd Maste 				    _PATH_DEVNULL);
3752f513db7SEd Maste 			}
37619261079SEd Maste 			debug2_f("xauth command: %s", cmd);
3772f513db7SEd Maste 
3782f513db7SEd Maste 			if (timeout != 0 && x11_refuse_time == 0) {
379e4a9863fSDag-Erling Smørgrav 				now = monotime() + 1;
3804d3fc8b0SEd Maste 				if (SSH_TIME_T_MAX - timeout < now)
3814d3fc8b0SEd Maste 					x11_refuse_time = SSH_TIME_T_MAX;
382e2f6069cSDag-Erling Smørgrav 				else
383e2f6069cSDag-Erling Smørgrav 					x11_refuse_time = now + timeout;
3844f52dfbbSDag-Erling Smørgrav 				channel_set_x11_refuse_time(ssh,
3854f52dfbbSDag-Erling Smørgrav 				    x11_refuse_time);
386e2f6069cSDag-Erling Smørgrav 			}
387557f75e5SDag-Erling Smørgrav 			if (system(cmd) == 0)
388557f75e5SDag-Erling Smørgrav 				generated = 1;
3892f513db7SEd Maste 			free(cmd);
390043840dfSDag-Erling Smørgrav 		}
391d4af9e69SDag-Erling Smørgrav 
392d4af9e69SDag-Erling Smørgrav 		/*
393d4af9e69SDag-Erling Smørgrav 		 * When in untrusted mode, we read the cookie only if it was
394d4af9e69SDag-Erling Smørgrav 		 * successfully generated as an untrusted one in the step
395d4af9e69SDag-Erling Smørgrav 		 * above.
396d4af9e69SDag-Erling Smørgrav 		 */
397d4af9e69SDag-Erling Smørgrav 		if (trusted || generated) {
3982f513db7SEd Maste 			xasprintf(&cmd,
399021d409fSDag-Erling Smørgrav 			    "%s %s%s list %s 2>" _PATH_DEVNULL,
400043840dfSDag-Erling Smørgrav 			    xauth_path,
401043840dfSDag-Erling Smørgrav 			    generated ? "-f " : "" ,
402043840dfSDag-Erling Smørgrav 			    generated ? xauthfile : "",
403043840dfSDag-Erling Smørgrav 			    display);
404043840dfSDag-Erling Smørgrav 			debug2("x11_get_proto: %s", cmd);
405043840dfSDag-Erling Smørgrav 			f = popen(cmd, "r");
406043840dfSDag-Erling Smørgrav 			if (f && fgets(line, sizeof(line), f) &&
407043840dfSDag-Erling Smørgrav 			    sscanf(line, "%*s %511s %511s", proto, data) == 2)
408043840dfSDag-Erling Smørgrav 				got_data = 1;
409043840dfSDag-Erling Smørgrav 			if (f)
410043840dfSDag-Erling Smørgrav 				pclose(f);
4112f513db7SEd Maste 			free(cmd);
412acc1a9efSDag-Erling Smørgrav 		}
413043840dfSDag-Erling Smørgrav 	}
414043840dfSDag-Erling Smørgrav 
415043840dfSDag-Erling Smørgrav 	if (do_unlink) {
416043840dfSDag-Erling Smørgrav 		unlink(xauthfile);
417043840dfSDag-Erling Smørgrav 		rmdir(xauthdir);
418043840dfSDag-Erling Smørgrav 	}
419acc1a9efSDag-Erling Smørgrav 
420acc1a9efSDag-Erling Smørgrav 	/* Don't fall back to fake X11 data for untrusted forwarding */
421acc1a9efSDag-Erling Smørgrav 	if (!trusted && !got_data) {
422acc1a9efSDag-Erling Smørgrav 		error("Warning: untrusted X11 forwarding setup failed: "
423acc1a9efSDag-Erling Smørgrav 		    "xauth key data not generated");
424acc1a9efSDag-Erling Smørgrav 		return -1;
425acc1a9efSDag-Erling Smørgrav 	}
426043840dfSDag-Erling Smørgrav 
427043840dfSDag-Erling Smørgrav 	/*
428043840dfSDag-Erling Smørgrav 	 * If we didn't get authentication data, just make up some
429043840dfSDag-Erling Smørgrav 	 * data.  The forwarding code will check the validity of the
430043840dfSDag-Erling Smørgrav 	 * response anyway, and substitute this data.  The X11
431043840dfSDag-Erling Smørgrav 	 * server, however, will ignore this fake data and use
432043840dfSDag-Erling Smørgrav 	 * whatever authentication mechanisms it was using otherwise
433043840dfSDag-Erling Smørgrav 	 * for the local connection.
434043840dfSDag-Erling Smørgrav 	 */
435043840dfSDag-Erling Smørgrav 	if (!got_data) {
436ca86bcf2SDag-Erling Smørgrav 		u_int8_t rnd[16];
437ca86bcf2SDag-Erling Smørgrav 		u_int i;
438043840dfSDag-Erling Smørgrav 
439043840dfSDag-Erling Smørgrav 		logit("Warning: No xauth data; "
440043840dfSDag-Erling Smørgrav 		    "using fake authentication data for X11 forwarding.");
441043840dfSDag-Erling Smørgrav 		strlcpy(proto, SSH_X11_PROTO, sizeof proto);
442ca86bcf2SDag-Erling Smørgrav 		arc4random_buf(rnd, sizeof(rnd));
443ca86bcf2SDag-Erling Smørgrav 		for (i = 0; i < sizeof(rnd); i++) {
444043840dfSDag-Erling Smørgrav 			snprintf(data + 2 * i, sizeof data - 2 * i, "%02x",
445ca86bcf2SDag-Erling Smørgrav 			    rnd[i]);
446043840dfSDag-Erling Smørgrav 		}
447043840dfSDag-Erling Smørgrav 	}
448acc1a9efSDag-Erling Smørgrav 
449acc1a9efSDag-Erling Smørgrav 	return 0;
450043840dfSDag-Erling Smørgrav }
451043840dfSDag-Erling Smørgrav 
452511b41d2SMark Murray /*
453511b41d2SMark Murray  * Checks if the client window has changed, and sends a packet about it to
454511b41d2SMark Murray  * the server if so.  The actual change is detected elsewhere (by a software
455511b41d2SMark Murray  * interrupt on Unix); this just checks the flag and sends a message if
456511b41d2SMark Murray  * appropriate.
457511b41d2SMark Murray  */
458511b41d2SMark Murray 
459ae1f160dSDag-Erling Smørgrav static void
4604f52dfbbSDag-Erling Smørgrav client_check_window_change(struct ssh *ssh)
461511b41d2SMark Murray {
462a04a10f8SKris Kennaway 	if (!received_window_change_signal)
463a04a10f8SKris Kennaway 		return;
464511b41d2SMark Murray 	received_window_change_signal = 0;
46519261079SEd Maste 	debug2_f("changed");
4664f52dfbbSDag-Erling Smørgrav 	channel_send_window_changes(ssh);
467511b41d2SMark Murray }
468511b41d2SMark Murray 
469bc5531deSDag-Erling Smørgrav static int
4704f52dfbbSDag-Erling Smørgrav client_global_request_reply(int type, u_int32_t seq, struct ssh *ssh)
471efcad6b7SDag-Erling Smørgrav {
472d4af9e69SDag-Erling Smørgrav 	struct global_confirm *gc;
473d4af9e69SDag-Erling Smørgrav 
474d4af9e69SDag-Erling Smørgrav 	if ((gc = TAILQ_FIRST(&global_confirms)) == NULL)
475bc5531deSDag-Erling Smørgrav 		return 0;
476d4af9e69SDag-Erling Smørgrav 	if (gc->cb != NULL)
4774f52dfbbSDag-Erling Smørgrav 		gc->cb(ssh, type, seq, gc->ctx);
478d4af9e69SDag-Erling Smørgrav 	if (--gc->ref_count <= 0) {
479d4af9e69SDag-Erling Smørgrav 		TAILQ_REMOVE(&global_confirms, gc, entry);
48019261079SEd Maste 		freezero(gc, sizeof(*gc));
481d4af9e69SDag-Erling Smørgrav 	}
482d4af9e69SDag-Erling Smørgrav 
48319261079SEd Maste 	ssh_packet_set_alive_timeouts(ssh, 0);
484bc5531deSDag-Erling Smørgrav 	return 0;
485efcad6b7SDag-Erling Smørgrav }
486efcad6b7SDag-Erling Smørgrav 
487efcad6b7SDag-Erling Smørgrav static void
48819261079SEd Maste schedule_server_alive_check(void)
489efcad6b7SDag-Erling Smørgrav {
49019261079SEd Maste 	if (options.server_alive_interval > 0)
49119261079SEd Maste 		server_alive_time = monotime() + options.server_alive_interval;
49219261079SEd Maste }
49319261079SEd Maste 
49419261079SEd Maste static void
49519261079SEd Maste server_alive_check(struct ssh *ssh)
49619261079SEd Maste {
49719261079SEd Maste 	int r;
49819261079SEd Maste 
49919261079SEd Maste 	if (ssh_packet_inc_alive_timeouts(ssh) > options.server_alive_count_max) {
5004a421b63SDag-Erling Smørgrav 		logit("Timeout, server %s not responding.", host);
50192eb0aa1SDag-Erling Smørgrav 		cleanup_exit(255);
50292eb0aa1SDag-Erling Smørgrav 	}
50319261079SEd Maste 	if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 ||
50419261079SEd Maste 	    (r = sshpkt_put_cstring(ssh, "keepalive@openssh.com")) != 0 ||
50519261079SEd Maste 	    (r = sshpkt_put_u8(ssh, 1)) != 0 ||		/* boolean: want reply */
50619261079SEd Maste 	    (r = sshpkt_send(ssh)) != 0)
50719261079SEd Maste 		fatal_fr(r, "send packet");
508d4af9e69SDag-Erling Smørgrav 	/* Insert an empty placeholder to maintain ordering */
509d4af9e69SDag-Erling Smørgrav 	client_register_global_confirm(NULL, NULL);
51019261079SEd Maste 	schedule_server_alive_check();
511efcad6b7SDag-Erling Smørgrav }
512efcad6b7SDag-Erling Smørgrav 
513*edf85781SEd Maste /* Try to send a dummy keystroke */
514*edf85781SEd Maste static int
515*edf85781SEd Maste send_chaff(struct ssh *ssh)
516*edf85781SEd Maste {
517*edf85781SEd Maste 	int r;
518*edf85781SEd Maste 
519*edf85781SEd Maste 	if ((ssh->kex->flags & KEX_HAS_PING) == 0)
520*edf85781SEd Maste 		return 0;
521*edf85781SEd Maste 	/* XXX probabilistically send chaff? */
522*edf85781SEd Maste 	/*
523*edf85781SEd Maste 	 * a SSH2_MSG_CHANNEL_DATA payload is 9 bytes:
524*edf85781SEd Maste 	 *    4 bytes channel ID + 4 bytes string length + 1 byte string data
525*edf85781SEd Maste 	 * simulate that here.
526*edf85781SEd Maste 	 */
527*edf85781SEd Maste 	if ((r = sshpkt_start(ssh, SSH2_MSG_PING)) != 0 ||
528*edf85781SEd Maste 	    (r = sshpkt_put_cstring(ssh, "PING!")) != 0 ||
529*edf85781SEd Maste 	    (r = sshpkt_send(ssh)) != 0)
530*edf85781SEd Maste 		fatal_fr(r, "send packet");
531*edf85781SEd Maste 	return 1;
532*edf85781SEd Maste }
533*edf85781SEd Maste 
534*edf85781SEd Maste /* Sets the next interval to send a keystroke or chaff packet */
535*edf85781SEd Maste static void
536*edf85781SEd Maste set_next_interval(const struct timespec *now, struct timespec *next_interval,
537*edf85781SEd Maste     u_int interval_ms, int starting)
538*edf85781SEd Maste {
539*edf85781SEd Maste 	struct timespec tmp;
540*edf85781SEd Maste 	long long interval_ns, fuzz_ns;
541*edf85781SEd Maste 	static long long rate_fuzz;
542*edf85781SEd Maste 
543*edf85781SEd Maste 	interval_ns = interval_ms * (1000LL * 1000);
544*edf85781SEd Maste 	fuzz_ns = (interval_ns * SSH_KEYSTROKE_TIMING_FUZZ) / 100;
545*edf85781SEd Maste 	/* Center fuzz around requested interval */
546*edf85781SEd Maste 	if (fuzz_ns > INT_MAX)
547*edf85781SEd Maste 		fuzz_ns = INT_MAX;
548*edf85781SEd Maste 	if (fuzz_ns > interval_ns) {
549*edf85781SEd Maste 		/* Shouldn't happen */
550*edf85781SEd Maste 		fatal_f("internal error: fuzz %u%% %lldns > interval %lldns",
551*edf85781SEd Maste 		    SSH_KEYSTROKE_TIMING_FUZZ, fuzz_ns, interval_ns);
552*edf85781SEd Maste 	}
553*edf85781SEd Maste 	/*
554*edf85781SEd Maste 	 * Randomise the keystroke/chaff intervals in two ways:
555*edf85781SEd Maste 	 * 1. Each interval has some random jitter applied to make the
556*edf85781SEd Maste 	 *    interval-to-interval time unpredictable.
557*edf85781SEd Maste 	 * 2. The overall interval rate is also randomly perturbed for each
558*edf85781SEd Maste 	 *    chaffing session to make the average rate unpredictable.
559*edf85781SEd Maste 	 */
560*edf85781SEd Maste 	if (starting)
561*edf85781SEd Maste 		rate_fuzz = arc4random_uniform(fuzz_ns);
562*edf85781SEd Maste 	interval_ns -= fuzz_ns;
563*edf85781SEd Maste 	interval_ns += arc4random_uniform(fuzz_ns) + rate_fuzz;
564*edf85781SEd Maste 
565*edf85781SEd Maste 	tmp.tv_sec = interval_ns / (1000 * 1000 * 1000);
566*edf85781SEd Maste 	tmp.tv_nsec = interval_ns % (1000 * 1000 * 1000);
567*edf85781SEd Maste 
568*edf85781SEd Maste 	timespecadd(now, &tmp, next_interval);
569*edf85781SEd Maste }
570*edf85781SEd Maste 
571*edf85781SEd Maste /*
572*edf85781SEd Maste  * Performs keystroke timing obfuscation. Returns non-zero if the
573*edf85781SEd Maste  * output fd should be polled.
574*edf85781SEd Maste  */
575*edf85781SEd Maste static int
576*edf85781SEd Maste obfuscate_keystroke_timing(struct ssh *ssh, struct timespec *timeout,
577*edf85781SEd Maste     int channel_did_enqueue)
578*edf85781SEd Maste {
579*edf85781SEd Maste 	static int active;
580*edf85781SEd Maste 	static struct timespec next_interval, chaff_until;
581*edf85781SEd Maste 	struct timespec now, tmp;
582*edf85781SEd Maste 	int just_started = 0, had_keystroke = 0;
583*edf85781SEd Maste 	static unsigned long long nchaff;
584*edf85781SEd Maste 	char *stop_reason = NULL;
585*edf85781SEd Maste 	long long n;
586*edf85781SEd Maste 
587*edf85781SEd Maste 	monotime_ts(&now);
588*edf85781SEd Maste 
589*edf85781SEd Maste 	if (options.obscure_keystroke_timing_interval <= 0)
590*edf85781SEd Maste 		return 1;	/* disabled in config */
591*edf85781SEd Maste 
592*edf85781SEd Maste 	if (!channel_still_open(ssh) || quit_pending) {
593*edf85781SEd Maste 		/* Stop if no channels left of we're waiting for one to close */
594*edf85781SEd Maste 		stop_reason = "no active channels";
595*edf85781SEd Maste 	} else if (ssh_packet_is_rekeying(ssh)) {
596*edf85781SEd Maste 		/* Stop if we're rekeying */
597*edf85781SEd Maste 		stop_reason = "rekeying started";
598*edf85781SEd Maste 	} else if (!ssh_packet_interactive_data_to_write(ssh) &&
599*edf85781SEd Maste 	    ssh_packet_have_data_to_write(ssh)) {
600*edf85781SEd Maste 		/* Stop if the output buffer has more than a few keystrokes */
601*edf85781SEd Maste 		stop_reason = "output buffer filling";
602*edf85781SEd Maste 	} else if (active && channel_did_enqueue &&
603*edf85781SEd Maste 	    ssh_packet_have_data_to_write(ssh)) {
604*edf85781SEd Maste 		/* Still in active mode and have a keystroke queued. */
605*edf85781SEd Maste 		had_keystroke = 1;
606*edf85781SEd Maste 	} else if (active) {
607*edf85781SEd Maste 		if (timespeccmp(&now, &chaff_until, >=)) {
608*edf85781SEd Maste 			/* Stop if there have been no keystrokes for a while */
609*edf85781SEd Maste 			stop_reason = "chaff time expired";
610*edf85781SEd Maste 		} else if (timespeccmp(&now, &next_interval, >=)) {
611*edf85781SEd Maste 			/* Otherwise if we were due to send, then send chaff */
612*edf85781SEd Maste 			if (send_chaff(ssh))
613*edf85781SEd Maste 				nchaff++;
614*edf85781SEd Maste 		}
615*edf85781SEd Maste 	}
616*edf85781SEd Maste 
617*edf85781SEd Maste 	if (stop_reason != NULL) {
618*edf85781SEd Maste 		if (active) {
619*edf85781SEd Maste 			debug3_f("stopping: %s (%llu chaff packets sent)",
620*edf85781SEd Maste 			    stop_reason, nchaff);
621*edf85781SEd Maste 			active = 0;
622*edf85781SEd Maste 		}
623*edf85781SEd Maste 		return 1;
624*edf85781SEd Maste 	}
625*edf85781SEd Maste 
626*edf85781SEd Maste 	/*
627*edf85781SEd Maste 	 * If we're in interactive mode, and only have a small amount
628*edf85781SEd Maste 	 * of outbound data, then we assume that the user is typing
629*edf85781SEd Maste 	 * interactively. In this case, start quantising outbound packets to
630*edf85781SEd Maste 	 * fixed time intervals to hide inter-keystroke timing.
631*edf85781SEd Maste 	 */
632*edf85781SEd Maste 	if (!active && ssh_packet_interactive_data_to_write(ssh) &&
633*edf85781SEd Maste 	    channel_did_enqueue && ssh_packet_have_data_to_write(ssh)) {
634*edf85781SEd Maste 		debug3_f("starting: interval ~%dms",
635*edf85781SEd Maste 		    options.obscure_keystroke_timing_interval);
636*edf85781SEd Maste 		just_started = had_keystroke = active = 1;
637*edf85781SEd Maste 		nchaff = 0;
638*edf85781SEd Maste 		set_next_interval(&now, &next_interval,
639*edf85781SEd Maste 		    options.obscure_keystroke_timing_interval, 1);
640*edf85781SEd Maste 	}
641*edf85781SEd Maste 
642*edf85781SEd Maste 	/* Don't hold off if obfuscation inactive */
643*edf85781SEd Maste 	if (!active)
644*edf85781SEd Maste 		return 1;
645*edf85781SEd Maste 
646*edf85781SEd Maste 	if (had_keystroke) {
647*edf85781SEd Maste 		/*
648*edf85781SEd Maste 		 * Arrange to send chaff packets for a random interval after
649*edf85781SEd Maste 		 * the last keystroke was sent.
650*edf85781SEd Maste 		 */
651*edf85781SEd Maste 		ms_to_timespec(&tmp, SSH_KEYSTROKE_CHAFF_MIN_MS +
652*edf85781SEd Maste 		    arc4random_uniform(SSH_KEYSTROKE_CHAFF_RNG_MS));
653*edf85781SEd Maste 		timespecadd(&now, &tmp, &chaff_until);
654*edf85781SEd Maste 	}
655*edf85781SEd Maste 
656*edf85781SEd Maste 	ptimeout_deadline_monotime_tsp(timeout, &next_interval);
657*edf85781SEd Maste 
658*edf85781SEd Maste 	if (just_started)
659*edf85781SEd Maste 		return 1;
660*edf85781SEd Maste 
661*edf85781SEd Maste 	/* Don't arm output fd for poll until the timing interval has elapsed */
662*edf85781SEd Maste 	if (timespeccmp(&now, &next_interval, <))
663*edf85781SEd Maste 		return 0;
664*edf85781SEd Maste 
665*edf85781SEd Maste 	/* Calculate number of intervals missed since the last check */
666*edf85781SEd Maste 	n = (now.tv_sec - next_interval.tv_sec) * 1000LL * 1000 * 1000;
667*edf85781SEd Maste 	n += now.tv_nsec - next_interval.tv_nsec;
668*edf85781SEd Maste 	n /= options.obscure_keystroke_timing_interval * 1000LL * 1000;
669*edf85781SEd Maste 	n = (n < 0) ? 1 : n + 1;
670*edf85781SEd Maste 
671*edf85781SEd Maste 	/* Advance to the next interval */
672*edf85781SEd Maste 	set_next_interval(&now, &next_interval,
673*edf85781SEd Maste 	    options.obscure_keystroke_timing_interval * n, 0);
674*edf85781SEd Maste 	return 1;
675*edf85781SEd Maste }
676*edf85781SEd Maste 
677511b41d2SMark Murray /*
678511b41d2SMark Murray  * Waits until the client can do something (some data becomes available on
679511b41d2SMark Murray  * one of the file descriptors).
680511b41d2SMark Murray  */
681ae1f160dSDag-Erling Smørgrav static void
6821323ec57SEd Maste client_wait_until_can_do_something(struct ssh *ssh, struct pollfd **pfdp,
683*edf85781SEd Maste     u_int *npfd_allocp, u_int *npfd_activep, int channel_did_enqueue,
6841323ec57SEd Maste     int *conn_in_readyp, int *conn_out_readyp)
685511b41d2SMark Murray {
686f374ba41SEd Maste 	struct timespec timeout;
687*edf85781SEd Maste 	int ret, oready;
6881323ec57SEd Maste 	u_int p;
689efcad6b7SDag-Erling Smørgrav 
6901323ec57SEd Maste 	*conn_in_readyp = *conn_out_readyp = 0;
691511b41d2SMark Murray 
6921323ec57SEd Maste 	/* Prepare channel poll. First two pollfd entries are reserved */
693f374ba41SEd Maste 	ptimeout_init(&timeout);
694f374ba41SEd Maste 	channel_prepare_poll(ssh, pfdp, npfd_allocp, npfd_activep, 2, &timeout);
6951323ec57SEd Maste 	if (*npfd_activep < 2)
6961323ec57SEd Maste 		fatal_f("bad npfd %u", *npfd_activep); /* shouldn't happen */
6971323ec57SEd Maste 
6981323ec57SEd Maste 	/* channel_prepare_poll could have closed the last channel */
6994f52dfbbSDag-Erling Smørgrav 	if (session_closed && !channel_still_open(ssh) &&
70019261079SEd Maste 	    !ssh_packet_have_data_to_write(ssh)) {
7011323ec57SEd Maste 		/* clear events since we did not call poll() */
7021323ec57SEd Maste 		for (p = 0; p < *npfd_activep; p++)
7031323ec57SEd Maste 			(*pfdp)[p].revents = 0;
704ae1f160dSDag-Erling Smørgrav 		return;
7054f52dfbbSDag-Erling Smørgrav 	}
7064f52dfbbSDag-Erling Smørgrav 
707*edf85781SEd Maste 	oready = obfuscate_keystroke_timing(ssh, &timeout, channel_did_enqueue);
708*edf85781SEd Maste 
7091323ec57SEd Maste 	/* Monitor server connection on reserved pollfd entries */
7101323ec57SEd Maste 	(*pfdp)[0].fd = connection_in;
7111323ec57SEd Maste 	(*pfdp)[0].events = POLLIN;
7121323ec57SEd Maste 	(*pfdp)[1].fd = connection_out;
713*edf85781SEd Maste 	(*pfdp)[1].events = (oready && ssh_packet_have_data_to_write(ssh)) ?
714*edf85781SEd Maste 	    POLLOUT : 0;
715511b41d2SMark Murray 
716511b41d2SMark Murray 	/*
717511b41d2SMark Murray 	 * Wait for something to happen.  This will suspend the process until
7181323ec57SEd Maste 	 * some polled descriptor can be read, written, or has some other
719e2f6069cSDag-Erling Smørgrav 	 * event pending, or a timeout expires.
720511b41d2SMark Murray 	 */
7214f52dfbbSDag-Erling Smørgrav 	set_control_persist_exit_time(ssh);
722f374ba41SEd Maste 	if (control_persist_exit_time > 0)
723f374ba41SEd Maste 		ptimeout_deadline_monotime(&timeout, control_persist_exit_time);
724f374ba41SEd Maste 	if (options.server_alive_interval > 0)
725f374ba41SEd Maste 		ptimeout_deadline_monotime(&timeout, server_alive_time);
726*edf85781SEd Maste 	if (options.rekey_interval > 0 && !ssh_packet_is_rekeying(ssh)) {
727f374ba41SEd Maste 		ptimeout_deadline_sec(&timeout,
728f374ba41SEd Maste 		    ssh_packet_get_rekey_timeout(ssh));
729e2f6069cSDag-Erling Smørgrav 	}
730e2f6069cSDag-Erling Smørgrav 
731*edf85781SEd Maste 	ret = ppoll(*pfdp, *npfd_activep, ptimeout_get_tsp(&timeout), NULL);
7321323ec57SEd Maste 
73319261079SEd Maste 	if (ret == -1) {
7341e8db6e2SBrian Feldman 		/*
7351323ec57SEd Maste 		 * We have to clear the events because we return.
7361e8db6e2SBrian Feldman 		 * We have to return, because the mainloop checks for the flags
7371e8db6e2SBrian Feldman 		 * set by the signal handlers.
7381e8db6e2SBrian Feldman 		 */
7391323ec57SEd Maste 		for (p = 0; p < *npfd_activep; p++)
7401323ec57SEd Maste 			(*pfdp)[p].revents = 0;
741511b41d2SMark Murray 		if (errno == EINTR)
742511b41d2SMark Murray 			return;
743511b41d2SMark Murray 		/* Note: we might still have data in the buffers. */
7441323ec57SEd Maste 		quit_message("poll: %s", strerror(errno));
7451323ec57SEd Maste 		return;
7461323ec57SEd Maste 	}
7471323ec57SEd Maste 
7481323ec57SEd Maste 	*conn_in_readyp = (*pfdp)[0].revents != 0;
7491323ec57SEd Maste 	*conn_out_readyp = (*pfdp)[1].revents != 0;
7501323ec57SEd Maste 
7511323ec57SEd Maste 	if (options.server_alive_interval > 0 && !*conn_in_readyp &&
7521323ec57SEd Maste 	    monotime() >= server_alive_time) {
753e4a9863fSDag-Erling Smørgrav 		/*
7541323ec57SEd Maste 		 * ServerAlive check is needed. We can't rely on the poll
75519261079SEd Maste 		 * timing out since traffic on the client side such as port
75619261079SEd Maste 		 * forwards can keep waking it up.
757e4a9863fSDag-Erling Smørgrav 		 */
75819261079SEd Maste 		server_alive_check(ssh);
759e4a9863fSDag-Erling Smørgrav 	}
7601323ec57SEd Maste }
761e4a9863fSDag-Erling Smørgrav 
762ae1f160dSDag-Erling Smørgrav static void
763190cef3dSDag-Erling Smørgrav client_suspend_self(struct sshbuf *bin, struct sshbuf *bout, struct sshbuf *berr)
764511b41d2SMark Murray {
765511b41d2SMark Murray 	/* Flush stdout and stderr buffers. */
766190cef3dSDag-Erling Smørgrav 	if (sshbuf_len(bout) > 0)
767190cef3dSDag-Erling Smørgrav 		atomicio(vwrite, fileno(stdout), sshbuf_mutable_ptr(bout),
768190cef3dSDag-Erling Smørgrav 		    sshbuf_len(bout));
769190cef3dSDag-Erling Smørgrav 	if (sshbuf_len(berr) > 0)
770190cef3dSDag-Erling Smørgrav 		atomicio(vwrite, fileno(stderr), sshbuf_mutable_ptr(berr),
771190cef3dSDag-Erling Smørgrav 		    sshbuf_len(berr));
772511b41d2SMark Murray 
773e146993eSDag-Erling Smørgrav 	leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
774511b41d2SMark Murray 
7754f52dfbbSDag-Erling Smørgrav 	sshbuf_reset(bin);
7764f52dfbbSDag-Erling Smørgrav 	sshbuf_reset(bout);
7774f52dfbbSDag-Erling Smørgrav 	sshbuf_reset(berr);
778511b41d2SMark Murray 
779511b41d2SMark Murray 	/* Send the suspend signal to the program itself. */
780511b41d2SMark Murray 	kill(getpid(), SIGTSTP);
781511b41d2SMark Murray 
7825e8dbd04SDag-Erling Smørgrav 	/* Reset window sizes in case they have changed */
783511b41d2SMark Murray 	received_window_change_signal = 1;
784511b41d2SMark Murray 
785e146993eSDag-Erling Smørgrav 	enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
786511b41d2SMark Murray }
787511b41d2SMark Murray 
788ae1f160dSDag-Erling Smørgrav static void
7891323ec57SEd Maste client_process_net_input(struct ssh *ssh)
790511b41d2SMark Murray {
7911323ec57SEd Maste 	int r;
792511b41d2SMark Murray 
793511b41d2SMark Murray 	/*
794511b41d2SMark Murray 	 * Read input from the server, and add any such data to the buffer of
795511b41d2SMark Murray 	 * the packet subsystem.
796511b41d2SMark Murray 	 */
79719261079SEd Maste 	schedule_server_alive_check();
7981323ec57SEd Maste 	if ((r = ssh_packet_process_read(ssh, connection_in)) == 0)
7991323ec57SEd Maste 		return; /* success */
8001323ec57SEd Maste 	if (r == SSH_ERR_SYSTEM_ERROR) {
8011323ec57SEd Maste 		if (errno == EAGAIN || errno == EINTR || errno == EWOULDBLOCK)
8021323ec57SEd Maste 			return;
8031323ec57SEd Maste 		if (errno == EPIPE) {
8041323ec57SEd Maste 			quit_message("Connection to %s closed by remote host.",
8051323ec57SEd Maste 			    host);
806511b41d2SMark Murray 			return;
807511b41d2SMark Murray 		}
808511b41d2SMark Murray 	}
8091323ec57SEd Maste 	quit_message("Read from remote host %s: %s", host, ssh_err(r));
810a04a10f8SKris Kennaway }
811a04a10f8SKris Kennaway 
812545d5ecaSDag-Erling Smørgrav static void
8134f52dfbbSDag-Erling Smørgrav client_status_confirm(struct ssh *ssh, int type, Channel *c, void *ctx)
814d74d50a8SDag-Erling Smørgrav {
815d4af9e69SDag-Erling Smørgrav 	struct channel_reply_ctx *cr = (struct channel_reply_ctx *)ctx;
816d4af9e69SDag-Erling Smørgrav 	char errmsg[256];
817190cef3dSDag-Erling Smørgrav 	int r, tochan;
818d74d50a8SDag-Erling Smørgrav 
819e146993eSDag-Erling Smørgrav 	/*
820e146993eSDag-Erling Smørgrav 	 * If a TTY was explicitly requested, then a failure to allocate
821e146993eSDag-Erling Smørgrav 	 * one is fatal.
822e146993eSDag-Erling Smørgrav 	 */
823e146993eSDag-Erling Smørgrav 	if (cr->action == CONFIRM_TTY &&
824e146993eSDag-Erling Smørgrav 	    (options.request_tty == REQUEST_TTY_FORCE ||
825e146993eSDag-Erling Smørgrav 	    options.request_tty == REQUEST_TTY_YES))
826e146993eSDag-Erling Smørgrav 		cr->action = CONFIRM_CLOSE;
827e146993eSDag-Erling Smørgrav 
828190cef3dSDag-Erling Smørgrav 	/* XXX suppress on mux _client_ quietmode */
829d4af9e69SDag-Erling Smørgrav 	tochan = options.log_level >= SYSLOG_LEVEL_ERROR &&
830b15c8340SDag-Erling Smørgrav 	    c->ctl_chan != -1 && c->extended_usage == CHAN_EXTENDED_WRITE;
831d74d50a8SDag-Erling Smørgrav 
832d4af9e69SDag-Erling Smørgrav 	if (type == SSH2_MSG_CHANNEL_SUCCESS) {
833d4af9e69SDag-Erling Smørgrav 		debug2("%s request accepted on channel %d",
834d4af9e69SDag-Erling Smørgrav 		    cr->request_type, c->self);
835d4af9e69SDag-Erling Smørgrav 	} else if (type == SSH2_MSG_CHANNEL_FAILURE) {
836d4af9e69SDag-Erling Smørgrav 		if (tochan) {
837d4af9e69SDag-Erling Smørgrav 			snprintf(errmsg, sizeof(errmsg),
838d4af9e69SDag-Erling Smørgrav 			    "%s request failed\r\n", cr->request_type);
839d4af9e69SDag-Erling Smørgrav 		} else {
840d4af9e69SDag-Erling Smørgrav 			snprintf(errmsg, sizeof(errmsg),
841d4af9e69SDag-Erling Smørgrav 			    "%s request failed on channel %d",
842d4af9e69SDag-Erling Smørgrav 			    cr->request_type, c->self);
843d74d50a8SDag-Erling Smørgrav 		}
844d4af9e69SDag-Erling Smørgrav 		/* If error occurred on primary session channel, then exit */
845e146993eSDag-Erling Smørgrav 		if (cr->action == CONFIRM_CLOSE && c->self == session_ident)
846d4af9e69SDag-Erling Smørgrav 			fatal("%s", errmsg);
847e146993eSDag-Erling Smørgrav 		/*
848e146993eSDag-Erling Smørgrav 		 * If error occurred on mux client, append to
849e146993eSDag-Erling Smørgrav 		 * their stderr.
850e146993eSDag-Erling Smørgrav 		 */
851e146993eSDag-Erling Smørgrav 		if (tochan) {
85219261079SEd Maste 			debug3_f("channel %d: mux request: %s", c->self,
85319261079SEd Maste 			    cr->request_type);
854190cef3dSDag-Erling Smørgrav 			if ((r = sshbuf_put(c->extended, errmsg,
855190cef3dSDag-Erling Smørgrav 			    strlen(errmsg))) != 0)
85619261079SEd Maste 				fatal_fr(r, "sshbuf_put");
857e146993eSDag-Erling Smørgrav 		} else
858d4af9e69SDag-Erling Smørgrav 			error("%s", errmsg);
859e146993eSDag-Erling Smørgrav 		if (cr->action == CONFIRM_TTY) {
860e146993eSDag-Erling Smørgrav 			/*
861e146993eSDag-Erling Smørgrav 			 * If a TTY allocation error occurred, then arrange
862e146993eSDag-Erling Smørgrav 			 * for the correct TTY to leave raw mode.
863e146993eSDag-Erling Smørgrav 			 */
864e146993eSDag-Erling Smørgrav 			if (c->self == session_ident)
865e146993eSDag-Erling Smørgrav 				leave_raw_mode(0);
866e146993eSDag-Erling Smørgrav 			else
8674f52dfbbSDag-Erling Smørgrav 				mux_tty_alloc_failed(ssh, c);
868e146993eSDag-Erling Smørgrav 		} else if (cr->action == CONFIRM_CLOSE) {
8694f52dfbbSDag-Erling Smørgrav 			chan_read_failed(ssh, c);
8704f52dfbbSDag-Erling Smørgrav 			chan_write_failed(ssh, c);
871d74d50a8SDag-Erling Smørgrav 		}
872d74d50a8SDag-Erling Smørgrav 	}
873e4a9863fSDag-Erling Smørgrav 	free(cr);
874d4af9e69SDag-Erling Smørgrav }
875d74d50a8SDag-Erling Smørgrav 
876d74d50a8SDag-Erling Smørgrav static void
8774f52dfbbSDag-Erling Smørgrav client_abandon_status_confirm(struct ssh *ssh, Channel *c, void *ctx)
878d74d50a8SDag-Erling Smørgrav {
879e4a9863fSDag-Erling Smørgrav 	free(ctx);
880d74d50a8SDag-Erling Smørgrav }
881d74d50a8SDag-Erling Smørgrav 
882e146993eSDag-Erling Smørgrav void
8834f52dfbbSDag-Erling Smørgrav client_expect_confirm(struct ssh *ssh, int id, const char *request,
884e146993eSDag-Erling Smørgrav     enum confirm_action action)
885d74d50a8SDag-Erling Smørgrav {
8860a37d4a3SXin LI 	struct channel_reply_ctx *cr = xcalloc(1, sizeof(*cr));
887d74d50a8SDag-Erling Smørgrav 
888d4af9e69SDag-Erling Smørgrav 	cr->request_type = request;
889e146993eSDag-Erling Smørgrav 	cr->action = action;
890d74d50a8SDag-Erling Smørgrav 
8914f52dfbbSDag-Erling Smørgrav 	channel_register_status_confirm(ssh, id, client_status_confirm,
892d4af9e69SDag-Erling Smørgrav 	    client_abandon_status_confirm, cr);
893d4af9e69SDag-Erling Smørgrav }
894d4af9e69SDag-Erling Smørgrav 
895d4af9e69SDag-Erling Smørgrav void
896d4af9e69SDag-Erling Smørgrav client_register_global_confirm(global_confirm_cb *cb, void *ctx)
897d4af9e69SDag-Erling Smørgrav {
898d4af9e69SDag-Erling Smørgrav 	struct global_confirm *gc, *last_gc;
899d4af9e69SDag-Erling Smørgrav 
900d4af9e69SDag-Erling Smørgrav 	/* Coalesce identical callbacks */
901d4af9e69SDag-Erling Smørgrav 	last_gc = TAILQ_LAST(&global_confirms, global_confirms);
902d4af9e69SDag-Erling Smørgrav 	if (last_gc && last_gc->cb == cb && last_gc->ctx == ctx) {
903d4af9e69SDag-Erling Smørgrav 		if (++last_gc->ref_count >= INT_MAX)
90419261079SEd Maste 			fatal_f("last_gc->ref_count = %d",
90519261079SEd Maste 			    last_gc->ref_count);
906d74d50a8SDag-Erling Smørgrav 		return;
907d74d50a8SDag-Erling Smørgrav 	}
908d74d50a8SDag-Erling Smørgrav 
9090a37d4a3SXin LI 	gc = xcalloc(1, sizeof(*gc));
910d4af9e69SDag-Erling Smørgrav 	gc->cb = cb;
911d4af9e69SDag-Erling Smørgrav 	gc->ctx = ctx;
912d4af9e69SDag-Erling Smørgrav 	gc->ref_count = 1;
913d4af9e69SDag-Erling Smørgrav 	TAILQ_INSERT_TAIL(&global_confirms, gc, entry);
914d74d50a8SDag-Erling Smørgrav }
915d74d50a8SDag-Erling Smørgrav 
916f374ba41SEd Maste /*
917f374ba41SEd Maste  * Returns non-zero if the client is able to handle a hostkeys-00@openssh.com
918f374ba41SEd Maste  * hostkey update request.
919f374ba41SEd Maste  */
920f374ba41SEd Maste static int
921f374ba41SEd Maste can_update_hostkeys(void)
922f374ba41SEd Maste {
923f374ba41SEd Maste 	if (hostkeys_update_complete)
924f374ba41SEd Maste 		return 0;
925f374ba41SEd Maste 	if (options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK &&
926f374ba41SEd Maste 	    options.batch_mode)
927f374ba41SEd Maste 		return 0; /* won't ask in batchmode, so don't even try */
928f374ba41SEd Maste 	if (!options.update_hostkeys || options.num_user_hostfiles <= 0)
929f374ba41SEd Maste 		return 0;
930f374ba41SEd Maste 	return 1;
931f374ba41SEd Maste }
932f374ba41SEd Maste 
933f374ba41SEd Maste static void
934f374ba41SEd Maste client_repledge(void)
935f374ba41SEd Maste {
936f374ba41SEd Maste 	debug3_f("enter");
937f374ba41SEd Maste 
938f374ba41SEd Maste 	/* Might be able to tighten pledge now that session is established */
939f374ba41SEd Maste 	if (options.control_master || options.control_path != NULL ||
940f374ba41SEd Maste 	    options.forward_x11 || options.fork_after_authentication ||
941f374ba41SEd Maste 	    can_update_hostkeys() ||
942f374ba41SEd Maste 	    (session_ident != -1 && !session_setup_complete)) {
943f374ba41SEd Maste 		/* Can't tighten */
944f374ba41SEd Maste 		return;
945f374ba41SEd Maste 	}
946f374ba41SEd Maste 	/*
947f374ba41SEd Maste 	 * LocalCommand and UpdateHostkeys have finished, so can get rid of
948f374ba41SEd Maste 	 * filesystem.
949f374ba41SEd Maste 	 *
950f374ba41SEd Maste 	 * XXX protocol allows a server can to change hostkeys during the
951f374ba41SEd Maste 	 *     connection at rekey time that could trigger a hostkeys update
952f374ba41SEd Maste 	 *     but AFAIK no implementations support this. Could improve by
953f374ba41SEd Maste 	 *     forcing known_hosts to be read-only or via unveil(2).
954f374ba41SEd Maste 	 */
955f374ba41SEd Maste 	if (options.num_local_forwards != 0 ||
956f374ba41SEd Maste 	    options.num_remote_forwards != 0 ||
957f374ba41SEd Maste 	    options.num_permitted_remote_opens != 0 ||
958f374ba41SEd Maste 	    options.enable_escape_commandline != 0) {
959f374ba41SEd Maste 		/* rfwd needs inet */
960f374ba41SEd Maste 		debug("pledge: network");
961f374ba41SEd Maste 		if (pledge("stdio unix inet dns proc tty", NULL) == -1)
962f374ba41SEd Maste 			fatal_f("pledge(): %s", strerror(errno));
963f374ba41SEd Maste 	} else if (options.forward_agent != 0) {
964f374ba41SEd Maste 		/* agent forwarding needs to open $SSH_AUTH_SOCK at will */
965f374ba41SEd Maste 		debug("pledge: agent");
966f374ba41SEd Maste 		if (pledge("stdio unix proc tty", NULL) == -1)
967f374ba41SEd Maste 			fatal_f("pledge(): %s", strerror(errno));
968f374ba41SEd Maste 	} else {
969f374ba41SEd Maste 		debug("pledge: fork");
970f374ba41SEd Maste 		if (pledge("stdio proc tty", NULL) == -1)
971f374ba41SEd Maste 			fatal_f("pledge(): %s", strerror(errno));
972f374ba41SEd Maste 	}
973f374ba41SEd Maste 	/* XXX further things to do:
974f374ba41SEd Maste 	 *
975f374ba41SEd Maste 	 * - might be able to get rid of proc if we kill ~^Z
976f374ba41SEd Maste 	 * - ssh -N (no session)
977f374ba41SEd Maste 	 * - stdio forwarding
978f374ba41SEd Maste 	 * - sessions without tty
979f374ba41SEd Maste 	 */
980f374ba41SEd Maste }
981f374ba41SEd Maste 
982d74d50a8SDag-Erling Smørgrav static void
9834f52dfbbSDag-Erling Smørgrav process_cmdline(struct ssh *ssh)
984545d5ecaSDag-Erling Smørgrav {
985545d5ecaSDag-Erling Smørgrav 	void (*handler)(int);
986a0ee8cc6SDag-Erling Smørgrav 	char *s, *cmd;
987a0ee8cc6SDag-Erling Smørgrav 	int ok, delete = 0, local = 0, remote = 0, dynamic = 0;
988a0ee8cc6SDag-Erling Smørgrav 	struct Forward fwd;
989545d5ecaSDag-Erling Smørgrav 
990b83788ffSDag-Erling Smørgrav 	memset(&fwd, 0, sizeof(fwd));
991d4af9e69SDag-Erling Smørgrav 
992e146993eSDag-Erling Smørgrav 	leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
99319261079SEd Maste 	handler = ssh_signal(SIGINT, SIG_IGN);
994545d5ecaSDag-Erling Smørgrav 	cmd = s = read_passphrase("\r\nssh> ", RP_ECHO);
995545d5ecaSDag-Erling Smørgrav 	if (s == NULL)
996545d5ecaSDag-Erling Smørgrav 		goto out;
997f7167e0eSDag-Erling Smørgrav 	while (isspace((u_char)*s))
998545d5ecaSDag-Erling Smørgrav 		s++;
999d74d50a8SDag-Erling Smørgrav 	if (*s == '-')
1000d74d50a8SDag-Erling Smørgrav 		s++;	/* Skip cmdline '-', if any */
1001d74d50a8SDag-Erling Smørgrav 	if (*s == '\0')
1002545d5ecaSDag-Erling Smørgrav 		goto out;
1003d74d50a8SDag-Erling Smørgrav 
1004d74d50a8SDag-Erling Smørgrav 	if (*s == 'h' || *s == 'H' || *s == '?') {
1005d74d50a8SDag-Erling Smørgrav 		logit("Commands:");
1006761efaa7SDag-Erling Smørgrav 		logit("      -L[bind_address:]port:host:hostport    "
1007761efaa7SDag-Erling Smørgrav 		    "Request local forward");
1008761efaa7SDag-Erling Smørgrav 		logit("      -R[bind_address:]port:host:hostport    "
1009761efaa7SDag-Erling Smørgrav 		    "Request remote forward");
1010cce7d346SDag-Erling Smørgrav 		logit("      -D[bind_address:]port                  "
1011cce7d346SDag-Erling Smørgrav 		    "Request dynamic forward");
1012462c32cbSDag-Erling Smørgrav 		logit("      -KL[bind_address:]port                 "
1013462c32cbSDag-Erling Smørgrav 		    "Cancel local forward");
1014761efaa7SDag-Erling Smørgrav 		logit("      -KR[bind_address:]port                 "
1015761efaa7SDag-Erling Smørgrav 		    "Cancel remote forward");
1016462c32cbSDag-Erling Smørgrav 		logit("      -KD[bind_address:]port                 "
1017462c32cbSDag-Erling Smørgrav 		    "Cancel dynamic forward");
1018021d409fSDag-Erling Smørgrav 		if (!options.permit_local_command)
1019021d409fSDag-Erling Smørgrav 			goto out;
1020761efaa7SDag-Erling Smørgrav 		logit("      !args                                  "
1021761efaa7SDag-Erling Smørgrav 		    "Execute local command");
1022021d409fSDag-Erling Smørgrav 		goto out;
1023021d409fSDag-Erling Smørgrav 	}
1024021d409fSDag-Erling Smørgrav 
1025021d409fSDag-Erling Smørgrav 	if (*s == '!' && options.permit_local_command) {
1026021d409fSDag-Erling Smørgrav 		s++;
1027021d409fSDag-Erling Smørgrav 		ssh_local_cmd(s);
1028d74d50a8SDag-Erling Smørgrav 		goto out;
1029d74d50a8SDag-Erling Smørgrav 	}
1030d74d50a8SDag-Erling Smørgrav 
1031d74d50a8SDag-Erling Smørgrav 	if (*s == 'K') {
1032d74d50a8SDag-Erling Smørgrav 		delete = 1;
1033d74d50a8SDag-Erling Smørgrav 		s++;
1034d74d50a8SDag-Erling Smørgrav 	}
1035cce7d346SDag-Erling Smørgrav 	if (*s == 'L')
1036cce7d346SDag-Erling Smørgrav 		local = 1;
1037cce7d346SDag-Erling Smørgrav 	else if (*s == 'R')
1038cce7d346SDag-Erling Smørgrav 		remote = 1;
1039cce7d346SDag-Erling Smørgrav 	else if (*s == 'D')
1040cce7d346SDag-Erling Smørgrav 		dynamic = 1;
1041cce7d346SDag-Erling Smørgrav 	else {
1042d95e11bfSDag-Erling Smørgrav 		logit("Invalid command.");
1043545d5ecaSDag-Erling Smørgrav 		goto out;
1044545d5ecaSDag-Erling Smørgrav 	}
1045cce7d346SDag-Erling Smørgrav 
1046f7167e0eSDag-Erling Smørgrav 	while (isspace((u_char)*++s))
1047d4af9e69SDag-Erling Smørgrav 		;
1048545d5ecaSDag-Erling Smørgrav 
1049b15c8340SDag-Erling Smørgrav 	/* XXX update list of forwards in options */
1050d74d50a8SDag-Erling Smørgrav 	if (delete) {
1051a0ee8cc6SDag-Erling Smørgrav 		/* We pass 1 for dynamicfwd to restrict to 1 or 2 fields. */
1052a0ee8cc6SDag-Erling Smørgrav 		if (!parse_forward(&fwd, s, 1, 0)) {
1053a0ee8cc6SDag-Erling Smørgrav 			logit("Bad forwarding close specification.");
1054545d5ecaSDag-Erling Smørgrav 			goto out;
1055545d5ecaSDag-Erling Smørgrav 		}
1056462c32cbSDag-Erling Smørgrav 		if (remote)
10574f52dfbbSDag-Erling Smørgrav 			ok = channel_request_rforward_cancel(ssh, &fwd) == 0;
1058462c32cbSDag-Erling Smørgrav 		else if (dynamic)
10594f52dfbbSDag-Erling Smørgrav 			ok = channel_cancel_lport_listener(ssh, &fwd,
1060a0ee8cc6SDag-Erling Smørgrav 			    0, &options.fwd_opts) > 0;
1061462c32cbSDag-Erling Smørgrav 		else
10624f52dfbbSDag-Erling Smørgrav 			ok = channel_cancel_lport_listener(ssh, &fwd,
1063a0ee8cc6SDag-Erling Smørgrav 			    CHANNEL_CANCEL_PORT_STATIC,
1064a0ee8cc6SDag-Erling Smørgrav 			    &options.fwd_opts) > 0;
1065462c32cbSDag-Erling Smørgrav 		if (!ok) {
1066d93a896eSDag-Erling Smørgrav 			logit("Unknown port forwarding.");
1067462c32cbSDag-Erling Smørgrav 			goto out;
1068462c32cbSDag-Erling Smørgrav 		}
1069462c32cbSDag-Erling Smørgrav 		logit("Canceled forwarding.");
10705e8dbd04SDag-Erling Smørgrav 	} else {
1071f374ba41SEd Maste 		/* -R specs can be both dynamic or not, so check both. */
1072f374ba41SEd Maste 		if (remote) {
1073f374ba41SEd Maste 			if (!parse_forward(&fwd, s, 0, remote) &&
1074f374ba41SEd Maste 			    !parse_forward(&fwd, s, 1, remote)) {
1075f374ba41SEd Maste 				logit("Bad remote forwarding specification.");
1076f374ba41SEd Maste 				goto out;
1077f374ba41SEd Maste 			}
1078f374ba41SEd Maste 		} else if (!parse_forward(&fwd, s, dynamic, remote)) {
1079f374ba41SEd Maste 			logit("Bad local forwarding specification.");
1080545d5ecaSDag-Erling Smørgrav 			goto out;
1081545d5ecaSDag-Erling Smørgrav 		}
1082cce7d346SDag-Erling Smørgrav 		if (local || dynamic) {
10834f52dfbbSDag-Erling Smørgrav 			if (!channel_setup_local_fwd_listener(ssh, &fwd,
1084a0ee8cc6SDag-Erling Smørgrav 			    &options.fwd_opts)) {
1085d95e11bfSDag-Erling Smørgrav 				logit("Port forwarding failed.");
1086545d5ecaSDag-Erling Smørgrav 				goto out;
1087545d5ecaSDag-Erling Smørgrav 			}
10885e8dbd04SDag-Erling Smørgrav 		} else {
10894f52dfbbSDag-Erling Smørgrav 			if (channel_request_remote_forwarding(ssh, &fwd) < 0) {
1090761efaa7SDag-Erling Smørgrav 				logit("Port forwarding failed.");
1091761efaa7SDag-Erling Smørgrav 				goto out;
1092761efaa7SDag-Erling Smørgrav 			}
10935e8dbd04SDag-Erling Smørgrav 		}
1094d95e11bfSDag-Erling Smørgrav 		logit("Forwarding port.");
1095d74d50a8SDag-Erling Smørgrav 	}
1096d74d50a8SDag-Erling Smørgrav 
1097545d5ecaSDag-Erling Smørgrav out:
109819261079SEd Maste 	ssh_signal(SIGINT, handler);
1099e146993eSDag-Erling Smørgrav 	enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
1100e4a9863fSDag-Erling Smørgrav 	free(cmd);
1101e4a9863fSDag-Erling Smørgrav 	free(fwd.listen_host);
1102a0ee8cc6SDag-Erling Smørgrav 	free(fwd.listen_path);
1103e4a9863fSDag-Erling Smørgrav 	free(fwd.connect_host);
1104a0ee8cc6SDag-Erling Smørgrav 	free(fwd.connect_path);
1105545d5ecaSDag-Erling Smørgrav }
1106545d5ecaSDag-Erling Smørgrav 
11076888a9beSDag-Erling Smørgrav /* reasons to suppress output of an escape command in help output */
11086888a9beSDag-Erling Smørgrav #define SUPPRESS_NEVER		0	/* never suppress, always show */
11094f52dfbbSDag-Erling Smørgrav #define SUPPRESS_MUXCLIENT	1	/* don't show in mux client sessions */
11104f52dfbbSDag-Erling Smørgrav #define SUPPRESS_MUXMASTER	2	/* don't show in mux master sessions */
11114f52dfbbSDag-Erling Smørgrav #define SUPPRESS_SYSLOG		4	/* don't show when logging to syslog */
1112f374ba41SEd Maste #define SUPPRESS_NOCMDLINE	8	/* don't show when cmdline disabled*/
11136888a9beSDag-Erling Smørgrav struct escape_help_text {
11146888a9beSDag-Erling Smørgrav 	const char *cmd;
11156888a9beSDag-Erling Smørgrav 	const char *text;
11166888a9beSDag-Erling Smørgrav 	unsigned int flags;
11176888a9beSDag-Erling Smørgrav };
11186888a9beSDag-Erling Smørgrav static struct escape_help_text esc_txt[] = {
11196888a9beSDag-Erling Smørgrav     {".",  "terminate session", SUPPRESS_MUXMASTER},
11206888a9beSDag-Erling Smørgrav     {".",  "terminate connection (and any multiplexed sessions)",
11216888a9beSDag-Erling Smørgrav 	SUPPRESS_MUXCLIENT},
11224f52dfbbSDag-Erling Smørgrav     {"B",  "send a BREAK to the remote system", SUPPRESS_NEVER},
1123f374ba41SEd Maste     {"C",  "open a command line", SUPPRESS_MUXCLIENT|SUPPRESS_NOCMDLINE},
11244f52dfbbSDag-Erling Smørgrav     {"R",  "request rekey", SUPPRESS_NEVER},
11256888a9beSDag-Erling Smørgrav     {"V/v",  "decrease/increase verbosity (LogLevel)", SUPPRESS_MUXCLIENT},
11266888a9beSDag-Erling Smørgrav     {"^Z", "suspend ssh", SUPPRESS_MUXCLIENT},
11276888a9beSDag-Erling Smørgrav     {"#",  "list forwarded connections", SUPPRESS_NEVER},
11286888a9beSDag-Erling Smørgrav     {"&",  "background ssh (when waiting for connections to terminate)",
11296888a9beSDag-Erling Smørgrav 	SUPPRESS_MUXCLIENT},
11306888a9beSDag-Erling Smørgrav     {"?", "this message", SUPPRESS_NEVER},
11316888a9beSDag-Erling Smørgrav };
11326888a9beSDag-Erling Smørgrav 
11336888a9beSDag-Erling Smørgrav static void
1134190cef3dSDag-Erling Smørgrav print_escape_help(struct sshbuf *b, int escape_char, int mux_client,
1135190cef3dSDag-Erling Smørgrav     int using_stderr)
11366888a9beSDag-Erling Smørgrav {
11376888a9beSDag-Erling Smørgrav 	unsigned int i, suppress_flags;
1138190cef3dSDag-Erling Smørgrav 	int r;
11396888a9beSDag-Erling Smørgrav 
1140190cef3dSDag-Erling Smørgrav 	if ((r = sshbuf_putf(b,
1141190cef3dSDag-Erling Smørgrav 	    "%c?\r\nSupported escape sequences:\r\n", escape_char)) != 0)
114219261079SEd Maste 		fatal_fr(r, "sshbuf_putf");
11436888a9beSDag-Erling Smørgrav 
11444f52dfbbSDag-Erling Smørgrav 	suppress_flags =
11456888a9beSDag-Erling Smørgrav 	    (mux_client ? SUPPRESS_MUXCLIENT : 0) |
11466888a9beSDag-Erling Smørgrav 	    (mux_client ? 0 : SUPPRESS_MUXMASTER) |
1147f374ba41SEd Maste 	    (using_stderr ? 0 : SUPPRESS_SYSLOG) |
1148f374ba41SEd Maste 	    (options.enable_escape_commandline == 0 ? SUPPRESS_NOCMDLINE : 0);
11496888a9beSDag-Erling Smørgrav 
11506888a9beSDag-Erling Smørgrav 	for (i = 0; i < sizeof(esc_txt)/sizeof(esc_txt[0]); i++) {
11516888a9beSDag-Erling Smørgrav 		if (esc_txt[i].flags & suppress_flags)
11526888a9beSDag-Erling Smørgrav 			continue;
1153190cef3dSDag-Erling Smørgrav 		if ((r = sshbuf_putf(b, " %c%-3s - %s\r\n",
1154190cef3dSDag-Erling Smørgrav 		    escape_char, esc_txt[i].cmd, esc_txt[i].text)) != 0)
115519261079SEd Maste 			fatal_fr(r, "sshbuf_putf");
11566888a9beSDag-Erling Smørgrav 	}
11576888a9beSDag-Erling Smørgrav 
1158190cef3dSDag-Erling Smørgrav 	if ((r = sshbuf_putf(b,
11596888a9beSDag-Erling Smørgrav 	    " %c%c   - send the escape character by typing it twice\r\n"
11606888a9beSDag-Erling Smørgrav 	    "(Note that escapes are only recognized immediately after "
1161190cef3dSDag-Erling Smørgrav 	    "newline.)\r\n", escape_char, escape_char)) != 0)
116219261079SEd Maste 		fatal_fr(r, "sshbuf_putf");
11636888a9beSDag-Erling Smørgrav }
11646888a9beSDag-Erling Smørgrav 
1165d4af9e69SDag-Erling Smørgrav /*
11664f52dfbbSDag-Erling Smørgrav  * Process the characters one by one.
1167d4af9e69SDag-Erling Smørgrav  */
1168ae1f160dSDag-Erling Smørgrav static int
11694f52dfbbSDag-Erling Smørgrav process_escapes(struct ssh *ssh, Channel *c,
1170190cef3dSDag-Erling Smørgrav     struct sshbuf *bin, struct sshbuf *bout, struct sshbuf *berr,
1171d4af9e69SDag-Erling Smørgrav     char *buf, int len)
1172b66f2d16SKris Kennaway {
1173b66f2d16SKris Kennaway 	pid_t pid;
1174190cef3dSDag-Erling Smørgrav 	int r, bytes = 0;
11751e8db6e2SBrian Feldman 	u_int i;
11761e8db6e2SBrian Feldman 	u_char ch;
1177b66f2d16SKris Kennaway 	char *s;
1178535af610SEd Maste 	struct escape_filter_ctx *efc;
1179d4af9e69SDag-Erling Smørgrav 
1180535af610SEd Maste 	if (c == NULL || c->filter_ctx == NULL || len <= 0)
1181d4af9e69SDag-Erling Smørgrav 		return 0;
1182b66f2d16SKris Kennaway 
1183535af610SEd Maste 	efc = (struct escape_filter_ctx *)c->filter_ctx;
1184043840dfSDag-Erling Smørgrav 
1185043840dfSDag-Erling Smørgrav 	for (i = 0; i < (u_int)len; i++) {
1186b66f2d16SKris Kennaway 		/* Get one character at a time. */
1187b66f2d16SKris Kennaway 		ch = buf[i];
1188b66f2d16SKris Kennaway 
11894f52dfbbSDag-Erling Smørgrav 		if (efc->escape_pending) {
1190b66f2d16SKris Kennaway 			/* We have previously seen an escape character. */
1191b66f2d16SKris Kennaway 			/* Clear the flag now. */
11924f52dfbbSDag-Erling Smørgrav 			efc->escape_pending = 0;
1193b66f2d16SKris Kennaway 
1194b66f2d16SKris Kennaway 			/* Process the escaped character. */
1195b66f2d16SKris Kennaway 			switch (ch) {
1196b66f2d16SKris Kennaway 			case '.':
1197b66f2d16SKris Kennaway 				/* Terminate the connection. */
1198190cef3dSDag-Erling Smørgrav 				if ((r = sshbuf_putf(berr, "%c.\r\n",
1199190cef3dSDag-Erling Smørgrav 				    efc->escape_char)) != 0)
120019261079SEd Maste 					fatal_fr(r, "sshbuf_putf");
1201b15c8340SDag-Erling Smørgrav 				if (c && c->ctl_chan != -1) {
1202f374ba41SEd Maste 					channel_force_close(ssh, c, 1);
1203d4af9e69SDag-Erling Smørgrav 					return 0;
1204d4af9e69SDag-Erling Smørgrav 				} else
1205b66f2d16SKris Kennaway 					quit_pending = 1;
1206b66f2d16SKris Kennaway 				return -1;
1207b66f2d16SKris Kennaway 
1208b66f2d16SKris Kennaway 			case 'Z' - 64:
1209d4af9e69SDag-Erling Smørgrav 				/* XXX support this for mux clients */
1210b15c8340SDag-Erling Smørgrav 				if (c && c->ctl_chan != -1) {
12116888a9beSDag-Erling Smørgrav 					char b[16];
1212d4af9e69SDag-Erling Smørgrav  noescape:
12136888a9beSDag-Erling Smørgrav 					if (ch == 'Z' - 64)
12146888a9beSDag-Erling Smørgrav 						snprintf(b, sizeof b, "^Z");
12156888a9beSDag-Erling Smørgrav 					else
12166888a9beSDag-Erling Smørgrav 						snprintf(b, sizeof b, "%c", ch);
1217190cef3dSDag-Erling Smørgrav 					if ((r = sshbuf_putf(berr,
12186888a9beSDag-Erling Smørgrav 					    "%c%s escape not available to "
1219d4af9e69SDag-Erling Smørgrav 					    "multiplexed sessions\r\n",
1220190cef3dSDag-Erling Smørgrav 					    efc->escape_char, b)) != 0)
122119261079SEd Maste 						fatal_fr(r, "sshbuf_putf");
1222d4af9e69SDag-Erling Smørgrav 					continue;
1223d4af9e69SDag-Erling Smørgrav 				}
1224d4af9e69SDag-Erling Smørgrav 				/* Suspend the program. Inform the user */
1225190cef3dSDag-Erling Smørgrav 				if ((r = sshbuf_putf(berr,
1226190cef3dSDag-Erling Smørgrav 				    "%c^Z [suspend ssh]\r\n",
1227190cef3dSDag-Erling Smørgrav 				    efc->escape_char)) != 0)
122819261079SEd Maste 					fatal_fr(r, "sshbuf_putf");
1229b66f2d16SKris Kennaway 
1230b66f2d16SKris Kennaway 				/* Restore terminal modes and suspend. */
1231b66f2d16SKris Kennaway 				client_suspend_self(bin, bout, berr);
1232b66f2d16SKris Kennaway 
1233b66f2d16SKris Kennaway 				/* We have been continued. */
1234b66f2d16SKris Kennaway 				continue;
1235b66f2d16SKris Kennaway 
1236d95e11bfSDag-Erling Smørgrav 			case 'B':
1237190cef3dSDag-Erling Smørgrav 				if ((r = sshbuf_putf(berr,
1238190cef3dSDag-Erling Smørgrav 				    "%cB\r\n", efc->escape_char)) != 0)
123919261079SEd Maste 					fatal_fr(r, "sshbuf_putf");
12404f52dfbbSDag-Erling Smørgrav 				channel_request_start(ssh, c->self, "break", 0);
1241190cef3dSDag-Erling Smørgrav 				if ((r = sshpkt_put_u32(ssh, 1000)) != 0 ||
1242190cef3dSDag-Erling Smørgrav 				    (r = sshpkt_send(ssh)) != 0)
124319261079SEd Maste 					fatal_fr(r, "send packet");
1244d95e11bfSDag-Erling Smørgrav 				continue;
1245d95e11bfSDag-Erling Smørgrav 
12461e8db6e2SBrian Feldman 			case 'R':
124719261079SEd Maste 				if (ssh->compat & SSH_BUG_NOREKEY)
1248d4af9e69SDag-Erling Smørgrav 					logit("Server does not "
1249d4af9e69SDag-Erling Smørgrav 					    "support re-keying");
12501e8db6e2SBrian Feldman 				else
12511e8db6e2SBrian Feldman 					need_rekeying = 1;
12521e8db6e2SBrian Feldman 				continue;
12531e8db6e2SBrian Feldman 
12546888a9beSDag-Erling Smørgrav 			case 'V':
12556888a9beSDag-Erling Smørgrav 				/* FALLTHROUGH */
12566888a9beSDag-Erling Smørgrav 			case 'v':
12576888a9beSDag-Erling Smørgrav 				if (c && c->ctl_chan != -1)
12586888a9beSDag-Erling Smørgrav 					goto noescape;
12596888a9beSDag-Erling Smørgrav 				if (!log_is_on_stderr()) {
1260190cef3dSDag-Erling Smørgrav 					if ((r = sshbuf_putf(berr,
12616888a9beSDag-Erling Smørgrav 					    "%c%c [Logging to syslog]\r\n",
1262190cef3dSDag-Erling Smørgrav 					    efc->escape_char, ch)) != 0)
126319261079SEd Maste 						fatal_fr(r, "sshbuf_putf");
12646888a9beSDag-Erling Smørgrav 					continue;
12656888a9beSDag-Erling Smørgrav 				}
12666888a9beSDag-Erling Smørgrav 				if (ch == 'V' && options.log_level >
12676888a9beSDag-Erling Smørgrav 				    SYSLOG_LEVEL_QUIET)
12686888a9beSDag-Erling Smørgrav 					log_change_level(--options.log_level);
12696888a9beSDag-Erling Smørgrav 				if (ch == 'v' && options.log_level <
12706888a9beSDag-Erling Smørgrav 				    SYSLOG_LEVEL_DEBUG3)
12716888a9beSDag-Erling Smørgrav 					log_change_level(++options.log_level);
1272190cef3dSDag-Erling Smørgrav 				if ((r = sshbuf_putf(berr,
12734f52dfbbSDag-Erling Smørgrav 				    "%c%c [LogLevel %s]\r\n",
12744f52dfbbSDag-Erling Smørgrav 				    efc->escape_char, ch,
1275190cef3dSDag-Erling Smørgrav 				    log_level_name(options.log_level))) != 0)
127619261079SEd Maste 					fatal_fr(r, "sshbuf_putf");
12776888a9beSDag-Erling Smørgrav 				continue;
12786888a9beSDag-Erling Smørgrav 
1279b66f2d16SKris Kennaway 			case '&':
1280535af610SEd Maste 				if (c->ctl_chan != -1)
1281d4af9e69SDag-Erling Smørgrav 					goto noescape;
1282b66f2d16SKris Kennaway 				/*
1283d4af9e69SDag-Erling Smørgrav 				 * Detach the program (continue to serve
1284d4af9e69SDag-Erling Smørgrav 				 * connections, but put in background and no
1285d4af9e69SDag-Erling Smørgrav 				 * more new connections).
1286b66f2d16SKris Kennaway 				 */
1287ae1f160dSDag-Erling Smørgrav 				/* Restore tty modes. */
1288e146993eSDag-Erling Smørgrav 				leave_raw_mode(
1289e146993eSDag-Erling Smørgrav 				    options.request_tty == REQUEST_TTY_FORCE);
1290ae1f160dSDag-Erling Smørgrav 
1291ae1f160dSDag-Erling Smørgrav 				/* Stop listening for new connections. */
12924f52dfbbSDag-Erling Smørgrav 				channel_stop_listening(ssh);
1293ae1f160dSDag-Erling Smørgrav 
129419261079SEd Maste 				if ((r = sshbuf_putf(berr, "%c& "
129519261079SEd Maste 				    "[backgrounded]\n", efc->escape_char)) != 0)
129619261079SEd Maste 					fatal_fr(r, "sshbuf_putf");
1297ae1f160dSDag-Erling Smørgrav 
1298ae1f160dSDag-Erling Smørgrav 				/* Fork into background. */
1299ae1f160dSDag-Erling Smørgrav 				pid = fork();
130019261079SEd Maste 				if (pid == -1) {
1301ae1f160dSDag-Erling Smørgrav 					error("fork: %.100s", strerror(errno));
1302ae1f160dSDag-Erling Smørgrav 					continue;
1303ae1f160dSDag-Erling Smørgrav 				}
1304ae1f160dSDag-Erling Smørgrav 				if (pid != 0) {	/* This is the parent. */
1305ae1f160dSDag-Erling Smørgrav 					/* The parent just exits. */
1306ae1f160dSDag-Erling Smørgrav 					exit(0);
1307ae1f160dSDag-Erling Smørgrav 				}
1308ae1f160dSDag-Erling Smørgrav 				/* The child continues serving connections. */
1309ae1f160dSDag-Erling Smørgrav 				/* fake EOF on stdin */
1310190cef3dSDag-Erling Smørgrav 				if ((r = sshbuf_put_u8(bin, 4)) != 0)
131119261079SEd Maste 					fatal_fr(r, "sshbuf_put_u8");
1312ae1f160dSDag-Erling Smørgrav 				return -1;
1313b66f2d16SKris Kennaway 			case '?':
13144f52dfbbSDag-Erling Smørgrav 				print_escape_help(berr, efc->escape_char,
13156888a9beSDag-Erling Smørgrav 				    (c && c->ctl_chan != -1),
13166888a9beSDag-Erling Smørgrav 				    log_is_on_stderr());
1317b66f2d16SKris Kennaway 				continue;
1318b66f2d16SKris Kennaway 
1319b66f2d16SKris Kennaway 			case '#':
1320190cef3dSDag-Erling Smørgrav 				if ((r = sshbuf_putf(berr, "%c#\r\n",
1321190cef3dSDag-Erling Smørgrav 				    efc->escape_char)) != 0)
132219261079SEd Maste 					fatal_fr(r, "sshbuf_putf");
13234f52dfbbSDag-Erling Smørgrav 				s = channel_open_message(ssh);
1324190cef3dSDag-Erling Smørgrav 				if ((r = sshbuf_put(berr, s, strlen(s))) != 0)
132519261079SEd Maste 					fatal_fr(r, "sshbuf_put");
1326e4a9863fSDag-Erling Smørgrav 				free(s);
1327b66f2d16SKris Kennaway 				continue;
1328b66f2d16SKris Kennaway 
1329545d5ecaSDag-Erling Smørgrav 			case 'C':
1330b15c8340SDag-Erling Smørgrav 				if (c && c->ctl_chan != -1)
1331cce7d346SDag-Erling Smørgrav 					goto noescape;
1332f374ba41SEd Maste 				if (options.enable_escape_commandline == 0) {
1333f374ba41SEd Maste 					if ((r = sshbuf_putf(berr,
1334f374ba41SEd Maste 					    "commandline disabled\r\n")) != 0)
1335f374ba41SEd Maste 						fatal_fr(r, "sshbuf_putf");
1336f374ba41SEd Maste 					continue;
1337f374ba41SEd Maste 				}
13384f52dfbbSDag-Erling Smørgrav 				process_cmdline(ssh);
1339545d5ecaSDag-Erling Smørgrav 				continue;
1340545d5ecaSDag-Erling Smørgrav 
1341b66f2d16SKris Kennaway 			default:
13424f52dfbbSDag-Erling Smørgrav 				if (ch != efc->escape_char) {
1343190cef3dSDag-Erling Smørgrav 					if ((r = sshbuf_put_u8(bin,
1344190cef3dSDag-Erling Smørgrav 					    efc->escape_char)) != 0)
134519261079SEd Maste 						fatal_fr(r, "sshbuf_put_u8");
1346b66f2d16SKris Kennaway 					bytes++;
1347b66f2d16SKris Kennaway 				}
1348b66f2d16SKris Kennaway 				/* Escaped characters fall through here */
1349b66f2d16SKris Kennaway 				break;
1350b66f2d16SKris Kennaway 			}
1351b66f2d16SKris Kennaway 		} else {
1352b66f2d16SKris Kennaway 			/*
1353d4af9e69SDag-Erling Smørgrav 			 * The previous character was not an escape char.
1354d4af9e69SDag-Erling Smørgrav 			 * Check if this is an escape.
1355b66f2d16SKris Kennaway 			 */
13564f52dfbbSDag-Erling Smørgrav 			if (last_was_cr && ch == efc->escape_char) {
1357d4af9e69SDag-Erling Smørgrav 				/*
1358d4af9e69SDag-Erling Smørgrav 				 * It is. Set the flag and continue to
1359d4af9e69SDag-Erling Smørgrav 				 * next character.
1360d4af9e69SDag-Erling Smørgrav 				 */
13614f52dfbbSDag-Erling Smørgrav 				efc->escape_pending = 1;
1362b66f2d16SKris Kennaway 				continue;
1363b66f2d16SKris Kennaway 			}
1364b66f2d16SKris Kennaway 		}
1365b66f2d16SKris Kennaway 
1366b66f2d16SKris Kennaway 		/*
1367b66f2d16SKris Kennaway 		 * Normal character.  Record whether it was a newline,
1368b66f2d16SKris Kennaway 		 * and append it to the buffer.
1369b66f2d16SKris Kennaway 		 */
1370b66f2d16SKris Kennaway 		last_was_cr = (ch == '\r' || ch == '\n');
1371190cef3dSDag-Erling Smørgrav 		if ((r = sshbuf_put_u8(bin, ch)) != 0)
137219261079SEd Maste 			fatal_fr(r, "sshbuf_put_u8");
1373b66f2d16SKris Kennaway 		bytes++;
1374b66f2d16SKris Kennaway 	}
1375b66f2d16SKris Kennaway 	return bytes;
1376b66f2d16SKris Kennaway }
1377b66f2d16SKris Kennaway 
1378511b41d2SMark Murray /*
1379a04a10f8SKris Kennaway  * Get packets from the connection input buffer, and process them as long as
1380a04a10f8SKris Kennaway  * there are packets available.
1381a04a10f8SKris Kennaway  *
1382a04a10f8SKris Kennaway  * Any unknown packets received during the actual
1383a04a10f8SKris Kennaway  * session cause the session to terminate.  This is
1384a04a10f8SKris Kennaway  * intended to make debugging easier since no
1385a04a10f8SKris Kennaway  * confirmations are sent.  Any compatible protocol
1386a04a10f8SKris Kennaway  * extensions must be negotiated during the
1387a04a10f8SKris Kennaway  * preparatory phase.
1388a04a10f8SKris Kennaway  */
1389a04a10f8SKris Kennaway 
1390ae1f160dSDag-Erling Smørgrav static void
139119261079SEd Maste client_process_buffered_input_packets(struct ssh *ssh)
1392a04a10f8SKris Kennaway {
139319261079SEd Maste 	ssh_dispatch_run_fatal(ssh, DISPATCH_NONBLOCK, &quit_pending);
1394a04a10f8SKris Kennaway }
1395a04a10f8SKris Kennaway 
1396b66f2d16SKris Kennaway /* scan buf[] for '~' before sending data to the peer */
1397b66f2d16SKris Kennaway 
1398d4af9e69SDag-Erling Smørgrav /* Helper: allocate a new escape_filter_ctx and fill in its escape char */
1399d4af9e69SDag-Erling Smørgrav void *
1400d4af9e69SDag-Erling Smørgrav client_new_escape_filter_ctx(int escape_char)
1401b66f2d16SKris Kennaway {
1402d4af9e69SDag-Erling Smørgrav 	struct escape_filter_ctx *ret;
1403d4af9e69SDag-Erling Smørgrav 
14040a37d4a3SXin LI 	ret = xcalloc(1, sizeof(*ret));
1405d4af9e69SDag-Erling Smørgrav 	ret->escape_pending = 0;
1406d4af9e69SDag-Erling Smørgrav 	ret->escape_char = escape_char;
1407d4af9e69SDag-Erling Smørgrav 	return (void *)ret;
1408d4af9e69SDag-Erling Smørgrav }
1409d4af9e69SDag-Erling Smørgrav 
1410d4af9e69SDag-Erling Smørgrav /* Free the escape filter context on channel free */
1411d4af9e69SDag-Erling Smørgrav void
14124f52dfbbSDag-Erling Smørgrav client_filter_cleanup(struct ssh *ssh, int cid, void *ctx)
1413d4af9e69SDag-Erling Smørgrav {
1414e4a9863fSDag-Erling Smørgrav 	free(ctx);
1415d4af9e69SDag-Erling Smørgrav }
1416d4af9e69SDag-Erling Smørgrav 
1417d4af9e69SDag-Erling Smørgrav int
14184f52dfbbSDag-Erling Smørgrav client_simple_escape_filter(struct ssh *ssh, Channel *c, char *buf, int len)
1419d4af9e69SDag-Erling Smørgrav {
1420d4af9e69SDag-Erling Smørgrav 	if (c->extended_usage != CHAN_EXTENDED_WRITE)
1421d4af9e69SDag-Erling Smørgrav 		return 0;
1422d4af9e69SDag-Erling Smørgrav 
14234f52dfbbSDag-Erling Smørgrav 	return process_escapes(ssh, c, c->input, c->output, c->extended,
1424d4af9e69SDag-Erling Smørgrav 	    buf, len);
1425b66f2d16SKris Kennaway }
1426b66f2d16SKris Kennaway 
1427ae1f160dSDag-Erling Smørgrav static void
1428f374ba41SEd Maste client_channel_closed(struct ssh *ssh, int id, int force, void *arg)
14291e8db6e2SBrian Feldman {
14304f52dfbbSDag-Erling Smørgrav 	channel_cancel_cleanup(ssh, id);
14311e8db6e2SBrian Feldman 	session_closed = 1;
1432e146993eSDag-Erling Smørgrav 	leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
14331e8db6e2SBrian Feldman }
14341e8db6e2SBrian Feldman 
1435a04a10f8SKris Kennaway /*
1436511b41d2SMark Murray  * Implements the interactive session with the server.  This is called after
1437511b41d2SMark Murray  * the user has been authenticated, and a command has been started on the
1438ae1f160dSDag-Erling Smørgrav  * remote host.  If escape_char != SSH_ESCAPECHAR_NONE, it is the character
1439ae1f160dSDag-Erling Smørgrav  * used as an escape character for terminating or suspending the session.
1440511b41d2SMark Murray  */
1441511b41d2SMark Murray int
14424f52dfbbSDag-Erling Smørgrav client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
14434f52dfbbSDag-Erling Smørgrav     int ssh2_chan_id)
1444511b41d2SMark Murray {
14451323ec57SEd Maste 	struct pollfd *pfd = NULL;
14461323ec57SEd Maste 	u_int npfd_alloc = 0, npfd_active = 0;
1447511b41d2SMark Murray 	double start_time, total_time;
1448*edf85781SEd Maste 	int channel_did_enqueue = 0, r, len;
1449d4af9e69SDag-Erling Smørgrav 	u_int64_t ibytes, obytes;
14501323ec57SEd Maste 	int conn_in_ready, conn_out_ready;
1451511b41d2SMark Murray 
1452511b41d2SMark Murray 	debug("Entering interactive session.");
1453f374ba41SEd Maste 	session_ident = ssh2_chan_id;
1454511b41d2SMark Murray 
1455acc1a9efSDag-Erling Smørgrav 	if (options.control_master &&
1456acc1a9efSDag-Erling Smørgrav 	    !option_clear_or_none(options.control_path)) {
1457acc1a9efSDag-Erling Smørgrav 		debug("pledge: id");
145819261079SEd Maste 		if (pledge("stdio rpath wpath cpath unix inet dns recvfd sendfd proc exec id tty",
1459acc1a9efSDag-Erling Smørgrav 		    NULL) == -1)
146019261079SEd Maste 			fatal_f("pledge(): %s", strerror(errno));
1461acc1a9efSDag-Erling Smørgrav 
1462acc1a9efSDag-Erling Smørgrav 	} else if (options.forward_x11 || options.permit_local_command) {
1463acc1a9efSDag-Erling Smørgrav 		debug("pledge: exec");
1464acc1a9efSDag-Erling Smørgrav 		if (pledge("stdio rpath wpath cpath unix inet dns proc exec tty",
1465acc1a9efSDag-Erling Smørgrav 		    NULL) == -1)
146619261079SEd Maste 			fatal_f("pledge(): %s", strerror(errno));
1467acc1a9efSDag-Erling Smørgrav 
1468acc1a9efSDag-Erling Smørgrav 	} else if (options.update_hostkeys) {
14691323ec57SEd Maste 		debug("pledge: filesystem");
1470acc1a9efSDag-Erling Smørgrav 		if (pledge("stdio rpath wpath cpath unix inet dns proc tty",
1471acc1a9efSDag-Erling Smørgrav 		    NULL) == -1)
147219261079SEd Maste 			fatal_f("pledge(): %s", strerror(errno));
1473acc1a9efSDag-Erling Smørgrav 
1474076ad2f8SDag-Erling Smørgrav 	} else if (!option_clear_or_none(options.proxy_command) ||
147519261079SEd Maste 	    options.fork_after_authentication) {
1476acc1a9efSDag-Erling Smørgrav 		debug("pledge: proc");
1477acc1a9efSDag-Erling Smørgrav 		if (pledge("stdio cpath unix inet dns proc tty", NULL) == -1)
147819261079SEd Maste 			fatal_f("pledge(): %s", strerror(errno));
1479acc1a9efSDag-Erling Smørgrav 
1480acc1a9efSDag-Erling Smørgrav 	} else {
1481acc1a9efSDag-Erling Smørgrav 		debug("pledge: network");
14824f52dfbbSDag-Erling Smørgrav 		if (pledge("stdio unix inet dns proc tty", NULL) == -1)
148319261079SEd Maste 			fatal_f("pledge(): %s", strerror(errno));
1484acc1a9efSDag-Erling Smørgrav 	}
1485acc1a9efSDag-Erling Smørgrav 
1486f374ba41SEd Maste 	/* might be able to tighten now */
1487f374ba41SEd Maste 	client_repledge();
1488f374ba41SEd Maste 
148947dd1d1bSDag-Erling Smørgrav 	start_time = monotime_double();
1490511b41d2SMark Murray 
1491511b41d2SMark Murray 	/* Initialize variables. */
1492511b41d2SMark Murray 	last_was_cr = 1;
1493511b41d2SMark Murray 	exit_status = -1;
149419261079SEd Maste 	connection_in = ssh_packet_get_connection_in(ssh);
149519261079SEd Maste 	connection_out = ssh_packet_get_connection_out(ssh);
14961e8db6e2SBrian Feldman 
1497511b41d2SMark Murray 	quit_pending = 0;
1498511b41d2SMark Murray 
1499190cef3dSDag-Erling Smørgrav 	/* Initialize buffer. */
1500190cef3dSDag-Erling Smørgrav 	if ((stderr_buffer = sshbuf_new()) == NULL)
150119261079SEd Maste 		fatal_f("sshbuf_new failed");
1502511b41d2SMark Murray 
150319261079SEd Maste 	client_init_dispatch(ssh);
1504a04a10f8SKris Kennaway 
1505d0c8c0bcSDag-Erling Smørgrav 	/*
1506d0c8c0bcSDag-Erling Smørgrav 	 * Set signal handlers, (e.g. to restore non-blocking mode)
1507d0c8c0bcSDag-Erling Smørgrav 	 * but don't overwrite SIG_IGN, matches behaviour from rsh(1)
1508d0c8c0bcSDag-Erling Smørgrav 	 */
150919261079SEd Maste 	if (ssh_signal(SIGHUP, SIG_IGN) != SIG_IGN)
151019261079SEd Maste 		ssh_signal(SIGHUP, signal_handler);
151119261079SEd Maste 	if (ssh_signal(SIGINT, SIG_IGN) != SIG_IGN)
151219261079SEd Maste 		ssh_signal(SIGINT, signal_handler);
151319261079SEd Maste 	if (ssh_signal(SIGQUIT, SIG_IGN) != SIG_IGN)
151419261079SEd Maste 		ssh_signal(SIGQUIT, signal_handler);
151519261079SEd Maste 	if (ssh_signal(SIGTERM, SIG_IGN) != SIG_IGN)
151619261079SEd Maste 		ssh_signal(SIGTERM, signal_handler);
151719261079SEd Maste 	ssh_signal(SIGWINCH, window_change_handler);
1518511b41d2SMark Murray 
1519511b41d2SMark Murray 	if (have_pty)
1520e146993eSDag-Erling Smørgrav 		enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
1521511b41d2SMark Murray 
1522e146993eSDag-Erling Smørgrav 	if (session_ident != -1) {
1523e146993eSDag-Erling Smørgrav 		if (escape_char_arg != SSH_ESCAPECHAR_NONE) {
15244f52dfbbSDag-Erling Smørgrav 			channel_register_filter(ssh, session_ident,
1525d4af9e69SDag-Erling Smørgrav 			    client_simple_escape_filter, NULL,
1526d4af9e69SDag-Erling Smørgrav 			    client_filter_cleanup,
1527e146993eSDag-Erling Smørgrav 			    client_new_escape_filter_ctx(
1528e146993eSDag-Erling Smørgrav 			    escape_char_arg));
1529e146993eSDag-Erling Smørgrav 		}
15304f52dfbbSDag-Erling Smørgrav 		channel_register_cleanup(ssh, session_ident,
1531021d409fSDag-Erling Smørgrav 		    client_channel_closed, 0);
1532e146993eSDag-Erling Smørgrav 	}
1533b66f2d16SKris Kennaway 
153419261079SEd Maste 	schedule_server_alive_check();
153519261079SEd Maste 
1536511b41d2SMark Murray 	/* Main loop of the client for the interactive session mode. */
1537511b41d2SMark Murray 	while (!quit_pending) {
1538*edf85781SEd Maste 		channel_did_enqueue = 0;
1539511b41d2SMark Murray 
1540511b41d2SMark Murray 		/* Process buffered packets sent by the server. */
154119261079SEd Maste 		client_process_buffered_input_packets(ssh);
1542511b41d2SMark Murray 
15434f52dfbbSDag-Erling Smørgrav 		if (session_closed && !channel_still_open(ssh))
1544a04a10f8SKris Kennaway 			break;
1545a04a10f8SKris Kennaway 
15464f52dfbbSDag-Erling Smørgrav 		if (ssh_packet_is_rekeying(ssh)) {
15471e8db6e2SBrian Feldman 			debug("rekeying in progress");
1548acc1a9efSDag-Erling Smørgrav 		} else if (need_rekeying) {
1549acc1a9efSDag-Erling Smørgrav 			/* manual rekey request */
1550acc1a9efSDag-Erling Smørgrav 			debug("need rekeying");
15514f52dfbbSDag-Erling Smørgrav 			if ((r = kex_start_rekex(ssh)) != 0)
155219261079SEd Maste 				fatal_fr(r, "kex_start_rekex");
1553acc1a9efSDag-Erling Smørgrav 			need_rekeying = 0;
15541e8db6e2SBrian Feldman 		} else {
1555511b41d2SMark Murray 			/*
15561e8db6e2SBrian Feldman 			 * Make packets from buffered channel data, and
15571e8db6e2SBrian Feldman 			 * enqueue them for sending to the server.
1558511b41d2SMark Murray 			 */
155919261079SEd Maste 			if (ssh_packet_not_very_much_data_to_write(ssh))
1560*edf85781SEd Maste 				channel_did_enqueue = channel_output_poll(ssh);
1561511b41d2SMark Murray 
1562511b41d2SMark Murray 			/*
15631e8db6e2SBrian Feldman 			 * Check if the window size has changed, and buffer a
15641e8db6e2SBrian Feldman 			 * message about it to the server if so.
1565511b41d2SMark Murray 			 */
15664f52dfbbSDag-Erling Smørgrav 			client_check_window_change(ssh);
1567511b41d2SMark Murray 
1568511b41d2SMark Murray 			if (quit_pending)
1569511b41d2SMark Murray 				break;
15701e8db6e2SBrian Feldman 		}
1571511b41d2SMark Murray 		/*
1572511b41d2SMark Murray 		 * Wait until we have something to do (something becomes
1573511b41d2SMark Murray 		 * available on one of the descriptors).
1574511b41d2SMark Murray 		 */
15751323ec57SEd Maste 		client_wait_until_can_do_something(ssh, &pfd, &npfd_alloc,
1576*edf85781SEd Maste 		    &npfd_active, channel_did_enqueue,
15771323ec57SEd Maste 		    &conn_in_ready, &conn_out_ready);
1578511b41d2SMark Murray 
1579511b41d2SMark Murray 		if (quit_pending)
1580511b41d2SMark Murray 			break;
1581511b41d2SMark Murray 
158238a52bd3SEd Maste 		/* Do channel operations. */
15831323ec57SEd Maste 		channel_after_poll(ssh, pfd, npfd_active);
1584511b41d2SMark Murray 
1585a04a10f8SKris Kennaway 		/* Buffer input from the connection.  */
15861323ec57SEd Maste 		if (conn_in_ready)
15871323ec57SEd Maste 			client_process_net_input(ssh);
1588511b41d2SMark Murray 
1589a04a10f8SKris Kennaway 		if (quit_pending)
1590a04a10f8SKris Kennaway 			break;
1591a04a10f8SKris Kennaway 
159219261079SEd Maste 		/* A timeout may have triggered rekeying */
159319261079SEd Maste 		if ((r = ssh_packet_check_rekey(ssh)) != 0)
159419261079SEd Maste 			fatal_fr(r, "cannot start rekeying");
159519261079SEd Maste 
1596d4af9e69SDag-Erling Smørgrav 		/*
1597d4af9e69SDag-Erling Smørgrav 		 * Send as much buffered packet data as possible to the
1598d4af9e69SDag-Erling Smørgrav 		 * sender.
1599d4af9e69SDag-Erling Smørgrav 		 */
16001323ec57SEd Maste 		if (conn_out_ready) {
160119261079SEd Maste 			if ((r = ssh_packet_write_poll(ssh)) != 0) {
160219261079SEd Maste 				sshpkt_fatal(ssh, r,
160319261079SEd Maste 				    "%s: ssh_packet_write_poll", __func__);
160419261079SEd Maste 			}
160519261079SEd Maste 		}
1606e2f6069cSDag-Erling Smørgrav 
1607e2f6069cSDag-Erling Smørgrav 		/*
1608e2f6069cSDag-Erling Smørgrav 		 * If we are a backgrounded control master, and the
1609e2f6069cSDag-Erling Smørgrav 		 * timeout has expired without any active client
1610e2f6069cSDag-Erling Smørgrav 		 * connections, then quit.
1611e2f6069cSDag-Erling Smørgrav 		 */
1612e2f6069cSDag-Erling Smørgrav 		if (control_persist_exit_time > 0) {
1613e4a9863fSDag-Erling Smørgrav 			if (monotime() >= control_persist_exit_time) {
1614e2f6069cSDag-Erling Smørgrav 				debug("ControlPersist timeout expired");
1615e2f6069cSDag-Erling Smørgrav 				break;
1616e2f6069cSDag-Erling Smørgrav 			}
1617e2f6069cSDag-Erling Smørgrav 		}
1618511b41d2SMark Murray 	}
16191323ec57SEd Maste 	free(pfd);
1620511b41d2SMark Murray 
1621511b41d2SMark Murray 	/* Terminate the session. */
1622511b41d2SMark Murray 
1623511b41d2SMark Murray 	/* Stop watching for window change. */
162419261079SEd Maste 	ssh_signal(SIGWINCH, SIG_DFL);
1625511b41d2SMark Murray 
162619261079SEd Maste 	if ((r = sshpkt_start(ssh, SSH2_MSG_DISCONNECT)) != 0 ||
162719261079SEd Maste 	    (r = sshpkt_put_u32(ssh, SSH2_DISCONNECT_BY_APPLICATION)) != 0 ||
162819261079SEd Maste 	    (r = sshpkt_put_cstring(ssh, "disconnected by user")) != 0 ||
162919261079SEd Maste 	    (r = sshpkt_put_cstring(ssh, "")) != 0 ||	/* language tag */
163019261079SEd Maste 	    (r = sshpkt_send(ssh)) != 0 ||
163119261079SEd Maste 	    (r = ssh_packet_write_wait(ssh)) != 0)
163219261079SEd Maste 		fatal_fr(r, "send disconnect");
16337aee6ffeSDag-Erling Smørgrav 
16344f52dfbbSDag-Erling Smørgrav 	channel_free_all(ssh);
1635ae1f160dSDag-Erling Smørgrav 
1636ae1f160dSDag-Erling Smørgrav 	if (have_pty)
1637e146993eSDag-Erling Smørgrav 		leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
1638ae1f160dSDag-Erling Smørgrav 
1639efcad6b7SDag-Erling Smørgrav 	/*
1640efcad6b7SDag-Erling Smørgrav 	 * If there was no shell or command requested, there will be no remote
1641efcad6b7SDag-Erling Smørgrav 	 * exit status to be returned.  In that case, clear error code if the
1642efcad6b7SDag-Erling Smørgrav 	 * connection was deliberately terminated at this end.
1643efcad6b7SDag-Erling Smørgrav 	 */
1644e9e8876aSEd Maste 	if (options.session_type == SESSION_TYPE_NONE &&
1645e9e8876aSEd Maste 	    received_signal == SIGTERM) {
1646efcad6b7SDag-Erling Smørgrav 		received_signal = 0;
1647efcad6b7SDag-Erling Smørgrav 		exit_status = 0;
1648ae1f160dSDag-Erling Smørgrav 	}
1649511b41d2SMark Murray 
16504f52dfbbSDag-Erling Smørgrav 	if (received_signal) {
16514f52dfbbSDag-Erling Smørgrav 		verbose("Killed by signal %d.", (int) received_signal);
165219261079SEd Maste 		cleanup_exit(255);
16534f52dfbbSDag-Erling Smørgrav 	}
1654efcad6b7SDag-Erling Smørgrav 
1655511b41d2SMark Murray 	/*
1656511b41d2SMark Murray 	 * In interactive mode (with pseudo tty) display a message indicating
1657511b41d2SMark Murray 	 * that the connection has been closed.
1658511b41d2SMark Murray 	 */
16591323ec57SEd Maste 	if (have_pty && options.log_level >= SYSLOG_LEVEL_INFO)
16601323ec57SEd Maste 		quit_message("Connection to %s closed.", host);
1661ae1f160dSDag-Erling Smørgrav 
1662511b41d2SMark Murray 	/* Output any buffered data for stderr. */
1663190cef3dSDag-Erling Smørgrav 	if (sshbuf_len(stderr_buffer) > 0) {
16644a421b63SDag-Erling Smørgrav 		len = atomicio(vwrite, fileno(stderr),
1665190cef3dSDag-Erling Smørgrav 		    (u_char *)sshbuf_ptr(stderr_buffer),
1666190cef3dSDag-Erling Smørgrav 		    sshbuf_len(stderr_buffer));
1667190cef3dSDag-Erling Smørgrav 		if (len < 0 || (u_int)len != sshbuf_len(stderr_buffer))
1668511b41d2SMark Murray 			error("Write failed flushing stderr buffer.");
1669190cef3dSDag-Erling Smørgrav 		else if ((r = sshbuf_consume(stderr_buffer, len)) != 0)
167019261079SEd Maste 			fatal_fr(r, "sshbuf_consume");
1671511b41d2SMark Murray 	}
1672511b41d2SMark Murray 
1673511b41d2SMark Murray 	/* Clear and free any buffers. */
1674190cef3dSDag-Erling Smørgrav 	sshbuf_free(stderr_buffer);
1675511b41d2SMark Murray 
1676511b41d2SMark Murray 	/* Report bytes transferred, and transfer rates. */
167747dd1d1bSDag-Erling Smørgrav 	total_time = monotime_double() - start_time;
167819261079SEd Maste 	ssh_packet_get_bytes(ssh, &ibytes, &obytes);
1679d4af9e69SDag-Erling Smørgrav 	verbose("Transferred: sent %llu, received %llu bytes, in %.1f seconds",
16804a421b63SDag-Erling Smørgrav 	    (unsigned long long)obytes, (unsigned long long)ibytes, total_time);
1681511b41d2SMark Murray 	if (total_time > 0)
1682d4af9e69SDag-Erling Smørgrav 		verbose("Bytes per second: sent %.1f, received %.1f",
1683d4af9e69SDag-Erling Smørgrav 		    obytes / total_time, ibytes / total_time);
1684511b41d2SMark Murray 	/* Return the exit status of the program. */
1685511b41d2SMark Murray 	debug("Exit status %d", exit_status);
1686511b41d2SMark Murray 	return exit_status;
1687511b41d2SMark Murray }
1688a04a10f8SKris Kennaway 
1689a04a10f8SKris Kennaway /*********/
1690a04a10f8SKris Kennaway 
1691ae1f160dSDag-Erling Smørgrav static Channel *
16924f52dfbbSDag-Erling Smørgrav client_request_forwarded_tcpip(struct ssh *ssh, const char *request_type,
16934f52dfbbSDag-Erling Smørgrav     int rchan, u_int rwindow, u_int rmaxpack)
16941e8db6e2SBrian Feldman {
16951e8db6e2SBrian Feldman 	Channel *c = NULL;
1696ca86bcf2SDag-Erling Smørgrav 	struct sshbuf *b = NULL;
16971e8db6e2SBrian Feldman 	char *listen_address, *originator_address;
169819261079SEd Maste 	u_int listen_port, originator_port;
1699ca86bcf2SDag-Erling Smørgrav 	int r;
17001e8db6e2SBrian Feldman 
17011e8db6e2SBrian Feldman 	/* Get rest of the packet */
170219261079SEd Maste 	if ((r = sshpkt_get_cstring(ssh, &listen_address, NULL)) != 0 ||
170319261079SEd Maste 	    (r = sshpkt_get_u32(ssh, &listen_port)) != 0 ||
170419261079SEd Maste 	    (r = sshpkt_get_cstring(ssh, &originator_address, NULL)) != 0 ||
170519261079SEd Maste 	    (r = sshpkt_get_u32(ssh, &originator_port)) != 0 ||
170619261079SEd Maste 	    (r = sshpkt_get_end(ssh)) != 0)
170719261079SEd Maste 		fatal_fr(r, "parse packet");
17081e8db6e2SBrian Feldman 
170919261079SEd Maste 	debug_f("listen %s port %d, originator %s port %d",
1710a0ee8cc6SDag-Erling Smørgrav 	    listen_address, listen_port, originator_address, originator_port);
17111e8db6e2SBrian Feldman 
171219261079SEd Maste 	if (listen_port > 0xffff)
171319261079SEd Maste 		error_f("invalid listen port");
171419261079SEd Maste 	else if (originator_port > 0xffff)
171519261079SEd Maste 		error_f("invalid originator port");
171619261079SEd Maste 	else {
171719261079SEd Maste 		c = channel_connect_by_listen_address(ssh,
171819261079SEd Maste 		    listen_address, listen_port, "forwarded-tcpip",
171919261079SEd Maste 		    originator_address);
172019261079SEd Maste 	}
1721d4af9e69SDag-Erling Smørgrav 
1722ca86bcf2SDag-Erling Smørgrav 	if (c != NULL && c->type == SSH_CHANNEL_MUX_CLIENT) {
1723ca86bcf2SDag-Erling Smørgrav 		if ((b = sshbuf_new()) == NULL) {
172419261079SEd Maste 			error_f("alloc reply");
1725ca86bcf2SDag-Erling Smørgrav 			goto out;
1726ca86bcf2SDag-Erling Smørgrav 		}
1727ca86bcf2SDag-Erling Smørgrav 		/* reconstruct and send to muxclient */
1728ca86bcf2SDag-Erling Smørgrav 		if ((r = sshbuf_put_u8(b, 0)) != 0 ||	/* padlen */
1729ca86bcf2SDag-Erling Smørgrav 		    (r = sshbuf_put_u8(b, SSH2_MSG_CHANNEL_OPEN)) != 0 ||
1730ca86bcf2SDag-Erling Smørgrav 		    (r = sshbuf_put_cstring(b, request_type)) != 0 ||
1731ca86bcf2SDag-Erling Smørgrav 		    (r = sshbuf_put_u32(b, rchan)) != 0 ||
1732ca86bcf2SDag-Erling Smørgrav 		    (r = sshbuf_put_u32(b, rwindow)) != 0 ||
1733ca86bcf2SDag-Erling Smørgrav 		    (r = sshbuf_put_u32(b, rmaxpack)) != 0 ||
1734ca86bcf2SDag-Erling Smørgrav 		    (r = sshbuf_put_cstring(b, listen_address)) != 0 ||
1735ca86bcf2SDag-Erling Smørgrav 		    (r = sshbuf_put_u32(b, listen_port)) != 0 ||
1736ca86bcf2SDag-Erling Smørgrav 		    (r = sshbuf_put_cstring(b, originator_address)) != 0 ||
1737ca86bcf2SDag-Erling Smørgrav 		    (r = sshbuf_put_u32(b, originator_port)) != 0 ||
17384f52dfbbSDag-Erling Smørgrav 		    (r = sshbuf_put_stringb(c->output, b)) != 0) {
173919261079SEd Maste 			error_fr(r, "compose for muxclient");
1740ca86bcf2SDag-Erling Smørgrav 			goto out;
1741ca86bcf2SDag-Erling Smørgrav 		}
1742ca86bcf2SDag-Erling Smørgrav 	}
1743ca86bcf2SDag-Erling Smørgrav 
1744ca86bcf2SDag-Erling Smørgrav  out:
1745ca86bcf2SDag-Erling Smørgrav 	sshbuf_free(b);
1746e4a9863fSDag-Erling Smørgrav 	free(originator_address);
1747e4a9863fSDag-Erling Smørgrav 	free(listen_address);
17481e8db6e2SBrian Feldman 	return c;
17491e8db6e2SBrian Feldman }
17501e8db6e2SBrian Feldman 
1751ae1f160dSDag-Erling Smørgrav static Channel *
17524f52dfbbSDag-Erling Smørgrav client_request_forwarded_streamlocal(struct ssh *ssh,
17534f52dfbbSDag-Erling Smørgrav     const char *request_type, int rchan)
1754a0ee8cc6SDag-Erling Smørgrav {
1755a0ee8cc6SDag-Erling Smørgrav 	Channel *c = NULL;
1756a0ee8cc6SDag-Erling Smørgrav 	char *listen_path;
175719261079SEd Maste 	int r;
1758a0ee8cc6SDag-Erling Smørgrav 
1759a0ee8cc6SDag-Erling Smørgrav 	/* Get the remote path. */
176019261079SEd Maste 	if ((r = sshpkt_get_cstring(ssh, &listen_path, NULL)) != 0 ||
176119261079SEd Maste 	    (r = sshpkt_get_string(ssh, NULL, NULL)) != 0 ||	/* reserved */
176219261079SEd Maste 	    (r = sshpkt_get_end(ssh)) != 0)
176319261079SEd Maste 		fatal_fr(r, "parse packet");
1764a0ee8cc6SDag-Erling Smørgrav 
176519261079SEd Maste 	debug_f("request: %s", listen_path);
1766a0ee8cc6SDag-Erling Smørgrav 
17674f52dfbbSDag-Erling Smørgrav 	c = channel_connect_by_listen_path(ssh, listen_path,
1768a0ee8cc6SDag-Erling Smørgrav 	    "forwarded-streamlocal@openssh.com", "forwarded-streamlocal");
1769a0ee8cc6SDag-Erling Smørgrav 	free(listen_path);
1770a0ee8cc6SDag-Erling Smørgrav 	return c;
1771a0ee8cc6SDag-Erling Smørgrav }
1772a0ee8cc6SDag-Erling Smørgrav 
1773a0ee8cc6SDag-Erling Smørgrav static Channel *
17744f52dfbbSDag-Erling Smørgrav client_request_x11(struct ssh *ssh, const char *request_type, int rchan)
17751e8db6e2SBrian Feldman {
17761e8db6e2SBrian Feldman 	Channel *c = NULL;
17771e8db6e2SBrian Feldman 	char *originator;
177819261079SEd Maste 	u_int originator_port;
177919261079SEd Maste 	int r, sock;
17801e8db6e2SBrian Feldman 
17811e8db6e2SBrian Feldman 	if (!options.forward_x11) {
17821e8db6e2SBrian Feldman 		error("Warning: ssh server tried X11 forwarding.");
1783d4af9e69SDag-Erling Smørgrav 		error("Warning: this is probably a break-in attempt by a "
1784d4af9e69SDag-Erling Smørgrav 		    "malicious server.");
17851e8db6e2SBrian Feldman 		return NULL;
17861e8db6e2SBrian Feldman 	}
17874d3fc8b0SEd Maste 	if (x11_refuse_time != 0 && monotime() >= x11_refuse_time) {
1788e2f6069cSDag-Erling Smørgrav 		verbose("Rejected X11 connection after ForwardX11Timeout "
1789e2f6069cSDag-Erling Smørgrav 		    "expired");
1790e2f6069cSDag-Erling Smørgrav 		return NULL;
1791e2f6069cSDag-Erling Smørgrav 	}
179219261079SEd Maste 	if ((r = sshpkt_get_cstring(ssh, &originator, NULL)) != 0 ||
179319261079SEd Maste 	    (r = sshpkt_get_u32(ssh, &originator_port)) != 0 ||
179419261079SEd Maste 	    (r = sshpkt_get_end(ssh)) != 0)
179519261079SEd Maste 		fatal_fr(r, "parse packet");
17961e8db6e2SBrian Feldman 	/* XXX check permission */
179719261079SEd Maste 	/* XXX range check originator port? */
179819261079SEd Maste 	debug("client_request_x11: request from %s %u", originator,
17991e8db6e2SBrian Feldman 	    originator_port);
1800e4a9863fSDag-Erling Smørgrav 	free(originator);
18014f52dfbbSDag-Erling Smørgrav 	sock = x11_connect_display(ssh);
1802ae1f160dSDag-Erling Smørgrav 	if (sock < 0)
1803ae1f160dSDag-Erling Smørgrav 		return NULL;
18044f52dfbbSDag-Erling Smørgrav 	c = channel_new(ssh, "x11",
180560c59fadSDag-Erling Smørgrav 	    SSH_CHANNEL_X11_OPEN, sock, sock, -1,
180660c59fadSDag-Erling Smørgrav 	    CHAN_TCP_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 0, "x11", 1);
1807ae1f160dSDag-Erling Smørgrav 	c->force_drain = 1;
18081e8db6e2SBrian Feldman 	return c;
18091e8db6e2SBrian Feldman }
18101e8db6e2SBrian Feldman 
1811ae1f160dSDag-Erling Smørgrav static Channel *
18124f52dfbbSDag-Erling Smørgrav client_request_agent(struct ssh *ssh, const char *request_type, int rchan)
18131e8db6e2SBrian Feldman {
18141e8db6e2SBrian Feldman 	Channel *c = NULL;
1815bc5531deSDag-Erling Smørgrav 	int r, sock;
18161e8db6e2SBrian Feldman 
18171e8db6e2SBrian Feldman 	if (!options.forward_agent) {
18181e8db6e2SBrian Feldman 		error("Warning: ssh server tried agent forwarding.");
1819d4af9e69SDag-Erling Smørgrav 		error("Warning: this is probably a break-in attempt by a "
1820d4af9e69SDag-Erling Smørgrav 		    "malicious server.");
18211e8db6e2SBrian Feldman 		return NULL;
18221e8db6e2SBrian Feldman 	}
182319261079SEd Maste 	if (forward_agent_sock_path == NULL) {
182419261079SEd Maste 		r = ssh_get_authentication_socket(&sock);
182519261079SEd Maste 	} else {
182619261079SEd Maste 		r = ssh_get_authentication_socket_path(forward_agent_sock_path, &sock);
182719261079SEd Maste 	}
182819261079SEd Maste 	if (r != 0) {
1829bc5531deSDag-Erling Smørgrav 		if (r != SSH_ERR_AGENT_NOT_PRESENT)
183019261079SEd Maste 			debug_fr(r, "ssh_get_authentication_socket");
1831ae1f160dSDag-Erling Smørgrav 		return NULL;
1832bc5531deSDag-Erling Smørgrav 	}
18331323ec57SEd Maste 	if ((r = ssh_agent_bind_hostkey(sock, ssh->kex->initial_hostkey,
18341323ec57SEd Maste 	    ssh->kex->session_id, ssh->kex->initial_sig, 1)) == 0)
18351323ec57SEd Maste 		debug_f("bound agent to hostkey");
18361323ec57SEd Maste 	else
18371323ec57SEd Maste 		debug2_fr(r, "ssh_agent_bind_hostkey");
18381323ec57SEd Maste 
18394f52dfbbSDag-Erling Smørgrav 	c = channel_new(ssh, "authentication agent connection",
18401e8db6e2SBrian Feldman 	    SSH_CHANNEL_OPEN, sock, sock, -1,
1841e3bd730fSBryan Drewery 	    CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0,
184289986192SBrooks Davis 	    "authentication agent connection", 1);
1843ae1f160dSDag-Erling Smørgrav 	c->force_drain = 1;
18441e8db6e2SBrian Feldman 	return c;
18451e8db6e2SBrian Feldman }
18461e8db6e2SBrian Feldman 
184747dd1d1bSDag-Erling Smørgrav char *
18484f52dfbbSDag-Erling Smørgrav client_request_tun_fwd(struct ssh *ssh, int tun_mode,
184919261079SEd Maste     int local_tun, int remote_tun, channel_open_fn *cb, void *cbctx)
1850d4af9e69SDag-Erling Smørgrav {
1851d4af9e69SDag-Erling Smørgrav 	Channel *c;
185219261079SEd Maste 	int r, fd;
185347dd1d1bSDag-Erling Smørgrav 	char *ifname = NULL;
1854d4af9e69SDag-Erling Smørgrav 
1855d4af9e69SDag-Erling Smørgrav 	if (tun_mode == SSH_TUNMODE_NO)
1856d4af9e69SDag-Erling Smørgrav 		return 0;
1857d4af9e69SDag-Erling Smørgrav 
1858d4af9e69SDag-Erling Smørgrav 	debug("Requesting tun unit %d in mode %d", local_tun, tun_mode);
1859d4af9e69SDag-Erling Smørgrav 
1860d4af9e69SDag-Erling Smørgrav 	/* Open local tunnel device */
186147dd1d1bSDag-Erling Smørgrav 	if ((fd = tun_open(local_tun, tun_mode, &ifname)) == -1) {
1862d4af9e69SDag-Erling Smørgrav 		error("Tunnel device open failed.");
186347dd1d1bSDag-Erling Smørgrav 		return NULL;
1864d4af9e69SDag-Erling Smørgrav 	}
186547dd1d1bSDag-Erling Smørgrav 	debug("Tunnel forwarding using interface %s", ifname);
1866d4af9e69SDag-Erling Smørgrav 
18674f52dfbbSDag-Erling Smørgrav 	c = channel_new(ssh, "tun", SSH_CHANNEL_OPENING, fd, fd, -1,
186860c59fadSDag-Erling Smørgrav 	    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
1869d4af9e69SDag-Erling Smørgrav 	c->datagram = 1;
1870d4af9e69SDag-Erling Smørgrav 
1871d4af9e69SDag-Erling Smørgrav #if defined(SSH_TUN_FILTER)
1872d4af9e69SDag-Erling Smørgrav 	if (options.tun_open == SSH_TUNMODE_POINTOPOINT)
18734f52dfbbSDag-Erling Smørgrav 		channel_register_filter(ssh, c->self, sys_tun_infilter,
1874d4af9e69SDag-Erling Smørgrav 		    sys_tun_outfilter, NULL, NULL);
1875d4af9e69SDag-Erling Smørgrav #endif
1876d4af9e69SDag-Erling Smørgrav 
187719261079SEd Maste 	if (cb != NULL)
187819261079SEd Maste 		channel_register_open_confirm(ssh, c->self, cb, cbctx);
187919261079SEd Maste 
188019261079SEd Maste 	if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_OPEN)) != 0 ||
188119261079SEd Maste 	    (r = sshpkt_put_cstring(ssh, "tun@openssh.com")) != 0 ||
188219261079SEd Maste 	    (r = sshpkt_put_u32(ssh, c->self)) != 0 ||
188319261079SEd Maste 	    (r = sshpkt_put_u32(ssh, c->local_window_max)) != 0 ||
188419261079SEd Maste 	    (r = sshpkt_put_u32(ssh, c->local_maxpacket)) != 0 ||
188519261079SEd Maste 	    (r = sshpkt_put_u32(ssh, tun_mode)) != 0 ||
188619261079SEd Maste 	    (r = sshpkt_put_u32(ssh, remote_tun)) != 0 ||
188719261079SEd Maste 	    (r = sshpkt_send(ssh)) != 0)
188819261079SEd Maste 		sshpkt_fatal(ssh, r, "%s: send reply", __func__);
1889d4af9e69SDag-Erling Smørgrav 
189047dd1d1bSDag-Erling Smørgrav 	return ifname;
1891d4af9e69SDag-Erling Smørgrav }
1892d4af9e69SDag-Erling Smørgrav 
1893a04a10f8SKris Kennaway /* XXXX move to generic input handler */
1894bc5531deSDag-Erling Smørgrav static int
18954f52dfbbSDag-Erling Smørgrav client_input_channel_open(int type, u_int32_t seq, struct ssh *ssh)
1896a04a10f8SKris Kennaway {
1897a04a10f8SKris Kennaway 	Channel *c = NULL;
189819261079SEd Maste 	char *ctype = NULL;
189919261079SEd Maste 	int r;
190019261079SEd Maste 	u_int rchan;
190119261079SEd Maste 	size_t len;
190219261079SEd Maste 	u_int rmaxpack, rwindow;
1903a04a10f8SKris Kennaway 
190419261079SEd Maste 	if ((r = sshpkt_get_cstring(ssh, &ctype, &len)) != 0 ||
190519261079SEd Maste 	    (r = sshpkt_get_u32(ssh, &rchan)) != 0 ||
190619261079SEd Maste 	    (r = sshpkt_get_u32(ssh, &rwindow)) != 0 ||
190719261079SEd Maste 	    (r = sshpkt_get_u32(ssh, &rmaxpack)) != 0)
190819261079SEd Maste 		goto out;
1909a04a10f8SKris Kennaway 
1910a04a10f8SKris Kennaway 	debug("client_input_channel_open: ctype %s rchan %d win %d max %d",
1911a04a10f8SKris Kennaway 	    ctype, rchan, rwindow, rmaxpack);
1912a04a10f8SKris Kennaway 
19131e8db6e2SBrian Feldman 	if (strcmp(ctype, "forwarded-tcpip") == 0) {
19144f52dfbbSDag-Erling Smørgrav 		c = client_request_forwarded_tcpip(ssh, ctype, rchan, rwindow,
1915ca86bcf2SDag-Erling Smørgrav 		    rmaxpack);
1916a0ee8cc6SDag-Erling Smørgrav 	} else if (strcmp(ctype, "forwarded-streamlocal@openssh.com") == 0) {
19174f52dfbbSDag-Erling Smørgrav 		c = client_request_forwarded_streamlocal(ssh, ctype, rchan);
19181e8db6e2SBrian Feldman 	} else if (strcmp(ctype, "x11") == 0) {
19194f52dfbbSDag-Erling Smørgrav 		c = client_request_x11(ssh, ctype, rchan);
19201e8db6e2SBrian Feldman 	} else if (strcmp(ctype, "auth-agent@openssh.com") == 0) {
19214f52dfbbSDag-Erling Smørgrav 		c = client_request_agent(ssh, ctype, rchan);
1922a04a10f8SKris Kennaway 	}
1923ca86bcf2SDag-Erling Smørgrav 	if (c != NULL && c->type == SSH_CHANNEL_MUX_CLIENT) {
1924ca86bcf2SDag-Erling Smørgrav 		debug3("proxied to downstream: %s", ctype);
1925ca86bcf2SDag-Erling Smørgrav 	} else if (c != NULL) {
1926a04a10f8SKris Kennaway 		debug("confirm %s", ctype);
1927a04a10f8SKris Kennaway 		c->remote_id = rchan;
19284f52dfbbSDag-Erling Smørgrav 		c->have_remote_id = 1;
1929a04a10f8SKris Kennaway 		c->remote_window = rwindow;
1930a04a10f8SKris Kennaway 		c->remote_maxpacket = rmaxpack;
1931ae1f160dSDag-Erling Smørgrav 		if (c->type != SSH_CHANNEL_CONNECTING) {
193219261079SEd Maste 			if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_OPEN_CONFIRMATION)) != 0 ||
193319261079SEd Maste 			    (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 ||
193419261079SEd Maste 			    (r = sshpkt_put_u32(ssh, c->self)) != 0 ||
193519261079SEd Maste 			    (r = sshpkt_put_u32(ssh, c->local_window)) != 0 ||
193619261079SEd Maste 			    (r = sshpkt_put_u32(ssh, c->local_maxpacket)) != 0 ||
193719261079SEd Maste 			    (r = sshpkt_send(ssh)) != 0)
193819261079SEd Maste 				sshpkt_fatal(ssh, r, "%s: send reply", __func__);
1939ae1f160dSDag-Erling Smørgrav 		}
1940a04a10f8SKris Kennaway 	} else {
1941a04a10f8SKris Kennaway 		debug("failure %s", ctype);
194219261079SEd Maste 		if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_OPEN_FAILURE)) != 0 ||
194319261079SEd Maste 		    (r = sshpkt_put_u32(ssh, rchan)) != 0 ||
194419261079SEd Maste 		    (r = sshpkt_put_u32(ssh, SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED)) != 0 ||
194519261079SEd Maste 		    (r = sshpkt_put_cstring(ssh, "open failed")) != 0 ||
194619261079SEd Maste 		    (r = sshpkt_put_cstring(ssh, "")) != 0 ||
194719261079SEd Maste 		    (r = sshpkt_send(ssh)) != 0)
194819261079SEd Maste 			sshpkt_fatal(ssh, r, "%s: send failure", __func__);
1949a04a10f8SKris Kennaway 	}
195019261079SEd Maste 	r = 0;
195119261079SEd Maste  out:
1952e4a9863fSDag-Erling Smørgrav 	free(ctype);
195319261079SEd Maste 	return r;
1954a04a10f8SKris Kennaway }
1955bc5531deSDag-Erling Smørgrav 
1956bc5531deSDag-Erling Smørgrav static int
19574f52dfbbSDag-Erling Smørgrav client_input_channel_req(int type, u_int32_t seq, struct ssh *ssh)
19581e8db6e2SBrian Feldman {
19591e8db6e2SBrian Feldman 	Channel *c = NULL;
196019261079SEd Maste 	char *rtype = NULL;
196119261079SEd Maste 	u_char reply;
196219261079SEd Maste 	u_int id, exitval;
196319261079SEd Maste 	int r, success = 0;
19641e8db6e2SBrian Feldman 
196519261079SEd Maste 	if ((r = sshpkt_get_u32(ssh, &id)) != 0)
196619261079SEd Maste 		return r;
196719261079SEd Maste 	if (id <= INT_MAX)
19684f52dfbbSDag-Erling Smørgrav 		c = channel_lookup(ssh, id);
19694f52dfbbSDag-Erling Smørgrav 	if (channel_proxy_upstream(c, type, seq, ssh))
1970ca86bcf2SDag-Erling Smørgrav 		return 0;
197119261079SEd Maste 	if ((r = sshpkt_get_cstring(ssh, &rtype, NULL)) != 0 ||
197219261079SEd Maste 	    (r = sshpkt_get_u8(ssh, &reply)) != 0)
197319261079SEd Maste 		goto out;
19741e8db6e2SBrian Feldman 
197519261079SEd Maste 	debug("client_input_channel_req: channel %u rtype %s reply %d",
19761e8db6e2SBrian Feldman 	    id, rtype, reply);
19771e8db6e2SBrian Feldman 
197819261079SEd Maste 	if (c == NULL) {
1979d4af9e69SDag-Erling Smørgrav 		error("client_input_channel_req: channel %d: "
1980d4af9e69SDag-Erling Smørgrav 		    "unknown channel", id);
1981d4af9e69SDag-Erling Smørgrav 	} else if (strcmp(rtype, "eow@openssh.com") == 0) {
198219261079SEd Maste 		if ((r = sshpkt_get_end(ssh)) != 0)
198319261079SEd Maste 			goto out;
19844f52dfbbSDag-Erling Smørgrav 		chan_rcvd_eow(ssh, c);
19851e8db6e2SBrian Feldman 	} else if (strcmp(rtype, "exit-status") == 0) {
198619261079SEd Maste 		if ((r = sshpkt_get_u32(ssh, &exitval)) != 0)
198719261079SEd Maste 			goto out;
1988b15c8340SDag-Erling Smørgrav 		if (c->ctl_chan != -1) {
19894f52dfbbSDag-Erling Smørgrav 			mux_exit_message(ssh, c, exitval);
1990b15c8340SDag-Erling Smørgrav 			success = 1;
199119261079SEd Maste 		} else if ((int)id == session_ident) {
1992b15c8340SDag-Erling Smørgrav 			/* Record exit value of local session */
19931e8db6e2SBrian Feldman 			success = 1;
1994d74d50a8SDag-Erling Smørgrav 			exit_status = exitval;
1995d74d50a8SDag-Erling Smørgrav 		} else {
1996b15c8340SDag-Erling Smørgrav 			/* Probably for a mux channel that has already closed */
199719261079SEd Maste 			debug_f("no sink for exit-status on channel %d",
199819261079SEd Maste 			    id);
1999d74d50a8SDag-Erling Smørgrav 		}
200019261079SEd Maste 		if ((r = sshpkt_get_end(ssh)) != 0)
200119261079SEd Maste 			goto out;
20021e8db6e2SBrian Feldman 	}
2003a0ee8cc6SDag-Erling Smørgrav 	if (reply && c != NULL && !(c->flags & CHAN_CLOSE_SENT)) {
20044f52dfbbSDag-Erling Smørgrav 		if (!c->have_remote_id)
200519261079SEd Maste 			fatal_f("channel %d: no remote_id", c->self);
200619261079SEd Maste 		if ((r = sshpkt_start(ssh, success ?
200719261079SEd Maste 		    SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE)) != 0 ||
200819261079SEd Maste 		    (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 ||
200919261079SEd Maste 		    (r = sshpkt_send(ssh)) != 0)
201019261079SEd Maste 			sshpkt_fatal(ssh, r, "%s: send failure", __func__);
20111e8db6e2SBrian Feldman 	}
201219261079SEd Maste 	r = 0;
201319261079SEd Maste  out:
2014e4a9863fSDag-Erling Smørgrav 	free(rtype);
201519261079SEd Maste 	return r;
20161e8db6e2SBrian Feldman }
2017bc5531deSDag-Erling Smørgrav 
2018bc5531deSDag-Erling Smørgrav struct hostkeys_update_ctx {
2019bc5531deSDag-Erling Smørgrav 	/* The hostname and (optionally) IP address string for the server */
2020bc5531deSDag-Erling Smørgrav 	char *host_str, *ip_str;
2021bc5531deSDag-Erling Smørgrav 
2022bc5531deSDag-Erling Smørgrav 	/*
2023bc5531deSDag-Erling Smørgrav 	 * Keys received from the server and a flag for each indicating
2024bc5531deSDag-Erling Smørgrav 	 * whether they already exist in known_hosts.
202519261079SEd Maste 	 * keys_match is filled in by hostkeys_find() and later (for new
2026f374ba41SEd Maste 	 * keys) by client_global_hostkeys_prove_confirm().
2027bc5531deSDag-Erling Smørgrav 	 */
2028bc5531deSDag-Erling Smørgrav 	struct sshkey **keys;
202919261079SEd Maste 	u_int *keys_match;	/* mask of HKF_MATCH_* from hostfile.h */
203019261079SEd Maste 	int *keys_verified;	/* flag for new keys verified by server */
203119261079SEd Maste 	size_t nkeys, nnew, nincomplete; /* total, new keys, incomplete match */
2032bc5531deSDag-Erling Smørgrav 
2033bc5531deSDag-Erling Smørgrav 	/*
2034bc5531deSDag-Erling Smørgrav 	 * Keys that are in known_hosts, but were not present in the update
2035bc5531deSDag-Erling Smørgrav 	 * from the server (i.e. scheduled to be deleted).
2036bc5531deSDag-Erling Smørgrav 	 * Filled in by hostkeys_find().
2037bc5531deSDag-Erling Smørgrav 	 */
2038bc5531deSDag-Erling Smørgrav 	struct sshkey **old_keys;
2039bc5531deSDag-Erling Smørgrav 	size_t nold;
204019261079SEd Maste 
204119261079SEd Maste 	/* Various special cases. */
204219261079SEd Maste 	int complex_hostspec;	/* wildcard or manual pattern-list host name */
204319261079SEd Maste 	int ca_available;	/* saw CA key for this host */
204419261079SEd Maste 	int old_key_seen;	/* saw old key with other name/addr */
204519261079SEd Maste 	int other_name_seen;	/* saw key with other name/addr */
2046bc5531deSDag-Erling Smørgrav };
2047bc5531deSDag-Erling Smørgrav 
2048ae1f160dSDag-Erling Smørgrav static void
2049bc5531deSDag-Erling Smørgrav hostkeys_update_ctx_free(struct hostkeys_update_ctx *ctx)
2050bc5531deSDag-Erling Smørgrav {
2051bc5531deSDag-Erling Smørgrav 	size_t i;
2052bc5531deSDag-Erling Smørgrav 
2053bc5531deSDag-Erling Smørgrav 	if (ctx == NULL)
2054bc5531deSDag-Erling Smørgrav 		return;
2055bc5531deSDag-Erling Smørgrav 	for (i = 0; i < ctx->nkeys; i++)
2056bc5531deSDag-Erling Smørgrav 		sshkey_free(ctx->keys[i]);
2057bc5531deSDag-Erling Smørgrav 	free(ctx->keys);
205819261079SEd Maste 	free(ctx->keys_match);
205919261079SEd Maste 	free(ctx->keys_verified);
2060bc5531deSDag-Erling Smørgrav 	for (i = 0; i < ctx->nold; i++)
2061bc5531deSDag-Erling Smørgrav 		sshkey_free(ctx->old_keys[i]);
2062bc5531deSDag-Erling Smørgrav 	free(ctx->old_keys);
2063bc5531deSDag-Erling Smørgrav 	free(ctx->host_str);
2064bc5531deSDag-Erling Smørgrav 	free(ctx->ip_str);
2065bc5531deSDag-Erling Smørgrav 	free(ctx);
2066bc5531deSDag-Erling Smørgrav }
2067bc5531deSDag-Erling Smørgrav 
206819261079SEd Maste /*
206919261079SEd Maste  * Returns non-zero if a known_hosts hostname list is not of a form that
207019261079SEd Maste  * can be handled by UpdateHostkeys. These include wildcard hostnames and
207119261079SEd Maste  * hostnames lists that do not follow the form host[,ip].
207219261079SEd Maste  */
207319261079SEd Maste static int
207419261079SEd Maste hostspec_is_complex(const char *hosts)
207519261079SEd Maste {
207619261079SEd Maste 	char *cp;
207719261079SEd Maste 
207819261079SEd Maste 	/* wildcard */
207919261079SEd Maste 	if (strchr(hosts, '*') != NULL || strchr(hosts, '?') != NULL)
208019261079SEd Maste 		return 1;
208119261079SEd Maste 	/* single host/ip = ok */
208219261079SEd Maste 	if ((cp = strchr(hosts, ',')) == NULL)
208319261079SEd Maste 		return 0;
208419261079SEd Maste 	/* more than two entries on the line */
208519261079SEd Maste 	if (strchr(cp + 1, ',') != NULL)
208619261079SEd Maste 		return 1;
208719261079SEd Maste 	/* XXX maybe parse cp+1 and ensure it is an IP? */
208819261079SEd Maste 	return 0;
208919261079SEd Maste }
209019261079SEd Maste 
209119261079SEd Maste /* callback to search for ctx->keys in known_hosts */
2092bc5531deSDag-Erling Smørgrav static int
2093bc5531deSDag-Erling Smørgrav hostkeys_find(struct hostkey_foreach_line *l, void *_ctx)
2094bc5531deSDag-Erling Smørgrav {
2095bc5531deSDag-Erling Smørgrav 	struct hostkeys_update_ctx *ctx = (struct hostkeys_update_ctx *)_ctx;
2096bc5531deSDag-Erling Smørgrav 	size_t i;
2097bc5531deSDag-Erling Smørgrav 	struct sshkey **tmp;
2098bc5531deSDag-Erling Smørgrav 
209919261079SEd Maste 	if (l->key == NULL)
2100bc5531deSDag-Erling Smørgrav 		return 0;
210119261079SEd Maste 	if (l->status != HKF_STATUS_MATCHED) {
210219261079SEd Maste 		/* Record if one of the keys appears on a non-matching line */
210319261079SEd Maste 		for (i = 0; i < ctx->nkeys; i++) {
210419261079SEd Maste 			if (sshkey_equal(l->key, ctx->keys[i])) {
210519261079SEd Maste 				ctx->other_name_seen = 1;
210619261079SEd Maste 				debug3_f("found %s key under different "
210719261079SEd Maste 				    "name/addr at %s:%ld",
210819261079SEd Maste 				    sshkey_ssh_name(ctx->keys[i]),
210919261079SEd Maste 				    l->path, l->linenum);
211019261079SEd Maste 				return 0;
211119261079SEd Maste 			}
211219261079SEd Maste 		}
211319261079SEd Maste 		return 0;
211419261079SEd Maste 	}
211519261079SEd Maste 	/* Don't proceed if revocation or CA markers are present */
211619261079SEd Maste 	/* XXX relax this */
211719261079SEd Maste 	if (l->marker != MRK_NONE) {
211819261079SEd Maste 		debug3_f("hostkeys file %s:%ld has CA/revocation marker",
211919261079SEd Maste 		    l->path, l->linenum);
212019261079SEd Maste 		ctx->complex_hostspec = 1;
212119261079SEd Maste 		return 0;
212219261079SEd Maste 	}
212319261079SEd Maste 
212419261079SEd Maste 	/* If CheckHostIP is enabled, then check for mismatched hostname/addr */
212519261079SEd Maste 	if (ctx->ip_str != NULL && strchr(l->hosts, ',') != NULL) {
212619261079SEd Maste 		if ((l->match & HKF_MATCH_HOST) == 0) {
212719261079SEd Maste 			/* Record if address matched a different hostname. */
212819261079SEd Maste 			ctx->other_name_seen = 1;
212919261079SEd Maste 			debug3_f("found address %s against different hostname "
213019261079SEd Maste 			    "at %s:%ld", ctx->ip_str, l->path, l->linenum);
213119261079SEd Maste 			return 0;
213219261079SEd Maste 		} else if ((l->match & HKF_MATCH_IP) == 0) {
213319261079SEd Maste 			/* Record if hostname matched a different address. */
213419261079SEd Maste 			ctx->other_name_seen = 1;
213519261079SEd Maste 			debug3_f("found hostname %s against different address "
213619261079SEd Maste 			    "at %s:%ld", ctx->host_str, l->path, l->linenum);
213719261079SEd Maste 		}
213819261079SEd Maste 	}
213919261079SEd Maste 
214019261079SEd Maste 	/*
214119261079SEd Maste 	 * UpdateHostkeys is skipped for wildcard host names and hostnames
214219261079SEd Maste 	 * that contain more than two entries (ssh never writes these).
214319261079SEd Maste 	 */
214419261079SEd Maste 	if (hostspec_is_complex(l->hosts)) {
214519261079SEd Maste 		debug3_f("hostkeys file %s:%ld complex host specification",
214619261079SEd Maste 		    l->path, l->linenum);
214719261079SEd Maste 		ctx->complex_hostspec = 1;
214819261079SEd Maste 		return 0;
214919261079SEd Maste 	}
2150bc5531deSDag-Erling Smørgrav 
2151bc5531deSDag-Erling Smørgrav 	/* Mark off keys we've already seen for this host */
2152bc5531deSDag-Erling Smørgrav 	for (i = 0; i < ctx->nkeys; i++) {
215319261079SEd Maste 		if (!sshkey_equal(l->key, ctx->keys[i]))
215419261079SEd Maste 			continue;
215519261079SEd Maste 		debug3_f("found %s key at %s:%ld",
2156bc5531deSDag-Erling Smørgrav 		    sshkey_ssh_name(ctx->keys[i]), l->path, l->linenum);
215719261079SEd Maste 		ctx->keys_match[i] |= l->match;
2158bc5531deSDag-Erling Smørgrav 		return 0;
2159bc5531deSDag-Erling Smørgrav 	}
2160bc5531deSDag-Erling Smørgrav 	/* This line contained a key that not offered by the server */
216119261079SEd Maste 	debug3_f("deprecated %s key at %s:%ld", sshkey_ssh_name(l->key),
216219261079SEd Maste 	    l->path, l->linenum);
21634f52dfbbSDag-Erling Smørgrav 	if ((tmp = recallocarray(ctx->old_keys, ctx->nold, ctx->nold + 1,
2164bc5531deSDag-Erling Smørgrav 	    sizeof(*ctx->old_keys))) == NULL)
216519261079SEd Maste 		fatal_f("recallocarray failed nold = %zu", ctx->nold);
2166bc5531deSDag-Erling Smørgrav 	ctx->old_keys = tmp;
2167bc5531deSDag-Erling Smørgrav 	ctx->old_keys[ctx->nold++] = l->key;
2168bc5531deSDag-Erling Smørgrav 	l->key = NULL;
2169bc5531deSDag-Erling Smørgrav 
2170bc5531deSDag-Erling Smørgrav 	return 0;
2171bc5531deSDag-Erling Smørgrav }
2172bc5531deSDag-Erling Smørgrav 
217319261079SEd Maste /* callback to search for ctx->old_keys in known_hosts under other names */
217419261079SEd Maste static int
217519261079SEd Maste hostkeys_check_old(struct hostkey_foreach_line *l, void *_ctx)
217619261079SEd Maste {
217719261079SEd Maste 	struct hostkeys_update_ctx *ctx = (struct hostkeys_update_ctx *)_ctx;
217819261079SEd Maste 	size_t i;
217919261079SEd Maste 	int hashed;
218019261079SEd Maste 
218119261079SEd Maste 	/* only care about lines that *don't* match the active host spec */
218219261079SEd Maste 	if (l->status == HKF_STATUS_MATCHED || l->key == NULL)
218319261079SEd Maste 		return 0;
218419261079SEd Maste 
218519261079SEd Maste 	hashed = l->match & (HKF_MATCH_HOST_HASHED|HKF_MATCH_IP_HASHED);
218619261079SEd Maste 	for (i = 0; i < ctx->nold; i++) {
218719261079SEd Maste 		if (!sshkey_equal(l->key, ctx->old_keys[i]))
218819261079SEd Maste 			continue;
218919261079SEd Maste 		debug3_f("found deprecated %s key at %s:%ld as %s",
219019261079SEd Maste 		    sshkey_ssh_name(ctx->old_keys[i]), l->path, l->linenum,
219119261079SEd Maste 		    hashed ? "[HASHED]" : l->hosts);
219219261079SEd Maste 		ctx->old_key_seen = 1;
219319261079SEd Maste 		break;
219419261079SEd Maste 	}
219519261079SEd Maste 	return 0;
219619261079SEd Maste }
219719261079SEd Maste 
219819261079SEd Maste /*
219919261079SEd Maste  * Check known_hosts files for deprecated keys under other names. Returns 0
220019261079SEd Maste  * on success or -1 on failure. Updates ctx->old_key_seen if deprecated keys
220119261079SEd Maste  * exist under names other than the active hostname/IP.
220219261079SEd Maste  */
220319261079SEd Maste static int
220419261079SEd Maste check_old_keys_othernames(struct hostkeys_update_ctx *ctx)
220519261079SEd Maste {
220619261079SEd Maste 	size_t i;
220719261079SEd Maste 	int r;
220819261079SEd Maste 
220919261079SEd Maste 	debug2_f("checking for %zu deprecated keys", ctx->nold);
221019261079SEd Maste 	for (i = 0; i < options.num_user_hostfiles; i++) {
221119261079SEd Maste 		debug3_f("searching %s for %s / %s",
221219261079SEd Maste 		    options.user_hostfiles[i], ctx->host_str,
221319261079SEd Maste 		    ctx->ip_str ? ctx->ip_str : "(none)");
221419261079SEd Maste 		if ((r = hostkeys_foreach(options.user_hostfiles[i],
221519261079SEd Maste 		    hostkeys_check_old, ctx, ctx->host_str, ctx->ip_str,
221619261079SEd Maste 		    HKF_WANT_PARSE_KEY, 0)) != 0) {
221719261079SEd Maste 			if (r == SSH_ERR_SYSTEM_ERROR && errno == ENOENT) {
221819261079SEd Maste 				debug_f("hostkeys file %s does not exist",
221919261079SEd Maste 				    options.user_hostfiles[i]);
222019261079SEd Maste 				continue;
222119261079SEd Maste 			}
222219261079SEd Maste 			error_fr(r, "hostkeys_foreach failed for %s",
222319261079SEd Maste 			    options.user_hostfiles[i]);
222419261079SEd Maste 			return -1;
222519261079SEd Maste 		}
222619261079SEd Maste 	}
222719261079SEd Maste 	return 0;
222819261079SEd Maste }
222919261079SEd Maste 
223019261079SEd Maste static void
223119261079SEd Maste hostkey_change_preamble(LogLevel loglevel)
223219261079SEd Maste {
223319261079SEd Maste 	do_log2(loglevel, "The server has updated its host keys.");
223419261079SEd Maste 	do_log2(loglevel, "These changes were verified by the server's "
223519261079SEd Maste 	    "existing trusted key.");
223619261079SEd Maste }
223719261079SEd Maste 
2238bc5531deSDag-Erling Smørgrav static void
2239bc5531deSDag-Erling Smørgrav update_known_hosts(struct hostkeys_update_ctx *ctx)
2240bc5531deSDag-Erling Smørgrav {
224119261079SEd Maste 	int r, was_raw = 0, first = 1;
224219261079SEd Maste 	int asking = options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK;
224319261079SEd Maste 	LogLevel loglevel = asking ?  SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_VERBOSE;
2244bc5531deSDag-Erling Smørgrav 	char *fp, *response;
2245bc5531deSDag-Erling Smørgrav 	size_t i;
224619261079SEd Maste 	struct stat sb;
2247bc5531deSDag-Erling Smørgrav 
2248bc5531deSDag-Erling Smørgrav 	for (i = 0; i < ctx->nkeys; i++) {
224919261079SEd Maste 		if (!ctx->keys_verified[i])
2250bc5531deSDag-Erling Smørgrav 			continue;
2251bc5531deSDag-Erling Smørgrav 		if ((fp = sshkey_fingerprint(ctx->keys[i],
2252bc5531deSDag-Erling Smørgrav 		    options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
225319261079SEd Maste 			fatal_f("sshkey_fingerprint failed");
225419261079SEd Maste 		if (first && asking)
225519261079SEd Maste 			hostkey_change_preamble(loglevel);
2256bc5531deSDag-Erling Smørgrav 		do_log2(loglevel, "Learned new hostkey: %s %s",
2257bc5531deSDag-Erling Smørgrav 		    sshkey_type(ctx->keys[i]), fp);
225819261079SEd Maste 		first = 0;
2259bc5531deSDag-Erling Smørgrav 		free(fp);
2260bc5531deSDag-Erling Smørgrav 	}
2261bc5531deSDag-Erling Smørgrav 	for (i = 0; i < ctx->nold; i++) {
2262bc5531deSDag-Erling Smørgrav 		if ((fp = sshkey_fingerprint(ctx->old_keys[i],
2263bc5531deSDag-Erling Smørgrav 		    options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
226419261079SEd Maste 			fatal_f("sshkey_fingerprint failed");
226519261079SEd Maste 		if (first && asking)
226619261079SEd Maste 			hostkey_change_preamble(loglevel);
2267bc5531deSDag-Erling Smørgrav 		do_log2(loglevel, "Deprecating obsolete hostkey: %s %s",
2268bc5531deSDag-Erling Smørgrav 		    sshkey_type(ctx->old_keys[i]), fp);
226919261079SEd Maste 		first = 0;
2270bc5531deSDag-Erling Smørgrav 		free(fp);
2271bc5531deSDag-Erling Smørgrav 	}
2272bc5531deSDag-Erling Smørgrav 	if (options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK) {
2273bc5531deSDag-Erling Smørgrav 		if (get_saved_tio() != NULL) {
2274bc5531deSDag-Erling Smørgrav 			leave_raw_mode(1);
2275bc5531deSDag-Erling Smørgrav 			was_raw = 1;
2276bc5531deSDag-Erling Smørgrav 		}
2277bc5531deSDag-Erling Smørgrav 		response = NULL;
2278bc5531deSDag-Erling Smørgrav 		for (i = 0; !quit_pending && i < 3; i++) {
2279bc5531deSDag-Erling Smørgrav 			free(response);
2280bc5531deSDag-Erling Smørgrav 			response = read_passphrase("Accept updated hostkeys? "
2281bc5531deSDag-Erling Smørgrav 			    "(yes/no): ", RP_ECHO);
22824d3fc8b0SEd Maste 			if (response != NULL && strcasecmp(response, "yes") == 0)
2283bc5531deSDag-Erling Smørgrav 				break;
2284bc5531deSDag-Erling Smørgrav 			else if (quit_pending || response == NULL ||
2285bc5531deSDag-Erling Smørgrav 			    strcasecmp(response, "no") == 0) {
2286bc5531deSDag-Erling Smørgrav 				options.update_hostkeys = 0;
2287bc5531deSDag-Erling Smørgrav 				break;
2288bc5531deSDag-Erling Smørgrav 			} else {
2289bc5531deSDag-Erling Smørgrav 				do_log2(loglevel, "Please enter "
2290bc5531deSDag-Erling Smørgrav 				    "\"yes\" or \"no\"");
2291bc5531deSDag-Erling Smørgrav 			}
2292bc5531deSDag-Erling Smørgrav 		}
2293bc5531deSDag-Erling Smørgrav 		if (quit_pending || i >= 3 || response == NULL)
2294bc5531deSDag-Erling Smørgrav 			options.update_hostkeys = 0;
2295bc5531deSDag-Erling Smørgrav 		free(response);
2296bc5531deSDag-Erling Smørgrav 		if (was_raw)
2297bc5531deSDag-Erling Smørgrav 			enter_raw_mode(1);
2298bc5531deSDag-Erling Smørgrav 	}
229919261079SEd Maste 	if (options.update_hostkeys == 0)
230019261079SEd Maste 		return;
2301bc5531deSDag-Erling Smørgrav 	/*
2302bc5531deSDag-Erling Smørgrav 	 * Now that all the keys are verified, we can go ahead and replace
2303bc5531deSDag-Erling Smørgrav 	 * them in known_hosts (assuming SSH_UPDATE_HOSTKEYS_ASK didn't
2304bc5531deSDag-Erling Smørgrav 	 * cancel the operation).
2305bc5531deSDag-Erling Smørgrav 	 */
230619261079SEd Maste 	for (i = 0; i < options.num_user_hostfiles; i++) {
230719261079SEd Maste 		/*
230819261079SEd Maste 		 * NB. keys are only added to hostfiles[0], for the rest we
230919261079SEd Maste 		 * just delete the hostname entries.
231019261079SEd Maste 		 */
231119261079SEd Maste 		if (stat(options.user_hostfiles[i], &sb) != 0) {
231219261079SEd Maste 			if (errno == ENOENT) {
231319261079SEd Maste 				debug_f("known hosts file %s does not "
231419261079SEd Maste 				    "exist", options.user_hostfiles[i]);
231519261079SEd Maste 			} else {
231619261079SEd Maste 				error_f("known hosts file %s "
231719261079SEd Maste 				    "inaccessible: %s",
231819261079SEd Maste 				    options.user_hostfiles[i], strerror(errno));
231919261079SEd Maste 			}
232019261079SEd Maste 			continue;
232119261079SEd Maste 		}
232219261079SEd Maste 		if ((r = hostfile_replace_entries(options.user_hostfiles[i],
232319261079SEd Maste 		    ctx->host_str, ctx->ip_str,
232419261079SEd Maste 		    i == 0 ? ctx->keys : NULL, i == 0 ? ctx->nkeys : 0,
2325bc5531deSDag-Erling Smørgrav 		    options.hash_known_hosts, 0,
232619261079SEd Maste 		    options.fingerprint_hash)) != 0) {
232719261079SEd Maste 			error_fr(r, "hostfile_replace_entries failed for %s",
232819261079SEd Maste 			    options.user_hostfiles[i]);
232919261079SEd Maste 		}
233019261079SEd Maste 	}
2331bc5531deSDag-Erling Smørgrav }
2332bc5531deSDag-Erling Smørgrav 
2333bc5531deSDag-Erling Smørgrav static void
2334f374ba41SEd Maste client_global_hostkeys_prove_confirm(struct ssh *ssh, int type,
23354f52dfbbSDag-Erling Smørgrav     u_int32_t seq, void *_ctx)
2336bc5531deSDag-Erling Smørgrav {
2337bc5531deSDag-Erling Smørgrav 	struct hostkeys_update_ctx *ctx = (struct hostkeys_update_ctx *)_ctx;
2338bc5531deSDag-Erling Smørgrav 	size_t i, ndone;
2339bc5531deSDag-Erling Smørgrav 	struct sshbuf *signdata;
23401323ec57SEd Maste 	int r, plaintype;
2341bc5531deSDag-Erling Smørgrav 	const u_char *sig;
23421323ec57SEd Maste 	const char *rsa_kexalg = NULL;
23431323ec57SEd Maste 	char *alg = NULL;
2344bc5531deSDag-Erling Smørgrav 	size_t siglen;
2345bc5531deSDag-Erling Smørgrav 
2346bc5531deSDag-Erling Smørgrav 	if (ctx->nnew == 0)
234719261079SEd Maste 		fatal_f("ctx->nnew == 0"); /* sanity */
2348bc5531deSDag-Erling Smørgrav 	if (type != SSH2_MSG_REQUEST_SUCCESS) {
2349bc5531deSDag-Erling Smørgrav 		error("Server failed to confirm ownership of "
2350bc5531deSDag-Erling Smørgrav 		    "private host keys");
2351bc5531deSDag-Erling Smørgrav 		hostkeys_update_ctx_free(ctx);
2352bc5531deSDag-Erling Smørgrav 		return;
2353bc5531deSDag-Erling Smørgrav 	}
23541323ec57SEd Maste 	if (sshkey_type_plain(sshkey_type_from_name(
23551323ec57SEd Maste 	    ssh->kex->hostkey_alg)) == KEY_RSA)
23561323ec57SEd Maste 		rsa_kexalg = ssh->kex->hostkey_alg;
2357bc5531deSDag-Erling Smørgrav 	if ((signdata = sshbuf_new()) == NULL)
235819261079SEd Maste 		fatal_f("sshbuf_new failed");
2359bc5531deSDag-Erling Smørgrav 	/*
2360bc5531deSDag-Erling Smørgrav 	 * Expect a signature for each of the ctx->nnew private keys we
2361bc5531deSDag-Erling Smørgrav 	 * haven't seen before. They will be in the same order as the
236219261079SEd Maste 	 * ctx->keys where the corresponding ctx->keys_match[i] == 0.
2363bc5531deSDag-Erling Smørgrav 	 */
2364bc5531deSDag-Erling Smørgrav 	for (ndone = i = 0; i < ctx->nkeys; i++) {
236519261079SEd Maste 		if (ctx->keys_match[i])
2366bc5531deSDag-Erling Smørgrav 			continue;
23671323ec57SEd Maste 		plaintype = sshkey_type_plain(ctx->keys[i]->type);
2368bc5531deSDag-Erling Smørgrav 		/* Prepare data to be signed: session ID, unique string, key */
2369bc5531deSDag-Erling Smørgrav 		sshbuf_reset(signdata);
2370bc5531deSDag-Erling Smørgrav 		if ( (r = sshbuf_put_cstring(signdata,
2371bc5531deSDag-Erling Smørgrav 		    "hostkeys-prove-00@openssh.com")) != 0 ||
237219261079SEd Maste 		    (r = sshbuf_put_stringb(signdata,
237319261079SEd Maste 		    ssh->kex->session_id)) != 0 ||
2374bc5531deSDag-Erling Smørgrav 		    (r = sshkey_puts(ctx->keys[i], signdata)) != 0)
237519261079SEd Maste 			fatal_fr(r, "compose signdata");
2376bc5531deSDag-Erling Smørgrav 		/* Extract and verify signature */
2377bc5531deSDag-Erling Smørgrav 		if ((r = sshpkt_get_string_direct(ssh, &sig, &siglen)) != 0) {
237819261079SEd Maste 			error_fr(r, "parse sig");
2379bc5531deSDag-Erling Smørgrav 			goto out;
2380bc5531deSDag-Erling Smørgrav 		}
23811323ec57SEd Maste 		if ((r = sshkey_get_sigtype(sig, siglen, &alg)) != 0) {
23821323ec57SEd Maste 			error_fr(r, "server gave unintelligible signature "
23831323ec57SEd Maste 			    "for %s key %zu", sshkey_type(ctx->keys[i]), i);
23841323ec57SEd Maste 			goto out;
23851323ec57SEd Maste 		}
238647dd1d1bSDag-Erling Smørgrav 		/*
23871323ec57SEd Maste 		 * Special case for RSA keys: if a RSA hostkey was negotiated,
23881323ec57SEd Maste 		 * then use its signature type for verification of RSA hostkey
23891323ec57SEd Maste 		 * proofs. Otherwise, accept only RSA-SHA256/512 signatures.
239047dd1d1bSDag-Erling Smørgrav 		 */
23911323ec57SEd Maste 		if (plaintype == KEY_RSA && rsa_kexalg == NULL &&
23921323ec57SEd Maste 		    match_pattern_list(alg, HOSTKEY_PROOF_RSA_ALGS, 0) != 1) {
23931323ec57SEd Maste 			debug_f("server used untrusted RSA signature algorithm "
23941323ec57SEd Maste 			    "%s for key %zu, disregarding", alg, i);
23951323ec57SEd Maste 			free(alg);
23961323ec57SEd Maste 			/* zap the key from the list */
23971323ec57SEd Maste 			sshkey_free(ctx->keys[i]);
23981323ec57SEd Maste 			ctx->keys[i] = NULL;
23991323ec57SEd Maste 			ndone++;
24001323ec57SEd Maste 			continue;
24011323ec57SEd Maste 		}
24021323ec57SEd Maste 		debug3_f("verify %s key %zu using sigalg %s",
24031323ec57SEd Maste 		    sshkey_type(ctx->keys[i]), i, alg);
24041323ec57SEd Maste 		free(alg);
2405bc5531deSDag-Erling Smørgrav 		if ((r = sshkey_verify(ctx->keys[i], sig, siglen,
240647dd1d1bSDag-Erling Smørgrav 		    sshbuf_ptr(signdata), sshbuf_len(signdata),
24071323ec57SEd Maste 		    plaintype == KEY_RSA ? rsa_kexalg : NULL, 0, NULL)) != 0) {
240819261079SEd Maste 			error_fr(r, "server gave bad signature for %s key %zu",
240919261079SEd Maste 			    sshkey_type(ctx->keys[i]), i);
2410bc5531deSDag-Erling Smørgrav 			goto out;
2411bc5531deSDag-Erling Smørgrav 		}
2412bc5531deSDag-Erling Smørgrav 		/* Key is good. Mark it as 'seen' */
241319261079SEd Maste 		ctx->keys_verified[i] = 1;
2414bc5531deSDag-Erling Smørgrav 		ndone++;
2415bc5531deSDag-Erling Smørgrav 	}
241619261079SEd Maste 	/* Shouldn't happen */
2417bc5531deSDag-Erling Smørgrav 	if (ndone != ctx->nnew)
241819261079SEd Maste 		fatal_f("ndone != ctx->nnew (%zu / %zu)", ndone, ctx->nnew);
241919261079SEd Maste 	if ((r = sshpkt_get_end(ssh)) != 0) {
242019261079SEd Maste 		error_f("protocol error");
242119261079SEd Maste 		goto out;
242219261079SEd Maste 	}
2423bc5531deSDag-Erling Smørgrav 
2424bc5531deSDag-Erling Smørgrav 	/* Make the edits to known_hosts */
2425bc5531deSDag-Erling Smørgrav 	update_known_hosts(ctx);
2426bc5531deSDag-Erling Smørgrav  out:
2427bc5531deSDag-Erling Smørgrav 	hostkeys_update_ctx_free(ctx);
2428f374ba41SEd Maste 	hostkeys_update_complete = 1;
2429f374ba41SEd Maste 	client_repledge();
2430bc5531deSDag-Erling Smørgrav }
2431bc5531deSDag-Erling Smørgrav 
2432bc5531deSDag-Erling Smørgrav /*
2433d93a896eSDag-Erling Smørgrav  * Returns non-zero if the key is accepted by HostkeyAlgorithms.
2434d93a896eSDag-Erling Smørgrav  * Made slightly less trivial by the multiple RSA signature algorithm names.
2435d93a896eSDag-Erling Smørgrav  */
2436d93a896eSDag-Erling Smørgrav static int
2437d93a896eSDag-Erling Smørgrav key_accepted_by_hostkeyalgs(const struct sshkey *key)
2438d93a896eSDag-Erling Smørgrav {
2439d93a896eSDag-Erling Smørgrav 	const char *ktype = sshkey_ssh_name(key);
244019261079SEd Maste 	const char *hostkeyalgs = options.hostkeyalgorithms;
2441d93a896eSDag-Erling Smørgrav 
2442535af610SEd Maste 	if (key->type == KEY_UNSPEC)
2443d93a896eSDag-Erling Smørgrav 		return 0;
2444d93a896eSDag-Erling Smørgrav 	if (key->type == KEY_RSA &&
2445d93a896eSDag-Erling Smørgrav 	    (match_pattern_list("rsa-sha2-256", hostkeyalgs, 0) == 1 ||
2446d93a896eSDag-Erling Smørgrav 	    match_pattern_list("rsa-sha2-512", hostkeyalgs, 0) == 1))
2447d93a896eSDag-Erling Smørgrav 		return 1;
2448d93a896eSDag-Erling Smørgrav 	return match_pattern_list(ktype, hostkeyalgs, 0) == 1;
2449d93a896eSDag-Erling Smørgrav }
2450d93a896eSDag-Erling Smørgrav 
2451d93a896eSDag-Erling Smørgrav /*
2452bc5531deSDag-Erling Smørgrav  * Handle hostkeys-00@openssh.com global request to inform the client of all
2453bc5531deSDag-Erling Smørgrav  * the server's hostkeys. The keys are checked against the user's
2454bc5531deSDag-Erling Smørgrav  * HostkeyAlgorithms preference before they are accepted.
2455bc5531deSDag-Erling Smørgrav  */
2456bc5531deSDag-Erling Smørgrav static int
245719261079SEd Maste client_input_hostkeys(struct ssh *ssh)
2458bc5531deSDag-Erling Smørgrav {
2459bc5531deSDag-Erling Smørgrav 	const u_char *blob = NULL;
2460bc5531deSDag-Erling Smørgrav 	size_t i, len = 0;
2461bc5531deSDag-Erling Smørgrav 	struct sshbuf *buf = NULL;
2462bc5531deSDag-Erling Smørgrav 	struct sshkey *key = NULL, **tmp;
2463f374ba41SEd Maste 	int r, prove_sent = 0;
2464bc5531deSDag-Erling Smørgrav 	char *fp;
2465bc5531deSDag-Erling Smørgrav 	static int hostkeys_seen = 0; /* XXX use struct ssh */
2466bc5531deSDag-Erling Smørgrav 	extern struct sockaddr_storage hostaddr; /* XXX from ssh.c */
2467bc5531deSDag-Erling Smørgrav 	struct hostkeys_update_ctx *ctx = NULL;
246819261079SEd Maste 	u_int want;
2469bc5531deSDag-Erling Smørgrav 
2470bc5531deSDag-Erling Smørgrav 	if (hostkeys_seen)
247119261079SEd Maste 		fatal_f("server already sent hostkeys");
2472f374ba41SEd Maste 	if (!can_update_hostkeys())
2473bc5531deSDag-Erling Smørgrav 		return 1;
2474f374ba41SEd Maste 	hostkeys_seen = 1;
2475bc5531deSDag-Erling Smørgrav 
2476bc5531deSDag-Erling Smørgrav 	ctx = xcalloc(1, sizeof(*ctx));
2477bc5531deSDag-Erling Smørgrav 	while (ssh_packet_remaining(ssh) > 0) {
2478bc5531deSDag-Erling Smørgrav 		sshkey_free(key);
2479bc5531deSDag-Erling Smørgrav 		key = NULL;
2480bc5531deSDag-Erling Smørgrav 		if ((r = sshpkt_get_string_direct(ssh, &blob, &len)) != 0) {
248119261079SEd Maste 			error_fr(r, "parse key");
2482bc5531deSDag-Erling Smørgrav 			goto out;
2483bc5531deSDag-Erling Smørgrav 		}
2484bc5531deSDag-Erling Smørgrav 		if ((r = sshkey_from_blob(blob, len, &key)) != 0) {
248519261079SEd Maste 			do_log2_fr(r, r == SSH_ERR_KEY_TYPE_UNKNOWN ?
248619261079SEd Maste 			    SYSLOG_LEVEL_DEBUG1 : SYSLOG_LEVEL_ERROR,
248719261079SEd Maste 			    "convert key");
248819261079SEd Maste 			continue;
2489bc5531deSDag-Erling Smørgrav 		}
2490bc5531deSDag-Erling Smørgrav 		fp = sshkey_fingerprint(key, options.fingerprint_hash,
2491bc5531deSDag-Erling Smørgrav 		    SSH_FP_DEFAULT);
249219261079SEd Maste 		debug3_f("received %s key %s", sshkey_type(key), fp);
2493bc5531deSDag-Erling Smørgrav 		free(fp);
2494eccfee6eSDag-Erling Smørgrav 
2495d93a896eSDag-Erling Smørgrav 		if (!key_accepted_by_hostkeyalgs(key)) {
249619261079SEd Maste 			debug3_f("%s key not permitted by "
249719261079SEd Maste 			    "HostkeyAlgorithms", sshkey_ssh_name(key));
2498bc5531deSDag-Erling Smørgrav 			continue;
2499bc5531deSDag-Erling Smørgrav 		}
2500bc5531deSDag-Erling Smørgrav 		/* Skip certs */
2501bc5531deSDag-Erling Smørgrav 		if (sshkey_is_cert(key)) {
250219261079SEd Maste 			debug3_f("%s key is a certificate; skipping",
250319261079SEd Maste 			    sshkey_ssh_name(key));
2504bc5531deSDag-Erling Smørgrav 			continue;
2505bc5531deSDag-Erling Smørgrav 		}
2506bc5531deSDag-Erling Smørgrav 		/* Ensure keys are unique */
2507bc5531deSDag-Erling Smørgrav 		for (i = 0; i < ctx->nkeys; i++) {
2508bc5531deSDag-Erling Smørgrav 			if (sshkey_equal(key, ctx->keys[i])) {
250919261079SEd Maste 				error_f("received duplicated %s host key",
251019261079SEd Maste 				    sshkey_ssh_name(key));
2511bc5531deSDag-Erling Smørgrav 				goto out;
2512bc5531deSDag-Erling Smørgrav 			}
2513bc5531deSDag-Erling Smørgrav 		}
2514bc5531deSDag-Erling Smørgrav 		/* Key is good, record it */
25154f52dfbbSDag-Erling Smørgrav 		if ((tmp = recallocarray(ctx->keys, ctx->nkeys, ctx->nkeys + 1,
2516bc5531deSDag-Erling Smørgrav 		    sizeof(*ctx->keys))) == NULL)
251719261079SEd Maste 			fatal_f("recallocarray failed nkeys = %zu",
251819261079SEd Maste 			    ctx->nkeys);
2519bc5531deSDag-Erling Smørgrav 		ctx->keys = tmp;
2520bc5531deSDag-Erling Smørgrav 		ctx->keys[ctx->nkeys++] = key;
2521bc5531deSDag-Erling Smørgrav 		key = NULL;
2522bc5531deSDag-Erling Smørgrav 	}
2523bc5531deSDag-Erling Smørgrav 
2524bc5531deSDag-Erling Smørgrav 	if (ctx->nkeys == 0) {
252519261079SEd Maste 		debug_f("server sent no hostkeys");
2526bc5531deSDag-Erling Smørgrav 		goto out;
2527bc5531deSDag-Erling Smørgrav 	}
2528bc5531deSDag-Erling Smørgrav 
252919261079SEd Maste 	if ((ctx->keys_match = calloc(ctx->nkeys,
253019261079SEd Maste 	    sizeof(*ctx->keys_match))) == NULL ||
253119261079SEd Maste 	    (ctx->keys_verified = calloc(ctx->nkeys,
253219261079SEd Maste 	    sizeof(*ctx->keys_verified))) == NULL)
253319261079SEd Maste 		fatal_f("calloc failed");
2534bc5531deSDag-Erling Smørgrav 
2535bc5531deSDag-Erling Smørgrav 	get_hostfile_hostname_ipaddr(host,
2536bc5531deSDag-Erling Smørgrav 	    options.check_host_ip ? (struct sockaddr *)&hostaddr : NULL,
2537bc5531deSDag-Erling Smørgrav 	    options.port, &ctx->host_str,
2538bc5531deSDag-Erling Smørgrav 	    options.check_host_ip ? &ctx->ip_str : NULL);
2539bc5531deSDag-Erling Smørgrav 
2540bc5531deSDag-Erling Smørgrav 	/* Find which keys we already know about. */
254119261079SEd Maste 	for (i = 0; i < options.num_user_hostfiles; i++) {
254219261079SEd Maste 		debug_f("searching %s for %s / %s",
254319261079SEd Maste 		    options.user_hostfiles[i], ctx->host_str,
254419261079SEd Maste 		    ctx->ip_str ? ctx->ip_str : "(none)");
254519261079SEd Maste 		if ((r = hostkeys_foreach(options.user_hostfiles[i],
254619261079SEd Maste 		    hostkeys_find, ctx, ctx->host_str, ctx->ip_str,
254719261079SEd Maste 		    HKF_WANT_PARSE_KEY, 0)) != 0) {
254819261079SEd Maste 			if (r == SSH_ERR_SYSTEM_ERROR && errno == ENOENT) {
254919261079SEd Maste 				debug_f("hostkeys file %s does not exist",
255019261079SEd Maste 				    options.user_hostfiles[i]);
255119261079SEd Maste 				continue;
255219261079SEd Maste 			}
255319261079SEd Maste 			error_fr(r, "hostkeys_foreach failed for %s",
255419261079SEd Maste 			    options.user_hostfiles[i]);
2555bc5531deSDag-Erling Smørgrav 			goto out;
2556bc5531deSDag-Erling Smørgrav 		}
255719261079SEd Maste 	}
2558bc5531deSDag-Erling Smørgrav 
2559bc5531deSDag-Erling Smørgrav 	/* Figure out if we have any new keys to add */
256019261079SEd Maste 	ctx->nnew = ctx->nincomplete = 0;
256119261079SEd Maste 	want = HKF_MATCH_HOST | ( options.check_host_ip ? HKF_MATCH_IP : 0);
2562bc5531deSDag-Erling Smørgrav 	for (i = 0; i < ctx->nkeys; i++) {
256319261079SEd Maste 		if (ctx->keys_match[i] == 0)
2564bc5531deSDag-Erling Smørgrav 			ctx->nnew++;
256519261079SEd Maste 		if ((ctx->keys_match[i] & want) != want)
256619261079SEd Maste 			ctx->nincomplete++;
2567bc5531deSDag-Erling Smørgrav 	}
2568bc5531deSDag-Erling Smørgrav 
256919261079SEd Maste 	debug3_f("%zu server keys: %zu new, %zu retained, "
257019261079SEd Maste 	    "%zu incomplete match. %zu to remove", ctx->nkeys, ctx->nnew,
257119261079SEd Maste 	    ctx->nkeys - ctx->nnew - ctx->nincomplete,
257219261079SEd Maste 	    ctx->nincomplete, ctx->nold);
2573bc5531deSDag-Erling Smørgrav 
257419261079SEd Maste 	if (ctx->nnew == 0 && ctx->nold == 0) {
257519261079SEd Maste 		debug_f("no new or deprecated keys from server");
257619261079SEd Maste 		goto out;
257719261079SEd Maste 	}
257819261079SEd Maste 
257919261079SEd Maste 	/* Various reasons why we cannot proceed with the update */
258019261079SEd Maste 	if (ctx->complex_hostspec) {
258119261079SEd Maste 		debug_f("CA/revocation marker, manual host list or wildcard "
258219261079SEd Maste 		    "host pattern found, skipping UserKnownHostsFile update");
258319261079SEd Maste 		goto out;
258419261079SEd Maste 	}
258519261079SEd Maste 	if (ctx->other_name_seen) {
258619261079SEd Maste 		debug_f("host key found matching a different name/address, "
258719261079SEd Maste 		    "skipping UserKnownHostsFile update");
258819261079SEd Maste 		goto out;
258919261079SEd Maste 	}
2590bc5531deSDag-Erling Smørgrav 	/*
259119261079SEd Maste 	 * If removing keys, check whether they appear under different
259219261079SEd Maste 	 * names/addresses and refuse to proceed if they do. This avoids
259319261079SEd Maste 	 * cases such as hosts with multiple names becoming inconsistent
259419261079SEd Maste 	 * with regards to CheckHostIP entries.
259519261079SEd Maste 	 * XXX UpdateHostkeys=force to override this (and other) checks?
259619261079SEd Maste 	 */
259719261079SEd Maste 	if (ctx->nold != 0) {
259819261079SEd Maste 		if (check_old_keys_othernames(ctx) != 0)
259919261079SEd Maste 			goto out; /* error already logged */
260019261079SEd Maste 		if (ctx->old_key_seen) {
260119261079SEd Maste 			debug_f("key(s) for %s%s%s exist under other names; "
260219261079SEd Maste 			    "skipping UserKnownHostsFile update",
260319261079SEd Maste 			    ctx->host_str, ctx->ip_str == NULL ? "" : ",",
260419261079SEd Maste 			    ctx->ip_str == NULL ? "" : ctx->ip_str);
260519261079SEd Maste 			goto out;
260619261079SEd Maste 		}
260719261079SEd Maste 	}
260819261079SEd Maste 
260919261079SEd Maste 	if (ctx->nnew == 0) {
261019261079SEd Maste 		/*
261119261079SEd Maste 		 * We have some keys to remove or fix matching for.
261219261079SEd Maste 		 * We can proceed to do this without requiring a fresh proof
261319261079SEd Maste 		 * from the server.
261419261079SEd Maste 		 */
261519261079SEd Maste 		update_known_hosts(ctx);
261619261079SEd Maste 		goto out;
261719261079SEd Maste 	}
261819261079SEd Maste 	/*
261919261079SEd Maste 	 * We have received previously-unseen keys from the server.
2620bc5531deSDag-Erling Smørgrav 	 * Ask the server to confirm ownership of the private halves.
2621bc5531deSDag-Erling Smørgrav 	 */
262219261079SEd Maste 	debug3_f("asking server to prove ownership for %zu keys", ctx->nnew);
2623bc5531deSDag-Erling Smørgrav 	if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 ||
2624bc5531deSDag-Erling Smørgrav 	    (r = sshpkt_put_cstring(ssh,
2625bc5531deSDag-Erling Smørgrav 	    "hostkeys-prove-00@openssh.com")) != 0 ||
2626bc5531deSDag-Erling Smørgrav 	    (r = sshpkt_put_u8(ssh, 1)) != 0) /* bool: want reply */
262719261079SEd Maste 		fatal_fr(r, "prepare hostkeys-prove");
2628bc5531deSDag-Erling Smørgrav 	if ((buf = sshbuf_new()) == NULL)
262919261079SEd Maste 		fatal_f("sshbuf_new");
2630bc5531deSDag-Erling Smørgrav 	for (i = 0; i < ctx->nkeys; i++) {
263119261079SEd Maste 		if (ctx->keys_match[i])
2632bc5531deSDag-Erling Smørgrav 			continue;
2633bc5531deSDag-Erling Smørgrav 		sshbuf_reset(buf);
263419261079SEd Maste 		if ((r = sshkey_putb(ctx->keys[i], buf)) != 0 ||
263519261079SEd Maste 		    (r = sshpkt_put_stringb(ssh, buf)) != 0)
263619261079SEd Maste 			fatal_fr(r, "assemble hostkeys-prove");
2637bc5531deSDag-Erling Smørgrav 	}
2638bc5531deSDag-Erling Smørgrav 	if ((r = sshpkt_send(ssh)) != 0)
263919261079SEd Maste 		fatal_fr(r, "send hostkeys-prove");
2640bc5531deSDag-Erling Smørgrav 	client_register_global_confirm(
2641f374ba41SEd Maste 	    client_global_hostkeys_prove_confirm, ctx);
2642bc5531deSDag-Erling Smørgrav 	ctx = NULL;  /* will be freed in callback */
2643f374ba41SEd Maste 	prove_sent = 1;
2644bc5531deSDag-Erling Smørgrav 
2645bc5531deSDag-Erling Smørgrav 	/* Success */
2646bc5531deSDag-Erling Smørgrav  out:
2647bc5531deSDag-Erling Smørgrav 	hostkeys_update_ctx_free(ctx);
2648bc5531deSDag-Erling Smørgrav 	sshkey_free(key);
2649bc5531deSDag-Erling Smørgrav 	sshbuf_free(buf);
2650f374ba41SEd Maste 	if (!prove_sent) {
2651f374ba41SEd Maste 		/* UpdateHostkeys handling completed */
2652f374ba41SEd Maste 		hostkeys_update_complete = 1;
2653f374ba41SEd Maste 		client_repledge();
2654f374ba41SEd Maste 	}
2655bc5531deSDag-Erling Smørgrav 	/*
2656bc5531deSDag-Erling Smørgrav 	 * NB. Return success for all cases. The server doesn't need to know
2657bc5531deSDag-Erling Smørgrav 	 * what the client does with its hosts file.
2658bc5531deSDag-Erling Smørgrav 	 */
2659bc5531deSDag-Erling Smørgrav 	return 1;
2660bc5531deSDag-Erling Smørgrav }
2661bc5531deSDag-Erling Smørgrav 
2662bc5531deSDag-Erling Smørgrav static int
26634f52dfbbSDag-Erling Smørgrav client_input_global_request(int type, u_int32_t seq, struct ssh *ssh)
2664ae1f160dSDag-Erling Smørgrav {
2665ae1f160dSDag-Erling Smørgrav 	char *rtype;
266619261079SEd Maste 	u_char want_reply;
266719261079SEd Maste 	int r, success = 0;
2668a04a10f8SKris Kennaway 
266919261079SEd Maste 	if ((r = sshpkt_get_cstring(ssh, &rtype, NULL)) != 0 ||
267019261079SEd Maste 	    (r = sshpkt_get_u8(ssh, &want_reply)) != 0)
267119261079SEd Maste 		goto out;
2672efcad6b7SDag-Erling Smørgrav 	debug("client_input_global_request: rtype %s want_reply %d",
2673efcad6b7SDag-Erling Smørgrav 	    rtype, want_reply);
2674bc5531deSDag-Erling Smørgrav 	if (strcmp(rtype, "hostkeys-00@openssh.com") == 0)
267519261079SEd Maste 		success = client_input_hostkeys(ssh);
2676ae1f160dSDag-Erling Smørgrav 	if (want_reply) {
267719261079SEd Maste 		if ((r = sshpkt_start(ssh, success ? SSH2_MSG_REQUEST_SUCCESS :
267819261079SEd Maste 		    SSH2_MSG_REQUEST_FAILURE)) != 0 ||
267919261079SEd Maste 		    (r = sshpkt_send(ssh)) != 0 ||
268019261079SEd Maste 		    (r = ssh_packet_write_wait(ssh)) != 0)
268119261079SEd Maste 			goto out;
2682ae1f160dSDag-Erling Smørgrav 	}
268319261079SEd Maste 	r = 0;
268419261079SEd Maste  out:
2685e4a9863fSDag-Erling Smørgrav 	free(rtype);
268619261079SEd Maste 	return r;
268719261079SEd Maste }
268819261079SEd Maste 
268919261079SEd Maste static void
269019261079SEd Maste client_send_env(struct ssh *ssh, int id, const char *name, const char *val)
269119261079SEd Maste {
269219261079SEd Maste 	int r;
269319261079SEd Maste 
269419261079SEd Maste 	debug("channel %d: setting env %s = \"%s\"", id, name, val);
269519261079SEd Maste 	channel_request_start(ssh, id, "env", 0);
269619261079SEd Maste 	if ((r = sshpkt_put_cstring(ssh, name)) != 0 ||
269719261079SEd Maste 	    (r = sshpkt_put_cstring(ssh, val)) != 0 ||
269819261079SEd Maste 	    (r = sshpkt_send(ssh)) != 0)
269919261079SEd Maste 		fatal_fr(r, "send setenv");
2700ae1f160dSDag-Erling Smørgrav }
2701ae1f160dSDag-Erling Smørgrav 
2702d74d50a8SDag-Erling Smørgrav void
27034f52dfbbSDag-Erling Smørgrav client_session2_setup(struct ssh *ssh, int id, int want_tty, int want_subsystem,
2704190cef3dSDag-Erling Smørgrav     const char *term, struct termios *tiop, int in_fd, struct sshbuf *cmd,
2705190cef3dSDag-Erling Smørgrav     char **env)
2706d74d50a8SDag-Erling Smørgrav {
270738a52bd3SEd Maste 	size_t i, j, len;
270838a52bd3SEd Maste 	int matched, r;
2709190cef3dSDag-Erling Smørgrav 	char *name, *val;
27105e8dbd04SDag-Erling Smørgrav 	Channel *c = NULL;
2711d74d50a8SDag-Erling Smørgrav 
271219261079SEd Maste 	debug2_f("id %d", id);
2713d74d50a8SDag-Erling Smørgrav 
27144f52dfbbSDag-Erling Smørgrav 	if ((c = channel_lookup(ssh, id)) == NULL)
271519261079SEd Maste 		fatal_f("channel %d: unknown channel", id);
27165e8dbd04SDag-Erling Smørgrav 
271719261079SEd Maste 	ssh_packet_set_interactive(ssh, want_tty,
27184a421b63SDag-Erling Smørgrav 	    options.ip_qos_interactive, options.ip_qos_bulk);
27194a421b63SDag-Erling Smørgrav 
2720d74d50a8SDag-Erling Smørgrav 	if (want_tty) {
2721d74d50a8SDag-Erling Smørgrav 		struct winsize ws;
2722d74d50a8SDag-Erling Smørgrav 
2723d74d50a8SDag-Erling Smørgrav 		/* Store window size in the packet. */
272419261079SEd Maste 		if (ioctl(in_fd, TIOCGWINSZ, &ws) == -1)
2725d74d50a8SDag-Erling Smørgrav 			memset(&ws, 0, sizeof(ws));
2726d74d50a8SDag-Erling Smørgrav 
27274f52dfbbSDag-Erling Smørgrav 		channel_request_start(ssh, id, "pty-req", 1);
27284f52dfbbSDag-Erling Smørgrav 		client_expect_confirm(ssh, id, "PTY allocation", CONFIRM_TTY);
272919261079SEd Maste 		if ((r = sshpkt_put_cstring(ssh, term != NULL ? term : ""))
273019261079SEd Maste 		    != 0 ||
273119261079SEd Maste 		    (r = sshpkt_put_u32(ssh, (u_int)ws.ws_col)) != 0 ||
273219261079SEd Maste 		    (r = sshpkt_put_u32(ssh, (u_int)ws.ws_row)) != 0 ||
273319261079SEd Maste 		    (r = sshpkt_put_u32(ssh, (u_int)ws.ws_xpixel)) != 0 ||
273419261079SEd Maste 		    (r = sshpkt_put_u32(ssh, (u_int)ws.ws_ypixel)) != 0)
273519261079SEd Maste 			fatal_fr(r, "build pty-req");
2736d4af9e69SDag-Erling Smørgrav 		if (tiop == NULL)
2737d4af9e69SDag-Erling Smørgrav 			tiop = get_saved_tio();
2738190cef3dSDag-Erling Smørgrav 		ssh_tty_make_modes(ssh, -1, tiop);
273919261079SEd Maste 		if ((r = sshpkt_send(ssh)) != 0)
274019261079SEd Maste 			fatal_fr(r, "send pty-req");
2741d74d50a8SDag-Erling Smørgrav 		/* XXX wait for reply */
27425e8dbd04SDag-Erling Smørgrav 		c->client_tty = 1;
2743d74d50a8SDag-Erling Smørgrav 	}
2744d74d50a8SDag-Erling Smørgrav 
2745d74d50a8SDag-Erling Smørgrav 	/* Transfer any environment variables from client to server */
2746d74d50a8SDag-Erling Smørgrav 	if (options.num_send_env != 0 && env != NULL) {
2747d74d50a8SDag-Erling Smørgrav 		debug("Sending environment.");
2748d74d50a8SDag-Erling Smørgrav 		for (i = 0; env[i] != NULL; i++) {
2749d74d50a8SDag-Erling Smørgrav 			/* Split */
2750d74d50a8SDag-Erling Smørgrav 			name = xstrdup(env[i]);
2751d74d50a8SDag-Erling Smørgrav 			if ((val = strchr(name, '=')) == NULL) {
2752e4a9863fSDag-Erling Smørgrav 				free(name);
2753d74d50a8SDag-Erling Smørgrav 				continue;
2754d74d50a8SDag-Erling Smørgrav 			}
2755d74d50a8SDag-Erling Smørgrav 			*val++ = '\0';
2756d74d50a8SDag-Erling Smørgrav 
2757d74d50a8SDag-Erling Smørgrav 			matched = 0;
2758d74d50a8SDag-Erling Smørgrav 			for (j = 0; j < options.num_send_env; j++) {
2759d74d50a8SDag-Erling Smørgrav 				if (match_pattern(name, options.send_env[j])) {
2760d74d50a8SDag-Erling Smørgrav 					matched = 1;
2761d74d50a8SDag-Erling Smørgrav 					break;
2762d74d50a8SDag-Erling Smørgrav 				}
2763d74d50a8SDag-Erling Smørgrav 			}
2764d74d50a8SDag-Erling Smørgrav 			if (!matched) {
2765d74d50a8SDag-Erling Smørgrav 				debug3("Ignored env %s", name);
2766e4a9863fSDag-Erling Smørgrav 				free(name);
2767d74d50a8SDag-Erling Smørgrav 				continue;
2768d74d50a8SDag-Erling Smørgrav 			}
276919261079SEd Maste 			client_send_env(ssh, id, name, val);
2770e4a9863fSDag-Erling Smørgrav 			free(name);
2771d74d50a8SDag-Erling Smørgrav 		}
2772d74d50a8SDag-Erling Smørgrav 	}
2773190cef3dSDag-Erling Smørgrav 	for (i = 0; i < options.num_setenv; i++) {
2774190cef3dSDag-Erling Smørgrav 		/* Split */
2775190cef3dSDag-Erling Smørgrav 		name = xstrdup(options.setenv[i]);
2776190cef3dSDag-Erling Smørgrav 		if ((val = strchr(name, '=')) == NULL) {
2777190cef3dSDag-Erling Smørgrav 			free(name);
2778190cef3dSDag-Erling Smørgrav 			continue;
2779190cef3dSDag-Erling Smørgrav 		}
2780190cef3dSDag-Erling Smørgrav 		*val++ = '\0';
278119261079SEd Maste 		client_send_env(ssh, id, name, val);
2782190cef3dSDag-Erling Smørgrav 		free(name);
2783190cef3dSDag-Erling Smørgrav 	}
2784190cef3dSDag-Erling Smørgrav 
2785190cef3dSDag-Erling Smørgrav 	len = sshbuf_len(cmd);
2786d74d50a8SDag-Erling Smørgrav 	if (len > 0) {
2787d74d50a8SDag-Erling Smørgrav 		if (len > 900)
2788d74d50a8SDag-Erling Smørgrav 			len = 900;
2789d74d50a8SDag-Erling Smørgrav 		if (want_subsystem) {
2790d4af9e69SDag-Erling Smørgrav 			debug("Sending subsystem: %.*s",
279138a52bd3SEd Maste 			    (int)len, (const u_char*)sshbuf_ptr(cmd));
27924f52dfbbSDag-Erling Smørgrav 			channel_request_start(ssh, id, "subsystem", 1);
27934f52dfbbSDag-Erling Smørgrav 			client_expect_confirm(ssh, id, "subsystem",
27944f52dfbbSDag-Erling Smørgrav 			    CONFIRM_CLOSE);
2795d74d50a8SDag-Erling Smørgrav 		} else {
2796d4af9e69SDag-Erling Smørgrav 			debug("Sending command: %.*s",
279738a52bd3SEd Maste 			    (int)len, (const u_char*)sshbuf_ptr(cmd));
27984f52dfbbSDag-Erling Smørgrav 			channel_request_start(ssh, id, "exec", 1);
27994f52dfbbSDag-Erling Smørgrav 			client_expect_confirm(ssh, id, "exec", CONFIRM_CLOSE);
2800d74d50a8SDag-Erling Smørgrav 		}
280119261079SEd Maste 		if ((r = sshpkt_put_stringb(ssh, cmd)) != 0 ||
280219261079SEd Maste 		    (r = sshpkt_send(ssh)) != 0)
280319261079SEd Maste 			fatal_fr(r, "send command");
2804d74d50a8SDag-Erling Smørgrav 	} else {
28054f52dfbbSDag-Erling Smørgrav 		channel_request_start(ssh, id, "shell", 1);
28064f52dfbbSDag-Erling Smørgrav 		client_expect_confirm(ssh, id, "shell", CONFIRM_CLOSE);
280719261079SEd Maste 		if ((r = sshpkt_send(ssh)) != 0)
280819261079SEd Maste 			fatal_fr(r, "send shell");
2809d74d50a8SDag-Erling Smørgrav 	}
2810f374ba41SEd Maste 
2811f374ba41SEd Maste 	session_setup_complete = 1;
2812f374ba41SEd Maste 	client_repledge();
2813d74d50a8SDag-Erling Smørgrav }
2814d74d50a8SDag-Erling Smørgrav 
2815ae1f160dSDag-Erling Smørgrav static void
281619261079SEd Maste client_init_dispatch(struct ssh *ssh)
2817a04a10f8SKris Kennaway {
281819261079SEd Maste 	ssh_dispatch_init(ssh, &dispatch_protocol_error);
2819545d5ecaSDag-Erling Smørgrav 
282019261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_CLOSE, &channel_input_oclose);
282119261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_DATA, &channel_input_data);
282219261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_EOF, &channel_input_ieof);
282319261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_EXTENDED_DATA, &channel_input_extended_data);
282419261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_OPEN, &client_input_channel_open);
282519261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation);
282619261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure);
282719261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_REQUEST, &client_input_channel_req);
282819261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust);
282919261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_SUCCESS, &channel_input_status_confirm);
283019261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_FAILURE, &channel_input_status_confirm);
283119261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_GLOBAL_REQUEST, &client_input_global_request);
28321e8db6e2SBrian Feldman 
28331e8db6e2SBrian Feldman 	/* rekeying */
283419261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_input_kexinit);
2835545d5ecaSDag-Erling Smørgrav 
2836545d5ecaSDag-Erling Smørgrav 	/* global request reply messages */
283719261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_REQUEST_FAILURE, &client_global_request_reply);
283819261079SEd Maste 	ssh_dispatch_set(ssh, SSH2_MSG_REQUEST_SUCCESS, &client_global_request_reply);
2839a04a10f8SKris Kennaway }
2840d4af9e69SDag-Erling Smørgrav 
2841e146993eSDag-Erling Smørgrav void
2842e146993eSDag-Erling Smørgrav client_stop_mux(void)
2843e146993eSDag-Erling Smørgrav {
2844e146993eSDag-Erling Smørgrav 	if (options.control_path != NULL && muxserver_sock != -1)
2845e146993eSDag-Erling Smørgrav 		unlink(options.control_path);
2846e146993eSDag-Erling Smørgrav 	/*
28476888a9beSDag-Erling Smørgrav 	 * If we are in persist mode, or don't have a shell, signal that we
28486888a9beSDag-Erling Smørgrav 	 * should close when all active channels are closed.
2849e146993eSDag-Erling Smørgrav 	 */
285019261079SEd Maste 	if (options.control_persist || options.session_type == SESSION_TYPE_NONE) {
2851e146993eSDag-Erling Smørgrav 		session_closed = 1;
2852e146993eSDag-Erling Smørgrav 		setproctitle("[stopped mux]");
2853e146993eSDag-Erling Smørgrav 	}
2854e146993eSDag-Erling Smørgrav }
2855e146993eSDag-Erling Smørgrav 
2856efcad6b7SDag-Erling Smørgrav /* client specific fatal cleanup */
2857efcad6b7SDag-Erling Smørgrav void
2858efcad6b7SDag-Erling Smørgrav cleanup_exit(int i)
2859efcad6b7SDag-Erling Smørgrav {
2860e146993eSDag-Erling Smørgrav 	leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
2861d4af9e69SDag-Erling Smørgrav 	if (options.control_path != NULL && muxserver_sock != -1)
2862d74d50a8SDag-Erling Smørgrav 		unlink(options.control_path);
28634a421b63SDag-Erling Smørgrav 	ssh_kill_proxy_command();
2864efcad6b7SDag-Erling Smørgrav 	_exit(i);
2865efcad6b7SDag-Erling Smørgrav }
2866