1511b41d2SMark Murray /* 2511b41d2SMark Murray * Author: Tatu Ylonen <ylo@cs.hut.fi> 3511b41d2SMark Murray * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4511b41d2SMark Murray * All rights reserved 5511b41d2SMark Murray * Server main loop for handling the interactive session. 6b66f2d16SKris Kennaway * 7b66f2d16SKris Kennaway * As far as I am concerned, the code I have written for this software 8b66f2d16SKris Kennaway * can be used freely for any purpose. Any derived versions of this 9b66f2d16SKris Kennaway * software must be clearly marked as such, and if the derived work is 10b66f2d16SKris Kennaway * incompatible with the protocol description in the RFC file, it must be 11b66f2d16SKris Kennaway * called by a name other than "ssh" or "Secure Shell". 12b66f2d16SKris Kennaway * 13a04a10f8SKris Kennaway * SSH2 support by Markus Friedl. 14af12a3e7SDag-Erling Smørgrav * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 15b66f2d16SKris Kennaway * 16b66f2d16SKris Kennaway * Redistribution and use in source and binary forms, with or without 17b66f2d16SKris Kennaway * modification, are permitted provided that the following conditions 18b66f2d16SKris Kennaway * are met: 19b66f2d16SKris Kennaway * 1. Redistributions of source code must retain the above copyright 20b66f2d16SKris Kennaway * notice, this list of conditions and the following disclaimer. 21b66f2d16SKris Kennaway * 2. Redistributions in binary form must reproduce the above copyright 22b66f2d16SKris Kennaway * notice, this list of conditions and the following disclaimer in the 23b66f2d16SKris Kennaway * documentation and/or other materials provided with the distribution. 24b66f2d16SKris Kennaway * 25b66f2d16SKris Kennaway * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26b66f2d16SKris Kennaway * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27b66f2d16SKris Kennaway * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28b66f2d16SKris Kennaway * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29b66f2d16SKris Kennaway * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30b66f2d16SKris Kennaway * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31b66f2d16SKris Kennaway * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32b66f2d16SKris Kennaway * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33b66f2d16SKris Kennaway * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34b66f2d16SKris Kennaway * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35a04a10f8SKris Kennaway */ 36511b41d2SMark Murray 37511b41d2SMark Murray #include "includes.h" 38f388f5efSDag-Erling Smørgrav RCSID("$OpenBSD: serverloop.c,v 1.104 2002/09/19 16:03:15 stevesk Exp $"); 39a82e551fSDag-Erling Smørgrav RCSID("$FreeBSD$"); 405b9b2fafSBrian Feldman 41511b41d2SMark Murray #include "xmalloc.h" 42511b41d2SMark Murray #include "packet.h" 43511b41d2SMark Murray #include "buffer.h" 44ca3176e7SBrian Feldman #include "log.h" 45511b41d2SMark Murray #include "servconf.h" 46f388f5efSDag-Erling Smørgrav #include "canohost.h" 47ca3176e7SBrian Feldman #include "sshpty.h" 48a04a10f8SKris Kennaway #include "channels.h" 49a04a10f8SKris Kennaway #include "compat.h" 50ca3176e7SBrian Feldman #include "ssh1.h" 51a04a10f8SKris Kennaway #include "ssh2.h" 52ca3176e7SBrian Feldman #include "auth.h" 53a04a10f8SKris Kennaway #include "session.h" 54a04a10f8SKris Kennaway #include "dispatch.h" 55b66f2d16SKris Kennaway #include "auth-options.h" 56ca3176e7SBrian Feldman #include "serverloop.h" 57ca3176e7SBrian Feldman #include "misc.h" 58ca3176e7SBrian Feldman #include "kex.h" 59511b41d2SMark Murray 605b9b2fafSBrian Feldman extern ServerOptions options; 615b9b2fafSBrian Feldman 62ca3176e7SBrian Feldman /* XXX */ 63ca3176e7SBrian Feldman extern Kex *xxx_kex; 64af12a3e7SDag-Erling Smørgrav static Authctxt *xxx_authctxt; 65ca3176e7SBrian Feldman 66511b41d2SMark Murray static Buffer stdin_buffer; /* Buffer for stdin data. */ 67511b41d2SMark Murray static Buffer stdout_buffer; /* Buffer for stdout data. */ 68511b41d2SMark Murray static Buffer stderr_buffer; /* Buffer for stderr data. */ 69511b41d2SMark Murray static int fdin; /* Descriptor for stdin (for writing) */ 70511b41d2SMark Murray static int fdout; /* Descriptor for stdout (for reading); 71511b41d2SMark Murray May be same number as fdin. */ 72511b41d2SMark Murray static int fderr; /* Descriptor for stderr. May be -1. */ 73511b41d2SMark Murray static long stdin_bytes = 0; /* Number of bytes written to stdin. */ 74511b41d2SMark Murray static long stdout_bytes = 0; /* Number of stdout bytes sent to client. */ 75511b41d2SMark Murray static long stderr_bytes = 0; /* Number of stderr bytes sent to client. */ 76511b41d2SMark Murray static long fdout_bytes = 0; /* Number of stdout bytes read from program. */ 77511b41d2SMark Murray static int stdin_eof = 0; /* EOF message received from client. */ 78511b41d2SMark Murray static int fdout_eof = 0; /* EOF encountered reading from fdout. */ 79511b41d2SMark Murray static int fderr_eof = 0; /* EOF encountered readung from fderr. */ 80e0fbb1d2SBrian Feldman static int fdin_is_tty = 0; /* fdin points to a tty. */ 81511b41d2SMark Murray static int connection_in; /* Connection to client (input). */ 82511b41d2SMark Murray static int connection_out; /* Connection to client (output). */ 83ca3176e7SBrian Feldman static int connection_closed = 0; /* Connection to client closed. */ 84ca3176e7SBrian Feldman static u_int buffer_high; /* "Soft" max buffer size. */ 85af12a3e7SDag-Erling Smørgrav static int client_alive_timeouts = 0; 86511b41d2SMark Murray 87511b41d2SMark Murray /* 88511b41d2SMark Murray * This SIGCHLD kludge is used to detect when the child exits. The server 89511b41d2SMark Murray * will exit after that, as soon as forwarded connections have terminated. 90511b41d2SMark Murray */ 91511b41d2SMark Murray 92af12a3e7SDag-Erling Smørgrav static volatile sig_atomic_t child_terminated = 0; /* The child has terminated. */ 93511b41d2SMark Murray 94af12a3e7SDag-Erling Smørgrav /* prototypes */ 95af12a3e7SDag-Erling Smørgrav static void server_init_dispatch(void); 96a04a10f8SKris Kennaway 97af12a3e7SDag-Erling Smørgrav /* 98af12a3e7SDag-Erling Smørgrav * we write to this pipe if a SIGCHLD is caught in order to avoid 99af12a3e7SDag-Erling Smørgrav * the race between select() and child_terminated 100af12a3e7SDag-Erling Smørgrav */ 101af12a3e7SDag-Erling Smørgrav static int notify_pipe[2]; 102af12a3e7SDag-Erling Smørgrav static void 103af12a3e7SDag-Erling Smørgrav notify_setup(void) 104af12a3e7SDag-Erling Smørgrav { 105af12a3e7SDag-Erling Smørgrav if (pipe(notify_pipe) < 0) { 106af12a3e7SDag-Erling Smørgrav error("pipe(notify_pipe) failed %s", strerror(errno)); 107af12a3e7SDag-Erling Smørgrav } else if ((fcntl(notify_pipe[0], F_SETFD, 1) == -1) || 108af12a3e7SDag-Erling Smørgrav (fcntl(notify_pipe[1], F_SETFD, 1) == -1)) { 109af12a3e7SDag-Erling Smørgrav error("fcntl(notify_pipe, F_SETFD) failed %s", strerror(errno)); 110af12a3e7SDag-Erling Smørgrav close(notify_pipe[0]); 111af12a3e7SDag-Erling Smørgrav close(notify_pipe[1]); 112af12a3e7SDag-Erling Smørgrav } else { 113af12a3e7SDag-Erling Smørgrav set_nonblock(notify_pipe[0]); 114af12a3e7SDag-Erling Smørgrav set_nonblock(notify_pipe[1]); 115af12a3e7SDag-Erling Smørgrav return; 116af12a3e7SDag-Erling Smørgrav } 117af12a3e7SDag-Erling Smørgrav notify_pipe[0] = -1; /* read end */ 118af12a3e7SDag-Erling Smørgrav notify_pipe[1] = -1; /* write end */ 119af12a3e7SDag-Erling Smørgrav } 120af12a3e7SDag-Erling Smørgrav static void 121af12a3e7SDag-Erling Smørgrav notify_parent(void) 122af12a3e7SDag-Erling Smørgrav { 123af12a3e7SDag-Erling Smørgrav if (notify_pipe[1] != -1) 124af12a3e7SDag-Erling Smørgrav write(notify_pipe[1], "", 1); 125af12a3e7SDag-Erling Smørgrav } 126af12a3e7SDag-Erling Smørgrav static void 127af12a3e7SDag-Erling Smørgrav notify_prepare(fd_set *readset) 128af12a3e7SDag-Erling Smørgrav { 129af12a3e7SDag-Erling Smørgrav if (notify_pipe[0] != -1) 130af12a3e7SDag-Erling Smørgrav FD_SET(notify_pipe[0], readset); 131af12a3e7SDag-Erling Smørgrav } 132af12a3e7SDag-Erling Smørgrav static void 133af12a3e7SDag-Erling Smørgrav notify_done(fd_set *readset) 134af12a3e7SDag-Erling Smørgrav { 135af12a3e7SDag-Erling Smørgrav char c; 136ca3176e7SBrian Feldman 137af12a3e7SDag-Erling Smørgrav if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) 138af12a3e7SDag-Erling Smørgrav while (read(notify_pipe[0], &c, 1) != -1) 139af12a3e7SDag-Erling Smørgrav debug2("notify_done: reading"); 140af12a3e7SDag-Erling Smørgrav } 141af12a3e7SDag-Erling Smørgrav 142af12a3e7SDag-Erling Smørgrav static void 143511b41d2SMark Murray sigchld_handler(int sig) 144511b41d2SMark Murray { 145511b41d2SMark Murray int save_errno = errno; 146511b41d2SMark Murray debug("Received SIGCHLD."); 147511b41d2SMark Murray child_terminated = 1; 148f388f5efSDag-Erling Smørgrav #ifndef _UNICOS 149989dd127SDag-Erling Smørgrav mysignal(SIGCHLD, sigchld_handler); 150f388f5efSDag-Erling Smørgrav #endif 151af12a3e7SDag-Erling Smørgrav notify_parent(); 152a04a10f8SKris Kennaway errno = save_errno; 153511b41d2SMark Murray } 154511b41d2SMark Murray 155511b41d2SMark Murray /* 156511b41d2SMark Murray * Make packets from buffered stderr data, and buffer it for sending 157511b41d2SMark Murray * to the client. 158511b41d2SMark Murray */ 159af12a3e7SDag-Erling Smørgrav static void 160ca3176e7SBrian Feldman make_packets_from_stderr_data(void) 161511b41d2SMark Murray { 162511b41d2SMark Murray int len; 163511b41d2SMark Murray 164511b41d2SMark Murray /* Send buffered stderr data to the client. */ 165511b41d2SMark Murray while (buffer_len(&stderr_buffer) > 0 && 166511b41d2SMark Murray packet_not_very_much_data_to_write()) { 167511b41d2SMark Murray len = buffer_len(&stderr_buffer); 168511b41d2SMark Murray if (packet_is_interactive()) { 169511b41d2SMark Murray if (len > 512) 170511b41d2SMark Murray len = 512; 171511b41d2SMark Murray } else { 172511b41d2SMark Murray /* Keep the packets at reasonable size. */ 173511b41d2SMark Murray if (len > packet_get_maxsize()) 174511b41d2SMark Murray len = packet_get_maxsize(); 175511b41d2SMark Murray } 176511b41d2SMark Murray packet_start(SSH_SMSG_STDERR_DATA); 177511b41d2SMark Murray packet_put_string(buffer_ptr(&stderr_buffer), len); 178511b41d2SMark Murray packet_send(); 179511b41d2SMark Murray buffer_consume(&stderr_buffer, len); 180511b41d2SMark Murray stderr_bytes += len; 181511b41d2SMark Murray } 182511b41d2SMark Murray } 183511b41d2SMark Murray 184511b41d2SMark Murray /* 185511b41d2SMark Murray * Make packets from buffered stdout data, and buffer it for sending to the 186511b41d2SMark Murray * client. 187511b41d2SMark Murray */ 188af12a3e7SDag-Erling Smørgrav static void 189ca3176e7SBrian Feldman make_packets_from_stdout_data(void) 190511b41d2SMark Murray { 191511b41d2SMark Murray int len; 192511b41d2SMark Murray 193511b41d2SMark Murray /* Send buffered stdout data to the client. */ 194511b41d2SMark Murray while (buffer_len(&stdout_buffer) > 0 && 195511b41d2SMark Murray packet_not_very_much_data_to_write()) { 196511b41d2SMark Murray len = buffer_len(&stdout_buffer); 197511b41d2SMark Murray if (packet_is_interactive()) { 198511b41d2SMark Murray if (len > 512) 199511b41d2SMark Murray len = 512; 200511b41d2SMark Murray } else { 201511b41d2SMark Murray /* Keep the packets at reasonable size. */ 202511b41d2SMark Murray if (len > packet_get_maxsize()) 203511b41d2SMark Murray len = packet_get_maxsize(); 204511b41d2SMark Murray } 205511b41d2SMark Murray packet_start(SSH_SMSG_STDOUT_DATA); 206511b41d2SMark Murray packet_put_string(buffer_ptr(&stdout_buffer), len); 207511b41d2SMark Murray packet_send(); 208511b41d2SMark Murray buffer_consume(&stdout_buffer, len); 209511b41d2SMark Murray stdout_bytes += len; 210511b41d2SMark Murray } 211511b41d2SMark Murray } 212511b41d2SMark Murray 213af12a3e7SDag-Erling Smørgrav static void 214af12a3e7SDag-Erling Smørgrav client_alive_check(void) 215af12a3e7SDag-Erling Smørgrav { 216af12a3e7SDag-Erling Smørgrav static int had_channel = 0; 217af12a3e7SDag-Erling Smørgrav int id; 218af12a3e7SDag-Erling Smørgrav 219af12a3e7SDag-Erling Smørgrav id = channel_find_open(); 220af12a3e7SDag-Erling Smørgrav if (id == -1) { 221af12a3e7SDag-Erling Smørgrav if (!had_channel) 222af12a3e7SDag-Erling Smørgrav return; 223af12a3e7SDag-Erling Smørgrav packet_disconnect("No open channels after timeout!"); 224af12a3e7SDag-Erling Smørgrav } 225af12a3e7SDag-Erling Smørgrav had_channel = 1; 226af12a3e7SDag-Erling Smørgrav 227af12a3e7SDag-Erling Smørgrav /* timeout, check to see how many we have had */ 228af12a3e7SDag-Erling Smørgrav if (++client_alive_timeouts > options.client_alive_count_max) 229af12a3e7SDag-Erling Smørgrav packet_disconnect("Timeout, your session not responding."); 230af12a3e7SDag-Erling Smørgrav 231af12a3e7SDag-Erling Smørgrav /* 232af12a3e7SDag-Erling Smørgrav * send a bogus channel request with "wantreply", 233af12a3e7SDag-Erling Smørgrav * we should get back a failure 234af12a3e7SDag-Erling Smørgrav */ 235af12a3e7SDag-Erling Smørgrav channel_request_start(id, "keepalive@openssh.com", 1); 236af12a3e7SDag-Erling Smørgrav packet_send(); 237af12a3e7SDag-Erling Smørgrav } 238af12a3e7SDag-Erling Smørgrav 239511b41d2SMark Murray /* 240511b41d2SMark Murray * Sleep in select() until we can do something. This will initialize the 241511b41d2SMark Murray * select masks. Upon return, the masks will indicate which descriptors 242511b41d2SMark Murray * have data or can accept data. Optionally, a maximum time can be specified 243511b41d2SMark Murray * for the duration of the wait (0 = infinite). 244511b41d2SMark Murray */ 245af12a3e7SDag-Erling Smørgrav static void 246ca3176e7SBrian Feldman wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp, int *maxfdp, 247af12a3e7SDag-Erling Smørgrav int *nallocp, u_int max_time_milliseconds) 248511b41d2SMark Murray { 249511b41d2SMark Murray struct timeval tv, *tvp; 250511b41d2SMark Murray int ret; 251ca3176e7SBrian Feldman int client_alive_scheduled = 0; 252ca3176e7SBrian Feldman 253ca3176e7SBrian Feldman /* 254ca3176e7SBrian Feldman * if using client_alive, set the max timeout accordingly, 255ca3176e7SBrian Feldman * and indicate that this particular timeout was for client 256ca3176e7SBrian Feldman * alive by setting the client_alive_scheduled flag. 257ca3176e7SBrian Feldman * 258ca3176e7SBrian Feldman * this could be randomized somewhat to make traffic 259ca3176e7SBrian Feldman * analysis more difficult, but we're not doing it yet. 260ca3176e7SBrian Feldman */ 261af12a3e7SDag-Erling Smørgrav if (compat20 && 262af12a3e7SDag-Erling Smørgrav max_time_milliseconds == 0 && options.client_alive_interval) { 263ca3176e7SBrian Feldman client_alive_scheduled = 1; 264ca3176e7SBrian Feldman max_time_milliseconds = options.client_alive_interval * 1000; 265af12a3e7SDag-Erling Smørgrav } 266511b41d2SMark Murray 267ca3176e7SBrian Feldman /* Allocate and update select() masks for channel descriptors. */ 268af12a3e7SDag-Erling Smørgrav channel_prepare_select(readsetp, writesetp, maxfdp, nallocp, 0); 269511b41d2SMark Murray 270a04a10f8SKris Kennaway if (compat20) { 271af12a3e7SDag-Erling Smørgrav #if 0 272a04a10f8SKris Kennaway /* wrong: bad condition XXX */ 273a04a10f8SKris Kennaway if (channel_not_very_much_buffered_data()) 274af12a3e7SDag-Erling Smørgrav #endif 275ca3176e7SBrian Feldman FD_SET(connection_in, *readsetp); 276a04a10f8SKris Kennaway } else { 2772632b0c8SKris Kennaway /* 2782632b0c8SKris Kennaway * Read packets from the client unless we have too much 2792632b0c8SKris Kennaway * buffered stdin or channel data. 2802632b0c8SKris Kennaway */ 2812632b0c8SKris Kennaway if (buffer_len(&stdin_buffer) < buffer_high && 282511b41d2SMark Murray channel_not_very_much_buffered_data()) 283ca3176e7SBrian Feldman FD_SET(connection_in, *readsetp); 284511b41d2SMark Murray /* 2852632b0c8SKris Kennaway * If there is not too much data already buffered going to 2862632b0c8SKris Kennaway * the client, try to get some more data from the program. 287511b41d2SMark Murray */ 2882632b0c8SKris Kennaway if (packet_not_very_much_data_to_write()) { 289511b41d2SMark Murray if (!fdout_eof) 290ca3176e7SBrian Feldman FD_SET(fdout, *readsetp); 291511b41d2SMark Murray if (!fderr_eof) 292ca3176e7SBrian Feldman FD_SET(fderr, *readsetp); 293511b41d2SMark Murray } 2942632b0c8SKris Kennaway /* 2952632b0c8SKris Kennaway * If we have buffered data, try to write some of that data 2962632b0c8SKris Kennaway * to the program. 2972632b0c8SKris Kennaway */ 2982632b0c8SKris Kennaway if (fdin != -1 && buffer_len(&stdin_buffer) > 0) 299ca3176e7SBrian Feldman FD_SET(fdin, *writesetp); 3002632b0c8SKris Kennaway } 301af12a3e7SDag-Erling Smørgrav notify_prepare(*readsetp); 302511b41d2SMark Murray 303511b41d2SMark Murray /* 304511b41d2SMark Murray * If we have buffered packet data going to the client, mark that 305511b41d2SMark Murray * descriptor. 306511b41d2SMark Murray */ 307511b41d2SMark Murray if (packet_have_data_to_write()) 308ca3176e7SBrian Feldman FD_SET(connection_out, *writesetp); 309511b41d2SMark Murray 310511b41d2SMark Murray /* 311511b41d2SMark Murray * If child has terminated and there is enough buffer space to read 312511b41d2SMark Murray * from it, then read as much as is available and exit. 313511b41d2SMark Murray */ 314511b41d2SMark Murray if (child_terminated && packet_not_very_much_data_to_write()) 315ca3176e7SBrian Feldman if (max_time_milliseconds == 0 || client_alive_scheduled) 316511b41d2SMark Murray max_time_milliseconds = 100; 317511b41d2SMark Murray 318511b41d2SMark Murray if (max_time_milliseconds == 0) 319511b41d2SMark Murray tvp = NULL; 320511b41d2SMark Murray else { 321511b41d2SMark Murray tv.tv_sec = max_time_milliseconds / 1000; 322511b41d2SMark Murray tv.tv_usec = 1000 * (max_time_milliseconds % 1000); 323511b41d2SMark Murray tvp = &tv; 324511b41d2SMark Murray } 325511b41d2SMark Murray 326511b41d2SMark Murray /* Wait for something to happen, or the timeout to expire. */ 327ca3176e7SBrian Feldman ret = select((*maxfdp)+1, *readsetp, *writesetp, NULL, tvp); 328511b41d2SMark Murray 329ca3176e7SBrian Feldman if (ret == -1) { 330af12a3e7SDag-Erling Smørgrav memset(*readsetp, 0, *nallocp); 331af12a3e7SDag-Erling Smørgrav memset(*writesetp, 0, *nallocp); 332511b41d2SMark Murray if (errno != EINTR) 333511b41d2SMark Murray error("select: %.100s", strerror(errno)); 334af12a3e7SDag-Erling Smørgrav } else if (ret == 0 && client_alive_scheduled) 335af12a3e7SDag-Erling Smørgrav client_alive_check(); 336ca3176e7SBrian Feldman 337af12a3e7SDag-Erling Smørgrav notify_done(*readsetp); 338511b41d2SMark Murray } 339511b41d2SMark Murray 340511b41d2SMark Murray /* 341511b41d2SMark Murray * Processes input from the client and the program. Input data is stored 342511b41d2SMark Murray * in buffers and processed later. 343511b41d2SMark Murray */ 344af12a3e7SDag-Erling Smørgrav static void 345511b41d2SMark Murray process_input(fd_set * readset) 346511b41d2SMark Murray { 347511b41d2SMark Murray int len; 348511b41d2SMark Murray char buf[16384]; 349511b41d2SMark Murray 350511b41d2SMark Murray /* Read and buffer any input data from the client. */ 351511b41d2SMark Murray if (FD_ISSET(connection_in, readset)) { 352511b41d2SMark Murray len = read(connection_in, buf, sizeof(buf)); 353511b41d2SMark Murray if (len == 0) { 354f388f5efSDag-Erling Smørgrav verbose("Connection closed by %.100s", 355f388f5efSDag-Erling Smørgrav get_remote_ipaddr()); 356ca3176e7SBrian Feldman connection_closed = 1; 357ca3176e7SBrian Feldman if (compat20) 358ca3176e7SBrian Feldman return; 359511b41d2SMark Murray fatal_cleanup(); 3602632b0c8SKris Kennaway } else if (len < 0) { 3612632b0c8SKris Kennaway if (errno != EINTR && errno != EAGAIN) { 362f388f5efSDag-Erling Smørgrav verbose("Read error from remote host " 363f388f5efSDag-Erling Smørgrav "%.100s: %.100s", 364f388f5efSDag-Erling Smørgrav get_remote_ipaddr(), strerror(errno)); 365511b41d2SMark Murray fatal_cleanup(); 366511b41d2SMark Murray } 3672632b0c8SKris Kennaway } else { 368511b41d2SMark Murray /* Buffer any received data. */ 369511b41d2SMark Murray packet_process_incoming(buf, len); 370511b41d2SMark Murray } 3712632b0c8SKris Kennaway } 372a04a10f8SKris Kennaway if (compat20) 373a04a10f8SKris Kennaway return; 374a04a10f8SKris Kennaway 375511b41d2SMark Murray /* Read and buffer any available stdout data from the program. */ 376511b41d2SMark Murray if (!fdout_eof && FD_ISSET(fdout, readset)) { 377511b41d2SMark Murray len = read(fdout, buf, sizeof(buf)); 3782632b0c8SKris Kennaway if (len < 0 && (errno == EINTR || errno == EAGAIN)) { 3792632b0c8SKris Kennaway /* do nothing */ 3802632b0c8SKris Kennaway } else if (len <= 0) { 381511b41d2SMark Murray fdout_eof = 1; 3822632b0c8SKris Kennaway } else { 383511b41d2SMark Murray buffer_append(&stdout_buffer, buf, len); 384511b41d2SMark Murray fdout_bytes += len; 385511b41d2SMark Murray } 386511b41d2SMark Murray } 387511b41d2SMark Murray /* Read and buffer any available stderr data from the program. */ 388511b41d2SMark Murray if (!fderr_eof && FD_ISSET(fderr, readset)) { 389511b41d2SMark Murray len = read(fderr, buf, sizeof(buf)); 3902632b0c8SKris Kennaway if (len < 0 && (errno == EINTR || errno == EAGAIN)) { 3912632b0c8SKris Kennaway /* do nothing */ 3922632b0c8SKris Kennaway } else if (len <= 0) { 393511b41d2SMark Murray fderr_eof = 1; 3942632b0c8SKris Kennaway } else { 395511b41d2SMark Murray buffer_append(&stderr_buffer, buf, len); 396511b41d2SMark Murray } 397511b41d2SMark Murray } 3982632b0c8SKris Kennaway } 399511b41d2SMark Murray 400511b41d2SMark Murray /* 401511b41d2SMark Murray * Sends data from internal buffers to client program stdin. 402511b41d2SMark Murray */ 403af12a3e7SDag-Erling Smørgrav static void 404511b41d2SMark Murray process_output(fd_set * writeset) 405511b41d2SMark Murray { 406e0fbb1d2SBrian Feldman struct termios tio; 407af12a3e7SDag-Erling Smørgrav u_char *data; 408af12a3e7SDag-Erling Smørgrav u_int dlen; 409511b41d2SMark Murray int len; 410511b41d2SMark Murray 411511b41d2SMark Murray /* Write buffered data to program stdin. */ 412a04a10f8SKris Kennaway if (!compat20 && fdin != -1 && FD_ISSET(fdin, writeset)) { 413af12a3e7SDag-Erling Smørgrav data = buffer_ptr(&stdin_buffer); 414af12a3e7SDag-Erling Smørgrav dlen = buffer_len(&stdin_buffer); 415af12a3e7SDag-Erling Smørgrav len = write(fdin, data, dlen); 4162632b0c8SKris Kennaway if (len < 0 && (errno == EINTR || errno == EAGAIN)) { 4172632b0c8SKris Kennaway /* do nothing */ 4182632b0c8SKris Kennaway } else if (len <= 0) { 419a04a10f8SKris Kennaway if (fdin != fdout) 420511b41d2SMark Murray close(fdin); 421511b41d2SMark Murray else 422511b41d2SMark Murray shutdown(fdin, SHUT_WR); /* We will no longer send. */ 423511b41d2SMark Murray fdin = -1; 424511b41d2SMark Murray } else { 425e0fbb1d2SBrian Feldman /* Successful write. */ 426af12a3e7SDag-Erling Smørgrav if (fdin_is_tty && dlen >= 1 && data[0] != '\r' && 427af12a3e7SDag-Erling Smørgrav tcgetattr(fdin, &tio) == 0 && 428e0fbb1d2SBrian Feldman !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) { 429e0fbb1d2SBrian Feldman /* 430e0fbb1d2SBrian Feldman * Simulate echo to reduce the impact of 431e0fbb1d2SBrian Feldman * traffic analysis 432e0fbb1d2SBrian Feldman */ 433ca3176e7SBrian Feldman packet_send_ignore(len); 434e0fbb1d2SBrian Feldman packet_send(); 435e0fbb1d2SBrian Feldman } 436e0fbb1d2SBrian Feldman /* Consume the data from the buffer. */ 437511b41d2SMark Murray buffer_consume(&stdin_buffer, len); 438511b41d2SMark Murray /* Update the count of bytes written to the program. */ 439511b41d2SMark Murray stdin_bytes += len; 440511b41d2SMark Murray } 441511b41d2SMark Murray } 442511b41d2SMark Murray /* Send any buffered packet data to the client. */ 443511b41d2SMark Murray if (FD_ISSET(connection_out, writeset)) 444511b41d2SMark Murray packet_write_poll(); 445511b41d2SMark Murray } 446511b41d2SMark Murray 447511b41d2SMark Murray /* 448511b41d2SMark Murray * Wait until all buffered output has been sent to the client. 449511b41d2SMark Murray * This is used when the program terminates. 450511b41d2SMark Murray */ 451af12a3e7SDag-Erling Smørgrav static void 452ca3176e7SBrian Feldman drain_output(void) 453511b41d2SMark Murray { 454511b41d2SMark Murray /* Send any buffered stdout data to the client. */ 455511b41d2SMark Murray if (buffer_len(&stdout_buffer) > 0) { 456511b41d2SMark Murray packet_start(SSH_SMSG_STDOUT_DATA); 457511b41d2SMark Murray packet_put_string(buffer_ptr(&stdout_buffer), 458511b41d2SMark Murray buffer_len(&stdout_buffer)); 459511b41d2SMark Murray packet_send(); 460511b41d2SMark Murray /* Update the count of sent bytes. */ 461511b41d2SMark Murray stdout_bytes += buffer_len(&stdout_buffer); 462511b41d2SMark Murray } 463511b41d2SMark Murray /* Send any buffered stderr data to the client. */ 464511b41d2SMark Murray if (buffer_len(&stderr_buffer) > 0) { 465511b41d2SMark Murray packet_start(SSH_SMSG_STDERR_DATA); 466511b41d2SMark Murray packet_put_string(buffer_ptr(&stderr_buffer), 467511b41d2SMark Murray buffer_len(&stderr_buffer)); 468511b41d2SMark Murray packet_send(); 469511b41d2SMark Murray /* Update the count of sent bytes. */ 470511b41d2SMark Murray stderr_bytes += buffer_len(&stderr_buffer); 471511b41d2SMark Murray } 472511b41d2SMark Murray /* Wait until all buffered data has been written to the client. */ 473511b41d2SMark Murray packet_write_wait(); 474511b41d2SMark Murray } 475511b41d2SMark Murray 476af12a3e7SDag-Erling Smørgrav static void 477ca3176e7SBrian Feldman process_buffered_input_packets(void) 478a04a10f8SKris Kennaway { 479ca3176e7SBrian Feldman dispatch_run(DISPATCH_NONBLOCK, NULL, compat20 ? xxx_kex : NULL); 480a04a10f8SKris Kennaway } 481a04a10f8SKris Kennaway 482511b41d2SMark Murray /* 483511b41d2SMark Murray * Performs the interactive session. This handles data transmission between 484511b41d2SMark Murray * the client and the program. Note that the notion of stdin, stdout, and 485511b41d2SMark Murray * stderr in this function is sort of reversed: this function writes to 486511b41d2SMark Murray * stdin (of the child program), and reads from stdout and stderr (of the 487511b41d2SMark Murray * child program). 488511b41d2SMark Murray */ 489511b41d2SMark Murray void 490a04a10f8SKris Kennaway server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg) 491511b41d2SMark Murray { 492ca3176e7SBrian Feldman fd_set *readset = NULL, *writeset = NULL; 493af12a3e7SDag-Erling Smørgrav int max_fd = 0, nalloc = 0; 494a04a10f8SKris Kennaway int wait_status; /* Status returned by wait(). */ 495a04a10f8SKris Kennaway pid_t wait_pid; /* pid returned by wait(). */ 496511b41d2SMark Murray int waiting_termination = 0; /* Have displayed waiting close message. */ 497ca3176e7SBrian Feldman u_int max_time_milliseconds; 498ca3176e7SBrian Feldman u_int previous_stdout_buffer_bytes; 499ca3176e7SBrian Feldman u_int stdout_buffer_bytes; 500511b41d2SMark Murray int type; 501511b41d2SMark Murray 502511b41d2SMark Murray debug("Entering interactive session."); 503511b41d2SMark Murray 504511b41d2SMark Murray /* Initialize the SIGCHLD kludge. */ 505511b41d2SMark Murray child_terminated = 0; 506989dd127SDag-Erling Smørgrav mysignal(SIGCHLD, sigchld_handler); 507511b41d2SMark Murray 508511b41d2SMark Murray /* Initialize our global variables. */ 509511b41d2SMark Murray fdin = fdin_arg; 510511b41d2SMark Murray fdout = fdout_arg; 511511b41d2SMark Murray fderr = fderr_arg; 5122632b0c8SKris Kennaway 5132632b0c8SKris Kennaway /* nonblocking IO */ 5142632b0c8SKris Kennaway set_nonblock(fdin); 5152632b0c8SKris Kennaway set_nonblock(fdout); 5162632b0c8SKris Kennaway /* we don't have stderr for interactive terminal sessions, see below */ 5172632b0c8SKris Kennaway if (fderr != -1) 5182632b0c8SKris Kennaway set_nonblock(fderr); 5192632b0c8SKris Kennaway 520e0fbb1d2SBrian Feldman if (!(datafellows & SSH_BUG_IGNOREMSG) && isatty(fdin)) 521e0fbb1d2SBrian Feldman fdin_is_tty = 1; 522e0fbb1d2SBrian Feldman 523511b41d2SMark Murray connection_in = packet_get_connection_in(); 524511b41d2SMark Murray connection_out = packet_get_connection_out(); 525511b41d2SMark Murray 526af12a3e7SDag-Erling Smørgrav notify_setup(); 527af12a3e7SDag-Erling Smørgrav 528511b41d2SMark Murray previous_stdout_buffer_bytes = 0; 529511b41d2SMark Murray 530511b41d2SMark Murray /* Set approximate I/O buffer size. */ 531511b41d2SMark Murray if (packet_is_interactive()) 532511b41d2SMark Murray buffer_high = 4096; 533511b41d2SMark Murray else 534511b41d2SMark Murray buffer_high = 64 * 1024; 535511b41d2SMark Murray 536af12a3e7SDag-Erling Smørgrav #if 0 537511b41d2SMark Murray /* Initialize max_fd to the maximum of the known file descriptors. */ 538af12a3e7SDag-Erling Smørgrav max_fd = MAX(connection_in, connection_out); 539af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, fdin); 540af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, fdout); 541ca3176e7SBrian Feldman if (fderr != -1) 542ca3176e7SBrian Feldman max_fd = MAX(max_fd, fderr); 543af12a3e7SDag-Erling Smørgrav #endif 544511b41d2SMark Murray 545511b41d2SMark Murray /* Initialize Initialize buffers. */ 546511b41d2SMark Murray buffer_init(&stdin_buffer); 547511b41d2SMark Murray buffer_init(&stdout_buffer); 548511b41d2SMark Murray buffer_init(&stderr_buffer); 549511b41d2SMark Murray 550511b41d2SMark Murray /* 551511b41d2SMark Murray * If we have no separate fderr (which is the case when we have a pty 552511b41d2SMark Murray * - there we cannot make difference between data sent to stdout and 553511b41d2SMark Murray * stderr), indicate that we have seen an EOF from stderr. This way 554511b41d2SMark Murray * we don\'t need to check the descriptor everywhere. 555511b41d2SMark Murray */ 556511b41d2SMark Murray if (fderr == -1) 557511b41d2SMark Murray fderr_eof = 1; 558511b41d2SMark Murray 559a04a10f8SKris Kennaway server_init_dispatch(); 560a04a10f8SKris Kennaway 561511b41d2SMark Murray /* Main loop of the server for the interactive session mode. */ 562511b41d2SMark Murray for (;;) { 563511b41d2SMark Murray 564511b41d2SMark Murray /* Process buffered packets from the client. */ 565511b41d2SMark Murray process_buffered_input_packets(); 566511b41d2SMark Murray 567511b41d2SMark Murray /* 568511b41d2SMark Murray * If we have received eof, and there is no more pending 569511b41d2SMark Murray * input data, cause a real eof by closing fdin. 570511b41d2SMark Murray */ 571511b41d2SMark Murray if (stdin_eof && fdin != -1 && buffer_len(&stdin_buffer) == 0) { 572a04a10f8SKris Kennaway if (fdin != fdout) 573511b41d2SMark Murray close(fdin); 574511b41d2SMark Murray else 575511b41d2SMark Murray shutdown(fdin, SHUT_WR); /* We will no longer send. */ 576511b41d2SMark Murray fdin = -1; 577511b41d2SMark Murray } 578511b41d2SMark Murray /* Make packets from buffered stderr data to send to the client. */ 579511b41d2SMark Murray make_packets_from_stderr_data(); 580511b41d2SMark Murray 581511b41d2SMark Murray /* 582511b41d2SMark Murray * Make packets from buffered stdout data to send to the 583511b41d2SMark Murray * client. If there is very little to send, this arranges to 584511b41d2SMark Murray * not send them now, but to wait a short while to see if we 585511b41d2SMark Murray * are getting more data. This is necessary, as some systems 586511b41d2SMark Murray * wake up readers from a pty after each separate character. 587511b41d2SMark Murray */ 588511b41d2SMark Murray max_time_milliseconds = 0; 589511b41d2SMark Murray stdout_buffer_bytes = buffer_len(&stdout_buffer); 590511b41d2SMark Murray if (stdout_buffer_bytes != 0 && stdout_buffer_bytes < 256 && 591511b41d2SMark Murray stdout_buffer_bytes != previous_stdout_buffer_bytes) { 592511b41d2SMark Murray /* try again after a while */ 593511b41d2SMark Murray max_time_milliseconds = 10; 594511b41d2SMark Murray } else { 595511b41d2SMark Murray /* Send it now. */ 596511b41d2SMark Murray make_packets_from_stdout_data(); 597511b41d2SMark Murray } 598511b41d2SMark Murray previous_stdout_buffer_bytes = buffer_len(&stdout_buffer); 599511b41d2SMark Murray 600511b41d2SMark Murray /* Send channel data to the client. */ 601511b41d2SMark Murray if (packet_not_very_much_data_to_write()) 602511b41d2SMark Murray channel_output_poll(); 603511b41d2SMark Murray 604511b41d2SMark Murray /* 605511b41d2SMark Murray * Bail out of the loop if the program has closed its output 606511b41d2SMark Murray * descriptors, and we have no more data to send to the 607511b41d2SMark Murray * client, and there is no pending buffered data. 608511b41d2SMark Murray */ 609511b41d2SMark Murray if (fdout_eof && fderr_eof && !packet_have_data_to_write() && 610511b41d2SMark Murray buffer_len(&stdout_buffer) == 0 && buffer_len(&stderr_buffer) == 0) { 611511b41d2SMark Murray if (!channel_still_open()) 612a04a10f8SKris Kennaway break; 613511b41d2SMark Murray if (!waiting_termination) { 614511b41d2SMark Murray const char *s = "Waiting for forwarded connections to terminate...\r\n"; 615511b41d2SMark Murray char *cp; 616511b41d2SMark Murray waiting_termination = 1; 617511b41d2SMark Murray buffer_append(&stderr_buffer, s, strlen(s)); 618511b41d2SMark Murray 619511b41d2SMark Murray /* Display list of open channels. */ 620511b41d2SMark Murray cp = channel_open_message(); 621511b41d2SMark Murray buffer_append(&stderr_buffer, cp, strlen(cp)); 622511b41d2SMark Murray xfree(cp); 623511b41d2SMark Murray } 624511b41d2SMark Murray } 625af12a3e7SDag-Erling Smørgrav max_fd = MAX(connection_in, connection_out); 626af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, fdin); 627af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, fdout); 628af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, fderr); 629af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, notify_pipe[0]); 630af12a3e7SDag-Erling Smørgrav 631511b41d2SMark Murray /* Sleep in select() until we can do something. */ 632ca3176e7SBrian Feldman wait_until_can_do_something(&readset, &writeset, &max_fd, 633af12a3e7SDag-Erling Smørgrav &nalloc, max_time_milliseconds); 634511b41d2SMark Murray 635511b41d2SMark Murray /* Process any channel events. */ 636ca3176e7SBrian Feldman channel_after_select(readset, writeset); 637511b41d2SMark Murray 638511b41d2SMark Murray /* Process input from the client and from program stdout/stderr. */ 639ca3176e7SBrian Feldman process_input(readset); 640511b41d2SMark Murray 641511b41d2SMark Murray /* Process output to the client and to program stdin. */ 642ca3176e7SBrian Feldman process_output(writeset); 643511b41d2SMark Murray } 644ca3176e7SBrian Feldman if (readset) 645ca3176e7SBrian Feldman xfree(readset); 646ca3176e7SBrian Feldman if (writeset) 647ca3176e7SBrian Feldman xfree(writeset); 648511b41d2SMark Murray 649511b41d2SMark Murray /* Cleanup and termination code. */ 650511b41d2SMark Murray 651511b41d2SMark Murray /* Wait until all output has been sent to the client. */ 652511b41d2SMark Murray drain_output(); 653511b41d2SMark Murray 654511b41d2SMark Murray debug("End of interactive session; stdin %ld, stdout (read %ld, sent %ld), stderr %ld bytes.", 655511b41d2SMark Murray stdin_bytes, fdout_bytes, stdout_bytes, stderr_bytes); 656511b41d2SMark Murray 657511b41d2SMark Murray /* Free and clear the buffers. */ 658511b41d2SMark Murray buffer_free(&stdin_buffer); 659511b41d2SMark Murray buffer_free(&stdout_buffer); 660511b41d2SMark Murray buffer_free(&stderr_buffer); 661511b41d2SMark Murray 662511b41d2SMark Murray /* Close the file descriptors. */ 663511b41d2SMark Murray if (fdout != -1) 664511b41d2SMark Murray close(fdout); 665511b41d2SMark Murray fdout = -1; 666511b41d2SMark Murray fdout_eof = 1; 667511b41d2SMark Murray if (fderr != -1) 668511b41d2SMark Murray close(fderr); 669511b41d2SMark Murray fderr = -1; 670511b41d2SMark Murray fderr_eof = 1; 671511b41d2SMark Murray if (fdin != -1) 672511b41d2SMark Murray close(fdin); 673511b41d2SMark Murray fdin = -1; 674511b41d2SMark Murray 675af12a3e7SDag-Erling Smørgrav channel_free_all(); 676511b41d2SMark Murray 677511b41d2SMark Murray /* We no longer want our SIGCHLD handler to be called. */ 678989dd127SDag-Erling Smørgrav mysignal(SIGCHLD, SIG_DFL); 679511b41d2SMark Murray 68080628bacSDag-Erling Smørgrav while ((wait_pid = waitpid(-1, &wait_status, 0)) < 0) 68180628bacSDag-Erling Smørgrav if (errno != EINTR) 682af12a3e7SDag-Erling Smørgrav packet_disconnect("wait: %.100s", strerror(errno)); 68380628bacSDag-Erling Smørgrav if (wait_pid != pid) 68480628bacSDag-Erling Smørgrav error("Strange, wait returned pid %ld, expected %ld", 68580628bacSDag-Erling Smørgrav (long)wait_pid, (long)pid); 686af12a3e7SDag-Erling Smørgrav 687511b41d2SMark Murray /* Check if it exited normally. */ 688511b41d2SMark Murray if (WIFEXITED(wait_status)) { 689511b41d2SMark Murray /* Yes, normal exit. Get exit status and send it to the client. */ 690511b41d2SMark Murray debug("Command exited with status %d.", WEXITSTATUS(wait_status)); 691511b41d2SMark Murray packet_start(SSH_SMSG_EXITSTATUS); 692511b41d2SMark Murray packet_put_int(WEXITSTATUS(wait_status)); 693511b41d2SMark Murray packet_send(); 694511b41d2SMark Murray packet_write_wait(); 695511b41d2SMark Murray 696511b41d2SMark Murray /* 697511b41d2SMark Murray * Wait for exit confirmation. Note that there might be 698511b41d2SMark Murray * other packets coming before it; however, the program has 699511b41d2SMark Murray * already died so we just ignore them. The client is 700511b41d2SMark Murray * supposed to respond with the confirmation when it receives 701511b41d2SMark Murray * the exit status. 702511b41d2SMark Murray */ 703511b41d2SMark Murray do { 704af12a3e7SDag-Erling Smørgrav type = packet_read(); 705511b41d2SMark Murray } 706511b41d2SMark Murray while (type != SSH_CMSG_EXIT_CONFIRMATION); 707511b41d2SMark Murray 708511b41d2SMark Murray debug("Received exit confirmation."); 709511b41d2SMark Murray return; 710511b41d2SMark Murray } 711511b41d2SMark Murray /* Check if the program terminated due to a signal. */ 712511b41d2SMark Murray if (WIFSIGNALED(wait_status)) 713511b41d2SMark Murray packet_disconnect("Command terminated on signal %d.", 714511b41d2SMark Murray WTERMSIG(wait_status)); 715511b41d2SMark Murray 716511b41d2SMark Murray /* Some weird exit cause. Just exit. */ 717511b41d2SMark Murray packet_disconnect("wait returned status %04x.", wait_status); 718511b41d2SMark Murray /* NOTREACHED */ 719511b41d2SMark Murray } 720a04a10f8SKris Kennaway 721af12a3e7SDag-Erling Smørgrav static void 722af12a3e7SDag-Erling Smørgrav collect_children(void) 723af12a3e7SDag-Erling Smørgrav { 724af12a3e7SDag-Erling Smørgrav pid_t pid; 725af12a3e7SDag-Erling Smørgrav sigset_t oset, nset; 726af12a3e7SDag-Erling Smørgrav int status; 727af12a3e7SDag-Erling Smørgrav 728af12a3e7SDag-Erling Smørgrav /* block SIGCHLD while we check for dead children */ 729af12a3e7SDag-Erling Smørgrav sigemptyset(&nset); 730af12a3e7SDag-Erling Smørgrav sigaddset(&nset, SIGCHLD); 731af12a3e7SDag-Erling Smørgrav sigprocmask(SIG_BLOCK, &nset, &oset); 732af12a3e7SDag-Erling Smørgrav if (child_terminated) { 73380628bacSDag-Erling Smørgrav while ((pid = waitpid(-1, &status, WNOHANG)) > 0 || 73480628bacSDag-Erling Smørgrav (pid < 0 && errno == EINTR)) 73580628bacSDag-Erling Smørgrav if (pid > 0) 736af12a3e7SDag-Erling Smørgrav session_close_by_pid(pid, status); 737af12a3e7SDag-Erling Smørgrav child_terminated = 0; 738af12a3e7SDag-Erling Smørgrav } 739af12a3e7SDag-Erling Smørgrav sigprocmask(SIG_SETMASK, &oset, NULL); 740af12a3e7SDag-Erling Smørgrav } 741af12a3e7SDag-Erling Smørgrav 742a04a10f8SKris Kennaway void 743af12a3e7SDag-Erling Smørgrav server_loop2(Authctxt *authctxt) 744a04a10f8SKris Kennaway { 745ca3176e7SBrian Feldman fd_set *readset = NULL, *writeset = NULL; 746af12a3e7SDag-Erling Smørgrav int rekeying = 0, max_fd, nalloc = 0; 747a04a10f8SKris Kennaway 748a04a10f8SKris Kennaway debug("Entering interactive session for SSH2."); 749a04a10f8SKris Kennaway 750989dd127SDag-Erling Smørgrav mysignal(SIGCHLD, sigchld_handler); 751a04a10f8SKris Kennaway child_terminated = 0; 752a04a10f8SKris Kennaway connection_in = packet_get_connection_in(); 753a04a10f8SKris Kennaway connection_out = packet_get_connection_out(); 754ca3176e7SBrian Feldman 755af12a3e7SDag-Erling Smørgrav notify_setup(); 756af12a3e7SDag-Erling Smørgrav 757ca3176e7SBrian Feldman max_fd = MAX(connection_in, connection_out); 758af12a3e7SDag-Erling Smørgrav max_fd = MAX(max_fd, notify_pipe[0]); 759af12a3e7SDag-Erling Smørgrav 760af12a3e7SDag-Erling Smørgrav xxx_authctxt = authctxt; 761ca3176e7SBrian Feldman 762a04a10f8SKris Kennaway server_init_dispatch(); 763a04a10f8SKris Kennaway 764a04a10f8SKris Kennaway for (;;) { 765a04a10f8SKris Kennaway process_buffered_input_packets(); 766ca3176e7SBrian Feldman 767ca3176e7SBrian Feldman rekeying = (xxx_kex != NULL && !xxx_kex->done); 768ca3176e7SBrian Feldman 769ca3176e7SBrian Feldman if (!rekeying && packet_not_very_much_data_to_write()) 770a04a10f8SKris Kennaway channel_output_poll(); 771ca3176e7SBrian Feldman wait_until_can_do_something(&readset, &writeset, &max_fd, 772af12a3e7SDag-Erling Smørgrav &nalloc, 0); 773af12a3e7SDag-Erling Smørgrav 774af12a3e7SDag-Erling Smørgrav collect_children(); 775ca3176e7SBrian Feldman if (!rekeying) 776ca3176e7SBrian Feldman channel_after_select(readset, writeset); 777ca3176e7SBrian Feldman process_input(readset); 778ca3176e7SBrian Feldman if (connection_closed) 779ca3176e7SBrian Feldman break; 780ca3176e7SBrian Feldman process_output(writeset); 781a04a10f8SKris Kennaway } 782af12a3e7SDag-Erling Smørgrav collect_children(); 783af12a3e7SDag-Erling Smørgrav 784ca3176e7SBrian Feldman if (readset) 785ca3176e7SBrian Feldman xfree(readset); 786ca3176e7SBrian Feldman if (writeset) 787ca3176e7SBrian Feldman xfree(writeset); 788ca3176e7SBrian Feldman 789af12a3e7SDag-Erling Smørgrav /* free all channels, no more reads and writes */ 790af12a3e7SDag-Erling Smørgrav channel_free_all(); 791af12a3e7SDag-Erling Smørgrav 792af12a3e7SDag-Erling Smørgrav /* free remaining sessions, e.g. remove wtmp entries */ 79380628bacSDag-Erling Smørgrav session_destroy_all(NULL); 794a04a10f8SKris Kennaway } 795a04a10f8SKris Kennaway 796af12a3e7SDag-Erling Smørgrav static void 797af12a3e7SDag-Erling Smørgrav server_input_channel_failure(int type, u_int32_t seq, void *ctxt) 798ca3176e7SBrian Feldman { 799ca3176e7SBrian Feldman debug("Got CHANNEL_FAILURE for keepalive"); 800ca3176e7SBrian Feldman /* 801ca3176e7SBrian Feldman * reset timeout, since we got a sane answer from the client. 802ca3176e7SBrian Feldman * even if this was generated by something other than 803ca3176e7SBrian Feldman * the bogus CHANNEL_REQUEST we send for keepalives. 804ca3176e7SBrian Feldman */ 805ca3176e7SBrian Feldman client_alive_timeouts = 0; 806ca3176e7SBrian Feldman } 807ca3176e7SBrian Feldman 808ca3176e7SBrian Feldman 809af12a3e7SDag-Erling Smørgrav static void 810af12a3e7SDag-Erling Smørgrav server_input_stdin_data(int type, u_int32_t seq, void *ctxt) 811a04a10f8SKris Kennaway { 812a04a10f8SKris Kennaway char *data; 813ca3176e7SBrian Feldman u_int data_len; 814a04a10f8SKris Kennaway 815a04a10f8SKris Kennaway /* Stdin data from the client. Append it to the buffer. */ 816a04a10f8SKris Kennaway /* Ignore any data if the client has closed stdin. */ 817a04a10f8SKris Kennaway if (fdin == -1) 818a04a10f8SKris Kennaway return; 819a04a10f8SKris Kennaway data = packet_get_string(&data_len); 820af12a3e7SDag-Erling Smørgrav packet_check_eom(); 821a04a10f8SKris Kennaway buffer_append(&stdin_buffer, data, data_len); 822a04a10f8SKris Kennaway memset(data, 0, data_len); 823a04a10f8SKris Kennaway xfree(data); 824a04a10f8SKris Kennaway } 825a04a10f8SKris Kennaway 826af12a3e7SDag-Erling Smørgrav static void 827af12a3e7SDag-Erling Smørgrav server_input_eof(int type, u_int32_t seq, void *ctxt) 828a04a10f8SKris Kennaway { 829a04a10f8SKris Kennaway /* 830a04a10f8SKris Kennaway * Eof from the client. The stdin descriptor to the 831a04a10f8SKris Kennaway * program will be closed when all buffered data has 832a04a10f8SKris Kennaway * drained. 833a04a10f8SKris Kennaway */ 834a04a10f8SKris Kennaway debug("EOF received for stdin."); 835af12a3e7SDag-Erling Smørgrav packet_check_eom(); 836a04a10f8SKris Kennaway stdin_eof = 1; 837a04a10f8SKris Kennaway } 838a04a10f8SKris Kennaway 839af12a3e7SDag-Erling Smørgrav static void 840af12a3e7SDag-Erling Smørgrav server_input_window_size(int type, u_int32_t seq, void *ctxt) 841a04a10f8SKris Kennaway { 842a04a10f8SKris Kennaway int row = packet_get_int(); 843a04a10f8SKris Kennaway int col = packet_get_int(); 844a04a10f8SKris Kennaway int xpixel = packet_get_int(); 845a04a10f8SKris Kennaway int ypixel = packet_get_int(); 846a04a10f8SKris Kennaway 847a04a10f8SKris Kennaway debug("Window change received."); 848af12a3e7SDag-Erling Smørgrav packet_check_eom(); 849a04a10f8SKris Kennaway if (fdin != -1) 850a04a10f8SKris Kennaway pty_change_window_size(fdin, row, col, xpixel, ypixel); 851a04a10f8SKris Kennaway } 852a04a10f8SKris Kennaway 853af12a3e7SDag-Erling Smørgrav static Channel * 854ca3176e7SBrian Feldman server_request_direct_tcpip(char *ctype) 855a04a10f8SKris Kennaway { 856af12a3e7SDag-Erling Smørgrav Channel *c; 857af12a3e7SDag-Erling Smørgrav int sock; 858a04a10f8SKris Kennaway char *target, *originator; 859a04a10f8SKris Kennaway int target_port, originator_port; 860a04a10f8SKris Kennaway 861a04a10f8SKris Kennaway target = packet_get_string(NULL); 862a04a10f8SKris Kennaway target_port = packet_get_int(); 863a04a10f8SKris Kennaway originator = packet_get_string(NULL); 864a04a10f8SKris Kennaway originator_port = packet_get_int(); 865af12a3e7SDag-Erling Smørgrav packet_check_eom(); 8662632b0c8SKris Kennaway 867ca3176e7SBrian Feldman debug("server_request_direct_tcpip: originator %s port %d, target %s port %d", 8682632b0c8SKris Kennaway originator, originator_port, target, target_port); 869b66f2d16SKris Kennaway 870a04a10f8SKris Kennaway /* XXX check permission */ 871a04a10f8SKris Kennaway sock = channel_connect_to(target, target_port); 872a04a10f8SKris Kennaway xfree(target); 873a04a10f8SKris Kennaway xfree(originator); 874a04a10f8SKris Kennaway if (sock < 0) 875ca3176e7SBrian Feldman return NULL; 876af12a3e7SDag-Erling Smørgrav c = channel_new(ctype, SSH_CHANNEL_CONNECTING, 877b66f2d16SKris Kennaway sock, sock, -1, CHAN_TCP_WINDOW_DEFAULT, 8785b9b2fafSBrian Feldman CHAN_TCP_PACKET_DEFAULT, 0, xstrdup("direct-tcpip"), 1); 879af12a3e7SDag-Erling Smørgrav return c; 880ca3176e7SBrian Feldman } 881ca3176e7SBrian Feldman 882af12a3e7SDag-Erling Smørgrav static Channel * 883ca3176e7SBrian Feldman server_request_session(char *ctype) 884ca3176e7SBrian Feldman { 885af12a3e7SDag-Erling Smørgrav Channel *c; 886ca3176e7SBrian Feldman 887ca3176e7SBrian Feldman debug("input_session_request"); 888af12a3e7SDag-Erling Smørgrav packet_check_eom(); 889ca3176e7SBrian Feldman /* 890ca3176e7SBrian Feldman * A server session has no fd to read or write until a 891ca3176e7SBrian Feldman * CHANNEL_REQUEST for a shell is made, so we set the type to 892ca3176e7SBrian Feldman * SSH_CHANNEL_LARVAL. Additionally, a callback for handling all 893ca3176e7SBrian Feldman * CHANNEL_REQUEST messages is registered. 894ca3176e7SBrian Feldman */ 895af12a3e7SDag-Erling Smørgrav c = channel_new(ctype, SSH_CHANNEL_LARVAL, 896af12a3e7SDag-Erling Smørgrav -1, -1, -1, /*window size*/0, CHAN_SES_PACKET_DEFAULT, 897ca3176e7SBrian Feldman 0, xstrdup("server-session"), 1); 898af12a3e7SDag-Erling Smørgrav if (session_open(xxx_authctxt, c->self) != 1) { 899af12a3e7SDag-Erling Smørgrav debug("session open failed, free channel %d", c->self); 900af12a3e7SDag-Erling Smørgrav channel_free(c); 901ca3176e7SBrian Feldman return NULL; 902a04a10f8SKris Kennaway } 903af12a3e7SDag-Erling Smørgrav channel_register_cleanup(c->self, session_close_by_channel); 904af12a3e7SDag-Erling Smørgrav return c; 905af12a3e7SDag-Erling Smørgrav } 906a04a10f8SKris Kennaway 907af12a3e7SDag-Erling Smørgrav static void 908af12a3e7SDag-Erling Smørgrav server_input_channel_open(int type, u_int32_t seq, void *ctxt) 909a04a10f8SKris Kennaway { 910a04a10f8SKris Kennaway Channel *c = NULL; 911a04a10f8SKris Kennaway char *ctype; 912a04a10f8SKris Kennaway int rchan; 913a82e551fSDag-Erling Smørgrav u_int rmaxpack, rwindow, len; 914a04a10f8SKris Kennaway 915a04a10f8SKris Kennaway ctype = packet_get_string(&len); 916a04a10f8SKris Kennaway rchan = packet_get_int(); 917a04a10f8SKris Kennaway rwindow = packet_get_int(); 918a04a10f8SKris Kennaway rmaxpack = packet_get_int(); 919a04a10f8SKris Kennaway 9205b9b2fafSBrian Feldman debug("server_input_channel_open: ctype %s rchan %d win %d max %d", 921a04a10f8SKris Kennaway ctype, rchan, rwindow, rmaxpack); 922a04a10f8SKris Kennaway 923a04a10f8SKris Kennaway if (strcmp(ctype, "session") == 0) { 924ca3176e7SBrian Feldman c = server_request_session(ctype); 925a04a10f8SKris Kennaway } else if (strcmp(ctype, "direct-tcpip") == 0) { 926ca3176e7SBrian Feldman c = server_request_direct_tcpip(ctype); 927a04a10f8SKris Kennaway } 928a04a10f8SKris Kennaway if (c != NULL) { 929ca3176e7SBrian Feldman debug("server_input_channel_open: confirm %s", ctype); 930a04a10f8SKris Kennaway c->remote_id = rchan; 931a04a10f8SKris Kennaway c->remote_window = rwindow; 932a04a10f8SKris Kennaway c->remote_maxpacket = rmaxpack; 933af12a3e7SDag-Erling Smørgrav if (c->type != SSH_CHANNEL_CONNECTING) { 934a04a10f8SKris Kennaway packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); 935a04a10f8SKris Kennaway packet_put_int(c->remote_id); 936a04a10f8SKris Kennaway packet_put_int(c->self); 937a04a10f8SKris Kennaway packet_put_int(c->local_window); 938a04a10f8SKris Kennaway packet_put_int(c->local_maxpacket); 939a04a10f8SKris Kennaway packet_send(); 940af12a3e7SDag-Erling Smørgrav } 941a04a10f8SKris Kennaway } else { 942ca3176e7SBrian Feldman debug("server_input_channel_open: failure %s", ctype); 943a04a10f8SKris Kennaway packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE); 944a04a10f8SKris Kennaway packet_put_int(rchan); 945a04a10f8SKris Kennaway packet_put_int(SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED); 946af12a3e7SDag-Erling Smørgrav if (!(datafellows & SSH_BUG_OPENFAILURE)) { 947af12a3e7SDag-Erling Smørgrav packet_put_cstring("open failed"); 948a04a10f8SKris Kennaway packet_put_cstring(""); 949af12a3e7SDag-Erling Smørgrav } 950a04a10f8SKris Kennaway packet_send(); 951a04a10f8SKris Kennaway } 952a04a10f8SKris Kennaway xfree(ctype); 953a04a10f8SKris Kennaway } 954a04a10f8SKris Kennaway 955af12a3e7SDag-Erling Smørgrav static void 956af12a3e7SDag-Erling Smørgrav server_input_global_request(int type, u_int32_t seq, void *ctxt) 957ca3176e7SBrian Feldman { 958ca3176e7SBrian Feldman char *rtype; 959ca3176e7SBrian Feldman int want_reply; 960ca3176e7SBrian Feldman int success = 0; 961ca3176e7SBrian Feldman 962ca3176e7SBrian Feldman rtype = packet_get_string(NULL); 963ca3176e7SBrian Feldman want_reply = packet_get_char(); 964ca3176e7SBrian Feldman debug("server_input_global_request: rtype %s want_reply %d", rtype, want_reply); 965ca3176e7SBrian Feldman 966ca3176e7SBrian Feldman /* -R style forwarding */ 967ca3176e7SBrian Feldman if (strcmp(rtype, "tcpip-forward") == 0) { 968ca3176e7SBrian Feldman struct passwd *pw; 969ca3176e7SBrian Feldman char *listen_address; 970ca3176e7SBrian Feldman u_short listen_port; 971ca3176e7SBrian Feldman 972ca3176e7SBrian Feldman pw = auth_get_user(); 973ca3176e7SBrian Feldman if (pw == NULL) 974ca3176e7SBrian Feldman fatal("server_input_global_request: no user"); 975ca3176e7SBrian Feldman listen_address = packet_get_string(NULL); /* XXX currently ignored */ 976ca3176e7SBrian Feldman listen_port = (u_short)packet_get_int(); 977ca3176e7SBrian Feldman debug("server_input_global_request: tcpip-forward listen %s port %d", 978ca3176e7SBrian Feldman listen_address, listen_port); 979ca3176e7SBrian Feldman 980ca3176e7SBrian Feldman /* check permissions */ 981ca3176e7SBrian Feldman if (!options.allow_tcp_forwarding || 982f388f5efSDag-Erling Smørgrav no_port_forwarding_flag 983f388f5efSDag-Erling Smørgrav #ifndef NO_IPPORT_RESERVED_CONCEPT 984f388f5efSDag-Erling Smørgrav || (listen_port < IPPORT_RESERVED && pw->pw_uid != 0) 985f388f5efSDag-Erling Smørgrav #endif 986f388f5efSDag-Erling Smørgrav ) { 987ca3176e7SBrian Feldman success = 0; 988ca3176e7SBrian Feldman packet_send_debug("Server has disabled port forwarding."); 989ca3176e7SBrian Feldman } else { 990ca3176e7SBrian Feldman /* Start listening on the port */ 991af12a3e7SDag-Erling Smørgrav success = channel_setup_remote_fwd_listener( 992af12a3e7SDag-Erling Smørgrav listen_address, listen_port, options.gateway_ports); 993ca3176e7SBrian Feldman } 994ca3176e7SBrian Feldman xfree(listen_address); 995ca3176e7SBrian Feldman } 996ca3176e7SBrian Feldman if (want_reply) { 997ca3176e7SBrian Feldman packet_start(success ? 998ca3176e7SBrian Feldman SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE); 999ca3176e7SBrian Feldman packet_send(); 1000ca3176e7SBrian Feldman packet_write_wait(); 1001ca3176e7SBrian Feldman } 1002ca3176e7SBrian Feldman xfree(rtype); 1003ca3176e7SBrian Feldman } 1004af12a3e7SDag-Erling Smørgrav static void 1005af12a3e7SDag-Erling Smørgrav server_input_channel_req(int type, u_int32_t seq, void *ctxt) 1006af12a3e7SDag-Erling Smørgrav { 1007af12a3e7SDag-Erling Smørgrav Channel *c; 1008af12a3e7SDag-Erling Smørgrav int id, reply, success = 0; 1009af12a3e7SDag-Erling Smørgrav char *rtype; 1010ca3176e7SBrian Feldman 1011af12a3e7SDag-Erling Smørgrav id = packet_get_int(); 1012af12a3e7SDag-Erling Smørgrav rtype = packet_get_string(NULL); 1013af12a3e7SDag-Erling Smørgrav reply = packet_get_char(); 1014af12a3e7SDag-Erling Smørgrav 1015af12a3e7SDag-Erling Smørgrav debug("server_input_channel_req: channel %d request %s reply %d", 1016af12a3e7SDag-Erling Smørgrav id, rtype, reply); 1017af12a3e7SDag-Erling Smørgrav 1018af12a3e7SDag-Erling Smørgrav if ((c = channel_lookup(id)) == NULL) 1019af12a3e7SDag-Erling Smørgrav packet_disconnect("server_input_channel_req: " 1020af12a3e7SDag-Erling Smørgrav "unknown channel %d", id); 1021af12a3e7SDag-Erling Smørgrav if (c->type == SSH_CHANNEL_LARVAL || c->type == SSH_CHANNEL_OPEN) 1022af12a3e7SDag-Erling Smørgrav success = session_input_channel_req(c, rtype); 1023af12a3e7SDag-Erling Smørgrav if (reply) { 1024af12a3e7SDag-Erling Smørgrav packet_start(success ? 1025af12a3e7SDag-Erling Smørgrav SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE); 1026af12a3e7SDag-Erling Smørgrav packet_put_int(c->remote_id); 1027af12a3e7SDag-Erling Smørgrav packet_send(); 1028af12a3e7SDag-Erling Smørgrav } 1029af12a3e7SDag-Erling Smørgrav xfree(rtype); 1030af12a3e7SDag-Erling Smørgrav } 1031af12a3e7SDag-Erling Smørgrav 1032af12a3e7SDag-Erling Smørgrav static void 1033ca3176e7SBrian Feldman server_init_dispatch_20(void) 1034a04a10f8SKris Kennaway { 1035a04a10f8SKris Kennaway debug("server_init_dispatch_20"); 1036a04a10f8SKris Kennaway dispatch_init(&dispatch_protocol_error); 1037a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_CLOSE, &channel_input_oclose); 1038a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_DATA, &channel_input_data); 1039a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_EOF, &channel_input_ieof); 1040a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_EXTENDED_DATA, &channel_input_extended_data); 1041a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_OPEN, &server_input_channel_open); 1042a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation); 1043a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure); 1044af12a3e7SDag-Erling Smørgrav dispatch_set(SSH2_MSG_CHANNEL_REQUEST, &server_input_channel_req); 1045a04a10f8SKris Kennaway dispatch_set(SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust); 1046ca3176e7SBrian Feldman dispatch_set(SSH2_MSG_GLOBAL_REQUEST, &server_input_global_request); 1047ca3176e7SBrian Feldman /* client_alive */ 1048ca3176e7SBrian Feldman dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &server_input_channel_failure); 1049ca3176e7SBrian Feldman /* rekeying */ 1050ca3176e7SBrian Feldman dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit); 1051a04a10f8SKris Kennaway } 1052af12a3e7SDag-Erling Smørgrav static void 1053ca3176e7SBrian Feldman server_init_dispatch_13(void) 1054a04a10f8SKris Kennaway { 1055a04a10f8SKris Kennaway debug("server_init_dispatch_13"); 1056a04a10f8SKris Kennaway dispatch_init(NULL); 1057a04a10f8SKris Kennaway dispatch_set(SSH_CMSG_EOF, &server_input_eof); 1058a04a10f8SKris Kennaway dispatch_set(SSH_CMSG_STDIN_DATA, &server_input_stdin_data); 1059a04a10f8SKris Kennaway dispatch_set(SSH_CMSG_WINDOW_SIZE, &server_input_window_size); 1060a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_close); 1061a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, &channel_input_close_confirmation); 1062a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_DATA, &channel_input_data); 1063a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation); 1064a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure); 1065a04a10f8SKris Kennaway dispatch_set(SSH_MSG_PORT_OPEN, &channel_input_port_open); 1066a04a10f8SKris Kennaway } 1067af12a3e7SDag-Erling Smørgrav static void 1068ca3176e7SBrian Feldman server_init_dispatch_15(void) 1069a04a10f8SKris Kennaway { 1070a04a10f8SKris Kennaway server_init_dispatch_13(); 1071a04a10f8SKris Kennaway debug("server_init_dispatch_15"); 1072a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_ieof); 1073a04a10f8SKris Kennaway dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, &channel_input_oclose); 1074a04a10f8SKris Kennaway } 1075af12a3e7SDag-Erling Smørgrav static void 1076ca3176e7SBrian Feldman server_init_dispatch(void) 1077a04a10f8SKris Kennaway { 1078a04a10f8SKris Kennaway if (compat20) 1079a04a10f8SKris Kennaway server_init_dispatch_20(); 1080a04a10f8SKris Kennaway else if (compat13) 1081a04a10f8SKris Kennaway server_init_dispatch_13(); 1082a04a10f8SKris Kennaway else 1083a04a10f8SKris Kennaway server_init_dispatch_15(); 1084a04a10f8SKris Kennaway } 1085