1*a0ee8cc6SDag-Erling Smørgrav /* $OpenBSD: serverloop.c,v 1.172 2014/07/15 15:54:14 millert Exp $ */ 2511b41d2SMark Murray /* 3511b41d2SMark Murray * Author: Tatu Ylonen <ylo@cs.hut.fi> 4511b41d2SMark Murray * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5511b41d2SMark Murray * All rights reserved 6511b41d2SMark Murray * Server main loop for handling the interactive session. 7b66f2d16SKris Kennaway * 8b66f2d16SKris Kennaway * As far as I am concerned, the code I have written for this software 9b66f2d16SKris Kennaway * can be used freely for any purpose. Any derived versions of this 10b66f2d16SKris Kennaway * software must be clearly marked as such, and if the derived work is 11b66f2d16SKris Kennaway * incompatible with the protocol description in the RFC file, it must be 12b66f2d16SKris Kennaway * called by a name other than "ssh" or "Secure Shell". 13b66f2d16SKris Kennaway * 14a04a10f8SKris Kennaway * SSH2 support by Markus Friedl. 15af12a3e7SDag-Erling Smørgrav * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 16b66f2d16SKris Kennaway * 17b66f2d16SKris Kennaway * Redistribution and use in source and binary forms, with or without 18b66f2d16SKris Kennaway * modification, are permitted provided that the following conditions 19b66f2d16SKris Kennaway * are met: 20b66f2d16SKris Kennaway * 1. Redistributions of source code must retain the above copyright 21b66f2d16SKris Kennaway * notice, this list of conditions and the following disclaimer. 22b66f2d16SKris Kennaway * 2. Redistributions in binary form must reproduce the above copyright 23b66f2d16SKris Kennaway * notice, this list of conditions and the following disclaimer in the 24b66f2d16SKris Kennaway * documentation and/or other materials provided with the distribution. 25b66f2d16SKris Kennaway * 26b66f2d16SKris Kennaway * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 27b66f2d16SKris Kennaway * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 28b66f2d16SKris Kennaway * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 29b66f2d16SKris Kennaway * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 30b66f2d16SKris Kennaway * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 31b66f2d16SKris Kennaway * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 32b66f2d16SKris Kennaway * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 33b66f2d16SKris Kennaway * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 34b66f2d16SKris Kennaway * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 35b66f2d16SKris Kennaway * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 36a04a10f8SKris Kennaway */ 37511b41d2SMark Murray 38511b41d2SMark Murray #include "includes.h" 39cf783db1SDag-Erling Smørgrav __RCSID("$FreeBSD$"); 40333ee039SDag-Erling Smørgrav 41333ee039SDag-Erling Smørgrav #include <sys/types.h> 42333ee039SDag-Erling Smørgrav #include <sys/param.h> 43333ee039SDag-Erling Smørgrav #include <sys/wait.h> 44333ee039SDag-Erling Smørgrav #include <sys/socket.h> 45333ee039SDag-Erling Smørgrav #ifdef HAVE_SYS_TIME_H 46333ee039SDag-Erling Smørgrav # include <sys/time.h> 47333ee039SDag-Erling Smørgrav #endif 48333ee039SDag-Erling Smørgrav 49333ee039SDag-Erling Smørgrav #include <netinet/in.h> 50333ee039SDag-Erling Smørgrav 51333ee039SDag-Erling Smørgrav #include <errno.h> 52333ee039SDag-Erling Smørgrav #include <fcntl.h> 53333ee039SDag-Erling Smørgrav #include <pwd.h> 54333ee039SDag-Erling Smørgrav #include <signal.h> 55333ee039SDag-Erling Smørgrav #include <string.h> 56333ee039SDag-Erling Smørgrav #include <termios.h> 57333ee039SDag-Erling Smørgrav #include <unistd.h> 58333ee039SDag-Erling Smørgrav #include <stdarg.h> 595b9b2fafSBrian Feldman 60d4af9e69SDag-Erling Smørgrav #include "openbsd-compat/sys-queue.h" 61511b41d2SMark Murray #include "xmalloc.h" 62511b41d2SMark Murray #include "packet.h" 63511b41d2SMark Murray #include "buffer.h" 64ca3176e7SBrian Feldman #include "log.h" 65*a0ee8cc6SDag-Erling Smørgrav #include "misc.h" 66511b41d2SMark Murray #include "servconf.h" 67f388f5efSDag-Erling Smørgrav #include "canohost.h" 68ca3176e7SBrian Feldman #include "sshpty.h" 69a04a10f8SKris Kennaway #include "channels.h" 70a04a10f8SKris Kennaway #include "compat.h" 71ca3176e7SBrian Feldman #include "ssh1.h" 72a04a10f8SKris Kennaway #include "ssh2.h" 73333ee039SDag-Erling Smørgrav #include "key.h" 74333ee039SDag-Erling Smørgrav #include "cipher.h" 75333ee039SDag-Erling Smørgrav #include "kex.h" 76333ee039SDag-Erling Smørgrav #include "hostfile.h" 77ca3176e7SBrian Feldman #include "auth.h" 78a04a10f8SKris Kennaway #include "session.h" 79a04a10f8SKris Kennaway #include "dispatch.h" 80b66f2d16SKris Kennaway #include "auth-options.h" 81ca3176e7SBrian Feldman #include "serverloop.h" 827aee6ffeSDag-Erling Smørgrav #include "roaming.h" 83511b41d2SMark Murray 845b9b2fafSBrian Feldman extern ServerOptions options; 855b9b2fafSBrian Feldman 86ca3176e7SBrian Feldman /* XXX */ 87ca3176e7SBrian Feldman extern Kex *xxx_kex; 881ec0d754SDag-Erling Smørgrav extern Authctxt *the_authctxt; 89b74df5b2SDag-Erling Smørgrav extern int use_privsep; 90ca3176e7SBrian Feldman 91511b41d2SMark Murray static Buffer stdin_buffer; /* Buffer for stdin data. */ 92511b41d2SMark Murray static Buffer stdout_buffer; /* Buffer for stdout data. */ 93511b41d2SMark Murray static Buffer stderr_buffer; /* Buffer for stderr data. */ 94511b41d2SMark Murray static int fdin; /* Descriptor for stdin (for writing) */ 95511b41d2SMark Murray static int fdout; /* Descriptor for stdout (for reading); 96511b41d2SMark Murray May be same number as fdin. */ 97511b41d2SMark Murray static int fderr; /* Descriptor for stderr. May be -1. */ 98511b41d2SMark Murray static long stdin_bytes = 0; /* Number of bytes written to stdin. */ 99511b41d2SMark Murray static long stdout_bytes = 0; /* Number of stdout bytes sent to client. */ 100511b41d2SMark Murray static long stderr_bytes = 0; /* Number of stderr bytes sent to client. */ 101511b41d2SMark Murray static long fdout_bytes = 0; /* Number of stdout bytes read from program. */ 102511b41d2SMark Murray static int stdin_eof = 0; /* EOF message received from client. */ 103511b41d2SMark Murray static int fdout_eof = 0; /* EOF encountered reading from fdout. */ 104511b41d2SMark Murray static int fderr_eof = 0; /* EOF encountered readung from fderr. */ 105e0fbb1d2SBrian Feldman static int fdin_is_tty = 0; /* fdin points to a tty. */ 106511b41d2SMark Murray static int connection_in; /* Connection to client (input). */ 107511b41d2SMark Murray static int connection_out; /* Connection to client (output). */ 108ca3176e7SBrian Feldman static int connection_closed = 0; /* Connection to client closed. */ 109ca3176e7SBrian Feldman static u_int buffer_high; /* "Soft" max buffer size. */ 110d4af9e69SDag-Erling Smørgrav static int no_more_sessions = 0; /* Disallow further sessions. */ 111511b41d2SMark Murray 112511b41d2SMark Murray /* 113511b41d2SMark Murray * This SIGCHLD kludge is used to detect when the child exits. The server 114511b41d2SMark Murray * will exit after that, as soon as forwarded connections have terminated. 115511b41d2SMark Murray */ 116511b41d2SMark Murray 117af12a3e7SDag-Erling Smørgrav static volatile sig_atomic_t child_terminated = 0; /* The child has terminated. */ 118511b41d2SMark Murray 119b74df5b2SDag-Erling Smørgrav /* Cleanup on signals (!use_privsep case only) */ 120b74df5b2SDag-Erling Smørgrav static volatile sig_atomic_t received_sigterm = 0; 121b74df5b2SDag-Erling Smørgrav 122af12a3e7SDag-Erling Smørgrav /* prototypes */ 123af12a3e7SDag-Erling Smørgrav static void server_init_dispatch(void); 124a04a10f8SKris Kennaway 125af12a3e7SDag-Erling Smørgrav /* 126af12a3e7SDag-Erling Smørgrav * we write to this pipe if a SIGCHLD is caught in order to avoid 127af12a3e7SDag-Erling Smørgrav * the race between select() and child_terminated 128af12a3e7SDag-Erling Smørgrav */ 129af12a3e7SDag-Erling Smørgrav static int notify_pipe[2]; 130af12a3e7SDag-Erling Smørgrav static void 131af12a3e7SDag-Erling Smørgrav notify_setup(void) 132af12a3e7SDag-Erling Smørgrav { 133af12a3e7SDag-Erling Smørgrav if (pipe(notify_pipe) < 0) { 134af12a3e7SDag-Erling Smørgrav error("pipe(notify_pipe) failed %s", strerror(errno)); 135e146993eSDag-Erling Smørgrav } else if ((fcntl(notify_pipe[0], F_SETFD, FD_CLOEXEC) == -1) || 136e146993eSDag-Erling Smørgrav (fcntl(notify_pipe[1], F_SETFD, FD_CLOEXEC) == -1)) { 137af12a3e7SDag-Erling Smørgrav error("fcntl(notify_pipe, F_SETFD) failed %s", strerror(errno)); 138af12a3e7SDag-Erling Smørgrav close(notify_pipe[0]); 139af12a3e7SDag-Erling Smørgrav close(notify_pipe[1]); 140af12a3e7SDag-Erling Smørgrav } else { 141af12a3e7SDag-Erling Smørgrav set_nonblock(notify_pipe[0]); 142af12a3e7SDag-Erling Smørgrav set_nonblock(notify_pipe[1]); 143af12a3e7SDag-Erling Smørgrav return; 144af12a3e7SDag-Erling Smørgrav } 145af12a3e7SDag-Erling Smørgrav notify_pipe[0] = -1; /* read end */ 146af12a3e7SDag-Erling Smørgrav notify_pipe[1] = -1; /* write end */ 147af12a3e7SDag-Erling Smørgrav } 148af12a3e7SDag-Erling Smørgrav static void 149af12a3e7SDag-Erling Smørgrav notify_parent(void) 150af12a3e7SDag-Erling Smørgrav { 151af12a3e7SDag-Erling Smørgrav if (notify_pipe[1] != -1) 152e4a9863fSDag-Erling Smørgrav (void)write(notify_pipe[1], "", 1); 153af12a3e7SDag-Erling Smørgrav } 154af12a3e7SDag-Erling Smørgrav static void 155af12a3e7SDag-Erling Smørgrav notify_prepare(fd_set *readset) 156af12a3e7SDag-Erling Smørgrav { 157af12a3e7SDag-Erling Smørgrav if (notify_pipe[0] != -1) 158af12a3e7SDag-Erling Smørgrav FD_SET(notify_pipe[0], readset); 159af12a3e7SDag-Erling Smørgrav } 160af12a3e7SDag-Erling Smørgrav static void 161af12a3e7SDag-Erling Smørgrav notify_done(fd_set *readset) 162af12a3e7SDag-Erling Smørgrav { 163af12a3e7SDag-Erling Smørgrav char c; 164ca3176e7SBrian Feldman 165af12a3e7SDag-Erling Smørgrav if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) 166af12a3e7SDag-Erling Smørgrav while (read(notify_pipe[0], &c, 1) != -1) 167af12a3e7SDag-Erling Smørgrav debug2("notify_done: reading"); 168af12a3e7SDag-Erling Smørgrav } 169af12a3e7SDag-Erling Smørgrav 170333ee039SDag-Erling Smørgrav /*ARGSUSED*/ 171af12a3e7SDag-Erling Smørgrav static void 172511b41d2SMark Murray sigchld_handler(int sig) 173511b41d2SMark Murray { 174511b41d2SMark Murray int save_errno = errno; 175511b41d2SMark Murray child_terminated = 1; 176f388f5efSDag-Erling Smørgrav #ifndef _UNICOS 177989dd127SDag-Erling Smørgrav mysignal(SIGCHLD, sigchld_handler); 178f388f5efSDag-Erling Smørgrav #endif 179af12a3e7SDag-Erling Smørgrav notify_parent(); 180a04a10f8SKris Kennaway errno = save_errno; 181511b41d2SMark Murray } 182511b41d2SMark Murray 183333ee039SDag-Erling Smørgrav /*ARGSUSED*/ 184b74df5b2SDag-Erling Smørgrav static void 185b74df5b2SDag-Erling Smørgrav sigterm_handler(int sig) 186b74df5b2SDag-Erling Smørgrav { 187b74df5b2SDag-Erling Smørgrav received_sigterm = sig; 188b74df5b2SDag-Erling Smørgrav } 189b74df5b2SDag-Erling Smørgrav 190511b41d2SMark Murray /* 191511b41d2SMark Murray * Make packets from buffered stderr data, and buffer it for sending 192511b41d2SMark Murray * to the client. 193511b41d2SMark Murray */ 194af12a3e7SDag-Erling Smørgrav static void 195ca3176e7SBrian Feldman make_packets_from_stderr_data(void) 196511b41d2SMark Murray { 197cf2b5f3bSDag-Erling Smørgrav u_int len; 198511b41d2SMark Murray 199511b41d2SMark Murray /* Send buffered stderr data to the client. */ 200511b41d2SMark Murray while (buffer_len(&stderr_buffer) > 0 && 201511b41d2SMark Murray packet_not_very_much_data_to_write()) { 202511b41d2SMark Murray len = buffer_len(&stderr_buffer); 203511b41d2SMark Murray if (packet_is_interactive()) { 204511b41d2SMark Murray if (len > 512) 205511b41d2SMark Murray len = 512; 206511b41d2SMark Murray } else { 207511b41d2SMark Murray /* Keep the packets at reasonable size. */ 208511b41d2SMark Murray if (len > packet_get_maxsize()) 209511b41d2SMark Murray len = packet_get_maxsize(); 210511b41d2SMark Murray } 211511b41d2SMark Murray packet_start(SSH_SMSG_STDERR_DATA); 212511b41d2SMark Murray packet_put_string(buffer_ptr(&stderr_buffer), len); 213511b41d2SMark Murray packet_send(); 214511b41d2SMark Murray buffer_consume(&stderr_buffer, len); 215511b41d2SMark Murray stderr_bytes += len; 216511b41d2SMark Murray } 217511b41d2SMark Murray } 218511b41d2SMark Murray 219511b41d2SMark Murray /* 220511b41d2SMark Murray * Make packets from buffered stdout data, and buffer it for sending to the 221511b41d2SMark Murray * client. 222511b41d2SMark Murray */ 223af12a3e7SDag-Erling Smørgrav static void 224ca3176e7SBrian Feldman make_packets_from_stdout_data(void) 225511b41d2SMark Murray { 226cf2b5f3bSDag-Erling Smørgrav u_int len; 227511b41d2SMark Murray 228511b41d2SMark Murray /* Send buffered stdout data to the client. */ 229511b41d2SMark Murray while (buffer_len(&stdout_buffer) > 0 && 230511b41d2SMark Murray packet_not_very_much_data_to_write()) { 231511b41d2SMark Murray len = buffer_len(&stdout_buffer); 232511b41d2SMark Murray if (packet_is_interactive()) { 233511b41d2SMark Murray if (len > 512) 234511b41d2SMark Murray len = 512; 235511b41d2SMark Murray } else { 236511b41d2SMark Murray /* Keep the packets at reasonable size. */ 237511b41d2SMark Murray if (len > packet_get_maxsize()) 238511b41d2SMark Murray len = packet_get_maxsize(); 239511b41d2SMark Murray } 240511b41d2SMark Murray packet_start(SSH_SMSG_STDOUT_DATA); 241511b41d2SMark Murray packet_put_string(buffer_ptr(&stdout_buffer), len); 242511b41d2SMark Murray packet_send(); 243511b41d2SMark Murray buffer_consume(&stdout_buffer, len); 244511b41d2SMark Murray stdout_bytes += len; 245511b41d2SMark Murray } 246511b41d2SMark Murray } 247511b41d2SMark Murray 248af12a3e7SDag-Erling Smørgrav static void 249af12a3e7SDag-Erling Smørgrav client_alive_check(void) 250af12a3e7SDag-Erling Smørgrav { 2511ec0d754SDag-Erling Smørgrav int channel_id; 252af12a3e7SDag-Erling Smørgrav 253af12a3e7SDag-Erling Smørgrav /* timeout, check to see how many we have had */ 2547aee6ffeSDag-Erling Smørgrav if (packet_inc_alive_timeouts() > options.client_alive_count_max) { 25562efe23aSDag-Erling Smørgrav logit("Timeout, client not responding."); 25662efe23aSDag-Erling Smørgrav cleanup_exit(255); 25762efe23aSDag-Erling Smørgrav } 258af12a3e7SDag-Erling Smørgrav 259af12a3e7SDag-Erling Smørgrav /* 2601ec0d754SDag-Erling Smørgrav * send a bogus global/channel request with "wantreply", 261af12a3e7SDag-Erling Smørgrav * we should get back a failure 262af12a3e7SDag-Erling Smørgrav */ 2631ec0d754SDag-Erling Smørgrav if ((channel_id = channel_find_open()) == -1) { 2641ec0d754SDag-Erling Smørgrav packet_start(SSH2_MSG_GLOBAL_REQUEST); 2651ec0d754SDag-Erling Smørgrav packet_put_cstring("keepalive@openssh.com"); 2661ec0d754SDag-Erling Smørgrav packet_put_char(1); /* boolean: want reply */ 2671ec0d754SDag-Erling Smørgrav } else { 2681ec0d754SDag-Erling Smørgrav channel_request_start(channel_id, "keepalive@openssh.com", 1); 2691ec0d754SDag-Erling Smørgrav } 270af12a3e7SDag-Erling Smørgrav packet_send(); 271af12a3e7SDag-Erling Smørgrav } 272af12a3e7SDag-Erling Smørgrav 273511b41d2SMark Murray /* 274511b41d2SMark Murray * Sleep in select() until we can do something. This will initialize the 275511b41d2SMark Murray * select masks. Upon return, the masks will indicate which descriptors 276511b41d2SMark Murray * have data or can accept data. Optionally, a maximum time can be specified 277511b41d2SMark Murray * for the duration of the wait (0 = infinite). 278511b41d2SMark Murray */ 279af12a3e7SDag-Erling Smørgrav static void 280ca3176e7SBrian Feldman wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp, int *maxfdp, 281e4a9863fSDag-Erling Smørgrav u_int *nallocp, u_int64_t max_time_milliseconds) 282511b41d2SMark Murray { 283511b41d2SMark Murray struct timeval tv, *tvp; 284511b41d2SMark Murray int ret; 285462c32cbSDag-Erling Smørgrav time_t minwait_secs = 0; 286ca3176e7SBrian Feldman int client_alive_scheduled = 0; 287d4af9e69SDag-Erling Smørgrav int program_alive_scheduled = 0; 288ca3176e7SBrian Feldman 289462c32cbSDag-Erling Smørgrav /* Allocate and update select() masks for channel descriptors. */ 290462c32cbSDag-Erling Smørgrav channel_prepare_select(readsetp, writesetp, maxfdp, nallocp, 291462c32cbSDag-Erling Smørgrav &minwait_secs, 0); 292462c32cbSDag-Erling Smørgrav 293462c32cbSDag-Erling Smørgrav if (minwait_secs != 0) 294462c32cbSDag-Erling Smørgrav max_time_milliseconds = MIN(max_time_milliseconds, 295462c32cbSDag-Erling Smørgrav (u_int)minwait_secs * 1000); 296462c32cbSDag-Erling Smørgrav 297ca3176e7SBrian Feldman /* 298ca3176e7SBrian Feldman * if using client_alive, set the max timeout accordingly, 299ca3176e7SBrian Feldman * and indicate that this particular timeout was for client 300ca3176e7SBrian Feldman * alive by setting the client_alive_scheduled flag. 301ca3176e7SBrian Feldman * 302ca3176e7SBrian Feldman * this could be randomized somewhat to make traffic 303ca3176e7SBrian Feldman * analysis more difficult, but we're not doing it yet. 304ca3176e7SBrian Feldman */ 305af12a3e7SDag-Erling Smørgrav if (compat20 && 306af12a3e7SDag-Erling Smørgrav max_time_milliseconds == 0 && options.client_alive_interval) { 307ca3176e7SBrian Feldman client_alive_scheduled = 1; 308f7167e0eSDag-Erling Smørgrav max_time_milliseconds = 309f7167e0eSDag-Erling Smørgrav (u_int64_t)options.client_alive_interval * 1000; 310af12a3e7SDag-Erling Smørgrav } 311511b41d2SMark Murray 312a04a10f8SKris Kennaway if (compat20) { 313af12a3e7SDag-Erling Smørgrav #if 0 314a04a10f8SKris Kennaway /* wrong: bad condition XXX */ 315a04a10f8SKris Kennaway if (channel_not_very_much_buffered_data()) 316af12a3e7SDag-Erling Smørgrav #endif 317ca3176e7SBrian Feldman FD_SET(connection_in, *readsetp); 318a04a10f8SKris Kennaway } else { 3192632b0c8SKris Kennaway /* 3202632b0c8SKris Kennaway * Read packets from the client unless we have too much 3212632b0c8SKris Kennaway * buffered stdin or channel data. 3222632b0c8SKris Kennaway */ 3232632b0c8SKris Kennaway if (buffer_len(&stdin_buffer) < buffer_high && 324511b41d2SMark Murray channel_not_very_much_buffered_data()) 325ca3176e7SBrian Feldman FD_SET(connection_in, *readsetp); 326511b41d2SMark Murray /* 3272632b0c8SKris Kennaway * If there is not too much data already buffered going to 3282632b0c8SKris Kennaway * the client, try to get some more data from the program. 329511b41d2SMark Murray */ 3302632b0c8SKris Kennaway if (packet_not_very_much_data_to_write()) { 331d4af9e69SDag-Erling Smørgrav program_alive_scheduled = child_terminated; 332511b41d2SMark Murray if (!fdout_eof) 333ca3176e7SBrian Feldman FD_SET(fdout, *readsetp); 334511b41d2SMark Murray if (!fderr_eof) 335ca3176e7SBrian Feldman FD_SET(fderr, *readsetp); 336511b41d2SMark Murray } 3372632b0c8SKris Kennaway /* 3382632b0c8SKris Kennaway * If we have buffered data, try to write some of that data 3392632b0c8SKris Kennaway * to the program. 3402632b0c8SKris Kennaway */ 3412632b0c8SKris Kennaway if (fdin != -1 && buffer_len(&stdin_buffer) > 0) 342ca3176e7SBrian Feldman FD_SET(fdin, *writesetp); 3432632b0c8SKris Kennaway } 344af12a3e7SDag-Erling Smørgrav notify_prepare(*readsetp); 345511b41d2SMark Murray 346511b41d2SMark Murray /* 347511b41d2SMark Murray * If we have buffered packet data going to the client, mark that 348511b41d2SMark Murray * descriptor. 349511b41d2SMark Murray */ 350511b41d2SMark Murray if (packet_have_data_to_write()) 351ca3176e7SBrian Feldman FD_SET(connection_out, *writesetp); 352511b41d2SMark Murray 353511b41d2SMark Murray /* 354511b41d2SMark Murray * If child has terminated and there is enough buffer space to read 355511b41d2SMark Murray * from it, then read as much as is available and exit. 356511b41d2SMark Murray */ 357511b41d2SMark Murray if (child_terminated && packet_not_very_much_data_to_write()) 358ca3176e7SBrian Feldman if (max_time_milliseconds == 0 || client_alive_scheduled) 359511b41d2SMark Murray max_time_milliseconds = 100; 360511b41d2SMark Murray 361511b41d2SMark Murray if (max_time_milliseconds == 0) 362511b41d2SMark Murray tvp = NULL; 363511b41d2SMark Murray else { 364511b41d2SMark Murray tv.tv_sec = max_time_milliseconds / 1000; 365511b41d2SMark Murray tv.tv_usec = 1000 * (max_time_milliseconds % 1000); 366511b41d2SMark Murray tvp = &tv; 367511b41d2SMark Murray } 368511b41d2SMark Murray 369511b41d2SMark Murray /* Wait for something to happen, or the timeout to expire. */ 370ca3176e7SBrian Feldman ret = select((*maxfdp)+1, *readsetp, *writesetp, NULL, tvp); 371511b41d2SMark Murray 372ca3176e7SBrian Feldman if (ret == -1) { 373af12a3e7SDag-Erling Smørgrav memset(*readsetp, 0, *nallocp); 374af12a3e7SDag-Erling Smørgrav memset(*writesetp, 0, *nallocp); 375511b41d2SMark Murray if (errno != EINTR) 376511b41d2SMark Murray error("select: %.100s", strerror(errno)); 377d4af9e69SDag-Erling Smørgrav } else { 378d4af9e69SDag-Erling Smørgrav if (ret == 0 && client_alive_scheduled) 379af12a3e7SDag-Erling Smørgrav client_alive_check(); 380d4af9e69SDag-Erling Smørgrav if (!compat20 && program_alive_scheduled && fdin_is_tty) { 381d4af9e69SDag-Erling Smørgrav if (!fdout_eof) 382d4af9e69SDag-Erling Smørgrav FD_SET(fdout, *readsetp); 383d4af9e69SDag-Erling Smørgrav if (!fderr_eof) 384d4af9e69SDag-Erling Smørgrav FD_SET(fderr, *readsetp); 385d4af9e69SDag-Erling Smørgrav } 386d4af9e69SDag-Erling Smørgrav } 387ca3176e7SBrian Feldman 388af12a3e7SDag-Erling Smørgrav notify_done(*readsetp); 389511b41d2SMark Murray } 390511b41d2SMark Murray 391511b41d2SMark Murray /* 392511b41d2SMark Murray * Processes input from the client and the program. Input data is stored 393511b41d2SMark Murray * in buffers and processed later. 394511b41d2SMark Murray */ 395af12a3e7SDag-Erling Smørgrav static void 396511b41d2SMark Murray process_input(fd_set *readset) 397511b41d2SMark Murray { 398511b41d2SMark Murray int len; 399511b41d2SMark Murray char buf[16384]; 400511b41d2SMark Murray 401511b41d2SMark Murray /* Read and buffer any input data from the client. */ 402511b41d2SMark Murray if (FD_ISSET(connection_in, readset)) { 4037aee6ffeSDag-Erling Smørgrav int cont = 0; 4047aee6ffeSDag-Erling Smørgrav len = roaming_read(connection_in, buf, sizeof(buf), &cont); 405511b41d2SMark Murray if (len == 0) { 4067aee6ffeSDag-Erling Smørgrav if (cont) 4077aee6ffeSDag-Erling Smørgrav return; 408f388f5efSDag-Erling Smørgrav verbose("Connection closed by %.100s", 409f388f5efSDag-Erling Smørgrav get_remote_ipaddr()); 410ca3176e7SBrian Feldman connection_closed = 1; 411ca3176e7SBrian Feldman if (compat20) 412ca3176e7SBrian Feldman return; 4131ec0d754SDag-Erling Smørgrav cleanup_exit(255); 4142632b0c8SKris Kennaway } else if (len < 0) { 415d4af9e69SDag-Erling Smørgrav if (errno != EINTR && errno != EAGAIN && 416d4af9e69SDag-Erling Smørgrav errno != EWOULDBLOCK) { 417f388f5efSDag-Erling Smørgrav verbose("Read error from remote host " 418f388f5efSDag-Erling Smørgrav "%.100s: %.100s", 419f388f5efSDag-Erling Smørgrav get_remote_ipaddr(), strerror(errno)); 4201ec0d754SDag-Erling Smørgrav cleanup_exit(255); 421511b41d2SMark Murray } 4222632b0c8SKris Kennaway } else { 423511b41d2SMark Murray /* Buffer any received data. */ 424511b41d2SMark Murray packet_process_incoming(buf, len); 425511b41d2SMark Murray } 4262632b0c8SKris Kennaway } 427a04a10f8SKris Kennaway if (compat20) 428a04a10f8SKris Kennaway return; 429a04a10f8SKris Kennaway 430511b41d2SMark Murray /* Read and buffer any available stdout data from the program. */ 431511b41d2SMark Murray if (!fdout_eof && FD_ISSET(fdout, readset)) { 432333ee039SDag-Erling Smørgrav errno = 0; 433511b41d2SMark Murray len = read(fdout, buf, sizeof(buf)); 434d4af9e69SDag-Erling Smørgrav if (len < 0 && (errno == EINTR || ((errno == EAGAIN || 435d4af9e69SDag-Erling Smørgrav errno == EWOULDBLOCK) && !child_terminated))) { 4362632b0c8SKris Kennaway /* do nothing */ 437333ee039SDag-Erling Smørgrav #ifndef PTY_ZEROREAD 4382632b0c8SKris Kennaway } else if (len <= 0) { 439333ee039SDag-Erling Smørgrav #else 440333ee039SDag-Erling Smørgrav } else if ((!isatty(fdout) && len <= 0) || 441333ee039SDag-Erling Smørgrav (isatty(fdout) && (len < 0 || (len == 0 && errno != 0)))) { 442333ee039SDag-Erling Smørgrav #endif 443511b41d2SMark Murray fdout_eof = 1; 4442632b0c8SKris Kennaway } else { 445511b41d2SMark Murray buffer_append(&stdout_buffer, buf, len); 446511b41d2SMark Murray fdout_bytes += len; 447511b41d2SMark Murray } 448511b41d2SMark Murray } 449511b41d2SMark Murray /* Read and buffer any available stderr data from the program. */ 450511b41d2SMark Murray if (!fderr_eof && FD_ISSET(fderr, readset)) { 451333ee039SDag-Erling Smørgrav errno = 0; 452511b41d2SMark Murray len = read(fderr, buf, sizeof(buf)); 453d4af9e69SDag-Erling Smørgrav if (len < 0 && (errno == EINTR || ((errno == EAGAIN || 454d4af9e69SDag-Erling Smørgrav errno == EWOULDBLOCK) && !child_terminated))) { 4552632b0c8SKris Kennaway /* do nothing */ 456333ee039SDag-Erling Smørgrav #ifndef PTY_ZEROREAD 4572632b0c8SKris Kennaway } else if (len <= 0) { 458333ee039SDag-Erling Smørgrav #else 459333ee039SDag-Erling Smørgrav } else if ((!isatty(fderr) && len <= 0) || 460333ee039SDag-Erling Smørgrav (isatty(fderr) && (len < 0 || (len == 0 && errno != 0)))) { 461333ee039SDag-Erling Smørgrav #endif 462511b41d2SMark Murray fderr_eof = 1; 4632632b0c8SKris Kennaway } else { 464511b41d2SMark Murray buffer_append(&stderr_buffer, buf, len); 465511b41d2SMark Murray } 466511b41d2SMark Murray } 4672632b0c8SKris Kennaway } 468511b41d2SMark Murray 469511b41d2SMark Murray /* 470511b41d2SMark Murray * Sends data from internal buffers to client program stdin. 471511b41d2SMark Murray */ 472af12a3e7SDag-Erling Smørgrav static void 473511b41d2SMark Murray process_output(fd_set *writeset) 474511b41d2SMark Murray { 475e0fbb1d2SBrian Feldman struct termios tio; 476af12a3e7SDag-Erling Smørgrav u_char *data; 477af12a3e7SDag-Erling Smørgrav u_int dlen; 478511b41d2SMark Murray int len; 479511b41d2SMark Murray 480511b41d2SMark Murray /* Write buffered data to program stdin. */ 481a04a10f8SKris Kennaway if (!compat20 && fdin != -1 && FD_ISSET(fdin, writeset)) { 482af12a3e7SDag-Erling Smørgrav data = buffer_ptr(&stdin_buffer); 483af12a3e7SDag-Erling Smørgrav dlen = buffer_len(&stdin_buffer); 484af12a3e7SDag-Erling Smørgrav len = write(fdin, data, dlen); 485d4af9e69SDag-Erling Smørgrav if (len < 0 && 486d4af9e69SDag-Erling Smørgrav (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)) { 4872632b0c8SKris Kennaway /* do nothing */ 4882632b0c8SKris Kennaway } else if (len <= 0) { 489a04a10f8SKris Kennaway if (fdin != fdout) 490511b41d2SMark Murray close(fdin); 491511b41d2SMark Murray else 492511b41d2SMark Murray shutdown(fdin, SHUT_WR); /* We will no longer send. */ 493511b41d2SMark Murray fdin = -1; 494511b41d2SMark Murray } else { 495e0fbb1d2SBrian Feldman /* Successful write. */ 496af12a3e7SDag-Erling Smørgrav if (fdin_is_tty && dlen >= 1 && data[0] != '\r' && 497af12a3e7SDag-Erling Smørgrav tcgetattr(fdin, &tio) == 0 && 498e0fbb1d2SBrian Feldman !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) { 499e0fbb1d2SBrian Feldman /* 500e0fbb1d2SBrian Feldman * Simulate echo to reduce the impact of 501e0fbb1d2SBrian Feldman * traffic analysis 502e0fbb1d2SBrian Feldman */ 503ca3176e7SBrian Feldman packet_send_ignore(len); 504e0fbb1d2SBrian Feldman packet_send(); 505e0fbb1d2SBrian Feldman } 506e0fbb1d2SBrian Feldman /* Consume the data from the buffer. */ 507511b41d2SMark Murray buffer_consume(&stdin_buffer, len); 508511b41d2SMark Murray /* Update the count of bytes written to the program. */ 509511b41d2SMark Murray stdin_bytes += len; 510511b41d2SMark Murray } 511511b41d2SMark Murray } 512511b41d2SMark Murray /* Send any buffered packet data to the client. */ 513511b41d2SMark Murray if (FD_ISSET(connection_out, writeset)) 514511b41d2SMark Murray packet_write_poll(); 515511b41d2SMark Murray } 516511b41d2SMark Murray 517511b41d2SMark Murray /* 518511b41d2SMark Murray * Wait until all buffered output has been sent to the client. 519511b41d2SMark Murray * This is used when the program terminates. 520511b41d2SMark Murray */ 521af12a3e7SDag-Erling Smørgrav static void 522ca3176e7SBrian Feldman drain_output(void) 523511b41d2SMark Murray { 524511b41d2SMark Murray /* Send any buffered stdout data to the client. */ 525511b41d2SMark Murray if (buffer_len(&stdout_buffer) > 0) { 526511b41d2SMark Murray packet_start(SSH_SMSG_STDOUT_DATA); 527511b41d2SMark Murray packet_put_string(buffer_ptr(&stdout_buffer), 528511b41d2SMark Murray buffer_len(&stdout_buffer)); 529511b41d2SMark Murray packet_send(); 530511b41d2SMark Murray /* Update the count of sent bytes. */ 531511b41d2SMark Murray stdout_bytes += buffer_len(&stdout_buffer); 532511b41d2SMark Murray } 533511b41d2SMark Murray /* Send any buffered stderr data to the client. */ 534511b41d2SMark Murray if (buffer_len(&stderr_buffer) > 0) { 535511b41d2SMark Murray packet_start(SSH_SMSG_STDERR_DATA); 536511b41d2SMark Murray packet_put_string(buffer_ptr(&stderr_buffer), 537511b41d2SMark Murray buffer_len(&stderr_buffer)); 538511b41d2SMark Murray packet_send(); 539511b41d2SMark Murray /* Update the count of sent bytes. */ 540511b41d2SMark Murray stderr_bytes += buffer_len(&stderr_buffer); 541511b41d2SMark Murray } 542511b41d2SMark Murray /* Wait until all buffered data has been written to the client. */ 543511b41d2SMark Murray packet_write_wait(); 544511b41d2SMark Murray } 545511b41d2SMark Murray 546af12a3e7SDag-Erling Smørgrav static void 547ca3176e7SBrian Feldman process_buffered_input_packets(void) 548a04a10f8SKris Kennaway { 549ca3176e7SBrian Feldman dispatch_run(DISPATCH_NONBLOCK, NULL, compat20 ? xxx_kex : NULL); 550a04a10f8SKris Kennaway } 551a04a10f8SKris Kennaway 552511b41d2SMark Murray /* 553511b41d2SMark Murray * Performs the interactive session. This handles data transmission between 554511b41d2SMark Murray * the client and the program. Note that the notion of stdin, stdout, and 555511b41d2SMark Murray * stderr in this function is sort of reversed: this function writes to 556511b41d2SMark Murray * stdin (of the child program), and reads from stdout and stderr (of the 557511b41d2SMark Murray * child program). 558511b41d2SMark Murray */ 559511b41d2SMark Murray void 560a04a10f8SKris Kennaway server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg) 561511b41d2SMark Murray { 562ca3176e7SBrian Feldman fd_set *readset = NULL, *writeset = NULL; 56321e764dfSDag-Erling Smørgrav int max_fd = 0; 56421e764dfSDag-Erling Smørgrav u_int nalloc = 0; 565a04a10f8SKris Kennaway int wait_status; /* Status returned by wait(). */ 566a04a10f8SKris Kennaway pid_t wait_pid; /* pid returned by wait(). */ 567511b41d2SMark Murray int waiting_termination = 0; /* Have displayed waiting close message. */ 568e4a9863fSDag-Erling Smørgrav u_int64_t max_time_milliseconds; 569ca3176e7SBrian Feldman u_int previous_stdout_buffer_bytes; 570ca3176e7SBrian Feldman u_int stdout_buffer_bytes; 571511b41d2SMark Murray int type; 572511b41d2SMark Murray 573511b41d2SMark Murray debug("Entering interactive session."); 574511b41d2SMark Murray 575511b41d2SMark Murray /* Initialize the SIGCHLD kludge. */ 576511b41d2SMark Murray child_terminated = 0; 577989dd127SDag-Erling Smørgrav mysignal(SIGCHLD, sigchld_handler); 578511b41d2SMark Murray 579b74df5b2SDag-Erling Smørgrav if (!use_privsep) { 580b74df5b2SDag-Erling Smørgrav signal(SIGTERM, sigterm_handler); 581b74df5b2SDag-Erling Smørgrav signal(SIGINT, sigterm_handler); 582b74df5b2SDag-Erling Smørgrav signal(SIGQUIT, sigterm_handler); 583b74df5b2SDag-Erling Smørgrav } 584b74df5b2SDag-Erling Smørgrav 585511b41d2SMark Murray /* Initialize our global variables. */ 586511b41d2SMark Murray fdin = fdin_arg; 587511b41d2SMark Murray fdout = fdout_arg; 588511b41d2SMark Murray fderr = fderr_arg; 5892632b0c8SKris Kennaway 5902632b0c8SKris Kennaway /* nonblocking IO */ 5912632b0c8SKris Kennaway set_nonblock(fdin); 5922632b0c8SKris Kennaway set_nonblock(fdout); 5932632b0c8SKris Kennaway /* we don't have stderr for interactive terminal sessions, see below */ 5942632b0c8SKris Kennaway if (fderr != -1) 5952632b0c8SKris Kennaway set_nonblock(fderr); 5962632b0c8SKris Kennaway 597e0fbb1d2SBrian Feldman if (!(datafellows & SSH_BUG_IGNOREMSG) && isatty(fdin)) 598e0fbb1d2SBrian Feldman fdin_is_tty = 1; 599e0fbb1d2SBrian Feldman 600511b41d2SMark Murray connection_in = packet_get_connection_in(); 601511b41d2SMark Murray connection_out = packet_get_connection_out(); 602511b41d2SMark Murray 603af12a3e7SDag-Erling Smørgrav notify_setup(); 604af12a3e7SDag-Erling Smørgrav 605511b41d2SMark Murray previous_stdout_buffer_bytes = 0; 606511b41d2SMark Murray 607511b41d2SMark Murray /* Set approximate I/O buffer size. */ 608511b41d2SMark Murray if (packet_is_interactive()) 609511b41d2SMark Murray buffer_high = 4096; 610511b41d2SMark Murray else 611511b41d2SMark Murray buffer_high = 64 * 1024; 612511b41d2SMark Murray 613af12a3e7SDag-Erling Smørgrav #if 0 614511b41d2SMark Murray /* Initialize max_fd to the maximum of the known file descriptors. */ 615af12a3e7SDag-Erling Smørgrav max_fd = MAX(connection_in, connection_out); 616af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, fdin); 617af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, fdout); 618ca3176e7SBrian Feldman if (fderr != -1) 619ca3176e7SBrian Feldman max_fd = MAX(max_fd, fderr); 620af12a3e7SDag-Erling Smørgrav #endif 621511b41d2SMark Murray 622511b41d2SMark Murray /* Initialize Initialize buffers. */ 623511b41d2SMark Murray buffer_init(&stdin_buffer); 624511b41d2SMark Murray buffer_init(&stdout_buffer); 625511b41d2SMark Murray buffer_init(&stderr_buffer); 626511b41d2SMark Murray 627511b41d2SMark Murray /* 628511b41d2SMark Murray * If we have no separate fderr (which is the case when we have a pty 629511b41d2SMark Murray * - there we cannot make difference between data sent to stdout and 630511b41d2SMark Murray * stderr), indicate that we have seen an EOF from stderr. This way 631b74df5b2SDag-Erling Smørgrav * we don't need to check the descriptor everywhere. 632511b41d2SMark Murray */ 633511b41d2SMark Murray if (fderr == -1) 634511b41d2SMark Murray fderr_eof = 1; 635511b41d2SMark Murray 636a04a10f8SKris Kennaway server_init_dispatch(); 637a04a10f8SKris Kennaway 638511b41d2SMark Murray /* Main loop of the server for the interactive session mode. */ 639511b41d2SMark Murray for (;;) { 640511b41d2SMark Murray 641511b41d2SMark Murray /* Process buffered packets from the client. */ 642511b41d2SMark Murray process_buffered_input_packets(); 643511b41d2SMark Murray 644511b41d2SMark Murray /* 645511b41d2SMark Murray * If we have received eof, and there is no more pending 646511b41d2SMark Murray * input data, cause a real eof by closing fdin. 647511b41d2SMark Murray */ 648511b41d2SMark Murray if (stdin_eof && fdin != -1 && buffer_len(&stdin_buffer) == 0) { 649a04a10f8SKris Kennaway if (fdin != fdout) 650511b41d2SMark Murray close(fdin); 651511b41d2SMark Murray else 652511b41d2SMark Murray shutdown(fdin, SHUT_WR); /* We will no longer send. */ 653511b41d2SMark Murray fdin = -1; 654511b41d2SMark Murray } 655511b41d2SMark Murray /* Make packets from buffered stderr data to send to the client. */ 656511b41d2SMark Murray make_packets_from_stderr_data(); 657511b41d2SMark Murray 658511b41d2SMark Murray /* 659511b41d2SMark Murray * Make packets from buffered stdout data to send to the 660511b41d2SMark Murray * client. If there is very little to send, this arranges to 661511b41d2SMark Murray * not send them now, but to wait a short while to see if we 662511b41d2SMark Murray * are getting more data. This is necessary, as some systems 663511b41d2SMark Murray * wake up readers from a pty after each separate character. 664511b41d2SMark Murray */ 665511b41d2SMark Murray max_time_milliseconds = 0; 666511b41d2SMark Murray stdout_buffer_bytes = buffer_len(&stdout_buffer); 667511b41d2SMark Murray if (stdout_buffer_bytes != 0 && stdout_buffer_bytes < 256 && 668511b41d2SMark Murray stdout_buffer_bytes != previous_stdout_buffer_bytes) { 669511b41d2SMark Murray /* try again after a while */ 670511b41d2SMark Murray max_time_milliseconds = 10; 671511b41d2SMark Murray } else { 672511b41d2SMark Murray /* Send it now. */ 673511b41d2SMark Murray make_packets_from_stdout_data(); 674511b41d2SMark Murray } 675511b41d2SMark Murray previous_stdout_buffer_bytes = buffer_len(&stdout_buffer); 676511b41d2SMark Murray 677511b41d2SMark Murray /* Send channel data to the client. */ 678511b41d2SMark Murray if (packet_not_very_much_data_to_write()) 679511b41d2SMark Murray channel_output_poll(); 680511b41d2SMark Murray 681511b41d2SMark Murray /* 682511b41d2SMark Murray * Bail out of the loop if the program has closed its output 683511b41d2SMark Murray * descriptors, and we have no more data to send to the 684511b41d2SMark Murray * client, and there is no pending buffered data. 685511b41d2SMark Murray */ 686511b41d2SMark Murray if (fdout_eof && fderr_eof && !packet_have_data_to_write() && 687511b41d2SMark Murray buffer_len(&stdout_buffer) == 0 && buffer_len(&stderr_buffer) == 0) { 688511b41d2SMark Murray if (!channel_still_open()) 689a04a10f8SKris Kennaway break; 690511b41d2SMark Murray if (!waiting_termination) { 691511b41d2SMark Murray const char *s = "Waiting for forwarded connections to terminate...\r\n"; 692511b41d2SMark Murray char *cp; 693511b41d2SMark Murray waiting_termination = 1; 694511b41d2SMark Murray buffer_append(&stderr_buffer, s, strlen(s)); 695511b41d2SMark Murray 696511b41d2SMark Murray /* Display list of open channels. */ 697511b41d2SMark Murray cp = channel_open_message(); 698511b41d2SMark Murray buffer_append(&stderr_buffer, cp, strlen(cp)); 699e4a9863fSDag-Erling Smørgrav free(cp); 700511b41d2SMark Murray } 701511b41d2SMark Murray } 702af12a3e7SDag-Erling Smørgrav max_fd = MAX(connection_in, connection_out); 703af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, fdin); 704af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, fdout); 705af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, fderr); 706af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, notify_pipe[0]); 707af12a3e7SDag-Erling Smørgrav 708511b41d2SMark Murray /* Sleep in select() until we can do something. */ 709ca3176e7SBrian Feldman wait_until_can_do_something(&readset, &writeset, &max_fd, 710af12a3e7SDag-Erling Smørgrav &nalloc, max_time_milliseconds); 711511b41d2SMark Murray 712b74df5b2SDag-Erling Smørgrav if (received_sigterm) { 7136888a9beSDag-Erling Smørgrav logit("Exiting on signal %d", (int)received_sigterm); 714b74df5b2SDag-Erling Smørgrav /* Clean up sessions, utmp, etc. */ 715b74df5b2SDag-Erling Smørgrav cleanup_exit(255); 716b74df5b2SDag-Erling Smørgrav } 717b74df5b2SDag-Erling Smørgrav 718511b41d2SMark Murray /* Process any channel events. */ 719ca3176e7SBrian Feldman channel_after_select(readset, writeset); 720511b41d2SMark Murray 721511b41d2SMark Murray /* Process input from the client and from program stdout/stderr. */ 722ca3176e7SBrian Feldman process_input(readset); 723511b41d2SMark Murray 724511b41d2SMark Murray /* Process output to the client and to program stdin. */ 725ca3176e7SBrian Feldman process_output(writeset); 726511b41d2SMark Murray } 727e4a9863fSDag-Erling Smørgrav free(readset); 728e4a9863fSDag-Erling Smørgrav free(writeset); 729511b41d2SMark Murray 730511b41d2SMark Murray /* Cleanup and termination code. */ 731511b41d2SMark Murray 732511b41d2SMark Murray /* Wait until all output has been sent to the client. */ 733511b41d2SMark Murray drain_output(); 734511b41d2SMark Murray 735462c32cbSDag-Erling Smørgrav debug("End of interactive session; stdin %ld, stdout (read %ld, sent %ld), stderr %ld bytes.", 736511b41d2SMark Murray stdin_bytes, fdout_bytes, stdout_bytes, stderr_bytes); 737511b41d2SMark Murray 738511b41d2SMark Murray /* Free and clear the buffers. */ 739511b41d2SMark Murray buffer_free(&stdin_buffer); 740511b41d2SMark Murray buffer_free(&stdout_buffer); 741511b41d2SMark Murray buffer_free(&stderr_buffer); 742511b41d2SMark Murray 743511b41d2SMark Murray /* Close the file descriptors. */ 744511b41d2SMark Murray if (fdout != -1) 745511b41d2SMark Murray close(fdout); 746511b41d2SMark Murray fdout = -1; 747511b41d2SMark Murray fdout_eof = 1; 748511b41d2SMark Murray if (fderr != -1) 749511b41d2SMark Murray close(fderr); 750511b41d2SMark Murray fderr = -1; 751511b41d2SMark Murray fderr_eof = 1; 752511b41d2SMark Murray if (fdin != -1) 753511b41d2SMark Murray close(fdin); 754511b41d2SMark Murray fdin = -1; 755511b41d2SMark Murray 756af12a3e7SDag-Erling Smørgrav channel_free_all(); 757511b41d2SMark Murray 758511b41d2SMark Murray /* We no longer want our SIGCHLD handler to be called. */ 759989dd127SDag-Erling Smørgrav mysignal(SIGCHLD, SIG_DFL); 760511b41d2SMark Murray 76180628bacSDag-Erling Smørgrav while ((wait_pid = waitpid(-1, &wait_status, 0)) < 0) 76280628bacSDag-Erling Smørgrav if (errno != EINTR) 763af12a3e7SDag-Erling Smørgrav packet_disconnect("wait: %.100s", strerror(errno)); 76480628bacSDag-Erling Smørgrav if (wait_pid != pid) 76580628bacSDag-Erling Smørgrav error("Strange, wait returned pid %ld, expected %ld", 76680628bacSDag-Erling Smørgrav (long)wait_pid, (long)pid); 767af12a3e7SDag-Erling Smørgrav 768511b41d2SMark Murray /* Check if it exited normally. */ 769511b41d2SMark Murray if (WIFEXITED(wait_status)) { 770511b41d2SMark Murray /* Yes, normal exit. Get exit status and send it to the client. */ 771511b41d2SMark Murray debug("Command exited with status %d.", WEXITSTATUS(wait_status)); 772511b41d2SMark Murray packet_start(SSH_SMSG_EXITSTATUS); 773511b41d2SMark Murray packet_put_int(WEXITSTATUS(wait_status)); 774511b41d2SMark Murray packet_send(); 775511b41d2SMark Murray packet_write_wait(); 776511b41d2SMark Murray 777511b41d2SMark Murray /* 778511b41d2SMark Murray * Wait for exit confirmation. Note that there might be 779511b41d2SMark Murray * other packets coming before it; however, the program has 780511b41d2SMark Murray * already died so we just ignore them. The client is 781511b41d2SMark Murray * supposed to respond with the confirmation when it receives 782511b41d2SMark Murray * the exit status. 783511b41d2SMark Murray */ 784511b41d2SMark Murray do { 785af12a3e7SDag-Erling Smørgrav type = packet_read(); 786511b41d2SMark Murray } 787511b41d2SMark Murray while (type != SSH_CMSG_EXIT_CONFIRMATION); 788511b41d2SMark Murray 789511b41d2SMark Murray debug("Received exit confirmation."); 790511b41d2SMark Murray return; 791511b41d2SMark Murray } 792511b41d2SMark Murray /* Check if the program terminated due to a signal. */ 793511b41d2SMark Murray if (WIFSIGNALED(wait_status)) 794511b41d2SMark Murray packet_disconnect("Command terminated on signal %d.", 795511b41d2SMark Murray WTERMSIG(wait_status)); 796511b41d2SMark Murray 797511b41d2SMark Murray /* Some weird exit cause. Just exit. */ 798511b41d2SMark Murray packet_disconnect("wait returned status %04x.", wait_status); 799511b41d2SMark Murray /* NOTREACHED */ 800511b41d2SMark Murray } 801a04a10f8SKris Kennaway 802af12a3e7SDag-Erling Smørgrav static void 803af12a3e7SDag-Erling Smørgrav collect_children(void) 804af12a3e7SDag-Erling Smørgrav { 805af12a3e7SDag-Erling Smørgrav pid_t pid; 806af12a3e7SDag-Erling Smørgrav sigset_t oset, nset; 807af12a3e7SDag-Erling Smørgrav int status; 808af12a3e7SDag-Erling Smørgrav 809af12a3e7SDag-Erling Smørgrav /* block SIGCHLD while we check for dead children */ 810af12a3e7SDag-Erling Smørgrav sigemptyset(&nset); 811af12a3e7SDag-Erling Smørgrav sigaddset(&nset, SIGCHLD); 812af12a3e7SDag-Erling Smørgrav sigprocmask(SIG_BLOCK, &nset, &oset); 813af12a3e7SDag-Erling Smørgrav if (child_terminated) { 814333ee039SDag-Erling Smørgrav debug("Received SIGCHLD."); 81580628bacSDag-Erling Smørgrav while ((pid = waitpid(-1, &status, WNOHANG)) > 0 || 81680628bacSDag-Erling Smørgrav (pid < 0 && errno == EINTR)) 81780628bacSDag-Erling Smørgrav if (pid > 0) 818af12a3e7SDag-Erling Smørgrav session_close_by_pid(pid, status); 819af12a3e7SDag-Erling Smørgrav child_terminated = 0; 820af12a3e7SDag-Erling Smørgrav } 821af12a3e7SDag-Erling Smørgrav sigprocmask(SIG_SETMASK, &oset, NULL); 822af12a3e7SDag-Erling Smørgrav } 823af12a3e7SDag-Erling Smørgrav 824a04a10f8SKris Kennaway void 825af12a3e7SDag-Erling Smørgrav server_loop2(Authctxt *authctxt) 826a04a10f8SKris Kennaway { 827ca3176e7SBrian Feldman fd_set *readset = NULL, *writeset = NULL; 828e4a9863fSDag-Erling Smørgrav int rekeying = 0, max_fd; 829e4a9863fSDag-Erling Smørgrav u_int nalloc = 0; 830e4a9863fSDag-Erling Smørgrav u_int64_t rekey_timeout_ms = 0; 831a04a10f8SKris Kennaway 832a04a10f8SKris Kennaway debug("Entering interactive session for SSH2."); 833a04a10f8SKris Kennaway 834989dd127SDag-Erling Smørgrav mysignal(SIGCHLD, sigchld_handler); 835a04a10f8SKris Kennaway child_terminated = 0; 836a04a10f8SKris Kennaway connection_in = packet_get_connection_in(); 837a04a10f8SKris Kennaway connection_out = packet_get_connection_out(); 838ca3176e7SBrian Feldman 839b74df5b2SDag-Erling Smørgrav if (!use_privsep) { 840b74df5b2SDag-Erling Smørgrav signal(SIGTERM, sigterm_handler); 841b74df5b2SDag-Erling Smørgrav signal(SIGINT, sigterm_handler); 842b74df5b2SDag-Erling Smørgrav signal(SIGQUIT, sigterm_handler); 843b74df5b2SDag-Erling Smørgrav } 844b74df5b2SDag-Erling Smørgrav 845af12a3e7SDag-Erling Smørgrav notify_setup(); 846af12a3e7SDag-Erling Smørgrav 847ca3176e7SBrian Feldman max_fd = MAX(connection_in, connection_out); 848af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, notify_pipe[0]); 849af12a3e7SDag-Erling Smørgrav 850a04a10f8SKris Kennaway server_init_dispatch(); 851a04a10f8SKris Kennaway 852a04a10f8SKris Kennaway for (;;) { 853a04a10f8SKris Kennaway process_buffered_input_packets(); 854ca3176e7SBrian Feldman 855ca3176e7SBrian Feldman rekeying = (xxx_kex != NULL && !xxx_kex->done); 856ca3176e7SBrian Feldman 857ca3176e7SBrian Feldman if (!rekeying && packet_not_very_much_data_to_write()) 858a04a10f8SKris Kennaway channel_output_poll(); 859e4a9863fSDag-Erling Smørgrav if (options.rekey_interval > 0 && compat20 && !rekeying) 860e4a9863fSDag-Erling Smørgrav rekey_timeout_ms = packet_get_rekey_timeout() * 1000; 861e4a9863fSDag-Erling Smørgrav else 862e4a9863fSDag-Erling Smørgrav rekey_timeout_ms = 0; 863e4a9863fSDag-Erling Smørgrav 864ca3176e7SBrian Feldman wait_until_can_do_something(&readset, &writeset, &max_fd, 865e4a9863fSDag-Erling Smørgrav &nalloc, rekey_timeout_ms); 866af12a3e7SDag-Erling Smørgrav 867b74df5b2SDag-Erling Smørgrav if (received_sigterm) { 8686888a9beSDag-Erling Smørgrav logit("Exiting on signal %d", (int)received_sigterm); 869b74df5b2SDag-Erling Smørgrav /* Clean up sessions, utmp, etc. */ 870b74df5b2SDag-Erling Smørgrav cleanup_exit(255); 871b74df5b2SDag-Erling Smørgrav } 872b74df5b2SDag-Erling Smørgrav 873af12a3e7SDag-Erling Smørgrav collect_children(); 874cf2b5f3bSDag-Erling Smørgrav if (!rekeying) { 875ca3176e7SBrian Feldman channel_after_select(readset, writeset); 876cf2b5f3bSDag-Erling Smørgrav if (packet_need_rekeying()) { 877cf2b5f3bSDag-Erling Smørgrav debug("need rekeying"); 878cf2b5f3bSDag-Erling Smørgrav xxx_kex->done = 0; 879cf2b5f3bSDag-Erling Smørgrav kex_send_kexinit(xxx_kex); 880cf2b5f3bSDag-Erling Smørgrav } 881cf2b5f3bSDag-Erling Smørgrav } 882ca3176e7SBrian Feldman process_input(readset); 883ca3176e7SBrian Feldman if (connection_closed) 884ca3176e7SBrian Feldman break; 885ca3176e7SBrian Feldman process_output(writeset); 886a04a10f8SKris Kennaway } 887af12a3e7SDag-Erling Smørgrav collect_children(); 888af12a3e7SDag-Erling Smørgrav 889e4a9863fSDag-Erling Smørgrav free(readset); 890e4a9863fSDag-Erling Smørgrav free(writeset); 891ca3176e7SBrian Feldman 892af12a3e7SDag-Erling Smørgrav /* free all channels, no more reads and writes */ 893af12a3e7SDag-Erling Smørgrav channel_free_all(); 894af12a3e7SDag-Erling Smørgrav 895af12a3e7SDag-Erling Smørgrav /* free remaining sessions, e.g. remove wtmp entries */ 89680628bacSDag-Erling Smørgrav session_destroy_all(NULL); 897a04a10f8SKris Kennaway } 898a04a10f8SKris Kennaway 899af12a3e7SDag-Erling Smørgrav static void 9001ec0d754SDag-Erling Smørgrav server_input_keep_alive(int type, u_int32_t seq, void *ctxt) 901ca3176e7SBrian Feldman { 9021ec0d754SDag-Erling Smørgrav debug("Got %d/%u for keepalive", type, seq); 903ca3176e7SBrian Feldman /* 904ca3176e7SBrian Feldman * reset timeout, since we got a sane answer from the client. 905ca3176e7SBrian Feldman * even if this was generated by something other than 906ca3176e7SBrian Feldman * the bogus CHANNEL_REQUEST we send for keepalives. 907ca3176e7SBrian Feldman */ 9087aee6ffeSDag-Erling Smørgrav packet_set_alive_timeouts(0); 909ca3176e7SBrian Feldman } 910ca3176e7SBrian Feldman 911af12a3e7SDag-Erling Smørgrav static void 912af12a3e7SDag-Erling Smørgrav server_input_stdin_data(int type, u_int32_t seq, void *ctxt) 913a04a10f8SKris Kennaway { 914a04a10f8SKris Kennaway char *data; 915ca3176e7SBrian Feldman u_int data_len; 916a04a10f8SKris Kennaway 917a04a10f8SKris Kennaway /* Stdin data from the client. Append it to the buffer. */ 918a04a10f8SKris Kennaway /* Ignore any data if the client has closed stdin. */ 919a04a10f8SKris Kennaway if (fdin == -1) 920a04a10f8SKris Kennaway return; 921a04a10f8SKris Kennaway data = packet_get_string(&data_len); 922af12a3e7SDag-Erling Smørgrav packet_check_eom(); 923a04a10f8SKris Kennaway buffer_append(&stdin_buffer, data, data_len); 924b83788ffSDag-Erling Smørgrav explicit_bzero(data, data_len); 925e4a9863fSDag-Erling Smørgrav free(data); 926a04a10f8SKris Kennaway } 927a04a10f8SKris Kennaway 928af12a3e7SDag-Erling Smørgrav static void 929af12a3e7SDag-Erling Smørgrav server_input_eof(int type, u_int32_t seq, void *ctxt) 930a04a10f8SKris Kennaway { 931a04a10f8SKris Kennaway /* 932a04a10f8SKris Kennaway * Eof from the client. The stdin descriptor to the 933a04a10f8SKris Kennaway * program will be closed when all buffered data has 934a04a10f8SKris Kennaway * drained. 935a04a10f8SKris Kennaway */ 936a04a10f8SKris Kennaway debug("EOF received for stdin."); 937af12a3e7SDag-Erling Smørgrav packet_check_eom(); 938a04a10f8SKris Kennaway stdin_eof = 1; 939a04a10f8SKris Kennaway } 940a04a10f8SKris Kennaway 941af12a3e7SDag-Erling Smørgrav static void 942af12a3e7SDag-Erling Smørgrav server_input_window_size(int type, u_int32_t seq, void *ctxt) 943a04a10f8SKris Kennaway { 944333ee039SDag-Erling Smørgrav u_int row = packet_get_int(); 945333ee039SDag-Erling Smørgrav u_int col = packet_get_int(); 946333ee039SDag-Erling Smørgrav u_int xpixel = packet_get_int(); 947333ee039SDag-Erling Smørgrav u_int ypixel = packet_get_int(); 948a04a10f8SKris Kennaway 949a04a10f8SKris Kennaway debug("Window change received."); 950af12a3e7SDag-Erling Smørgrav packet_check_eom(); 951a04a10f8SKris Kennaway if (fdin != -1) 952a04a10f8SKris Kennaway pty_change_window_size(fdin, row, col, xpixel, ypixel); 953a04a10f8SKris Kennaway } 954a04a10f8SKris Kennaway 955af12a3e7SDag-Erling Smørgrav static Channel * 9561ec0d754SDag-Erling Smørgrav server_request_direct_tcpip(void) 957a04a10f8SKris Kennaway { 9586888a9beSDag-Erling Smørgrav Channel *c = NULL; 959a04a10f8SKris Kennaway char *target, *originator; 960cce7d346SDag-Erling Smørgrav u_short target_port, originator_port; 961a04a10f8SKris Kennaway 962a04a10f8SKris Kennaway target = packet_get_string(NULL); 963a04a10f8SKris Kennaway target_port = packet_get_int(); 964a04a10f8SKris Kennaway originator = packet_get_string(NULL); 965a04a10f8SKris Kennaway originator_port = packet_get_int(); 966af12a3e7SDag-Erling Smørgrav packet_check_eom(); 9672632b0c8SKris Kennaway 968d4af9e69SDag-Erling Smørgrav debug("server_request_direct_tcpip: originator %s port %d, target %s " 969d4af9e69SDag-Erling Smørgrav "port %d", originator, originator_port, target, target_port); 970b66f2d16SKris Kennaway 9716888a9beSDag-Erling Smørgrav /* XXX fine grained permissions */ 9726888a9beSDag-Erling Smørgrav if ((options.allow_tcp_forwarding & FORWARD_LOCAL) != 0 && 9736888a9beSDag-Erling Smørgrav !no_port_forwarding_flag) { 974*a0ee8cc6SDag-Erling Smørgrav c = channel_connect_to_port(target, target_port, 975d4af9e69SDag-Erling Smørgrav "direct-tcpip", "direct-tcpip"); 9766888a9beSDag-Erling Smørgrav } else { 9776888a9beSDag-Erling Smørgrav logit("refused local port forward: " 9786888a9beSDag-Erling Smørgrav "originator %s port %d, target %s port %d", 9796888a9beSDag-Erling Smørgrav originator, originator_port, target, target_port); 9806888a9beSDag-Erling Smørgrav } 981d4af9e69SDag-Erling Smørgrav 982e4a9863fSDag-Erling Smørgrav free(originator); 983e4a9863fSDag-Erling Smørgrav free(target); 984d4af9e69SDag-Erling Smørgrav 985af12a3e7SDag-Erling Smørgrav return c; 986ca3176e7SBrian Feldman } 987ca3176e7SBrian Feldman 988af12a3e7SDag-Erling Smørgrav static Channel * 989*a0ee8cc6SDag-Erling Smørgrav server_request_direct_streamlocal(void) 990*a0ee8cc6SDag-Erling Smørgrav { 991*a0ee8cc6SDag-Erling Smørgrav Channel *c = NULL; 992*a0ee8cc6SDag-Erling Smørgrav char *target, *originator; 993*a0ee8cc6SDag-Erling Smørgrav u_short originator_port; 994*a0ee8cc6SDag-Erling Smørgrav 995*a0ee8cc6SDag-Erling Smørgrav target = packet_get_string(NULL); 996*a0ee8cc6SDag-Erling Smørgrav originator = packet_get_string(NULL); 997*a0ee8cc6SDag-Erling Smørgrav originator_port = packet_get_int(); 998*a0ee8cc6SDag-Erling Smørgrav packet_check_eom(); 999*a0ee8cc6SDag-Erling Smørgrav 1000*a0ee8cc6SDag-Erling Smørgrav debug("server_request_direct_streamlocal: originator %s port %d, target %s", 1001*a0ee8cc6SDag-Erling Smørgrav originator, originator_port, target); 1002*a0ee8cc6SDag-Erling Smørgrav 1003*a0ee8cc6SDag-Erling Smørgrav /* XXX fine grained permissions */ 1004*a0ee8cc6SDag-Erling Smørgrav if ((options.allow_streamlocal_forwarding & FORWARD_LOCAL) != 0 && 1005*a0ee8cc6SDag-Erling Smørgrav !no_port_forwarding_flag) { 1006*a0ee8cc6SDag-Erling Smørgrav c = channel_connect_to_path(target, 1007*a0ee8cc6SDag-Erling Smørgrav "direct-streamlocal@openssh.com", "direct-streamlocal"); 1008*a0ee8cc6SDag-Erling Smørgrav } else { 1009*a0ee8cc6SDag-Erling Smørgrav logit("refused streamlocal port forward: " 1010*a0ee8cc6SDag-Erling Smørgrav "originator %s port %d, target %s", 1011*a0ee8cc6SDag-Erling Smørgrav originator, originator_port, target); 1012*a0ee8cc6SDag-Erling Smørgrav } 1013*a0ee8cc6SDag-Erling Smørgrav 1014*a0ee8cc6SDag-Erling Smørgrav free(originator); 1015*a0ee8cc6SDag-Erling Smørgrav free(target); 1016*a0ee8cc6SDag-Erling Smørgrav 1017*a0ee8cc6SDag-Erling Smørgrav return c; 1018*a0ee8cc6SDag-Erling Smørgrav } 1019*a0ee8cc6SDag-Erling Smørgrav 1020*a0ee8cc6SDag-Erling Smørgrav static Channel * 1021b74df5b2SDag-Erling Smørgrav server_request_tun(void) 1022b74df5b2SDag-Erling Smørgrav { 1023b74df5b2SDag-Erling Smørgrav Channel *c = NULL; 1024b74df5b2SDag-Erling Smørgrav int mode, tun; 1025b74df5b2SDag-Erling Smørgrav int sock; 1026b74df5b2SDag-Erling Smørgrav 1027b74df5b2SDag-Erling Smørgrav mode = packet_get_int(); 1028b74df5b2SDag-Erling Smørgrav switch (mode) { 1029b74df5b2SDag-Erling Smørgrav case SSH_TUNMODE_POINTOPOINT: 1030b74df5b2SDag-Erling Smørgrav case SSH_TUNMODE_ETHERNET: 1031b74df5b2SDag-Erling Smørgrav break; 1032b74df5b2SDag-Erling Smørgrav default: 1033b74df5b2SDag-Erling Smørgrav packet_send_debug("Unsupported tunnel device mode."); 1034b74df5b2SDag-Erling Smørgrav return NULL; 1035b74df5b2SDag-Erling Smørgrav } 1036b74df5b2SDag-Erling Smørgrav if ((options.permit_tun & mode) == 0) { 1037b74df5b2SDag-Erling Smørgrav packet_send_debug("Server has rejected tunnel device " 1038b74df5b2SDag-Erling Smørgrav "forwarding"); 1039b74df5b2SDag-Erling Smørgrav return NULL; 1040b74df5b2SDag-Erling Smørgrav } 1041b74df5b2SDag-Erling Smørgrav 1042b74df5b2SDag-Erling Smørgrav tun = packet_get_int(); 1043b74df5b2SDag-Erling Smørgrav if (forced_tun_device != -1) { 1044b74df5b2SDag-Erling Smørgrav if (tun != SSH_TUNID_ANY && forced_tun_device != tun) 1045b74df5b2SDag-Erling Smørgrav goto done; 1046b74df5b2SDag-Erling Smørgrav tun = forced_tun_device; 1047b74df5b2SDag-Erling Smørgrav } 1048b74df5b2SDag-Erling Smørgrav sock = tun_open(tun, mode); 1049b74df5b2SDag-Erling Smørgrav if (sock < 0) 1050b74df5b2SDag-Erling Smørgrav goto done; 1051b74df5b2SDag-Erling Smørgrav c = channel_new("tun", SSH_CHANNEL_OPEN, sock, sock, -1, 105260c59fadSDag-Erling Smørgrav CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1); 1053b74df5b2SDag-Erling Smørgrav c->datagram = 1; 1054b74df5b2SDag-Erling Smørgrav #if defined(SSH_TUN_FILTER) 1055b74df5b2SDag-Erling Smørgrav if (mode == SSH_TUNMODE_POINTOPOINT) 1056b74df5b2SDag-Erling Smørgrav channel_register_filter(c->self, sys_tun_infilter, 1057d4af9e69SDag-Erling Smørgrav sys_tun_outfilter, NULL, NULL); 1058b74df5b2SDag-Erling Smørgrav #endif 1059b74df5b2SDag-Erling Smørgrav 1060b74df5b2SDag-Erling Smørgrav done: 1061b74df5b2SDag-Erling Smørgrav if (c == NULL) 1062b74df5b2SDag-Erling Smørgrav packet_send_debug("Failed to open the tunnel device."); 1063b74df5b2SDag-Erling Smørgrav return c; 1064b74df5b2SDag-Erling Smørgrav } 1065b74df5b2SDag-Erling Smørgrav 1066b74df5b2SDag-Erling Smørgrav static Channel * 10671ec0d754SDag-Erling Smørgrav server_request_session(void) 1068ca3176e7SBrian Feldman { 1069af12a3e7SDag-Erling Smørgrav Channel *c; 1070ca3176e7SBrian Feldman 1071ca3176e7SBrian Feldman debug("input_session_request"); 1072af12a3e7SDag-Erling Smørgrav packet_check_eom(); 1073d4af9e69SDag-Erling Smørgrav 1074d4af9e69SDag-Erling Smørgrav if (no_more_sessions) { 1075d4af9e69SDag-Erling Smørgrav packet_disconnect("Possible attack: attempt to open a session " 1076d4af9e69SDag-Erling Smørgrav "after additional sessions disabled"); 1077d4af9e69SDag-Erling Smørgrav } 1078d4af9e69SDag-Erling Smørgrav 1079ca3176e7SBrian Feldman /* 1080ca3176e7SBrian Feldman * A server session has no fd to read or write until a 1081ca3176e7SBrian Feldman * CHANNEL_REQUEST for a shell is made, so we set the type to 1082ca3176e7SBrian Feldman * SSH_CHANNEL_LARVAL. Additionally, a callback for handling all 1083ca3176e7SBrian Feldman * CHANNEL_REQUEST messages is registered. 1084ca3176e7SBrian Feldman */ 10851ec0d754SDag-Erling Smørgrav c = channel_new("session", SSH_CHANNEL_LARVAL, 1086af12a3e7SDag-Erling Smørgrav -1, -1, -1, /*window size*/0, CHAN_SES_PACKET_DEFAULT, 1087cf2b5f3bSDag-Erling Smørgrav 0, "server-session", 1); 10881ec0d754SDag-Erling Smørgrav if (session_open(the_authctxt, c->self) != 1) { 1089af12a3e7SDag-Erling Smørgrav debug("session open failed, free channel %d", c->self); 1090af12a3e7SDag-Erling Smørgrav channel_free(c); 1091ca3176e7SBrian Feldman return NULL; 1092a04a10f8SKris Kennaway } 1093b74df5b2SDag-Erling Smørgrav channel_register_cleanup(c->self, session_close_by_channel, 0); 1094af12a3e7SDag-Erling Smørgrav return c; 1095af12a3e7SDag-Erling Smørgrav } 1096a04a10f8SKris Kennaway 1097af12a3e7SDag-Erling Smørgrav static void 1098af12a3e7SDag-Erling Smørgrav server_input_channel_open(int type, u_int32_t seq, void *ctxt) 1099a04a10f8SKris Kennaway { 1100a04a10f8SKris Kennaway Channel *c = NULL; 1101a04a10f8SKris Kennaway char *ctype; 1102a04a10f8SKris Kennaway int rchan; 1103a82e551fSDag-Erling Smørgrav u_int rmaxpack, rwindow, len; 1104a04a10f8SKris Kennaway 1105a04a10f8SKris Kennaway ctype = packet_get_string(&len); 1106a04a10f8SKris Kennaway rchan = packet_get_int(); 1107a04a10f8SKris Kennaway rwindow = packet_get_int(); 1108a04a10f8SKris Kennaway rmaxpack = packet_get_int(); 1109a04a10f8SKris Kennaway 11105b9b2fafSBrian Feldman debug("server_input_channel_open: ctype %s rchan %d win %d max %d", 1111a04a10f8SKris Kennaway ctype, rchan, rwindow, rmaxpack); 1112a04a10f8SKris Kennaway 1113a04a10f8SKris Kennaway if (strcmp(ctype, "session") == 0) { 11141ec0d754SDag-Erling Smørgrav c = server_request_session(); 1115a04a10f8SKris Kennaway } else if (strcmp(ctype, "direct-tcpip") == 0) { 11161ec0d754SDag-Erling Smørgrav c = server_request_direct_tcpip(); 1117*a0ee8cc6SDag-Erling Smørgrav } else if (strcmp(ctype, "direct-streamlocal@openssh.com") == 0) { 1118*a0ee8cc6SDag-Erling Smørgrav c = server_request_direct_streamlocal(); 1119b74df5b2SDag-Erling Smørgrav } else if (strcmp(ctype, "tun@openssh.com") == 0) { 1120b74df5b2SDag-Erling Smørgrav c = server_request_tun(); 1121a04a10f8SKris Kennaway } 1122a04a10f8SKris Kennaway if (c != NULL) { 1123ca3176e7SBrian Feldman debug("server_input_channel_open: confirm %s", ctype); 1124a04a10f8SKris Kennaway c->remote_id = rchan; 1125a04a10f8SKris Kennaway c->remote_window = rwindow; 1126a04a10f8SKris Kennaway c->remote_maxpacket = rmaxpack; 1127af12a3e7SDag-Erling Smørgrav if (c->type != SSH_CHANNEL_CONNECTING) { 1128a04a10f8SKris Kennaway packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); 1129a04a10f8SKris Kennaway packet_put_int(c->remote_id); 1130a04a10f8SKris Kennaway packet_put_int(c->self); 1131a04a10f8SKris Kennaway packet_put_int(c->local_window); 1132a04a10f8SKris Kennaway packet_put_int(c->local_maxpacket); 1133a04a10f8SKris Kennaway packet_send(); 1134af12a3e7SDag-Erling Smørgrav } 1135a04a10f8SKris Kennaway } else { 1136ca3176e7SBrian Feldman debug("server_input_channel_open: failure %s", ctype); 1137a04a10f8SKris Kennaway packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE); 1138a04a10f8SKris Kennaway packet_put_int(rchan); 1139a04a10f8SKris Kennaway packet_put_int(SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED); 1140af12a3e7SDag-Erling Smørgrav if (!(datafellows & SSH_BUG_OPENFAILURE)) { 1141af12a3e7SDag-Erling Smørgrav packet_put_cstring("open failed"); 1142a04a10f8SKris Kennaway packet_put_cstring(""); 1143af12a3e7SDag-Erling Smørgrav } 1144a04a10f8SKris Kennaway packet_send(); 1145a04a10f8SKris Kennaway } 1146e4a9863fSDag-Erling Smørgrav free(ctype); 1147a04a10f8SKris Kennaway } 1148a04a10f8SKris Kennaway 1149af12a3e7SDag-Erling Smørgrav static void 1150af12a3e7SDag-Erling Smørgrav server_input_global_request(int type, u_int32_t seq, void *ctxt) 1151ca3176e7SBrian Feldman { 1152ca3176e7SBrian Feldman char *rtype; 1153ca3176e7SBrian Feldman int want_reply; 1154cce7d346SDag-Erling Smørgrav int success = 0, allocated_listen_port = 0; 1155ca3176e7SBrian Feldman 1156ca3176e7SBrian Feldman rtype = packet_get_string(NULL); 1157ca3176e7SBrian Feldman want_reply = packet_get_char(); 1158ca3176e7SBrian Feldman debug("server_input_global_request: rtype %s want_reply %d", rtype, want_reply); 1159ca3176e7SBrian Feldman 1160ca3176e7SBrian Feldman /* -R style forwarding */ 1161ca3176e7SBrian Feldman if (strcmp(rtype, "tcpip-forward") == 0) { 1162ca3176e7SBrian Feldman struct passwd *pw; 1163*a0ee8cc6SDag-Erling Smørgrav struct Forward fwd; 1164ca3176e7SBrian Feldman 11651ec0d754SDag-Erling Smørgrav pw = the_authctxt->pw; 11661ec0d754SDag-Erling Smørgrav if (pw == NULL || !the_authctxt->valid) 11671ec0d754SDag-Erling Smørgrav fatal("server_input_global_request: no/invalid user"); 1168*a0ee8cc6SDag-Erling Smørgrav memset(&fwd, 0, sizeof(fwd)); 1169*a0ee8cc6SDag-Erling Smørgrav fwd.listen_host = packet_get_string(NULL); 1170*a0ee8cc6SDag-Erling Smørgrav fwd.listen_port = (u_short)packet_get_int(); 1171ca3176e7SBrian Feldman debug("server_input_global_request: tcpip-forward listen %s port %d", 1172*a0ee8cc6SDag-Erling Smørgrav fwd.listen_host, fwd.listen_port); 1173ca3176e7SBrian Feldman 1174ca3176e7SBrian Feldman /* check permissions */ 11756888a9beSDag-Erling Smørgrav if ((options.allow_tcp_forwarding & FORWARD_REMOTE) == 0 || 1176cce7d346SDag-Erling Smørgrav no_port_forwarding_flag || 1177*a0ee8cc6SDag-Erling Smørgrav (!want_reply && fwd.listen_port == 0) 1178f388f5efSDag-Erling Smørgrav #ifndef NO_IPPORT_RESERVED_CONCEPT 1179*a0ee8cc6SDag-Erling Smørgrav || (fwd.listen_port != 0 && fwd.listen_port < IPPORT_RESERVED && 11807aee6ffeSDag-Erling Smørgrav pw->pw_uid != 0) 1181f388f5efSDag-Erling Smørgrav #endif 1182f388f5efSDag-Erling Smørgrav ) { 1183ca3176e7SBrian Feldman success = 0; 1184ca3176e7SBrian Feldman packet_send_debug("Server has disabled port forwarding."); 1185ca3176e7SBrian Feldman } else { 1186ca3176e7SBrian Feldman /* Start listening on the port */ 1187*a0ee8cc6SDag-Erling Smørgrav success = channel_setup_remote_fwd_listener(&fwd, 1188*a0ee8cc6SDag-Erling Smørgrav &allocated_listen_port, &options.fwd_opts); 1189ca3176e7SBrian Feldman } 1190*a0ee8cc6SDag-Erling Smørgrav free(fwd.listen_host); 119121e764dfSDag-Erling Smørgrav } else if (strcmp(rtype, "cancel-tcpip-forward") == 0) { 1192*a0ee8cc6SDag-Erling Smørgrav struct Forward fwd; 119321e764dfSDag-Erling Smørgrav 1194*a0ee8cc6SDag-Erling Smørgrav memset(&fwd, 0, sizeof(fwd)); 1195*a0ee8cc6SDag-Erling Smørgrav fwd.listen_host = packet_get_string(NULL); 1196*a0ee8cc6SDag-Erling Smørgrav fwd.listen_port = (u_short)packet_get_int(); 119721e764dfSDag-Erling Smørgrav debug("%s: cancel-tcpip-forward addr %s port %d", __func__, 1198*a0ee8cc6SDag-Erling Smørgrav fwd.listen_host, fwd.listen_port); 119921e764dfSDag-Erling Smørgrav 1200*a0ee8cc6SDag-Erling Smørgrav success = channel_cancel_rport_listener(&fwd); 1201*a0ee8cc6SDag-Erling Smørgrav free(fwd.listen_host); 1202*a0ee8cc6SDag-Erling Smørgrav } else if (strcmp(rtype, "streamlocal-forward@openssh.com") == 0) { 1203*a0ee8cc6SDag-Erling Smørgrav struct Forward fwd; 1204*a0ee8cc6SDag-Erling Smørgrav 1205*a0ee8cc6SDag-Erling Smørgrav memset(&fwd, 0, sizeof(fwd)); 1206*a0ee8cc6SDag-Erling Smørgrav fwd.listen_path = packet_get_string(NULL); 1207*a0ee8cc6SDag-Erling Smørgrav debug("server_input_global_request: streamlocal-forward listen path %s", 1208*a0ee8cc6SDag-Erling Smørgrav fwd.listen_path); 1209*a0ee8cc6SDag-Erling Smørgrav 1210*a0ee8cc6SDag-Erling Smørgrav /* check permissions */ 1211*a0ee8cc6SDag-Erling Smørgrav if ((options.allow_streamlocal_forwarding & FORWARD_REMOTE) == 0 1212*a0ee8cc6SDag-Erling Smørgrav || no_port_forwarding_flag) { 1213*a0ee8cc6SDag-Erling Smørgrav success = 0; 1214*a0ee8cc6SDag-Erling Smørgrav packet_send_debug("Server has disabled port forwarding."); 1215*a0ee8cc6SDag-Erling Smørgrav } else { 1216*a0ee8cc6SDag-Erling Smørgrav /* Start listening on the socket */ 1217*a0ee8cc6SDag-Erling Smørgrav success = channel_setup_remote_fwd_listener( 1218*a0ee8cc6SDag-Erling Smørgrav &fwd, NULL, &options.fwd_opts); 1219*a0ee8cc6SDag-Erling Smørgrav } 1220*a0ee8cc6SDag-Erling Smørgrav free(fwd.listen_path); 1221*a0ee8cc6SDag-Erling Smørgrav } else if (strcmp(rtype, "cancel-streamlocal-forward@openssh.com") == 0) { 1222*a0ee8cc6SDag-Erling Smørgrav struct Forward fwd; 1223*a0ee8cc6SDag-Erling Smørgrav 1224*a0ee8cc6SDag-Erling Smørgrav memset(&fwd, 0, sizeof(fwd)); 1225*a0ee8cc6SDag-Erling Smørgrav fwd.listen_path = packet_get_string(NULL); 1226*a0ee8cc6SDag-Erling Smørgrav debug("%s: cancel-streamlocal-forward path %s", __func__, 1227*a0ee8cc6SDag-Erling Smørgrav fwd.listen_path); 1228*a0ee8cc6SDag-Erling Smørgrav 1229*a0ee8cc6SDag-Erling Smørgrav success = channel_cancel_rport_listener(&fwd); 1230*a0ee8cc6SDag-Erling Smørgrav free(fwd.listen_path); 1231d4af9e69SDag-Erling Smørgrav } else if (strcmp(rtype, "no-more-sessions@openssh.com") == 0) { 1232d4af9e69SDag-Erling Smørgrav no_more_sessions = 1; 1233d4af9e69SDag-Erling Smørgrav success = 1; 1234ca3176e7SBrian Feldman } 1235ca3176e7SBrian Feldman if (want_reply) { 1236ca3176e7SBrian Feldman packet_start(success ? 1237ca3176e7SBrian Feldman SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE); 1238cce7d346SDag-Erling Smørgrav if (success && allocated_listen_port > 0) 1239cce7d346SDag-Erling Smørgrav packet_put_int(allocated_listen_port); 1240ca3176e7SBrian Feldman packet_send(); 1241ca3176e7SBrian Feldman packet_write_wait(); 1242ca3176e7SBrian Feldman } 1243e4a9863fSDag-Erling Smørgrav free(rtype); 1244ca3176e7SBrian Feldman } 1245333ee039SDag-Erling Smørgrav 1246af12a3e7SDag-Erling Smørgrav static void 1247af12a3e7SDag-Erling Smørgrav server_input_channel_req(int type, u_int32_t seq, void *ctxt) 1248af12a3e7SDag-Erling Smørgrav { 1249af12a3e7SDag-Erling Smørgrav Channel *c; 1250af12a3e7SDag-Erling Smørgrav int id, reply, success = 0; 1251af12a3e7SDag-Erling Smørgrav char *rtype; 1252ca3176e7SBrian Feldman 1253af12a3e7SDag-Erling Smørgrav id = packet_get_int(); 1254af12a3e7SDag-Erling Smørgrav rtype = packet_get_string(NULL); 1255af12a3e7SDag-Erling Smørgrav reply = packet_get_char(); 1256af12a3e7SDag-Erling Smørgrav 1257af12a3e7SDag-Erling Smørgrav debug("server_input_channel_req: channel %d request %s reply %d", 1258af12a3e7SDag-Erling Smørgrav id, rtype, reply); 1259af12a3e7SDag-Erling Smørgrav 1260af12a3e7SDag-Erling Smørgrav if ((c = channel_lookup(id)) == NULL) 1261af12a3e7SDag-Erling Smørgrav packet_disconnect("server_input_channel_req: " 1262af12a3e7SDag-Erling Smørgrav "unknown channel %d", id); 1263d4af9e69SDag-Erling Smørgrav if (!strcmp(rtype, "eow@openssh.com")) { 1264d4af9e69SDag-Erling Smørgrav packet_check_eom(); 1265d4af9e69SDag-Erling Smørgrav chan_rcvd_eow(c); 1266d4af9e69SDag-Erling Smørgrav } else if ((c->type == SSH_CHANNEL_LARVAL || 1267d4af9e69SDag-Erling Smørgrav c->type == SSH_CHANNEL_OPEN) && strcmp(c->ctype, "session") == 0) 1268af12a3e7SDag-Erling Smørgrav success = session_input_channel_req(c, rtype); 1269*a0ee8cc6SDag-Erling Smørgrav if (reply && !(c->flags & CHAN_CLOSE_SENT)) { 1270af12a3e7SDag-Erling Smørgrav packet_start(success ? 1271af12a3e7SDag-Erling Smørgrav SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE); 1272af12a3e7SDag-Erling Smørgrav packet_put_int(c->remote_id); 1273af12a3e7SDag-Erling Smørgrav packet_send(); 1274af12a3e7SDag-Erling Smørgrav } 1275e4a9863fSDag-Erling Smørgrav free(rtype); 1276af12a3e7SDag-Erling Smørgrav } 1277af12a3e7SDag-Erling Smørgrav 1278af12a3e7SDag-Erling Smørgrav static void 1279ca3176e7SBrian Feldman server_init_dispatch_20(void) 1280a04a10f8SKris Kennaway { 1281a04a10f8SKris Kennaway debug("server_init_dispatch_20"); 1282a04a10f8SKris Kennaway dispatch_init(&dispatch_protocol_error); 1283a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_CLOSE, &channel_input_oclose); 1284a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_DATA, &channel_input_data); 1285a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_EOF, &channel_input_ieof); 1286a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_EXTENDED_DATA, &channel_input_extended_data); 1287a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_OPEN, &server_input_channel_open); 1288a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation); 1289a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure); 1290af12a3e7SDag-Erling Smørgrav dispatch_set(SSH2_MSG_CHANNEL_REQUEST, &server_input_channel_req); 1291a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust); 1292ca3176e7SBrian Feldman dispatch_set(SSH2_MSG_GLOBAL_REQUEST, &server_input_global_request); 1293ca3176e7SBrian Feldman /* client_alive */ 1294cce7d346SDag-Erling Smørgrav dispatch_set(SSH2_MSG_CHANNEL_SUCCESS, &server_input_keep_alive); 1295cce7d346SDag-Erling Smørgrav dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &server_input_keep_alive); 12961ec0d754SDag-Erling Smørgrav dispatch_set(SSH2_MSG_REQUEST_SUCCESS, &server_input_keep_alive); 12971ec0d754SDag-Erling Smørgrav dispatch_set(SSH2_MSG_REQUEST_FAILURE, &server_input_keep_alive); 1298ca3176e7SBrian Feldman /* rekeying */ 1299ca3176e7SBrian Feldman dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit); 1300a04a10f8SKris Kennaway } 1301af12a3e7SDag-Erling Smørgrav static void 1302ca3176e7SBrian Feldman server_init_dispatch_13(void) 1303a04a10f8SKris Kennaway { 1304a04a10f8SKris Kennaway debug("server_init_dispatch_13"); 1305a04a10f8SKris Kennaway dispatch_init(NULL); 1306a04a10f8SKris Kennaway dispatch_set(SSH_CMSG_EOF, &server_input_eof); 1307a04a10f8SKris Kennaway dispatch_set(SSH_CMSG_STDIN_DATA, &server_input_stdin_data); 1308a04a10f8SKris Kennaway dispatch_set(SSH_CMSG_WINDOW_SIZE, &server_input_window_size); 1309a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_close); 1310a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, &channel_input_close_confirmation); 1311a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_DATA, &channel_input_data); 1312a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation); 1313a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure); 1314a04a10f8SKris Kennaway dispatch_set(SSH_MSG_PORT_OPEN, &channel_input_port_open); 1315a04a10f8SKris Kennaway } 1316af12a3e7SDag-Erling Smørgrav static void 1317ca3176e7SBrian Feldman server_init_dispatch_15(void) 1318a04a10f8SKris Kennaway { 1319a04a10f8SKris Kennaway server_init_dispatch_13(); 1320a04a10f8SKris Kennaway debug("server_init_dispatch_15"); 1321a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_ieof); 1322a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, &channel_input_oclose); 1323a04a10f8SKris Kennaway } 1324af12a3e7SDag-Erling Smørgrav static void 1325ca3176e7SBrian Feldman server_init_dispatch(void) 1326a04a10f8SKris Kennaway { 1327a04a10f8SKris Kennaway if (compat20) 1328a04a10f8SKris Kennaway server_init_dispatch_20(); 1329a04a10f8SKris Kennaway else if (compat13) 1330a04a10f8SKris Kennaway server_init_dispatch_13(); 1331a04a10f8SKris Kennaway else 1332a04a10f8SKris Kennaway server_init_dispatch_15(); 1333a04a10f8SKris Kennaway } 1334