xref: /freebsd/crypto/openssh/serverloop.c (revision 7778ab7e0cc22f0824eb1d1047a7ef8b4785267a)
1 /* $OpenBSD: serverloop.c,v 1.159 2009/05/28 16:50:16 andreas Exp $ */
2 /* $FreeBSD$ */
3 /*
4  * Author: Tatu Ylonen <ylo@cs.hut.fi>
5  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6  *                    All rights reserved
7  * Server main loop for handling the interactive session.
8  *
9  * As far as I am concerned, the code I have written for this software
10  * can be used freely for any purpose.  Any derived versions of this
11  * software must be clearly marked as such, and if the derived work is
12  * incompatible with the protocol description in the RFC file, it must be
13  * called by a name other than "ssh" or "Secure Shell".
14  *
15  * SSH2 support by Markus Friedl.
16  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
17  *
18  * Redistribution and use in source and binary forms, with or without
19  * modification, are permitted provided that the following conditions
20  * are met:
21  * 1. Redistributions of source code must retain the above copyright
22  *    notice, this list of conditions and the following disclaimer.
23  * 2. Redistributions in binary form must reproduce the above copyright
24  *    notice, this list of conditions and the following disclaimer in the
25  *    documentation and/or other materials provided with the distribution.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
28  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
29  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
30  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
31  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
32  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
33  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
34  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
35  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
36  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
37  */
38 
39 #include "includes.h"
40 
41 #include <sys/types.h>
42 #include <sys/param.h>
43 #include <sys/wait.h>
44 #include <sys/socket.h>
45 #ifdef HAVE_SYS_TIME_H
46 # include <sys/time.h>
47 #endif
48 
49 #include <netinet/in.h>
50 
51 #include <errno.h>
52 #include <fcntl.h>
53 #include <pwd.h>
54 #include <signal.h>
55 #include <string.h>
56 #include <termios.h>
57 #include <unistd.h>
58 #include <stdarg.h>
59 
60 #include "openbsd-compat/sys-queue.h"
61 #include "xmalloc.h"
62 #include "packet.h"
63 #include "buffer.h"
64 #include "log.h"
65 #include "servconf.h"
66 #include "canohost.h"
67 #include "sshpty.h"
68 #include "channels.h"
69 #include "compat.h"
70 #include "ssh1.h"
71 #include "ssh2.h"
72 #include "key.h"
73 #include "cipher.h"
74 #include "kex.h"
75 #include "hostfile.h"
76 #include "auth.h"
77 #include "session.h"
78 #include "dispatch.h"
79 #include "auth-options.h"
80 #include "serverloop.h"
81 #include "misc.h"
82 #include "roaming.h"
83 
84 extern ServerOptions options;
85 
86 /* XXX */
87 extern Kex *xxx_kex;
88 extern Authctxt *the_authctxt;
89 extern int use_privsep;
90 
91 static Buffer stdin_buffer;	/* Buffer for stdin data. */
92 static Buffer stdout_buffer;	/* Buffer for stdout data. */
93 static Buffer stderr_buffer;	/* Buffer for stderr data. */
94 static int fdin;		/* Descriptor for stdin (for writing) */
95 static int fdout;		/* Descriptor for stdout (for reading);
96 				   May be same number as fdin. */
97 static int fderr;		/* Descriptor for stderr.  May be -1. */
98 static long stdin_bytes = 0;	/* Number of bytes written to stdin. */
99 static long stdout_bytes = 0;	/* Number of stdout bytes sent to client. */
100 static long stderr_bytes = 0;	/* Number of stderr bytes sent to client. */
101 static long fdout_bytes = 0;	/* Number of stdout bytes read from program. */
102 static int stdin_eof = 0;	/* EOF message received from client. */
103 static int fdout_eof = 0;	/* EOF encountered reading from fdout. */
104 static int fderr_eof = 0;	/* EOF encountered readung from fderr. */
105 static int fdin_is_tty = 0;	/* fdin points to a tty. */
106 static int connection_in;	/* Connection to client (input). */
107 static int connection_out;	/* Connection to client (output). */
108 static int connection_closed = 0;	/* Connection to client closed. */
109 static u_int buffer_high;	/* "Soft" max buffer size. */
110 static int no_more_sessions = 0; /* Disallow further sessions. */
111 
112 /*
113  * This SIGCHLD kludge is used to detect when the child exits.  The server
114  * will exit after that, as soon as forwarded connections have terminated.
115  */
116 
117 static volatile sig_atomic_t child_terminated = 0;	/* The child has terminated. */
118 
119 /* Cleanup on signals (!use_privsep case only) */
120 static volatile sig_atomic_t received_sigterm = 0;
121 
122 /* prototypes */
123 static void server_init_dispatch(void);
124 
125 /*
126  * we write to this pipe if a SIGCHLD is caught in order to avoid
127  * the race between select() and child_terminated
128  */
129 static int notify_pipe[2];
130 static void
131 notify_setup(void)
132 {
133 	if (pipe(notify_pipe) < 0) {
134 		error("pipe(notify_pipe) failed %s", strerror(errno));
135 	} else if ((fcntl(notify_pipe[0], F_SETFD, 1) == -1) ||
136 	    (fcntl(notify_pipe[1], F_SETFD, 1) == -1)) {
137 		error("fcntl(notify_pipe, F_SETFD) failed %s", strerror(errno));
138 		close(notify_pipe[0]);
139 		close(notify_pipe[1]);
140 	} else {
141 		set_nonblock(notify_pipe[0]);
142 		set_nonblock(notify_pipe[1]);
143 		return;
144 	}
145 	notify_pipe[0] = -1;	/* read end */
146 	notify_pipe[1] = -1;	/* write end */
147 }
148 static void
149 notify_parent(void)
150 {
151 	if (notify_pipe[1] != -1)
152 		write(notify_pipe[1], "", 1);
153 }
154 static void
155 notify_prepare(fd_set *readset)
156 {
157 	if (notify_pipe[0] != -1)
158 		FD_SET(notify_pipe[0], readset);
159 }
160 static void
161 notify_done(fd_set *readset)
162 {
163 	char c;
164 
165 	if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset))
166 		while (read(notify_pipe[0], &c, 1) != -1)
167 			debug2("notify_done: reading");
168 }
169 
170 /*ARGSUSED*/
171 static void
172 sigchld_handler(int sig)
173 {
174 	int save_errno = errno;
175 	child_terminated = 1;
176 #ifndef _UNICOS
177 	mysignal(SIGCHLD, sigchld_handler);
178 #endif
179 	notify_parent();
180 	errno = save_errno;
181 }
182 
183 /*ARGSUSED*/
184 static void
185 sigterm_handler(int sig)
186 {
187 	received_sigterm = sig;
188 }
189 
190 /*
191  * Make packets from buffered stderr data, and buffer it for sending
192  * to the client.
193  */
194 static void
195 make_packets_from_stderr_data(void)
196 {
197 	u_int len;
198 
199 	/* Send buffered stderr data to the client. */
200 	while (buffer_len(&stderr_buffer) > 0 &&
201 	    packet_not_very_much_data_to_write()) {
202 		len = buffer_len(&stderr_buffer);
203 		if (packet_is_interactive()) {
204 			if (len > 512)
205 				len = 512;
206 		} else {
207 			/* Keep the packets at reasonable size. */
208 			if (len > packet_get_maxsize())
209 				len = packet_get_maxsize();
210 		}
211 		packet_start(SSH_SMSG_STDERR_DATA);
212 		packet_put_string(buffer_ptr(&stderr_buffer), len);
213 		packet_send();
214 		buffer_consume(&stderr_buffer, len);
215 		stderr_bytes += len;
216 	}
217 }
218 
219 /*
220  * Make packets from buffered stdout data, and buffer it for sending to the
221  * client.
222  */
223 static void
224 make_packets_from_stdout_data(void)
225 {
226 	u_int len;
227 
228 	/* Send buffered stdout data to the client. */
229 	while (buffer_len(&stdout_buffer) > 0 &&
230 	    packet_not_very_much_data_to_write()) {
231 		len = buffer_len(&stdout_buffer);
232 		if (packet_is_interactive()) {
233 			if (len > 512)
234 				len = 512;
235 		} else {
236 			/* Keep the packets at reasonable size. */
237 			if (len > packet_get_maxsize())
238 				len = packet_get_maxsize();
239 		}
240 		packet_start(SSH_SMSG_STDOUT_DATA);
241 		packet_put_string(buffer_ptr(&stdout_buffer), len);
242 		packet_send();
243 		buffer_consume(&stdout_buffer, len);
244 		stdout_bytes += len;
245 	}
246 }
247 
248 static void
249 client_alive_check(void)
250 {
251 	int channel_id;
252 
253 	/* timeout, check to see how many we have had */
254 	if (packet_inc_alive_timeouts() > options.client_alive_count_max) {
255 		logit("Timeout, client not responding.");
256 		cleanup_exit(255);
257 	}
258 
259 	/*
260 	 * send a bogus global/channel request with "wantreply",
261 	 * we should get back a failure
262 	 */
263 	if ((channel_id = channel_find_open()) == -1) {
264 		packet_start(SSH2_MSG_GLOBAL_REQUEST);
265 		packet_put_cstring("keepalive@openssh.com");
266 		packet_put_char(1);	/* boolean: want reply */
267 	} else {
268 		channel_request_start(channel_id, "keepalive@openssh.com", 1);
269 	}
270 	packet_send();
271 }
272 
273 /*
274  * Sleep in select() until we can do something.  This will initialize the
275  * select masks.  Upon return, the masks will indicate which descriptors
276  * have data or can accept data.  Optionally, a maximum time can be specified
277  * for the duration of the wait (0 = infinite).
278  */
279 static void
280 wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp, int *maxfdp,
281     u_int *nallocp, u_int max_time_milliseconds)
282 {
283 	struct timeval tv, *tvp;
284 	int ret;
285 	int client_alive_scheduled = 0;
286 	int program_alive_scheduled = 0;
287 
288 	/*
289 	 * if using client_alive, set the max timeout accordingly,
290 	 * and indicate that this particular timeout was for client
291 	 * alive by setting the client_alive_scheduled flag.
292 	 *
293 	 * this could be randomized somewhat to make traffic
294 	 * analysis more difficult, but we're not doing it yet.
295 	 */
296 	if (compat20 &&
297 	    max_time_milliseconds == 0 && options.client_alive_interval) {
298 		client_alive_scheduled = 1;
299 		max_time_milliseconds = options.client_alive_interval * 1000;
300 	}
301 
302 	/* Allocate and update select() masks for channel descriptors. */
303 	channel_prepare_select(readsetp, writesetp, maxfdp, nallocp, 0);
304 
305 	if (compat20) {
306 #if 0
307 		/* wrong: bad condition XXX */
308 		if (channel_not_very_much_buffered_data())
309 #endif
310 		FD_SET(connection_in, *readsetp);
311 	} else {
312 		/*
313 		 * Read packets from the client unless we have too much
314 		 * buffered stdin or channel data.
315 		 */
316 		if (buffer_len(&stdin_buffer) < buffer_high &&
317 		    channel_not_very_much_buffered_data())
318 			FD_SET(connection_in, *readsetp);
319 		/*
320 		 * If there is not too much data already buffered going to
321 		 * the client, try to get some more data from the program.
322 		 */
323 		if (packet_not_very_much_data_to_write()) {
324 			program_alive_scheduled = child_terminated;
325 			if (!fdout_eof)
326 				FD_SET(fdout, *readsetp);
327 			if (!fderr_eof)
328 				FD_SET(fderr, *readsetp);
329 		}
330 		/*
331 		 * If we have buffered data, try to write some of that data
332 		 * to the program.
333 		 */
334 		if (fdin != -1 && buffer_len(&stdin_buffer) > 0)
335 			FD_SET(fdin, *writesetp);
336 	}
337 	notify_prepare(*readsetp);
338 
339 	/*
340 	 * If we have buffered packet data going to the client, mark that
341 	 * descriptor.
342 	 */
343 	if (packet_have_data_to_write())
344 		FD_SET(connection_out, *writesetp);
345 
346 	/*
347 	 * If child has terminated and there is enough buffer space to read
348 	 * from it, then read as much as is available and exit.
349 	 */
350 	if (child_terminated && packet_not_very_much_data_to_write())
351 		if (max_time_milliseconds == 0 || client_alive_scheduled)
352 			max_time_milliseconds = 100;
353 
354 	if (max_time_milliseconds == 0)
355 		tvp = NULL;
356 	else {
357 		tv.tv_sec = max_time_milliseconds / 1000;
358 		tv.tv_usec = 1000 * (max_time_milliseconds % 1000);
359 		tvp = &tv;
360 	}
361 
362 	/* Wait for something to happen, or the timeout to expire. */
363 	ret = select((*maxfdp)+1, *readsetp, *writesetp, NULL, tvp);
364 
365 	if (ret == -1) {
366 		memset(*readsetp, 0, *nallocp);
367 		memset(*writesetp, 0, *nallocp);
368 		if (errno != EINTR)
369 			error("select: %.100s", strerror(errno));
370 	} else {
371 		if (ret == 0 && client_alive_scheduled)
372 			client_alive_check();
373 		if (!compat20 && program_alive_scheduled && fdin_is_tty) {
374 			if (!fdout_eof)
375 				FD_SET(fdout, *readsetp);
376 			if (!fderr_eof)
377 				FD_SET(fderr, *readsetp);
378 		}
379 	}
380 
381 	notify_done(*readsetp);
382 }
383 
384 /*
385  * Processes input from the client and the program.  Input data is stored
386  * in buffers and processed later.
387  */
388 static void
389 process_input(fd_set *readset)
390 {
391 	int len;
392 	char buf[16384];
393 
394 	/* Read and buffer any input data from the client. */
395 	if (FD_ISSET(connection_in, readset)) {
396 		int cont = 0;
397 		len = roaming_read(connection_in, buf, sizeof(buf), &cont);
398 		if (len == 0) {
399 			if (cont)
400 				return;
401 			verbose("Connection closed by %.100s",
402 			    get_remote_ipaddr());
403 			connection_closed = 1;
404 			if (compat20)
405 				return;
406 			cleanup_exit(255);
407 		} else if (len < 0) {
408 			if (errno != EINTR && errno != EAGAIN &&
409 			    errno != EWOULDBLOCK) {
410 				verbose("Read error from remote host "
411 				    "%.100s: %.100s",
412 				    get_remote_ipaddr(), strerror(errno));
413 				cleanup_exit(255);
414 			}
415 		} else {
416 			/* Buffer any received data. */
417 			packet_process_incoming(buf, len);
418 		}
419 	}
420 	if (compat20)
421 		return;
422 
423 	/* Read and buffer any available stdout data from the program. */
424 	if (!fdout_eof && FD_ISSET(fdout, readset)) {
425 		errno = 0;
426 		len = read(fdout, buf, sizeof(buf));
427 		if (len < 0 && (errno == EINTR || ((errno == EAGAIN ||
428 		    errno == EWOULDBLOCK) && !child_terminated))) {
429 			/* do nothing */
430 #ifndef PTY_ZEROREAD
431 		} else if (len <= 0) {
432 #else
433 		} else if ((!isatty(fdout) && len <= 0) ||
434 		    (isatty(fdout) && (len < 0 || (len == 0 && errno != 0)))) {
435 #endif
436 			fdout_eof = 1;
437 		} else {
438 			buffer_append(&stdout_buffer, buf, len);
439 			fdout_bytes += len;
440 		}
441 	}
442 	/* Read and buffer any available stderr data from the program. */
443 	if (!fderr_eof && FD_ISSET(fderr, readset)) {
444 		errno = 0;
445 		len = read(fderr, buf, sizeof(buf));
446 		if (len < 0 && (errno == EINTR || ((errno == EAGAIN ||
447 		    errno == EWOULDBLOCK) && !child_terminated))) {
448 			/* do nothing */
449 #ifndef PTY_ZEROREAD
450 		} else if (len <= 0) {
451 #else
452 		} else if ((!isatty(fderr) && len <= 0) ||
453 		    (isatty(fderr) && (len < 0 || (len == 0 && errno != 0)))) {
454 #endif
455 			fderr_eof = 1;
456 		} else {
457 			buffer_append(&stderr_buffer, buf, len);
458 		}
459 	}
460 }
461 
462 /*
463  * Sends data from internal buffers to client program stdin.
464  */
465 static void
466 process_output(fd_set *writeset)
467 {
468 	struct termios tio;
469 	u_char *data;
470 	u_int dlen;
471 	int len;
472 
473 	/* Write buffered data to program stdin. */
474 	if (!compat20 && fdin != -1 && FD_ISSET(fdin, writeset)) {
475 		data = buffer_ptr(&stdin_buffer);
476 		dlen = buffer_len(&stdin_buffer);
477 		len = write(fdin, data, dlen);
478 		if (len < 0 &&
479 		    (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)) {
480 			/* do nothing */
481 		} else if (len <= 0) {
482 			if (fdin != fdout)
483 				close(fdin);
484 			else
485 				shutdown(fdin, SHUT_WR); /* We will no longer send. */
486 			fdin = -1;
487 		} else {
488 			/* Successful write. */
489 			if (fdin_is_tty && dlen >= 1 && data[0] != '\r' &&
490 			    tcgetattr(fdin, &tio) == 0 &&
491 			    !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) {
492 				/*
493 				 * Simulate echo to reduce the impact of
494 				 * traffic analysis
495 				 */
496 				packet_send_ignore(len);
497 				packet_send();
498 			}
499 			/* Consume the data from the buffer. */
500 			buffer_consume(&stdin_buffer, len);
501 			/* Update the count of bytes written to the program. */
502 			stdin_bytes += len;
503 		}
504 	}
505 	/* Send any buffered packet data to the client. */
506 	if (FD_ISSET(connection_out, writeset))
507 		packet_write_poll();
508 }
509 
510 /*
511  * Wait until all buffered output has been sent to the client.
512  * This is used when the program terminates.
513  */
514 static void
515 drain_output(void)
516 {
517 	/* Send any buffered stdout data to the client. */
518 	if (buffer_len(&stdout_buffer) > 0) {
519 		packet_start(SSH_SMSG_STDOUT_DATA);
520 		packet_put_string(buffer_ptr(&stdout_buffer),
521 				  buffer_len(&stdout_buffer));
522 		packet_send();
523 		/* Update the count of sent bytes. */
524 		stdout_bytes += buffer_len(&stdout_buffer);
525 	}
526 	/* Send any buffered stderr data to the client. */
527 	if (buffer_len(&stderr_buffer) > 0) {
528 		packet_start(SSH_SMSG_STDERR_DATA);
529 		packet_put_string(buffer_ptr(&stderr_buffer),
530 				  buffer_len(&stderr_buffer));
531 		packet_send();
532 		/* Update the count of sent bytes. */
533 		stderr_bytes += buffer_len(&stderr_buffer);
534 	}
535 	/* Wait until all buffered data has been written to the client. */
536 	packet_write_wait();
537 }
538 
539 static void
540 process_buffered_input_packets(void)
541 {
542 	dispatch_run(DISPATCH_NONBLOCK, NULL, compat20 ? xxx_kex : NULL);
543 }
544 
545 /*
546  * Performs the interactive session.  This handles data transmission between
547  * the client and the program.  Note that the notion of stdin, stdout, and
548  * stderr in this function is sort of reversed: this function writes to
549  * stdin (of the child program), and reads from stdout and stderr (of the
550  * child program).
551  */
552 void
553 server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg)
554 {
555 	fd_set *readset = NULL, *writeset = NULL;
556 	int max_fd = 0;
557 	u_int nalloc = 0;
558 	int wait_status;	/* Status returned by wait(). */
559 	pid_t wait_pid;		/* pid returned by wait(). */
560 	int waiting_termination = 0;	/* Have displayed waiting close message. */
561 	u_int max_time_milliseconds;
562 	u_int previous_stdout_buffer_bytes;
563 	u_int stdout_buffer_bytes;
564 	int type;
565 
566 	debug("Entering interactive session.");
567 
568 	/* Initialize the SIGCHLD kludge. */
569 	child_terminated = 0;
570 	mysignal(SIGCHLD, sigchld_handler);
571 
572 	if (!use_privsep) {
573 		signal(SIGTERM, sigterm_handler);
574 		signal(SIGINT, sigterm_handler);
575 		signal(SIGQUIT, sigterm_handler);
576 	}
577 
578 	/* Initialize our global variables. */
579 	fdin = fdin_arg;
580 	fdout = fdout_arg;
581 	fderr = fderr_arg;
582 
583 	/* nonblocking IO */
584 	set_nonblock(fdin);
585 	set_nonblock(fdout);
586 	/* we don't have stderr for interactive terminal sessions, see below */
587 	if (fderr != -1)
588 		set_nonblock(fderr);
589 
590 	if (!(datafellows & SSH_BUG_IGNOREMSG) && isatty(fdin))
591 		fdin_is_tty = 1;
592 
593 	connection_in = packet_get_connection_in();
594 	connection_out = packet_get_connection_out();
595 
596 	notify_setup();
597 
598 	previous_stdout_buffer_bytes = 0;
599 
600 	/* Set approximate I/O buffer size. */
601 	if (packet_is_interactive())
602 		buffer_high = 4096;
603 	else
604 		buffer_high = 64 * 1024;
605 
606 #if 0
607 	/* Initialize max_fd to the maximum of the known file descriptors. */
608 	max_fd = MAX(connection_in, connection_out);
609 	max_fd = MAX(max_fd, fdin);
610 	max_fd = MAX(max_fd, fdout);
611 	if (fderr != -1)
612 		max_fd = MAX(max_fd, fderr);
613 #endif
614 
615 	/* Initialize Initialize buffers. */
616 	buffer_init(&stdin_buffer);
617 	buffer_init(&stdout_buffer);
618 	buffer_init(&stderr_buffer);
619 
620 	/*
621 	 * If we have no separate fderr (which is the case when we have a pty
622 	 * - there we cannot make difference between data sent to stdout and
623 	 * stderr), indicate that we have seen an EOF from stderr.  This way
624 	 * we don't need to check the descriptor everywhere.
625 	 */
626 	if (fderr == -1)
627 		fderr_eof = 1;
628 
629 	server_init_dispatch();
630 
631 	/* Main loop of the server for the interactive session mode. */
632 	for (;;) {
633 
634 		/* Process buffered packets from the client. */
635 		process_buffered_input_packets();
636 
637 		/*
638 		 * If we have received eof, and there is no more pending
639 		 * input data, cause a real eof by closing fdin.
640 		 */
641 		if (stdin_eof && fdin != -1 && buffer_len(&stdin_buffer) == 0) {
642 			if (fdin != fdout)
643 				close(fdin);
644 			else
645 				shutdown(fdin, SHUT_WR); /* We will no longer send. */
646 			fdin = -1;
647 		}
648 		/* Make packets from buffered stderr data to send to the client. */
649 		make_packets_from_stderr_data();
650 
651 		/*
652 		 * Make packets from buffered stdout data to send to the
653 		 * client. If there is very little to send, this arranges to
654 		 * not send them now, but to wait a short while to see if we
655 		 * are getting more data. This is necessary, as some systems
656 		 * wake up readers from a pty after each separate character.
657 		 */
658 		max_time_milliseconds = 0;
659 		stdout_buffer_bytes = buffer_len(&stdout_buffer);
660 		if (stdout_buffer_bytes != 0 && stdout_buffer_bytes < 256 &&
661 		    stdout_buffer_bytes != previous_stdout_buffer_bytes) {
662 			/* try again after a while */
663 			max_time_milliseconds = 10;
664 		} else {
665 			/* Send it now. */
666 			make_packets_from_stdout_data();
667 		}
668 		previous_stdout_buffer_bytes = buffer_len(&stdout_buffer);
669 
670 		/* Send channel data to the client. */
671 		if (packet_not_very_much_data_to_write())
672 			channel_output_poll();
673 
674 		/*
675 		 * Bail out of the loop if the program has closed its output
676 		 * descriptors, and we have no more data to send to the
677 		 * client, and there is no pending buffered data.
678 		 */
679 		if (fdout_eof && fderr_eof && !packet_have_data_to_write() &&
680 		    buffer_len(&stdout_buffer) == 0 && buffer_len(&stderr_buffer) == 0) {
681 			if (!channel_still_open())
682 				break;
683 			if (!waiting_termination) {
684 				const char *s = "Waiting for forwarded connections to terminate...\r\n";
685 				char *cp;
686 				waiting_termination = 1;
687 				buffer_append(&stderr_buffer, s, strlen(s));
688 
689 				/* Display list of open channels. */
690 				cp = channel_open_message();
691 				buffer_append(&stderr_buffer, cp, strlen(cp));
692 				xfree(cp);
693 			}
694 		}
695 		max_fd = MAX(connection_in, connection_out);
696 		max_fd = MAX(max_fd, fdin);
697 		max_fd = MAX(max_fd, fdout);
698 		max_fd = MAX(max_fd, fderr);
699 		max_fd = MAX(max_fd, notify_pipe[0]);
700 
701 		/* Sleep in select() until we can do something. */
702 		wait_until_can_do_something(&readset, &writeset, &max_fd,
703 		    &nalloc, max_time_milliseconds);
704 
705 		if (received_sigterm) {
706 			logit("Exiting on signal %d", received_sigterm);
707 			/* Clean up sessions, utmp, etc. */
708 			cleanup_exit(255);
709 		}
710 
711 		/* Process any channel events. */
712 		channel_after_select(readset, writeset);
713 
714 		/* Process input from the client and from program stdout/stderr. */
715 		process_input(readset);
716 
717 		/* Process output to the client and to program stdin. */
718 		process_output(writeset);
719 	}
720 	if (readset)
721 		xfree(readset);
722 	if (writeset)
723 		xfree(writeset);
724 
725 	/* Cleanup and termination code. */
726 
727 	/* Wait until all output has been sent to the client. */
728 	drain_output();
729 
730 	debug("End of interactive session; stdin %ld, stdout (read %ld, " "sent %ld), stderr %ld bytes.",
731 	    stdin_bytes, fdout_bytes, stdout_bytes, stderr_bytes);
732 
733 	/* Free and clear the buffers. */
734 	buffer_free(&stdin_buffer);
735 	buffer_free(&stdout_buffer);
736 	buffer_free(&stderr_buffer);
737 
738 	/* Close the file descriptors. */
739 	if (fdout != -1)
740 		close(fdout);
741 	fdout = -1;
742 	fdout_eof = 1;
743 	if (fderr != -1)
744 		close(fderr);
745 	fderr = -1;
746 	fderr_eof = 1;
747 	if (fdin != -1)
748 		close(fdin);
749 	fdin = -1;
750 
751 	channel_free_all();
752 
753 	/* We no longer want our SIGCHLD handler to be called. */
754 	mysignal(SIGCHLD, SIG_DFL);
755 
756 	while ((wait_pid = waitpid(-1, &wait_status, 0)) < 0)
757 		if (errno != EINTR)
758 			packet_disconnect("wait: %.100s", strerror(errno));
759 	if (wait_pid != pid)
760 		error("Strange, wait returned pid %ld, expected %ld",
761 		    (long)wait_pid, (long)pid);
762 
763 	/* Check if it exited normally. */
764 	if (WIFEXITED(wait_status)) {
765 		/* Yes, normal exit.  Get exit status and send it to the client. */
766 		debug("Command exited with status %d.", WEXITSTATUS(wait_status));
767 		packet_start(SSH_SMSG_EXITSTATUS);
768 		packet_put_int(WEXITSTATUS(wait_status));
769 		packet_send();
770 		packet_write_wait();
771 
772 		/*
773 		 * Wait for exit confirmation.  Note that there might be
774 		 * other packets coming before it; however, the program has
775 		 * already died so we just ignore them.  The client is
776 		 * supposed to respond with the confirmation when it receives
777 		 * the exit status.
778 		 */
779 		do {
780 			type = packet_read();
781 		}
782 		while (type != SSH_CMSG_EXIT_CONFIRMATION);
783 
784 		debug("Received exit confirmation.");
785 		return;
786 	}
787 	/* Check if the program terminated due to a signal. */
788 	if (WIFSIGNALED(wait_status))
789 		packet_disconnect("Command terminated on signal %d.",
790 				  WTERMSIG(wait_status));
791 
792 	/* Some weird exit cause.  Just exit. */
793 	packet_disconnect("wait returned status %04x.", wait_status);
794 	/* NOTREACHED */
795 }
796 
797 static void
798 collect_children(void)
799 {
800 	pid_t pid;
801 	sigset_t oset, nset;
802 	int status;
803 
804 	/* block SIGCHLD while we check for dead children */
805 	sigemptyset(&nset);
806 	sigaddset(&nset, SIGCHLD);
807 	sigprocmask(SIG_BLOCK, &nset, &oset);
808 	if (child_terminated) {
809 		debug("Received SIGCHLD.");
810 		while ((pid = waitpid(-1, &status, WNOHANG)) > 0 ||
811 		    (pid < 0 && errno == EINTR))
812 			if (pid > 0)
813 				session_close_by_pid(pid, status);
814 		child_terminated = 0;
815 	}
816 	sigprocmask(SIG_SETMASK, &oset, NULL);
817 }
818 
819 void
820 server_loop2(Authctxt *authctxt)
821 {
822 	fd_set *readset = NULL, *writeset = NULL;
823 	int rekeying = 0, max_fd, nalloc = 0;
824 
825 	debug("Entering interactive session for SSH2.");
826 
827 	mysignal(SIGCHLD, sigchld_handler);
828 	child_terminated = 0;
829 	connection_in = packet_get_connection_in();
830 	connection_out = packet_get_connection_out();
831 
832 	if (!use_privsep) {
833 		signal(SIGTERM, sigterm_handler);
834 		signal(SIGINT, sigterm_handler);
835 		signal(SIGQUIT, sigterm_handler);
836 	}
837 
838 	notify_setup();
839 
840 	max_fd = MAX(connection_in, connection_out);
841 	max_fd = MAX(max_fd, notify_pipe[0]);
842 
843 	server_init_dispatch();
844 
845 	for (;;) {
846 		process_buffered_input_packets();
847 
848 		rekeying = (xxx_kex != NULL && !xxx_kex->done);
849 
850 		if (!rekeying && packet_not_very_much_data_to_write())
851 			channel_output_poll();
852 		wait_until_can_do_something(&readset, &writeset, &max_fd,
853 		    &nalloc, 0);
854 
855 		if (received_sigterm) {
856 			logit("Exiting on signal %d", received_sigterm);
857 			/* Clean up sessions, utmp, etc. */
858 			cleanup_exit(255);
859 		}
860 
861 		collect_children();
862 		if (!rekeying) {
863 			channel_after_select(readset, writeset);
864 			if (packet_need_rekeying()) {
865 				debug("need rekeying");
866 				xxx_kex->done = 0;
867 				kex_send_kexinit(xxx_kex);
868 			}
869 		}
870 		process_input(readset);
871 		if (connection_closed)
872 			break;
873 		process_output(writeset);
874 	}
875 	collect_children();
876 
877 	if (readset)
878 		xfree(readset);
879 	if (writeset)
880 		xfree(writeset);
881 
882 	/* free all channels, no more reads and writes */
883 	channel_free_all();
884 
885 	/* free remaining sessions, e.g. remove wtmp entries */
886 	session_destroy_all(NULL);
887 }
888 
889 static void
890 server_input_keep_alive(int type, u_int32_t seq, void *ctxt)
891 {
892 	debug("Got %d/%u for keepalive", type, seq);
893 	/*
894 	 * reset timeout, since we got a sane answer from the client.
895 	 * even if this was generated by something other than
896 	 * the bogus CHANNEL_REQUEST we send for keepalives.
897 	 */
898 	packet_set_alive_timeouts(0);
899 }
900 
901 static void
902 server_input_stdin_data(int type, u_int32_t seq, void *ctxt)
903 {
904 	char *data;
905 	u_int data_len;
906 
907 	/* Stdin data from the client.  Append it to the buffer. */
908 	/* Ignore any data if the client has closed stdin. */
909 	if (fdin == -1)
910 		return;
911 	data = packet_get_string(&data_len);
912 	packet_check_eom();
913 	buffer_append(&stdin_buffer, data, data_len);
914 	memset(data, 0, data_len);
915 	xfree(data);
916 }
917 
918 static void
919 server_input_eof(int type, u_int32_t seq, void *ctxt)
920 {
921 	/*
922 	 * Eof from the client.  The stdin descriptor to the
923 	 * program will be closed when all buffered data has
924 	 * drained.
925 	 */
926 	debug("EOF received for stdin.");
927 	packet_check_eom();
928 	stdin_eof = 1;
929 }
930 
931 static void
932 server_input_window_size(int type, u_int32_t seq, void *ctxt)
933 {
934 	u_int row = packet_get_int();
935 	u_int col = packet_get_int();
936 	u_int xpixel = packet_get_int();
937 	u_int ypixel = packet_get_int();
938 
939 	debug("Window change received.");
940 	packet_check_eom();
941 	if (fdin != -1)
942 		pty_change_window_size(fdin, row, col, xpixel, ypixel);
943 }
944 
945 static Channel *
946 server_request_direct_tcpip(void)
947 {
948 	Channel *c;
949 	char *target, *originator;
950 	u_short target_port, originator_port;
951 
952 	target = packet_get_string(NULL);
953 	target_port = packet_get_int();
954 	originator = packet_get_string(NULL);
955 	originator_port = packet_get_int();
956 	packet_check_eom();
957 
958 	debug("server_request_direct_tcpip: originator %s port %d, target %s "
959 	    "port %d", originator, originator_port, target, target_port);
960 
961 	/* XXX check permission */
962 	c = channel_connect_to(target, target_port,
963 	    "direct-tcpip", "direct-tcpip");
964 
965 	xfree(originator);
966 	xfree(target);
967 
968 	return c;
969 }
970 
971 static Channel *
972 server_request_tun(void)
973 {
974 	Channel *c = NULL;
975 	int mode, tun;
976 	int sock;
977 
978 	mode = packet_get_int();
979 	switch (mode) {
980 	case SSH_TUNMODE_POINTOPOINT:
981 	case SSH_TUNMODE_ETHERNET:
982 		break;
983 	default:
984 		packet_send_debug("Unsupported tunnel device mode.");
985 		return NULL;
986 	}
987 	if ((options.permit_tun & mode) == 0) {
988 		packet_send_debug("Server has rejected tunnel device "
989 		    "forwarding");
990 		return NULL;
991 	}
992 
993 	tun = packet_get_int();
994 	if (forced_tun_device != -1) {
995 		if (tun != SSH_TUNID_ANY && forced_tun_device != tun)
996 			goto done;
997 		tun = forced_tun_device;
998 	}
999 	sock = tun_open(tun, mode);
1000 	if (sock < 0)
1001 		goto done;
1002 	if (options.hpn_disabled)
1003 		c = channel_new("tun", SSH_CHANNEL_OPEN, sock, sock, -1,
1004 		    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0,
1005 		    "tun", 1);
1006 	else
1007 		c = channel_new("tun", SSH_CHANNEL_OPEN, sock, sock, -1,
1008 		    options.hpn_buffer_size, CHAN_TCP_PACKET_DEFAULT, 0,
1009 		    "tun", 1);
1010 	c->datagram = 1;
1011 #if defined(SSH_TUN_FILTER)
1012 	if (mode == SSH_TUNMODE_POINTOPOINT)
1013 		channel_register_filter(c->self, sys_tun_infilter,
1014 		    sys_tun_outfilter, NULL, NULL);
1015 #endif
1016 
1017  done:
1018 	if (c == NULL)
1019 		packet_send_debug("Failed to open the tunnel device.");
1020 	return c;
1021 }
1022 
1023 static Channel *
1024 server_request_session(void)
1025 {
1026 	Channel *c;
1027 
1028 	debug("input_session_request");
1029 	packet_check_eom();
1030 
1031 	if (no_more_sessions) {
1032 		packet_disconnect("Possible attack: attempt to open a session "
1033 		    "after additional sessions disabled");
1034 	}
1035 
1036 	/*
1037 	 * A server session has no fd to read or write until a
1038 	 * CHANNEL_REQUEST for a shell is made, so we set the type to
1039 	 * SSH_CHANNEL_LARVAL.  Additionally, a callback for handling all
1040 	 * CHANNEL_REQUEST messages is registered.
1041 	 */
1042 	c = channel_new("session", SSH_CHANNEL_LARVAL,
1043 	    -1, -1, -1, /*window size*/0, CHAN_SES_PACKET_DEFAULT,
1044 	    0, "server-session", 1);
1045 	if (!options.hpn_disabled && options.tcp_rcv_buf_poll)
1046 		c->dynamic_window = 1;
1047 	if (session_open(the_authctxt, c->self) != 1) {
1048 		debug("session open failed, free channel %d", c->self);
1049 		channel_free(c);
1050 		return NULL;
1051 	}
1052 	channel_register_cleanup(c->self, session_close_by_channel, 0);
1053 	return c;
1054 }
1055 
1056 static void
1057 server_input_channel_open(int type, u_int32_t seq, void *ctxt)
1058 {
1059 	Channel *c = NULL;
1060 	char *ctype;
1061 	int rchan;
1062 	u_int rmaxpack, rwindow, len;
1063 
1064 	ctype = packet_get_string(&len);
1065 	rchan = packet_get_int();
1066 	rwindow = packet_get_int();
1067 	rmaxpack = packet_get_int();
1068 
1069 	debug("server_input_channel_open: ctype %s rchan %d win %d max %d",
1070 	    ctype, rchan, rwindow, rmaxpack);
1071 
1072 	if (strcmp(ctype, "session") == 0) {
1073 		c = server_request_session();
1074 	} else if (strcmp(ctype, "direct-tcpip") == 0) {
1075 		c = server_request_direct_tcpip();
1076 	} else if (strcmp(ctype, "tun@openssh.com") == 0) {
1077 		c = server_request_tun();
1078 	}
1079 	if (c != NULL) {
1080 		debug("server_input_channel_open: confirm %s", ctype);
1081 		c->remote_id = rchan;
1082 		c->remote_window = rwindow;
1083 		c->remote_maxpacket = rmaxpack;
1084 		if (c->type != SSH_CHANNEL_CONNECTING) {
1085 			packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
1086 			packet_put_int(c->remote_id);
1087 			packet_put_int(c->self);
1088 			packet_put_int(c->local_window);
1089 			packet_put_int(c->local_maxpacket);
1090 			packet_send();
1091 		}
1092 	} else {
1093 		debug("server_input_channel_open: failure %s", ctype);
1094 		packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE);
1095 		packet_put_int(rchan);
1096 		packet_put_int(SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED);
1097 		if (!(datafellows & SSH_BUG_OPENFAILURE)) {
1098 			packet_put_cstring("open failed");
1099 			packet_put_cstring("");
1100 		}
1101 		packet_send();
1102 	}
1103 	xfree(ctype);
1104 }
1105 
1106 static void
1107 server_input_global_request(int type, u_int32_t seq, void *ctxt)
1108 {
1109 	char *rtype;
1110 	int want_reply;
1111 	int success = 0, allocated_listen_port = 0;
1112 
1113 	rtype = packet_get_string(NULL);
1114 	want_reply = packet_get_char();
1115 	debug("server_input_global_request: rtype %s want_reply %d", rtype, want_reply);
1116 
1117 	/* -R style forwarding */
1118 	if (strcmp(rtype, "tcpip-forward") == 0) {
1119 		struct passwd *pw;
1120 		char *listen_address;
1121 		u_short listen_port;
1122 
1123 		pw = the_authctxt->pw;
1124 		if (pw == NULL || !the_authctxt->valid)
1125 			fatal("server_input_global_request: no/invalid user");
1126 		listen_address = packet_get_string(NULL);
1127 		listen_port = (u_short)packet_get_int();
1128 		debug("server_input_global_request: tcpip-forward listen %s port %d",
1129 		    listen_address, listen_port);
1130 
1131 		/* check permissions */
1132 		if (!options.allow_tcp_forwarding ||
1133 		    no_port_forwarding_flag ||
1134 		    (!want_reply && listen_port == 0)
1135 #ifndef NO_IPPORT_RESERVED_CONCEPT
1136 		    || (listen_port != 0 && listen_port < IPPORT_RESERVED &&
1137                     pw->pw_uid != 0)
1138 #endif
1139 		    ) {
1140 			success = 0;
1141 			packet_send_debug("Server has disabled port forwarding.");
1142 		} else {
1143 			/* Start listening on the port */
1144 			success = channel_setup_remote_fwd_listener(
1145 			    listen_address, listen_port,
1146 			    &allocated_listen_port, options.gateway_ports);
1147 		}
1148 		xfree(listen_address);
1149 	} else if (strcmp(rtype, "cancel-tcpip-forward") == 0) {
1150 		char *cancel_address;
1151 		u_short cancel_port;
1152 
1153 		cancel_address = packet_get_string(NULL);
1154 		cancel_port = (u_short)packet_get_int();
1155 		debug("%s: cancel-tcpip-forward addr %s port %d", __func__,
1156 		    cancel_address, cancel_port);
1157 
1158 		success = channel_cancel_rport_listener(cancel_address,
1159 		    cancel_port);
1160 		xfree(cancel_address);
1161 	} else if (strcmp(rtype, "no-more-sessions@openssh.com") == 0) {
1162 		no_more_sessions = 1;
1163 		success = 1;
1164 	}
1165 	if (want_reply) {
1166 		packet_start(success ?
1167 		    SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE);
1168 		if (success && allocated_listen_port > 0)
1169 			packet_put_int(allocated_listen_port);
1170 		packet_send();
1171 		packet_write_wait();
1172 	}
1173 	xfree(rtype);
1174 }
1175 
1176 static void
1177 server_input_channel_req(int type, u_int32_t seq, void *ctxt)
1178 {
1179 	Channel *c;
1180 	int id, reply, success = 0;
1181 	char *rtype;
1182 
1183 	id = packet_get_int();
1184 	rtype = packet_get_string(NULL);
1185 	reply = packet_get_char();
1186 
1187 	debug("server_input_channel_req: channel %d request %s reply %d",
1188 	    id, rtype, reply);
1189 
1190 	if ((c = channel_lookup(id)) == NULL)
1191 		packet_disconnect("server_input_channel_req: "
1192 		    "unknown channel %d", id);
1193 	if (!strcmp(rtype, "eow@openssh.com")) {
1194 		packet_check_eom();
1195 		chan_rcvd_eow(c);
1196 	} else if ((c->type == SSH_CHANNEL_LARVAL ||
1197 	    c->type == SSH_CHANNEL_OPEN) && strcmp(c->ctype, "session") == 0)
1198 		success = session_input_channel_req(c, rtype);
1199 	if (reply) {
1200 		packet_start(success ?
1201 		    SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE);
1202 		packet_put_int(c->remote_id);
1203 		packet_send();
1204 	}
1205 	xfree(rtype);
1206 }
1207 
1208 static void
1209 server_init_dispatch_20(void)
1210 {
1211 	debug("server_init_dispatch_20");
1212 	dispatch_init(&dispatch_protocol_error);
1213 	dispatch_set(SSH2_MSG_CHANNEL_CLOSE, &channel_input_oclose);
1214 	dispatch_set(SSH2_MSG_CHANNEL_DATA, &channel_input_data);
1215 	dispatch_set(SSH2_MSG_CHANNEL_EOF, &channel_input_ieof);
1216 	dispatch_set(SSH2_MSG_CHANNEL_EXTENDED_DATA, &channel_input_extended_data);
1217 	dispatch_set(SSH2_MSG_CHANNEL_OPEN, &server_input_channel_open);
1218 	dispatch_set(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation);
1219 	dispatch_set(SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure);
1220 	dispatch_set(SSH2_MSG_CHANNEL_REQUEST, &server_input_channel_req);
1221 	dispatch_set(SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust);
1222 	dispatch_set(SSH2_MSG_GLOBAL_REQUEST, &server_input_global_request);
1223 	/* client_alive */
1224 	dispatch_set(SSH2_MSG_CHANNEL_SUCCESS, &server_input_keep_alive);
1225 	dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &server_input_keep_alive);
1226 	dispatch_set(SSH2_MSG_REQUEST_SUCCESS, &server_input_keep_alive);
1227 	dispatch_set(SSH2_MSG_REQUEST_FAILURE, &server_input_keep_alive);
1228 	/* rekeying */
1229 	dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
1230 }
1231 static void
1232 server_init_dispatch_13(void)
1233 {
1234 	debug("server_init_dispatch_13");
1235 	dispatch_init(NULL);
1236 	dispatch_set(SSH_CMSG_EOF, &server_input_eof);
1237 	dispatch_set(SSH_CMSG_STDIN_DATA, &server_input_stdin_data);
1238 	dispatch_set(SSH_CMSG_WINDOW_SIZE, &server_input_window_size);
1239 	dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_close);
1240 	dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, &channel_input_close_confirmation);
1241 	dispatch_set(SSH_MSG_CHANNEL_DATA, &channel_input_data);
1242 	dispatch_set(SSH_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation);
1243 	dispatch_set(SSH_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure);
1244 	dispatch_set(SSH_MSG_PORT_OPEN, &channel_input_port_open);
1245 }
1246 static void
1247 server_init_dispatch_15(void)
1248 {
1249 	server_init_dispatch_13();
1250 	debug("server_init_dispatch_15");
1251 	dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_ieof);
1252 	dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, &channel_input_oclose);
1253 }
1254 static void
1255 server_init_dispatch(void)
1256 {
1257 	if (compat20)
1258 		server_init_dispatch_20();
1259 	else if (compat13)
1260 		server_init_dispatch_13();
1261 	else
1262 		server_init_dispatch_15();
1263 }
1264