xref: /freebsd/crypto/openssh/sftp-client.c (revision 734e82fe33aa764367791a7d603b383996c6b40b)
1 /* $OpenBSD: sftp-client.c,v 1.171 2023/04/30 22:54:22 djm Exp $ */
2 /*
3  * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 /* XXX: memleaks */
19 /* XXX: signed vs unsigned */
20 /* XXX: remove all logging, only return status codes */
21 /* XXX: copy between two remote sites */
22 
23 #include "includes.h"
24 
25 #include <sys/types.h>
26 #ifdef HAVE_SYS_STATVFS_H
27 #include <sys/statvfs.h>
28 #endif
29 #include "openbsd-compat/sys-queue.h"
30 #ifdef HAVE_SYS_STAT_H
31 # include <sys/stat.h>
32 #endif
33 #ifdef HAVE_SYS_TIME_H
34 # include <sys/time.h>
35 #endif
36 #include <sys/uio.h>
37 
38 #include <dirent.h>
39 #include <errno.h>
40 #ifdef HAVE_POLL_H
41 #include <poll.h>
42 #else
43 # ifdef HAVE_SYS_POLL_H
44 #  include <sys/poll.h>
45 # endif
46 #endif
47 #include <fcntl.h>
48 #include <signal.h>
49 #include <stdarg.h>
50 #include <stdio.h>
51 #include <stdlib.h>
52 #include <string.h>
53 #include <unistd.h>
54 
55 #include "xmalloc.h"
56 #include "ssherr.h"
57 #include "sshbuf.h"
58 #include "log.h"
59 #include "atomicio.h"
60 #include "progressmeter.h"
61 #include "misc.h"
62 #include "utf8.h"
63 
64 #include "sftp.h"
65 #include "sftp-common.h"
66 #include "sftp-client.h"
67 
68 extern volatile sig_atomic_t interrupted;
69 extern int showprogress;
70 
71 /* Default size of buffer for up/download (fix sftp.1 scp.1 if changed) */
72 #define DEFAULT_COPY_BUFLEN	32768
73 
74 /* Default number of concurrent xfer requests (fix sftp.1 scp.1 if changed) */
75 #define DEFAULT_NUM_REQUESTS	64
76 
77 /* Minimum amount of data to read at a time */
78 #define MIN_READ_SIZE	512
79 
80 /* Maximum depth to descend in directory trees */
81 #define MAX_DIR_DEPTH 64
82 
83 /* Directory separator characters */
84 #ifdef HAVE_CYGWIN
85 # define SFTP_DIRECTORY_CHARS      "/\\"
86 #else /* HAVE_CYGWIN */
87 # define SFTP_DIRECTORY_CHARS      "/"
88 #endif /* HAVE_CYGWIN */
89 
90 struct sftp_conn {
91 	int fd_in;
92 	int fd_out;
93 	u_int download_buflen;
94 	u_int upload_buflen;
95 	u_int num_requests;
96 	u_int version;
97 	u_int msg_id;
98 #define SFTP_EXT_POSIX_RENAME		0x00000001
99 #define SFTP_EXT_STATVFS		0x00000002
100 #define SFTP_EXT_FSTATVFS		0x00000004
101 #define SFTP_EXT_HARDLINK		0x00000008
102 #define SFTP_EXT_FSYNC			0x00000010
103 #define SFTP_EXT_LSETSTAT		0x00000020
104 #define SFTP_EXT_LIMITS			0x00000040
105 #define SFTP_EXT_PATH_EXPAND		0x00000080
106 #define SFTP_EXT_COPY_DATA		0x00000100
107 #define SFTP_EXT_GETUSERSGROUPS_BY_ID	0x00000200
108 	u_int exts;
109 	u_int64_t limit_kbps;
110 	struct bwlimit bwlimit_in, bwlimit_out;
111 };
112 
113 /* Tracks in-progress requests during file transfers */
114 struct request {
115 	u_int id;
116 	size_t len;
117 	u_int64_t offset;
118 	TAILQ_ENTRY(request) tq;
119 };
120 TAILQ_HEAD(requests, request);
121 
122 static u_char *
123 get_handle(struct sftp_conn *conn, u_int expected_id, size_t *len,
124     const char *errfmt, ...) __attribute__((format(printf, 4, 5)));
125 
126 static struct request *
127 request_enqueue(struct requests *requests, u_int id, size_t len,
128     uint64_t offset)
129 {
130 	struct request *req;
131 
132 	req = xcalloc(1, sizeof(*req));
133 	req->id = id;
134 	req->len = len;
135 	req->offset = offset;
136 	TAILQ_INSERT_TAIL(requests, req, tq);
137 	return req;
138 }
139 
140 static struct request *
141 request_find(struct requests *requests, u_int id)
142 {
143 	struct request *req;
144 
145 	for (req = TAILQ_FIRST(requests);
146 	    req != NULL && req->id != id;
147 	    req = TAILQ_NEXT(req, tq))
148 		;
149 	return req;
150 }
151 
152 static int
153 sftpio(void *_bwlimit, size_t amount)
154 {
155 	struct bwlimit *bwlimit = (struct bwlimit *)_bwlimit;
156 
157 	refresh_progress_meter(0);
158 	if (bwlimit != NULL)
159 		bandwidth_limit(bwlimit, amount);
160 	return 0;
161 }
162 
163 static void
164 send_msg(struct sftp_conn *conn, struct sshbuf *m)
165 {
166 	u_char mlen[4];
167 	struct iovec iov[2];
168 
169 	if (sshbuf_len(m) > SFTP_MAX_MSG_LENGTH)
170 		fatal("Outbound message too long %zu", sshbuf_len(m));
171 
172 	/* Send length first */
173 	put_u32(mlen, sshbuf_len(m));
174 	iov[0].iov_base = mlen;
175 	iov[0].iov_len = sizeof(mlen);
176 	iov[1].iov_base = (u_char *)sshbuf_ptr(m);
177 	iov[1].iov_len = sshbuf_len(m);
178 
179 	if (atomiciov6(writev, conn->fd_out, iov, 2, sftpio,
180 	    conn->limit_kbps > 0 ? &conn->bwlimit_out : NULL) !=
181 	    sshbuf_len(m) + sizeof(mlen))
182 		fatal("Couldn't send packet: %s", strerror(errno));
183 
184 	sshbuf_reset(m);
185 }
186 
187 static void
188 get_msg_extended(struct sftp_conn *conn, struct sshbuf *m, int initial)
189 {
190 	u_int msg_len;
191 	u_char *p;
192 	int r;
193 
194 	sshbuf_reset(m);
195 	if ((r = sshbuf_reserve(m, 4, &p)) != 0)
196 		fatal_fr(r, "reserve");
197 	if (atomicio6(read, conn->fd_in, p, 4, sftpio,
198 	    conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL) != 4) {
199 		if (errno == EPIPE || errno == ECONNRESET)
200 			fatal("Connection closed");
201 		else
202 			fatal("Couldn't read packet: %s", strerror(errno));
203 	}
204 
205 	if ((r = sshbuf_get_u32(m, &msg_len)) != 0)
206 		fatal_fr(r, "sshbuf_get_u32");
207 	if (msg_len > SFTP_MAX_MSG_LENGTH) {
208 		do_log2(initial ? SYSLOG_LEVEL_ERROR : SYSLOG_LEVEL_FATAL,
209 		    "Received message too long %u", msg_len);
210 		fatal("Ensure the remote shell produces no output "
211 		    "for non-interactive sessions.");
212 	}
213 
214 	if ((r = sshbuf_reserve(m, msg_len, &p)) != 0)
215 		fatal_fr(r, "reserve");
216 	if (atomicio6(read, conn->fd_in, p, msg_len, sftpio,
217 	    conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL)
218 	    != msg_len) {
219 		if (errno == EPIPE)
220 			fatal("Connection closed");
221 		else
222 			fatal("Read packet: %s", strerror(errno));
223 	}
224 }
225 
226 static void
227 get_msg(struct sftp_conn *conn, struct sshbuf *m)
228 {
229 	get_msg_extended(conn, m, 0);
230 }
231 
232 static void
233 send_string_request(struct sftp_conn *conn, u_int id, u_int code, const char *s,
234     u_int len)
235 {
236 	struct sshbuf *msg;
237 	int r;
238 
239 	if ((msg = sshbuf_new()) == NULL)
240 		fatal_f("sshbuf_new failed");
241 	if ((r = sshbuf_put_u8(msg, code)) != 0 ||
242 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
243 	    (r = sshbuf_put_string(msg, s, len)) != 0)
244 		fatal_fr(r, "compose");
245 	send_msg(conn, msg);
246 	debug3("Sent message fd %d T:%u I:%u", conn->fd_out, code, id);
247 	sshbuf_free(msg);
248 }
249 
250 static void
251 send_string_attrs_request(struct sftp_conn *conn, u_int id, u_int code,
252     const void *s, u_int len, Attrib *a)
253 {
254 	struct sshbuf *msg;
255 	int r;
256 
257 	if ((msg = sshbuf_new()) == NULL)
258 		fatal_f("sshbuf_new failed");
259 	if ((r = sshbuf_put_u8(msg, code)) != 0 ||
260 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
261 	    (r = sshbuf_put_string(msg, s, len)) != 0 ||
262 	    (r = encode_attrib(msg, a)) != 0)
263 		fatal_fr(r, "compose");
264 	send_msg(conn, msg);
265 	debug3("Sent message fd %d T:%u I:%u F:0x%04x M:%05o",
266 	    conn->fd_out, code, id, a->flags, a->perm);
267 	sshbuf_free(msg);
268 }
269 
270 static u_int
271 get_status(struct sftp_conn *conn, u_int expected_id)
272 {
273 	struct sshbuf *msg;
274 	u_char type;
275 	u_int id, status;
276 	int r;
277 
278 	if ((msg = sshbuf_new()) == NULL)
279 		fatal_f("sshbuf_new failed");
280 	get_msg(conn, msg);
281 	if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
282 	    (r = sshbuf_get_u32(msg, &id)) != 0)
283 		fatal_fr(r, "compose");
284 
285 	if (id != expected_id)
286 		fatal("ID mismatch (%u != %u)", id, expected_id);
287 	if (type != SSH2_FXP_STATUS)
288 		fatal("Expected SSH2_FXP_STATUS(%u) packet, got %u",
289 		    SSH2_FXP_STATUS, type);
290 
291 	if ((r = sshbuf_get_u32(msg, &status)) != 0)
292 		fatal_fr(r, "parse");
293 	sshbuf_free(msg);
294 
295 	debug3("SSH2_FXP_STATUS %u", status);
296 
297 	return status;
298 }
299 
300 static u_char *
301 get_handle(struct sftp_conn *conn, u_int expected_id, size_t *len,
302     const char *errfmt, ...)
303 {
304 	struct sshbuf *msg;
305 	u_int id, status;
306 	u_char type;
307 	u_char *handle;
308 	char errmsg[256];
309 	va_list args;
310 	int r;
311 
312 	va_start(args, errfmt);
313 	if (errfmt != NULL)
314 		vsnprintf(errmsg, sizeof(errmsg), errfmt, args);
315 	va_end(args);
316 
317 	if ((msg = sshbuf_new()) == NULL)
318 		fatal_f("sshbuf_new failed");
319 	get_msg(conn, msg);
320 	if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
321 	    (r = sshbuf_get_u32(msg, &id)) != 0)
322 		fatal_fr(r, "parse");
323 
324 	if (id != expected_id)
325 		fatal("%s: ID mismatch (%u != %u)",
326 		    errfmt == NULL ? __func__ : errmsg, id, expected_id);
327 	if (type == SSH2_FXP_STATUS) {
328 		if ((r = sshbuf_get_u32(msg, &status)) != 0)
329 			fatal_fr(r, "parse status");
330 		if (errfmt != NULL)
331 			error("%s: %s", errmsg, fx2txt(status));
332 		sshbuf_free(msg);
333 		return(NULL);
334 	} else if (type != SSH2_FXP_HANDLE)
335 		fatal("%s: Expected SSH2_FXP_HANDLE(%u) packet, got %u",
336 		    errfmt == NULL ? __func__ : errmsg, SSH2_FXP_HANDLE, type);
337 
338 	if ((r = sshbuf_get_string(msg, &handle, len)) != 0)
339 		fatal_fr(r, "parse handle");
340 	sshbuf_free(msg);
341 
342 	return handle;
343 }
344 
345 /* XXX returning &static is error-prone. Refactor to fill *Attrib argument */
346 static Attrib *
347 get_decode_stat(struct sftp_conn *conn, u_int expected_id, int quiet)
348 {
349 	struct sshbuf *msg;
350 	u_int id;
351 	u_char type;
352 	int r;
353 	static Attrib a;
354 
355 	if ((msg = sshbuf_new()) == NULL)
356 		fatal_f("sshbuf_new failed");
357 	get_msg(conn, msg);
358 
359 	if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
360 	    (r = sshbuf_get_u32(msg, &id)) != 0)
361 		fatal_fr(r, "parse");
362 
363 	if (id != expected_id)
364 		fatal("ID mismatch (%u != %u)", id, expected_id);
365 	if (type == SSH2_FXP_STATUS) {
366 		u_int status;
367 
368 		if ((r = sshbuf_get_u32(msg, &status)) != 0)
369 			fatal_fr(r, "parse status");
370 		if (quiet)
371 			debug("stat remote: %s", fx2txt(status));
372 		else
373 			error("stat remote: %s", fx2txt(status));
374 		sshbuf_free(msg);
375 		return(NULL);
376 	} else if (type != SSH2_FXP_ATTRS) {
377 		fatal("Expected SSH2_FXP_ATTRS(%u) packet, got %u",
378 		    SSH2_FXP_ATTRS, type);
379 	}
380 	if ((r = decode_attrib(msg, &a)) != 0) {
381 		error_fr(r, "decode_attrib");
382 		sshbuf_free(msg);
383 		return NULL;
384 	}
385 	debug3("Received stat reply T:%u I:%u F:0x%04x M:%05o",
386 	    type, id, a.flags, a.perm);
387 	sshbuf_free(msg);
388 
389 	return &a;
390 }
391 
392 static int
393 get_decode_statvfs(struct sftp_conn *conn, struct sftp_statvfs *st,
394     u_int expected_id, int quiet)
395 {
396 	struct sshbuf *msg;
397 	u_char type;
398 	u_int id;
399 	u_int64_t flag;
400 	int r;
401 
402 	if ((msg = sshbuf_new()) == NULL)
403 		fatal_f("sshbuf_new failed");
404 	get_msg(conn, msg);
405 
406 	if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
407 	    (r = sshbuf_get_u32(msg, &id)) != 0)
408 		fatal_fr(r, "parse");
409 
410 	debug3("Received statvfs reply T:%u I:%u", type, id);
411 	if (id != expected_id)
412 		fatal("ID mismatch (%u != %u)", id, expected_id);
413 	if (type == SSH2_FXP_STATUS) {
414 		u_int status;
415 
416 		if ((r = sshbuf_get_u32(msg, &status)) != 0)
417 			fatal_fr(r, "parse status");
418 		if (quiet)
419 			debug("remote statvfs: %s", fx2txt(status));
420 		else
421 			error("remote statvfs: %s", fx2txt(status));
422 		sshbuf_free(msg);
423 		return -1;
424 	} else if (type != SSH2_FXP_EXTENDED_REPLY) {
425 		fatal("Expected SSH2_FXP_EXTENDED_REPLY(%u) packet, got %u",
426 		    SSH2_FXP_EXTENDED_REPLY, type);
427 	}
428 
429 	memset(st, 0, sizeof(*st));
430 	if ((r = sshbuf_get_u64(msg, &st->f_bsize)) != 0 ||
431 	    (r = sshbuf_get_u64(msg, &st->f_frsize)) != 0 ||
432 	    (r = sshbuf_get_u64(msg, &st->f_blocks)) != 0 ||
433 	    (r = sshbuf_get_u64(msg, &st->f_bfree)) != 0 ||
434 	    (r = sshbuf_get_u64(msg, &st->f_bavail)) != 0 ||
435 	    (r = sshbuf_get_u64(msg, &st->f_files)) != 0 ||
436 	    (r = sshbuf_get_u64(msg, &st->f_ffree)) != 0 ||
437 	    (r = sshbuf_get_u64(msg, &st->f_favail)) != 0 ||
438 	    (r = sshbuf_get_u64(msg, &st->f_fsid)) != 0 ||
439 	    (r = sshbuf_get_u64(msg, &flag)) != 0 ||
440 	    (r = sshbuf_get_u64(msg, &st->f_namemax)) != 0)
441 		fatal_fr(r, "parse statvfs");
442 
443 	st->f_flag = (flag & SSH2_FXE_STATVFS_ST_RDONLY) ? ST_RDONLY : 0;
444 	st->f_flag |= (flag & SSH2_FXE_STATVFS_ST_NOSUID) ? ST_NOSUID : 0;
445 
446 	sshbuf_free(msg);
447 
448 	return 0;
449 }
450 
451 struct sftp_conn *
452 do_init(int fd_in, int fd_out, u_int transfer_buflen, u_int num_requests,
453     u_int64_t limit_kbps)
454 {
455 	u_char type;
456 	struct sshbuf *msg;
457 	struct sftp_conn *ret;
458 	int r;
459 
460 	ret = xcalloc(1, sizeof(*ret));
461 	ret->msg_id = 1;
462 	ret->fd_in = fd_in;
463 	ret->fd_out = fd_out;
464 	ret->download_buflen = ret->upload_buflen =
465 	    transfer_buflen ? transfer_buflen : DEFAULT_COPY_BUFLEN;
466 	ret->num_requests =
467 	    num_requests ? num_requests : DEFAULT_NUM_REQUESTS;
468 	ret->exts = 0;
469 	ret->limit_kbps = 0;
470 
471 	if ((msg = sshbuf_new()) == NULL)
472 		fatal_f("sshbuf_new failed");
473 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_INIT)) != 0 ||
474 	    (r = sshbuf_put_u32(msg, SSH2_FILEXFER_VERSION)) != 0)
475 		fatal_fr(r, "parse");
476 
477 	send_msg(ret, msg);
478 
479 	get_msg_extended(ret, msg, 1);
480 
481 	/* Expecting a VERSION reply */
482 	if ((r = sshbuf_get_u8(msg, &type)) != 0)
483 		fatal_fr(r, "parse type");
484 	if (type != SSH2_FXP_VERSION) {
485 		error("Invalid packet back from SSH2_FXP_INIT (type %u)",
486 		    type);
487 		sshbuf_free(msg);
488 		free(ret);
489 		return(NULL);
490 	}
491 	if ((r = sshbuf_get_u32(msg, &ret->version)) != 0)
492 		fatal_fr(r, "parse version");
493 
494 	debug2("Remote version: %u", ret->version);
495 
496 	/* Check for extensions */
497 	while (sshbuf_len(msg) > 0) {
498 		char *name;
499 		u_char *value;
500 		size_t vlen;
501 		int known = 0;
502 
503 		if ((r = sshbuf_get_cstring(msg, &name, NULL)) != 0 ||
504 		    (r = sshbuf_get_string(msg, &value, &vlen)) != 0)
505 			fatal_fr(r, "parse extension");
506 		if (strcmp(name, "posix-rename@openssh.com") == 0 &&
507 		    strcmp((char *)value, "1") == 0) {
508 			ret->exts |= SFTP_EXT_POSIX_RENAME;
509 			known = 1;
510 		} else if (strcmp(name, "statvfs@openssh.com") == 0 &&
511 		    strcmp((char *)value, "2") == 0) {
512 			ret->exts |= SFTP_EXT_STATVFS;
513 			known = 1;
514 		} else if (strcmp(name, "fstatvfs@openssh.com") == 0 &&
515 		    strcmp((char *)value, "2") == 0) {
516 			ret->exts |= SFTP_EXT_FSTATVFS;
517 			known = 1;
518 		} else if (strcmp(name, "hardlink@openssh.com") == 0 &&
519 		    strcmp((char *)value, "1") == 0) {
520 			ret->exts |= SFTP_EXT_HARDLINK;
521 			known = 1;
522 		} else if (strcmp(name, "fsync@openssh.com") == 0 &&
523 		    strcmp((char *)value, "1") == 0) {
524 			ret->exts |= SFTP_EXT_FSYNC;
525 			known = 1;
526 		} else if (strcmp(name, "lsetstat@openssh.com") == 0 &&
527 		    strcmp((char *)value, "1") == 0) {
528 			ret->exts |= SFTP_EXT_LSETSTAT;
529 			known = 1;
530 		} else if (strcmp(name, "limits@openssh.com") == 0 &&
531 		    strcmp((char *)value, "1") == 0) {
532 			ret->exts |= SFTP_EXT_LIMITS;
533 			known = 1;
534 		} else if (strcmp(name, "expand-path@openssh.com") == 0 &&
535 		    strcmp((char *)value, "1") == 0) {
536 			ret->exts |= SFTP_EXT_PATH_EXPAND;
537 			known = 1;
538 		} else if (strcmp(name, "copy-data") == 0 &&
539 		    strcmp((char *)value, "1") == 0) {
540 			ret->exts |= SFTP_EXT_COPY_DATA;
541 			known = 1;
542 		} else if (strcmp(name,
543 		    "users-groups-by-id@openssh.com") == 0 &&
544 		    strcmp((char *)value, "1") == 0) {
545 			ret->exts |= SFTP_EXT_GETUSERSGROUPS_BY_ID;
546 			known = 1;
547 		}
548 		if (known) {
549 			debug2("Server supports extension \"%s\" revision %s",
550 			    name, value);
551 		} else {
552 			debug2("Unrecognised server extension \"%s\"", name);
553 		}
554 		free(name);
555 		free(value);
556 	}
557 
558 	sshbuf_free(msg);
559 
560 	/* Query the server for its limits */
561 	if (ret->exts & SFTP_EXT_LIMITS) {
562 		struct sftp_limits limits;
563 		if (do_limits(ret, &limits) != 0)
564 			fatal_f("limits failed");
565 
566 		/* If the caller did not specify, find a good value */
567 		if (transfer_buflen == 0) {
568 			ret->download_buflen = MINIMUM(limits.read_length,
569 			    SFTP_MAX_MSG_LENGTH - 1024);
570 			ret->upload_buflen = MINIMUM(limits.write_length,
571 			    SFTP_MAX_MSG_LENGTH - 1024);
572 			ret->download_buflen = MAXIMUM(ret->download_buflen, 64);
573 			ret->upload_buflen = MAXIMUM(ret->upload_buflen, 64);
574 			debug3("server upload/download buffer sizes "
575 			    "%llu / %llu; using %u / %u",
576 			    (unsigned long long)limits.write_length,
577 			    (unsigned long long)limits.read_length,
578 			    ret->upload_buflen, ret->download_buflen);
579 		}
580 
581 		/* Use the server limit to scale down our value only */
582 		if (num_requests == 0 && limits.open_handles) {
583 			ret->num_requests =
584 			    MINIMUM(DEFAULT_NUM_REQUESTS, limits.open_handles);
585 			if (ret->num_requests == 0)
586 				ret->num_requests = 1;
587 			debug3("server handle limit %llu; using %u",
588 			    (unsigned long long)limits.open_handles,
589 			    ret->num_requests);
590 		}
591 	}
592 
593 	/* Some filexfer v.0 servers don't support large packets */
594 	if (ret->version == 0) {
595 		ret->download_buflen = MINIMUM(ret->download_buflen, 20480);
596 		ret->upload_buflen = MINIMUM(ret->upload_buflen, 20480);
597 	}
598 
599 	ret->limit_kbps = limit_kbps;
600 	if (ret->limit_kbps > 0) {
601 		bandwidth_limit_init(&ret->bwlimit_in, ret->limit_kbps,
602 		    ret->download_buflen);
603 		bandwidth_limit_init(&ret->bwlimit_out, ret->limit_kbps,
604 		    ret->upload_buflen);
605 	}
606 
607 	return ret;
608 }
609 
610 u_int
611 sftp_proto_version(struct sftp_conn *conn)
612 {
613 	return conn->version;
614 }
615 
616 int
617 do_limits(struct sftp_conn *conn, struct sftp_limits *limits)
618 {
619 	u_int id, msg_id;
620 	u_char type;
621 	struct sshbuf *msg;
622 	int r;
623 
624 	if ((conn->exts & SFTP_EXT_LIMITS) == 0) {
625 		error("Server does not support limits@openssh.com extension");
626 		return -1;
627 	}
628 
629 	if ((msg = sshbuf_new()) == NULL)
630 		fatal_f("sshbuf_new failed");
631 
632 	id = conn->msg_id++;
633 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
634 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
635 	    (r = sshbuf_put_cstring(msg, "limits@openssh.com")) != 0)
636 		fatal_fr(r, "compose");
637 	send_msg(conn, msg);
638 	debug3("Sent message limits@openssh.com I:%u", id);
639 
640 	get_msg(conn, msg);
641 
642 	if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
643 	    (r = sshbuf_get_u32(msg, &msg_id)) != 0)
644 		fatal_fr(r, "parse");
645 
646 	debug3("Received limits reply T:%u I:%u", type, msg_id);
647 	if (id != msg_id)
648 		fatal("ID mismatch (%u != %u)", msg_id, id);
649 	if (type != SSH2_FXP_EXTENDED_REPLY) {
650 		debug_f("expected SSH2_FXP_EXTENDED_REPLY(%u) packet, got %u",
651 		    SSH2_FXP_EXTENDED_REPLY, type);
652 		/* Disable the limits extension */
653 		conn->exts &= ~SFTP_EXT_LIMITS;
654 		sshbuf_free(msg);
655 		return 0;
656 	}
657 
658 	memset(limits, 0, sizeof(*limits));
659 	if ((r = sshbuf_get_u64(msg, &limits->packet_length)) != 0 ||
660 	    (r = sshbuf_get_u64(msg, &limits->read_length)) != 0 ||
661 	    (r = sshbuf_get_u64(msg, &limits->write_length)) != 0 ||
662 	    (r = sshbuf_get_u64(msg, &limits->open_handles)) != 0)
663 		fatal_fr(r, "parse limits");
664 
665 	sshbuf_free(msg);
666 
667 	return 0;
668 }
669 
670 int
671 do_close(struct sftp_conn *conn, const u_char *handle, u_int handle_len)
672 {
673 	u_int id, status;
674 	struct sshbuf *msg;
675 	int r;
676 
677 	if ((msg = sshbuf_new()) == NULL)
678 		fatal_f("sshbuf_new failed");
679 
680 	id = conn->msg_id++;
681 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_CLOSE)) != 0 ||
682 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
683 	    (r = sshbuf_put_string(msg, handle, handle_len)) != 0)
684 		fatal_fr(r, "parse");
685 	send_msg(conn, msg);
686 	debug3("Sent message SSH2_FXP_CLOSE I:%u", id);
687 
688 	status = get_status(conn, id);
689 	if (status != SSH2_FX_OK)
690 		error("close remote: %s", fx2txt(status));
691 
692 	sshbuf_free(msg);
693 
694 	return status == SSH2_FX_OK ? 0 : -1;
695 }
696 
697 
698 static int
699 do_lsreaddir(struct sftp_conn *conn, const char *path, int print_flag,
700     SFTP_DIRENT ***dir)
701 {
702 	struct sshbuf *msg;
703 	u_int count, id, i, expected_id, ents = 0;
704 	size_t handle_len;
705 	u_char type, *handle;
706 	int status = SSH2_FX_FAILURE;
707 	int r;
708 
709 	if (dir)
710 		*dir = NULL;
711 
712 	id = conn->msg_id++;
713 
714 	if ((msg = sshbuf_new()) == NULL)
715 		fatal_f("sshbuf_new failed");
716 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_OPENDIR)) != 0 ||
717 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
718 	    (r = sshbuf_put_cstring(msg, path)) != 0)
719 		fatal_fr(r, "compose OPENDIR");
720 	send_msg(conn, msg);
721 
722 	handle = get_handle(conn, id, &handle_len,
723 	    "remote readdir(\"%s\")", path);
724 	if (handle == NULL) {
725 		sshbuf_free(msg);
726 		return -1;
727 	}
728 
729 	if (dir) {
730 		ents = 0;
731 		*dir = xcalloc(1, sizeof(**dir));
732 		(*dir)[0] = NULL;
733 	}
734 
735 	for (; !interrupted;) {
736 		id = expected_id = conn->msg_id++;
737 
738 		debug3("Sending SSH2_FXP_READDIR I:%u", id);
739 
740 		sshbuf_reset(msg);
741 		if ((r = sshbuf_put_u8(msg, SSH2_FXP_READDIR)) != 0 ||
742 		    (r = sshbuf_put_u32(msg, id)) != 0 ||
743 		    (r = sshbuf_put_string(msg, handle, handle_len)) != 0)
744 			fatal_fr(r, "compose READDIR");
745 		send_msg(conn, msg);
746 
747 		sshbuf_reset(msg);
748 
749 		get_msg(conn, msg);
750 
751 		if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
752 		    (r = sshbuf_get_u32(msg, &id)) != 0)
753 			fatal_fr(r, "parse");
754 
755 		debug3("Received reply T:%u I:%u", type, id);
756 
757 		if (id != expected_id)
758 			fatal("ID mismatch (%u != %u)", id, expected_id);
759 
760 		if (type == SSH2_FXP_STATUS) {
761 			u_int rstatus;
762 
763 			if ((r = sshbuf_get_u32(msg, &rstatus)) != 0)
764 				fatal_fr(r, "parse status");
765 			debug3("Received SSH2_FXP_STATUS %d", rstatus);
766 			if (rstatus == SSH2_FX_EOF)
767 				break;
768 			error("Couldn't read directory: %s", fx2txt(rstatus));
769 			goto out;
770 		} else if (type != SSH2_FXP_NAME)
771 			fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
772 			    SSH2_FXP_NAME, type);
773 
774 		if ((r = sshbuf_get_u32(msg, &count)) != 0)
775 			fatal_fr(r, "parse count");
776 		if (count > SSHBUF_SIZE_MAX)
777 			fatal_f("nonsensical number of entries");
778 		if (count == 0)
779 			break;
780 		debug3("Received %d SSH2_FXP_NAME responses", count);
781 		for (i = 0; i < count; i++) {
782 			char *filename, *longname;
783 			Attrib a;
784 
785 			if ((r = sshbuf_get_cstring(msg, &filename,
786 			    NULL)) != 0 ||
787 			    (r = sshbuf_get_cstring(msg, &longname,
788 			    NULL)) != 0)
789 				fatal_fr(r, "parse filenames");
790 			if ((r = decode_attrib(msg, &a)) != 0) {
791 				error_fr(r, "couldn't decode attrib");
792 				free(filename);
793 				free(longname);
794 				goto out;
795 			}
796 
797 			if (print_flag)
798 				mprintf("%s\n", longname);
799 
800 			/*
801 			 * Directory entries should never contain '/'
802 			 * These can be used to attack recursive ops
803 			 * (e.g. send '../../../../etc/passwd')
804 			 */
805 			if (strpbrk(filename, SFTP_DIRECTORY_CHARS) != NULL) {
806 				error("Server sent suspect path \"%s\" "
807 				    "during readdir of \"%s\"", filename, path);
808 			} else if (dir) {
809 				*dir = xreallocarray(*dir, ents + 2, sizeof(**dir));
810 				(*dir)[ents] = xcalloc(1, sizeof(***dir));
811 				(*dir)[ents]->filename = xstrdup(filename);
812 				(*dir)[ents]->longname = xstrdup(longname);
813 				memcpy(&(*dir)[ents]->a, &a, sizeof(a));
814 				(*dir)[++ents] = NULL;
815 			}
816 			free(filename);
817 			free(longname);
818 		}
819 	}
820 	status = 0;
821 
822  out:
823 	sshbuf_free(msg);
824 	do_close(conn, handle, handle_len);
825 	free(handle);
826 
827 	if (status != 0 && dir != NULL) {
828 		/* Don't return results on error */
829 		free_sftp_dirents(*dir);
830 		*dir = NULL;
831 	} else if (interrupted && dir != NULL && *dir != NULL) {
832 		/* Don't return partial matches on interrupt */
833 		free_sftp_dirents(*dir);
834 		*dir = xcalloc(1, sizeof(**dir));
835 		**dir = NULL;
836 	}
837 
838 	return status == SSH2_FX_OK ? 0 : -1;
839 }
840 
841 int
842 do_readdir(struct sftp_conn *conn, const char *path, SFTP_DIRENT ***dir)
843 {
844 	return(do_lsreaddir(conn, path, 0, dir));
845 }
846 
847 void free_sftp_dirents(SFTP_DIRENT **s)
848 {
849 	int i;
850 
851 	if (s == NULL)
852 		return;
853 	for (i = 0; s[i]; i++) {
854 		free(s[i]->filename);
855 		free(s[i]->longname);
856 		free(s[i]);
857 	}
858 	free(s);
859 }
860 
861 int
862 do_rm(struct sftp_conn *conn, const char *path)
863 {
864 	u_int status, id;
865 
866 	debug2("Sending SSH2_FXP_REMOVE \"%s\"", path);
867 
868 	id = conn->msg_id++;
869 	send_string_request(conn, id, SSH2_FXP_REMOVE, path, strlen(path));
870 	status = get_status(conn, id);
871 	if (status != SSH2_FX_OK)
872 		error("remote delete %s: %s", path, fx2txt(status));
873 	return status == SSH2_FX_OK ? 0 : -1;
874 }
875 
876 int
877 do_mkdir(struct sftp_conn *conn, const char *path, Attrib *a, int print_flag)
878 {
879 	u_int status, id;
880 
881 	debug2("Sending SSH2_FXP_MKDIR \"%s\"", path);
882 
883 	id = conn->msg_id++;
884 	send_string_attrs_request(conn, id, SSH2_FXP_MKDIR, path,
885 	    strlen(path), a);
886 
887 	status = get_status(conn, id);
888 	if (status != SSH2_FX_OK && print_flag)
889 		error("remote mkdir \"%s\": %s", path, fx2txt(status));
890 
891 	return status == SSH2_FX_OK ? 0 : -1;
892 }
893 
894 int
895 do_rmdir(struct sftp_conn *conn, const char *path)
896 {
897 	u_int status, id;
898 
899 	debug2("Sending SSH2_FXP_RMDIR \"%s\"", path);
900 
901 	id = conn->msg_id++;
902 	send_string_request(conn, id, SSH2_FXP_RMDIR, path,
903 	    strlen(path));
904 
905 	status = get_status(conn, id);
906 	if (status != SSH2_FX_OK)
907 		error("remote rmdir \"%s\": %s", path, fx2txt(status));
908 
909 	return status == SSH2_FX_OK ? 0 : -1;
910 }
911 
912 Attrib *
913 do_stat(struct sftp_conn *conn, const char *path, int quiet)
914 {
915 	u_int id;
916 
917 	debug2("Sending SSH2_FXP_STAT \"%s\"", path);
918 
919 	id = conn->msg_id++;
920 
921 	send_string_request(conn, id,
922 	    conn->version == 0 ? SSH2_FXP_STAT_VERSION_0 : SSH2_FXP_STAT,
923 	    path, strlen(path));
924 
925 	return(get_decode_stat(conn, id, quiet));
926 }
927 
928 Attrib *
929 do_lstat(struct sftp_conn *conn, const char *path, int quiet)
930 {
931 	u_int id;
932 
933 	if (conn->version == 0) {
934 		if (quiet)
935 			debug("Server version does not support lstat operation");
936 		else
937 			logit("Server version does not support lstat operation");
938 		return(do_stat(conn, path, quiet));
939 	}
940 
941 	id = conn->msg_id++;
942 	send_string_request(conn, id, SSH2_FXP_LSTAT, path,
943 	    strlen(path));
944 
945 	return(get_decode_stat(conn, id, quiet));
946 }
947 
948 #ifdef notyet
949 Attrib *
950 do_fstat(struct sftp_conn *conn, const u_char *handle, u_int handle_len,
951     int quiet)
952 {
953 	u_int id;
954 
955 	debug2("Sending SSH2_FXP_FSTAT \"%s\"");
956 
957 	id = conn->msg_id++;
958 	send_string_request(conn, id, SSH2_FXP_FSTAT, handle,
959 	    handle_len);
960 
961 	return(get_decode_stat(conn, id, quiet));
962 }
963 #endif
964 
965 int
966 do_setstat(struct sftp_conn *conn, const char *path, Attrib *a)
967 {
968 	u_int status, id;
969 
970 	debug2("Sending SSH2_FXP_SETSTAT \"%s\"", path);
971 
972 	id = conn->msg_id++;
973 	send_string_attrs_request(conn, id, SSH2_FXP_SETSTAT, path,
974 	    strlen(path), a);
975 
976 	status = get_status(conn, id);
977 	if (status != SSH2_FX_OK)
978 		error("remote setstat \"%s\": %s", path, fx2txt(status));
979 
980 	return status == SSH2_FX_OK ? 0 : -1;
981 }
982 
983 int
984 do_fsetstat(struct sftp_conn *conn, const u_char *handle, u_int handle_len,
985     Attrib *a)
986 {
987 	u_int status, id;
988 
989 	debug2("Sending SSH2_FXP_FSETSTAT");
990 
991 	id = conn->msg_id++;
992 	send_string_attrs_request(conn, id, SSH2_FXP_FSETSTAT, handle,
993 	    handle_len, a);
994 
995 	status = get_status(conn, id);
996 	if (status != SSH2_FX_OK)
997 		error("remote fsetstat: %s", fx2txt(status));
998 
999 	return status == SSH2_FX_OK ? 0 : -1;
1000 }
1001 
1002 /* Implements both the realpath and expand-path operations */
1003 static char *
1004 do_realpath_expand(struct sftp_conn *conn, const char *path, int expand)
1005 {
1006 	struct sshbuf *msg;
1007 	u_int expected_id, count, id;
1008 	char *filename, *longname;
1009 	Attrib a;
1010 	u_char type;
1011 	int r;
1012 	const char *what = "SSH2_FXP_REALPATH";
1013 
1014 	if (expand)
1015 		what = "expand-path@openssh.com";
1016 	if ((msg = sshbuf_new()) == NULL)
1017 		fatal_f("sshbuf_new failed");
1018 
1019 	expected_id = id = conn->msg_id++;
1020 	if (expand) {
1021 		debug2("Sending SSH2_FXP_EXTENDED(expand-path@openssh.com) "
1022 		    "\"%s\"", path);
1023 		if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
1024 		    (r = sshbuf_put_u32(msg, id)) != 0 ||
1025 		    (r = sshbuf_put_cstring(msg,
1026 		    "expand-path@openssh.com")) != 0 ||
1027 		    (r = sshbuf_put_cstring(msg, path)) != 0)
1028 			fatal_fr(r, "compose %s", what);
1029 		send_msg(conn, msg);
1030 	} else {
1031 		debug2("Sending SSH2_FXP_REALPATH \"%s\"", path);
1032 		send_string_request(conn, id, SSH2_FXP_REALPATH,
1033 		    path, strlen(path));
1034 	}
1035 	get_msg(conn, msg);
1036 	if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
1037 	    (r = sshbuf_get_u32(msg, &id)) != 0)
1038 		fatal_fr(r, "parse");
1039 
1040 	if (id != expected_id)
1041 		fatal("ID mismatch (%u != %u)", id, expected_id);
1042 
1043 	if (type == SSH2_FXP_STATUS) {
1044 		u_int status;
1045 		char *errmsg;
1046 
1047 		if ((r = sshbuf_get_u32(msg, &status)) != 0 ||
1048 		    (r = sshbuf_get_cstring(msg, &errmsg, NULL)) != 0)
1049 			fatal_fr(r, "parse status");
1050 		error("%s %s: %s", expand ? "expand" : "realpath",
1051 		    path, *errmsg == '\0' ? fx2txt(status) : errmsg);
1052 		free(errmsg);
1053 		sshbuf_free(msg);
1054 		return NULL;
1055 	} else if (type != SSH2_FXP_NAME)
1056 		fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
1057 		    SSH2_FXP_NAME, type);
1058 
1059 	if ((r = sshbuf_get_u32(msg, &count)) != 0)
1060 		fatal_fr(r, "parse count");
1061 	if (count != 1)
1062 		fatal("Got multiple names (%d) from %s", count, what);
1063 
1064 	if ((r = sshbuf_get_cstring(msg, &filename, NULL)) != 0 ||
1065 	    (r = sshbuf_get_cstring(msg, &longname, NULL)) != 0 ||
1066 	    (r = decode_attrib(msg, &a)) != 0)
1067 		fatal_fr(r, "parse filename/attrib");
1068 
1069 	debug3("%s %s -> %s", what, path, filename);
1070 
1071 	free(longname);
1072 
1073 	sshbuf_free(msg);
1074 
1075 	return(filename);
1076 }
1077 
1078 char *
1079 do_realpath(struct sftp_conn *conn, const char *path)
1080 {
1081 	return do_realpath_expand(conn, path, 0);
1082 }
1083 
1084 int
1085 can_expand_path(struct sftp_conn *conn)
1086 {
1087 	return (conn->exts & SFTP_EXT_PATH_EXPAND) != 0;
1088 }
1089 
1090 char *
1091 do_expand_path(struct sftp_conn *conn, const char *path)
1092 {
1093 	if (!can_expand_path(conn)) {
1094 		debug3_f("no server support, fallback to realpath");
1095 		return do_realpath_expand(conn, path, 0);
1096 	}
1097 	return do_realpath_expand(conn, path, 1);
1098 }
1099 
1100 int
1101 do_copy(struct sftp_conn *conn, const char *oldpath, const char *newpath)
1102 {
1103 	Attrib junk, *a;
1104 	struct sshbuf *msg;
1105 	u_char *old_handle, *new_handle;
1106 	u_int mode, status, id;
1107 	size_t old_handle_len, new_handle_len;
1108 	int r;
1109 
1110 	/* Return if the extension is not supported */
1111 	if ((conn->exts & SFTP_EXT_COPY_DATA) == 0) {
1112 		error("Server does not support copy-data extension");
1113 		return -1;
1114 	}
1115 
1116 	/* Make sure the file exists, and we can copy its perms */
1117 	if ((a = do_stat(conn, oldpath, 0)) == NULL)
1118 		return -1;
1119 
1120 	/* Do not preserve set[ug]id here, as we do not preserve ownership */
1121 	if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
1122 		mode = a->perm & 0777;
1123 
1124 		if (!S_ISREG(a->perm)) {
1125 			error("Cannot copy non-regular file: %s", oldpath);
1126 			return -1;
1127 		}
1128 	} else {
1129 		/* NB: The user's umask will apply to this */
1130 		mode = 0666;
1131 	}
1132 
1133 	/* Set up the new perms for the new file */
1134 	attrib_clear(a);
1135 	a->perm = mode;
1136 	a->flags |= SSH2_FILEXFER_ATTR_PERMISSIONS;
1137 
1138 	if ((msg = sshbuf_new()) == NULL)
1139 		fatal("%s: sshbuf_new failed", __func__);
1140 
1141 	attrib_clear(&junk); /* Send empty attributes */
1142 
1143 	/* Open the old file for reading */
1144 	id = conn->msg_id++;
1145 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_OPEN)) != 0 ||
1146 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
1147 	    (r = sshbuf_put_cstring(msg, oldpath)) != 0 ||
1148 	    (r = sshbuf_put_u32(msg, SSH2_FXF_READ)) != 0 ||
1149 	    (r = encode_attrib(msg, &junk)) != 0)
1150 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
1151 	send_msg(conn, msg);
1152 	debug3("Sent message SSH2_FXP_OPEN I:%u P:%s", id, oldpath);
1153 
1154 	sshbuf_reset(msg);
1155 
1156 	old_handle = get_handle(conn, id, &old_handle_len,
1157 	    "remote open(\"%s\")", oldpath);
1158 	if (old_handle == NULL) {
1159 		sshbuf_free(msg);
1160 		return -1;
1161 	}
1162 
1163 	/* Open the new file for writing */
1164 	id = conn->msg_id++;
1165 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_OPEN)) != 0 ||
1166 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
1167 	    (r = sshbuf_put_cstring(msg, newpath)) != 0 ||
1168 	    (r = sshbuf_put_u32(msg, SSH2_FXF_WRITE|SSH2_FXF_CREAT|
1169 	    SSH2_FXF_TRUNC)) != 0 ||
1170 	    (r = encode_attrib(msg, a)) != 0)
1171 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
1172 	send_msg(conn, msg);
1173 	debug3("Sent message SSH2_FXP_OPEN I:%u P:%s", id, newpath);
1174 
1175 	sshbuf_reset(msg);
1176 
1177 	new_handle = get_handle(conn, id, &new_handle_len,
1178 	    "remote open(\"%s\")", newpath);
1179 	if (new_handle == NULL) {
1180 		sshbuf_free(msg);
1181 		free(old_handle);
1182 		return -1;
1183 	}
1184 
1185 	/* Copy the file data */
1186 	id = conn->msg_id++;
1187 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
1188 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
1189 	    (r = sshbuf_put_cstring(msg, "copy-data")) != 0 ||
1190 	    (r = sshbuf_put_string(msg, old_handle, old_handle_len)) != 0 ||
1191 	    (r = sshbuf_put_u64(msg, 0)) != 0 ||
1192 	    (r = sshbuf_put_u64(msg, 0)) != 0 ||
1193 	    (r = sshbuf_put_string(msg, new_handle, new_handle_len)) != 0 ||
1194 	    (r = sshbuf_put_u64(msg, 0)) != 0)
1195 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
1196 	send_msg(conn, msg);
1197 	debug3("Sent message copy-data \"%s\" 0 0 -> \"%s\" 0",
1198 	       oldpath, newpath);
1199 
1200 	status = get_status(conn, id);
1201 	if (status != SSH2_FX_OK)
1202 		error("Couldn't copy file \"%s\" to \"%s\": %s", oldpath,
1203 		    newpath, fx2txt(status));
1204 
1205 	/* Clean up everything */
1206 	sshbuf_free(msg);
1207 	do_close(conn, old_handle, old_handle_len);
1208 	do_close(conn, new_handle, new_handle_len);
1209 	free(old_handle);
1210 	free(new_handle);
1211 
1212 	return status == SSH2_FX_OK ? 0 : -1;
1213 }
1214 
1215 int
1216 do_rename(struct sftp_conn *conn, const char *oldpath, const char *newpath,
1217     int force_legacy)
1218 {
1219 	struct sshbuf *msg;
1220 	u_int status, id;
1221 	int r, use_ext = (conn->exts & SFTP_EXT_POSIX_RENAME) && !force_legacy;
1222 
1223 	if ((msg = sshbuf_new()) == NULL)
1224 		fatal_f("sshbuf_new failed");
1225 
1226 	/* Send rename request */
1227 	id = conn->msg_id++;
1228 	if (use_ext) {
1229 		debug2("Sending SSH2_FXP_EXTENDED(posix-rename@openssh.com) "
1230 		    "\"%s\" to \"%s\"", oldpath, newpath);
1231 		if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
1232 		    (r = sshbuf_put_u32(msg, id)) != 0 ||
1233 		    (r = sshbuf_put_cstring(msg,
1234 		    "posix-rename@openssh.com")) != 0)
1235 			fatal_fr(r, "compose posix-rename");
1236 	} else {
1237 		debug2("Sending SSH2_FXP_RENAME \"%s\" to \"%s\"",
1238 		    oldpath, newpath);
1239 		if ((r = sshbuf_put_u8(msg, SSH2_FXP_RENAME)) != 0 ||
1240 		    (r = sshbuf_put_u32(msg, id)) != 0)
1241 			fatal_fr(r, "compose rename");
1242 	}
1243 	if ((r = sshbuf_put_cstring(msg, oldpath)) != 0 ||
1244 	    (r = sshbuf_put_cstring(msg, newpath)) != 0)
1245 		fatal_fr(r, "compose paths");
1246 	send_msg(conn, msg);
1247 	debug3("Sent message %s \"%s\" -> \"%s\"",
1248 	    use_ext ? "posix-rename@openssh.com" :
1249 	    "SSH2_FXP_RENAME", oldpath, newpath);
1250 	sshbuf_free(msg);
1251 
1252 	status = get_status(conn, id);
1253 	if (status != SSH2_FX_OK)
1254 		error("remote rename \"%s\" to \"%s\": %s", oldpath,
1255 		    newpath, fx2txt(status));
1256 
1257 	return status == SSH2_FX_OK ? 0 : -1;
1258 }
1259 
1260 int
1261 do_hardlink(struct sftp_conn *conn, const char *oldpath, const char *newpath)
1262 {
1263 	struct sshbuf *msg;
1264 	u_int status, id;
1265 	int r;
1266 
1267 	if ((conn->exts & SFTP_EXT_HARDLINK) == 0) {
1268 		error("Server does not support hardlink@openssh.com extension");
1269 		return -1;
1270 	}
1271 	debug2("Sending SSH2_FXP_EXTENDED(hardlink@openssh.com) "
1272 	    "\"%s\" to \"%s\"", oldpath, newpath);
1273 
1274 	if ((msg = sshbuf_new()) == NULL)
1275 		fatal_f("sshbuf_new failed");
1276 
1277 	/* Send link request */
1278 	id = conn->msg_id++;
1279 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
1280 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
1281 	    (r = sshbuf_put_cstring(msg, "hardlink@openssh.com")) != 0 ||
1282 	    (r = sshbuf_put_cstring(msg, oldpath)) != 0 ||
1283 	    (r = sshbuf_put_cstring(msg, newpath)) != 0)
1284 		fatal_fr(r, "compose");
1285 	send_msg(conn, msg);
1286 	debug3("Sent message hardlink@openssh.com \"%s\" -> \"%s\"",
1287 	    oldpath, newpath);
1288 	sshbuf_free(msg);
1289 
1290 	status = get_status(conn, id);
1291 	if (status != SSH2_FX_OK)
1292 		error("remote link \"%s\" to \"%s\": %s", oldpath,
1293 		    newpath, fx2txt(status));
1294 
1295 	return status == SSH2_FX_OK ? 0 : -1;
1296 }
1297 
1298 int
1299 do_symlink(struct sftp_conn *conn, const char *oldpath, const char *newpath)
1300 {
1301 	struct sshbuf *msg;
1302 	u_int status, id;
1303 	int r;
1304 
1305 	if (conn->version < 3) {
1306 		error("This server does not support the symlink operation");
1307 		return(SSH2_FX_OP_UNSUPPORTED);
1308 	}
1309 	debug2("Sending SSH2_FXP_SYMLINK \"%s\" to \"%s\"", oldpath, newpath);
1310 
1311 	if ((msg = sshbuf_new()) == NULL)
1312 		fatal_f("sshbuf_new failed");
1313 
1314 	/* Send symlink request */
1315 	id = conn->msg_id++;
1316 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_SYMLINK)) != 0 ||
1317 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
1318 	    (r = sshbuf_put_cstring(msg, oldpath)) != 0 ||
1319 	    (r = sshbuf_put_cstring(msg, newpath)) != 0)
1320 		fatal_fr(r, "compose");
1321 	send_msg(conn, msg);
1322 	debug3("Sent message SSH2_FXP_SYMLINK \"%s\" -> \"%s\"", oldpath,
1323 	    newpath);
1324 	sshbuf_free(msg);
1325 
1326 	status = get_status(conn, id);
1327 	if (status != SSH2_FX_OK)
1328 		error("remote symlink file \"%s\" to \"%s\": %s", oldpath,
1329 		    newpath, fx2txt(status));
1330 
1331 	return status == SSH2_FX_OK ? 0 : -1;
1332 }
1333 
1334 int
1335 do_fsync(struct sftp_conn *conn, u_char *handle, u_int handle_len)
1336 {
1337 	struct sshbuf *msg;
1338 	u_int status, id;
1339 	int r;
1340 
1341 	/* Silently return if the extension is not supported */
1342 	if ((conn->exts & SFTP_EXT_FSYNC) == 0)
1343 		return -1;
1344 	debug2("Sending SSH2_FXP_EXTENDED(fsync@openssh.com)");
1345 
1346 	/* Send fsync request */
1347 	if ((msg = sshbuf_new()) == NULL)
1348 		fatal_f("sshbuf_new failed");
1349 	id = conn->msg_id++;
1350 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
1351 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
1352 	    (r = sshbuf_put_cstring(msg, "fsync@openssh.com")) != 0 ||
1353 	    (r = sshbuf_put_string(msg, handle, handle_len)) != 0)
1354 		fatal_fr(r, "compose");
1355 	send_msg(conn, msg);
1356 	debug3("Sent message fsync@openssh.com I:%u", id);
1357 	sshbuf_free(msg);
1358 
1359 	status = get_status(conn, id);
1360 	if (status != SSH2_FX_OK)
1361 		error("remote fsync: %s", fx2txt(status));
1362 
1363 	return status == SSH2_FX_OK ? 0 : -1;
1364 }
1365 
1366 #ifdef notyet
1367 char *
1368 do_readlink(struct sftp_conn *conn, const char *path)
1369 {
1370 	struct sshbuf *msg;
1371 	u_int expected_id, count, id;
1372 	char *filename, *longname;
1373 	Attrib a;
1374 	u_char type;
1375 	int r;
1376 
1377 	debug2("Sending SSH2_FXP_READLINK \"%s\"", path);
1378 
1379 	expected_id = id = conn->msg_id++;
1380 	send_string_request(conn, id, SSH2_FXP_READLINK, path, strlen(path));
1381 
1382 	if ((msg = sshbuf_new()) == NULL)
1383 		fatal_f("sshbuf_new failed");
1384 
1385 	get_msg(conn, msg);
1386 	if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
1387 	    (r = sshbuf_get_u32(msg, &id)) != 0)
1388 		fatal_fr(r, "parse");
1389 
1390 	if (id != expected_id)
1391 		fatal("ID mismatch (%u != %u)", id, expected_id);
1392 
1393 	if (type == SSH2_FXP_STATUS) {
1394 		u_int status;
1395 
1396 		if ((r = sshbuf_get_u32(msg, &status)) != 0)
1397 			fatal_fr(r, "parse status");
1398 		error("Couldn't readlink: %s", fx2txt(status));
1399 		sshbuf_free(msg);
1400 		return(NULL);
1401 	} else if (type != SSH2_FXP_NAME)
1402 		fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
1403 		    SSH2_FXP_NAME, type);
1404 
1405 	if ((r = sshbuf_get_u32(msg, &count)) != 0)
1406 		fatal_fr(r, "parse count");
1407 	if (count != 1)
1408 		fatal("Got multiple names (%d) from SSH_FXP_READLINK", count);
1409 
1410 	if ((r = sshbuf_get_cstring(msg, &filename, NULL)) != 0 ||
1411 	    (r = sshbuf_get_cstring(msg, &longname, NULL)) != 0 ||
1412 	    (r = decode_attrib(msg, &a)) != 0)
1413 		fatal_fr(r, "parse filenames/attrib");
1414 
1415 	debug3("SSH_FXP_READLINK %s -> %s", path, filename);
1416 
1417 	free(longname);
1418 
1419 	sshbuf_free(msg);
1420 
1421 	return filename;
1422 }
1423 #endif
1424 
1425 int
1426 do_statvfs(struct sftp_conn *conn, const char *path, struct sftp_statvfs *st,
1427     int quiet)
1428 {
1429 	struct sshbuf *msg;
1430 	u_int id;
1431 	int r;
1432 
1433 	if ((conn->exts & SFTP_EXT_STATVFS) == 0) {
1434 		error("Server does not support statvfs@openssh.com extension");
1435 		return -1;
1436 	}
1437 
1438 	debug2("Sending SSH2_FXP_EXTENDED(statvfs@openssh.com) \"%s\"", path);
1439 
1440 	id = conn->msg_id++;
1441 
1442 	if ((msg = sshbuf_new()) == NULL)
1443 		fatal_f("sshbuf_new failed");
1444 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
1445 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
1446 	    (r = sshbuf_put_cstring(msg, "statvfs@openssh.com")) != 0 ||
1447 	    (r = sshbuf_put_cstring(msg, path)) != 0)
1448 		fatal_fr(r, "compose");
1449 	send_msg(conn, msg);
1450 	sshbuf_free(msg);
1451 
1452 	return get_decode_statvfs(conn, st, id, quiet);
1453 }
1454 
1455 #ifdef notyet
1456 int
1457 do_fstatvfs(struct sftp_conn *conn, const u_char *handle, u_int handle_len,
1458     struct sftp_statvfs *st, int quiet)
1459 {
1460 	struct sshbuf *msg;
1461 	u_int id;
1462 
1463 	if ((conn->exts & SFTP_EXT_FSTATVFS) == 0) {
1464 		error("Server does not support fstatvfs@openssh.com extension");
1465 		return -1;
1466 	}
1467 
1468 	debug2("Sending SSH2_FXP_EXTENDED(fstatvfs@openssh.com)");
1469 
1470 	id = conn->msg_id++;
1471 
1472 	if ((msg = sshbuf_new()) == NULL)
1473 		fatal_f("sshbuf_new failed");
1474 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
1475 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
1476 	    (r = sshbuf_put_cstring(msg, "fstatvfs@openssh.com")) != 0 ||
1477 	    (r = sshbuf_put_string(msg, handle, handle_len)) != 0)
1478 		fatal_fr(r, "compose");
1479 	send_msg(conn, msg);
1480 	sshbuf_free(msg);
1481 
1482 	return get_decode_statvfs(conn, st, id, quiet);
1483 }
1484 #endif
1485 
1486 int
1487 do_lsetstat(struct sftp_conn *conn, const char *path, Attrib *a)
1488 {
1489 	struct sshbuf *msg;
1490 	u_int status, id;
1491 	int r;
1492 
1493 	if ((conn->exts & SFTP_EXT_LSETSTAT) == 0) {
1494 		error("Server does not support lsetstat@openssh.com extension");
1495 		return -1;
1496 	}
1497 
1498 	debug2("Sending SSH2_FXP_EXTENDED(lsetstat@openssh.com) \"%s\"", path);
1499 
1500 	id = conn->msg_id++;
1501 	if ((msg = sshbuf_new()) == NULL)
1502 		fatal_f("sshbuf_new failed");
1503 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
1504 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
1505 	    (r = sshbuf_put_cstring(msg, "lsetstat@openssh.com")) != 0 ||
1506 	    (r = sshbuf_put_cstring(msg, path)) != 0 ||
1507 	    (r = encode_attrib(msg, a)) != 0)
1508 		fatal_fr(r, "compose");
1509 	send_msg(conn, msg);
1510 	sshbuf_free(msg);
1511 
1512 	status = get_status(conn, id);
1513 	if (status != SSH2_FX_OK)
1514 		error("remote lsetstat \"%s\": %s", path, fx2txt(status));
1515 
1516 	return status == SSH2_FX_OK ? 0 : -1;
1517 }
1518 
1519 static void
1520 send_read_request(struct sftp_conn *conn, u_int id, u_int64_t offset,
1521     u_int len, const u_char *handle, u_int handle_len)
1522 {
1523 	struct sshbuf *msg;
1524 	int r;
1525 
1526 	if ((msg = sshbuf_new()) == NULL)
1527 		fatal_f("sshbuf_new failed");
1528 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_READ)) != 0 ||
1529 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
1530 	    (r = sshbuf_put_string(msg, handle, handle_len)) != 0 ||
1531 	    (r = sshbuf_put_u64(msg, offset)) != 0 ||
1532 	    (r = sshbuf_put_u32(msg, len)) != 0)
1533 		fatal_fr(r, "compose");
1534 	send_msg(conn, msg);
1535 	sshbuf_free(msg);
1536 }
1537 
1538 static int
1539 send_open(struct sftp_conn *conn, const char *path, const char *tag,
1540     u_int openmode, Attrib *a, u_char **handlep, size_t *handle_lenp)
1541 {
1542 	Attrib junk;
1543 	u_char *handle;
1544 	size_t handle_len;
1545 	struct sshbuf *msg;
1546 	int r;
1547 	u_int id;
1548 
1549 	debug2("Sending SSH2_FXP_OPEN \"%s\"", path);
1550 
1551 	*handlep = NULL;
1552 	*handle_lenp = 0;
1553 
1554 	if (a == NULL) {
1555 		attrib_clear(&junk); /* Send empty attributes */
1556 		a = &junk;
1557 	}
1558 	/* Send open request */
1559 	if ((msg = sshbuf_new()) == NULL)
1560 		fatal_f("sshbuf_new failed");
1561 	id = conn->msg_id++;
1562 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_OPEN)) != 0 ||
1563 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
1564 	    (r = sshbuf_put_cstring(msg, path)) != 0 ||
1565 	    (r = sshbuf_put_u32(msg, openmode)) != 0 ||
1566 	    (r = encode_attrib(msg, a)) != 0)
1567 		fatal_fr(r, "compose %s open", tag);
1568 	send_msg(conn, msg);
1569 	sshbuf_free(msg);
1570 	debug3("Sent %s message SSH2_FXP_OPEN I:%u P:%s M:0x%04x",
1571 	    tag, id, path, openmode);
1572 	if ((handle = get_handle(conn, id, &handle_len,
1573 	    "%s open \"%s\"", tag, path)) == NULL)
1574 		return -1;
1575 	/* success */
1576 	*handlep = handle;
1577 	*handle_lenp = handle_len;
1578 	return 0;
1579 }
1580 
1581 static const char *
1582 progress_meter_path(const char *path)
1583 {
1584 	const char *progresspath;
1585 
1586 	if ((progresspath = strrchr(path, '/')) == NULL)
1587 		return path;
1588 	progresspath++;
1589 	if (*progresspath == '\0')
1590 		return path;
1591 	return progresspath;
1592 }
1593 
1594 int
1595 do_download(struct sftp_conn *conn, const char *remote_path,
1596     const char *local_path, Attrib *a, int preserve_flag, int resume_flag,
1597     int fsync_flag, int inplace_flag)
1598 {
1599 	struct sshbuf *msg;
1600 	u_char *handle;
1601 	int local_fd = -1, write_error;
1602 	int read_error, write_errno, lmodified = 0, reordered = 0, r;
1603 	u_int64_t offset = 0, size, highwater = 0, maxack = 0;
1604 	u_int mode, id, buflen, num_req, max_req, status = SSH2_FX_OK;
1605 	off_t progress_counter;
1606 	size_t handle_len;
1607 	struct stat st;
1608 	struct requests requests;
1609 	struct request *req;
1610 	u_char type;
1611 
1612 	debug2_f("download remote \"%s\" to local \"%s\"",
1613 	    remote_path, local_path);
1614 
1615 	TAILQ_INIT(&requests);
1616 
1617 	if (a == NULL && (a = do_stat(conn, remote_path, 0)) == NULL)
1618 		return -1;
1619 
1620 	/* Do not preserve set[ug]id here, as we do not preserve ownership */
1621 	if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS)
1622 		mode = a->perm & 0777;
1623 	else
1624 		mode = 0666;
1625 
1626 	if ((a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) &&
1627 	    (!S_ISREG(a->perm))) {
1628 		error("download %s: not a regular file", remote_path);
1629 		return(-1);
1630 	}
1631 
1632 	if (a->flags & SSH2_FILEXFER_ATTR_SIZE)
1633 		size = a->size;
1634 	else
1635 		size = 0;
1636 
1637 	buflen = conn->download_buflen;
1638 
1639 	/* Send open request */
1640 	if (send_open(conn, remote_path, "remote", SSH2_FXF_READ, NULL,
1641 	    &handle, &handle_len) != 0)
1642 		return -1;
1643 
1644 	local_fd = open(local_path, O_WRONLY | O_CREAT |
1645 	((resume_flag || inplace_flag) ? 0 : O_TRUNC), mode | S_IWUSR);
1646 	if (local_fd == -1) {
1647 		error("open local \"%s\": %s", local_path, strerror(errno));
1648 		goto fail;
1649 	}
1650 	if (resume_flag) {
1651 		if (fstat(local_fd, &st) == -1) {
1652 			error("stat local \"%s\": %s",
1653 			    local_path, strerror(errno));
1654 			goto fail;
1655 		}
1656 		if (st.st_size < 0) {
1657 			error("\"%s\" has negative size", local_path);
1658 			goto fail;
1659 		}
1660 		if ((u_int64_t)st.st_size > size) {
1661 			error("Unable to resume download of \"%s\": "
1662 			    "local file is larger than remote", local_path);
1663  fail:
1664 			do_close(conn, handle, handle_len);
1665 			free(handle);
1666 			if (local_fd != -1)
1667 				close(local_fd);
1668 			return -1;
1669 		}
1670 		offset = highwater = maxack = st.st_size;
1671 	}
1672 
1673 	/* Read from remote and write to local */
1674 	write_error = read_error = write_errno = num_req = 0;
1675 	max_req = 1;
1676 	progress_counter = offset;
1677 
1678 	if (showprogress && size != 0) {
1679 		start_progress_meter(progress_meter_path(remote_path),
1680 		    size, &progress_counter);
1681 	}
1682 
1683 	if ((msg = sshbuf_new()) == NULL)
1684 		fatal_f("sshbuf_new failed");
1685 
1686 	while (num_req > 0 || max_req > 0) {
1687 		u_char *data;
1688 		size_t len;
1689 
1690 		/*
1691 		 * Simulate EOF on interrupt: stop sending new requests and
1692 		 * allow outstanding requests to drain gracefully
1693 		 */
1694 		if (interrupted) {
1695 			if (num_req == 0) /* If we haven't started yet... */
1696 				break;
1697 			max_req = 0;
1698 		}
1699 
1700 		/* Send some more requests */
1701 		while (num_req < max_req) {
1702 			debug3("Request range %llu -> %llu (%d/%d)",
1703 			    (unsigned long long)offset,
1704 			    (unsigned long long)offset + buflen - 1,
1705 			    num_req, max_req);
1706 			req = request_enqueue(&requests, conn->msg_id++,
1707 			    buflen, offset);
1708 			offset += buflen;
1709 			num_req++;
1710 			send_read_request(conn, req->id, req->offset,
1711 			    req->len, handle, handle_len);
1712 		}
1713 
1714 		sshbuf_reset(msg);
1715 		get_msg(conn, msg);
1716 		if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
1717 		    (r = sshbuf_get_u32(msg, &id)) != 0)
1718 			fatal_fr(r, "parse");
1719 		debug3("Received reply T:%u I:%u R:%d", type, id, max_req);
1720 
1721 		/* Find the request in our queue */
1722 		if ((req = request_find(&requests, id)) == NULL)
1723 			fatal("Unexpected reply %u", id);
1724 
1725 		switch (type) {
1726 		case SSH2_FXP_STATUS:
1727 			if ((r = sshbuf_get_u32(msg, &status)) != 0)
1728 				fatal_fr(r, "parse status");
1729 			if (status != SSH2_FX_EOF)
1730 				read_error = 1;
1731 			max_req = 0;
1732 			TAILQ_REMOVE(&requests, req, tq);
1733 			free(req);
1734 			num_req--;
1735 			break;
1736 		case SSH2_FXP_DATA:
1737 			if ((r = sshbuf_get_string(msg, &data, &len)) != 0)
1738 				fatal_fr(r, "parse data");
1739 			debug3("Received data %llu -> %llu",
1740 			    (unsigned long long)req->offset,
1741 			    (unsigned long long)req->offset + len - 1);
1742 			if (len > req->len)
1743 				fatal("Received more data than asked for "
1744 				    "%zu > %zu", len, req->len);
1745 			lmodified = 1;
1746 			if ((lseek(local_fd, req->offset, SEEK_SET) == -1 ||
1747 			    atomicio(vwrite, local_fd, data, len) != len) &&
1748 			    !write_error) {
1749 				write_errno = errno;
1750 				write_error = 1;
1751 				max_req = 0;
1752 			} else {
1753 				/*
1754 				 * Track both the highest offset acknowledged
1755 				 * and the highest *contiguous* offset
1756 				 * acknowledged.
1757 				 * We'll need the latter for ftruncate()ing
1758 				 * interrupted transfers.
1759 				 */
1760 				if (maxack < req->offset + len)
1761 					maxack = req->offset + len;
1762 				if (!reordered && req->offset <= highwater)
1763 					highwater = maxack;
1764 				else if (!reordered && req->offset > highwater)
1765 					reordered = 1;
1766 			}
1767 			progress_counter += len;
1768 			free(data);
1769 
1770 			if (len == req->len) {
1771 				TAILQ_REMOVE(&requests, req, tq);
1772 				free(req);
1773 				num_req--;
1774 			} else {
1775 				/* Resend the request for the missing data */
1776 				debug3("Short data block, re-requesting "
1777 				    "%llu -> %llu (%2d)",
1778 				    (unsigned long long)req->offset + len,
1779 				    (unsigned long long)req->offset +
1780 				    req->len - 1, num_req);
1781 				req->id = conn->msg_id++;
1782 				req->len -= len;
1783 				req->offset += len;
1784 				send_read_request(conn, req->id,
1785 				    req->offset, req->len, handle, handle_len);
1786 				/* Reduce the request size */
1787 				if (len < buflen)
1788 					buflen = MAXIMUM(MIN_READ_SIZE, len);
1789 			}
1790 			if (max_req > 0) { /* max_req = 0 iff EOF received */
1791 				if (size > 0 && offset > size) {
1792 					/* Only one request at a time
1793 					 * after the expected EOF */
1794 					debug3("Finish at %llu (%2d)",
1795 					    (unsigned long long)offset,
1796 					    num_req);
1797 					max_req = 1;
1798 				} else if (max_req < conn->num_requests) {
1799 					++max_req;
1800 				}
1801 			}
1802 			break;
1803 		default:
1804 			fatal("Expected SSH2_FXP_DATA(%u) packet, got %u",
1805 			    SSH2_FXP_DATA, type);
1806 		}
1807 	}
1808 
1809 	if (showprogress && size)
1810 		stop_progress_meter();
1811 
1812 	/* Sanity check */
1813 	if (TAILQ_FIRST(&requests) != NULL)
1814 		fatal("Transfer complete, but requests still in queue");
1815 
1816 	if (!read_error && !write_error && !interrupted) {
1817 		/* we got everything */
1818 		highwater = maxack;
1819 	}
1820 
1821 	/*
1822 	 * Truncate at highest contiguous point to avoid holes on interrupt,
1823 	 * or unconditionally if writing in place.
1824 	 */
1825 	if (inplace_flag || read_error || write_error || interrupted) {
1826 		if (reordered && resume_flag &&
1827 		    (read_error || write_error || interrupted)) {
1828 			error("Unable to resume download of \"%s\": "
1829 			    "server reordered requests", local_path);
1830 		}
1831 		debug("truncating at %llu", (unsigned long long)highwater);
1832 		if (ftruncate(local_fd, highwater) == -1)
1833 			error("local ftruncate \"%s\": %s", local_path,
1834 			    strerror(errno));
1835 	}
1836 	if (read_error) {
1837 		error("read remote \"%s\" : %s", remote_path, fx2txt(status));
1838 		status = -1;
1839 		do_close(conn, handle, handle_len);
1840 	} else if (write_error) {
1841 		error("write local \"%s\": %s", local_path,
1842 		    strerror(write_errno));
1843 		status = SSH2_FX_FAILURE;
1844 		do_close(conn, handle, handle_len);
1845 	} else {
1846 		if (do_close(conn, handle, handle_len) != 0 || interrupted)
1847 			status = SSH2_FX_FAILURE;
1848 		else
1849 			status = SSH2_FX_OK;
1850 		/* Override umask and utimes if asked */
1851 #ifdef HAVE_FCHMOD
1852 		if (preserve_flag && fchmod(local_fd, mode) == -1)
1853 #else
1854 		if (preserve_flag && chmod(local_path, mode) == -1)
1855 #endif /* HAVE_FCHMOD */
1856 			error("local chmod \"%s\": %s", local_path,
1857 			    strerror(errno));
1858 		if (preserve_flag &&
1859 		    (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME)) {
1860 			struct timeval tv[2];
1861 			tv[0].tv_sec = a->atime;
1862 			tv[1].tv_sec = a->mtime;
1863 			tv[0].tv_usec = tv[1].tv_usec = 0;
1864 			if (utimes(local_path, tv) == -1)
1865 				error("local set times \"%s\": %s",
1866 				    local_path, strerror(errno));
1867 		}
1868 		if (resume_flag && !lmodified)
1869 			logit("File \"%s\" was not modified", local_path);
1870 		else if (fsync_flag) {
1871 			debug("syncing \"%s\"", local_path);
1872 			if (fsync(local_fd) == -1)
1873 				error("local sync \"%s\": %s",
1874 				    local_path, strerror(errno));
1875 		}
1876 	}
1877 	close(local_fd);
1878 	sshbuf_free(msg);
1879 	free(handle);
1880 
1881 	return status == SSH2_FX_OK ? 0 : -1;
1882 }
1883 
1884 static int
1885 download_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
1886     int depth, Attrib *dirattrib, int preserve_flag, int print_flag,
1887     int resume_flag, int fsync_flag, int follow_link_flag, int inplace_flag)
1888 {
1889 	int i, ret = 0;
1890 	SFTP_DIRENT **dir_entries;
1891 	char *filename, *new_src = NULL, *new_dst = NULL;
1892 	mode_t mode = 0777, tmpmode = mode;
1893 
1894 	if (depth >= MAX_DIR_DEPTH) {
1895 		error("Maximum directory depth exceeded: %d levels", depth);
1896 		return -1;
1897 	}
1898 
1899 	debug2_f("download dir remote \"%s\" to local \"%s\"", src, dst);
1900 
1901 	if (dirattrib == NULL &&
1902 	    (dirattrib = do_stat(conn, src, 1)) == NULL) {
1903 		error("stat remote \"%s\" directory failed", src);
1904 		return -1;
1905 	}
1906 	if (!S_ISDIR(dirattrib->perm)) {
1907 		error("\"%s\" is not a directory", src);
1908 		return -1;
1909 	}
1910 	if (print_flag && print_flag != SFTP_PROGRESS_ONLY)
1911 		mprintf("Retrieving %s\n", src);
1912 
1913 	if (dirattrib->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
1914 		mode = dirattrib->perm & 01777;
1915 		tmpmode = mode | (S_IWUSR|S_IXUSR);
1916 	} else {
1917 		debug("download remote \"%s\": server "
1918 		    "did not send permissions", dst);
1919 	}
1920 
1921 	if (mkdir(dst, tmpmode) == -1 && errno != EEXIST) {
1922 		error("mkdir %s: %s", dst, strerror(errno));
1923 		return -1;
1924 	}
1925 
1926 	if (do_readdir(conn, src, &dir_entries) == -1) {
1927 		error("remote readdir \"%s\" failed", src);
1928 		return -1;
1929 	}
1930 
1931 	for (i = 0; dir_entries[i] != NULL && !interrupted; i++) {
1932 		free(new_dst);
1933 		free(new_src);
1934 
1935 		filename = dir_entries[i]->filename;
1936 		new_dst = path_append(dst, filename);
1937 		new_src = path_append(src, filename);
1938 
1939 		if (S_ISDIR(dir_entries[i]->a.perm)) {
1940 			if (strcmp(filename, ".") == 0 ||
1941 			    strcmp(filename, "..") == 0)
1942 				continue;
1943 			if (download_dir_internal(conn, new_src, new_dst,
1944 			    depth + 1, &(dir_entries[i]->a), preserve_flag,
1945 			    print_flag, resume_flag,
1946 			    fsync_flag, follow_link_flag, inplace_flag) == -1)
1947 				ret = -1;
1948 		} else if (S_ISREG(dir_entries[i]->a.perm) ||
1949 		    (follow_link_flag && S_ISLNK(dir_entries[i]->a.perm))) {
1950 			/*
1951 			 * If this is a symlink then don't send the link's
1952 			 * Attrib. do_download() will do a FXP_STAT operation
1953 			 * and get the link target's attributes.
1954 			 */
1955 			if (do_download(conn, new_src, new_dst,
1956 			    S_ISLNK(dir_entries[i]->a.perm) ? NULL :
1957 			    &(dir_entries[i]->a),
1958 			    preserve_flag, resume_flag, fsync_flag,
1959 			    inplace_flag) == -1) {
1960 				error("Download of file %s to %s failed",
1961 				    new_src, new_dst);
1962 				ret = -1;
1963 			}
1964 		} else
1965 			logit("download \"%s\": not a regular file", new_src);
1966 
1967 	}
1968 	free(new_dst);
1969 	free(new_src);
1970 
1971 	if (preserve_flag) {
1972 		if (dirattrib->flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
1973 			struct timeval tv[2];
1974 			tv[0].tv_sec = dirattrib->atime;
1975 			tv[1].tv_sec = dirattrib->mtime;
1976 			tv[0].tv_usec = tv[1].tv_usec = 0;
1977 			if (utimes(dst, tv) == -1)
1978 				error("local set times on \"%s\": %s",
1979 				    dst, strerror(errno));
1980 		} else
1981 			debug("Server did not send times for directory "
1982 			    "\"%s\"", dst);
1983 	}
1984 
1985 	if (mode != tmpmode && chmod(dst, mode) == -1)
1986 		error("local chmod directory \"%s\": %s", dst,
1987 		    strerror(errno));
1988 
1989 	free_sftp_dirents(dir_entries);
1990 
1991 	return ret;
1992 }
1993 
1994 int
1995 download_dir(struct sftp_conn *conn, const char *src, const char *dst,
1996     Attrib *dirattrib, int preserve_flag, int print_flag, int resume_flag,
1997     int fsync_flag, int follow_link_flag, int inplace_flag)
1998 {
1999 	char *src_canon;
2000 	int ret;
2001 
2002 	if ((src_canon = do_realpath(conn, src)) == NULL) {
2003 		error("download \"%s\": path canonicalization failed", src);
2004 		return -1;
2005 	}
2006 
2007 	ret = download_dir_internal(conn, src_canon, dst, 0,
2008 	    dirattrib, preserve_flag, print_flag, resume_flag, fsync_flag,
2009 	    follow_link_flag, inplace_flag);
2010 	free(src_canon);
2011 	return ret;
2012 }
2013 
2014 int
2015 do_upload(struct sftp_conn *conn, const char *local_path,
2016     const char *remote_path, int preserve_flag, int resume,
2017     int fsync_flag, int inplace_flag)
2018 {
2019 	int r, local_fd;
2020 	u_int openmode, id, status = SSH2_FX_OK, reordered = 0;
2021 	off_t offset, progress_counter;
2022 	u_char type, *handle, *data;
2023 	struct sshbuf *msg;
2024 	struct stat sb;
2025 	Attrib a, t, *c = NULL;
2026 	u_int32_t startid, ackid;
2027 	u_int64_t highwater = 0, maxack = 0;
2028 	struct request *ack = NULL;
2029 	struct requests acks;
2030 	size_t handle_len;
2031 
2032 	debug2_f("upload local \"%s\" to remote \"%s\"",
2033 	    local_path, remote_path);
2034 
2035 	TAILQ_INIT(&acks);
2036 
2037 	if ((local_fd = open(local_path, O_RDONLY)) == -1) {
2038 		error("open local \"%s\": %s", local_path, strerror(errno));
2039 		return(-1);
2040 	}
2041 	if (fstat(local_fd, &sb) == -1) {
2042 		error("fstat local \"%s\": %s", local_path, strerror(errno));
2043 		close(local_fd);
2044 		return(-1);
2045 	}
2046 	if (!S_ISREG(sb.st_mode)) {
2047 		error("local \"%s\" is not a regular file", local_path);
2048 		close(local_fd);
2049 		return(-1);
2050 	}
2051 	stat_to_attrib(&sb, &a);
2052 
2053 	a.flags &= ~SSH2_FILEXFER_ATTR_SIZE;
2054 	a.flags &= ~SSH2_FILEXFER_ATTR_UIDGID;
2055 	a.perm &= 0777;
2056 	if (!preserve_flag)
2057 		a.flags &= ~SSH2_FILEXFER_ATTR_ACMODTIME;
2058 
2059 	if (resume) {
2060 		/* Get remote file size if it exists */
2061 		if ((c = do_stat(conn, remote_path, 0)) == NULL) {
2062 			close(local_fd);
2063 			return -1;
2064 		}
2065 
2066 		if ((off_t)c->size >= sb.st_size) {
2067 			error("resume \"%s\": destination file "
2068 			    "same size or larger", local_path);
2069 			close(local_fd);
2070 			return -1;
2071 		}
2072 
2073 		if (lseek(local_fd, (off_t)c->size, SEEK_SET) == -1) {
2074 			close(local_fd);
2075 			return -1;
2076 		}
2077 	}
2078 
2079 	openmode = SSH2_FXF_WRITE|SSH2_FXF_CREAT;
2080 	if (resume)
2081 		openmode |= SSH2_FXF_APPEND;
2082 	else if (!inplace_flag)
2083 		openmode |= SSH2_FXF_TRUNC;
2084 
2085 	/* Send open request */
2086 	if (send_open(conn, remote_path, "dest", openmode, &a,
2087 	    &handle, &handle_len) != 0) {
2088 		close(local_fd);
2089 		return -1;
2090 	}
2091 
2092 	id = conn->msg_id;
2093 	startid = ackid = id + 1;
2094 	data = xmalloc(conn->upload_buflen);
2095 
2096 	/* Read from local and write to remote */
2097 	offset = progress_counter = (resume ? c->size : 0);
2098 	if (showprogress) {
2099 		start_progress_meter(progress_meter_path(local_path),
2100 		    sb.st_size, &progress_counter);
2101 	}
2102 
2103 	if ((msg = sshbuf_new()) == NULL)
2104 		fatal_f("sshbuf_new failed");
2105 	for (;;) {
2106 		int len;
2107 
2108 		/*
2109 		 * Can't use atomicio here because it returns 0 on EOF,
2110 		 * thus losing the last block of the file.
2111 		 * Simulate an EOF on interrupt, allowing ACKs from the
2112 		 * server to drain.
2113 		 */
2114 		if (interrupted || status != SSH2_FX_OK)
2115 			len = 0;
2116 		else do
2117 			len = read(local_fd, data, conn->upload_buflen);
2118 		while ((len == -1) &&
2119 		    (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK));
2120 
2121 		if (len == -1) {
2122 			fatal("read local \"%s\": %s",
2123 			    local_path, strerror(errno));
2124 		} else if (len != 0) {
2125 			ack = request_enqueue(&acks, ++id, len, offset);
2126 			sshbuf_reset(msg);
2127 			if ((r = sshbuf_put_u8(msg, SSH2_FXP_WRITE)) != 0 ||
2128 			    (r = sshbuf_put_u32(msg, ack->id)) != 0 ||
2129 			    (r = sshbuf_put_string(msg, handle,
2130 			    handle_len)) != 0 ||
2131 			    (r = sshbuf_put_u64(msg, offset)) != 0 ||
2132 			    (r = sshbuf_put_string(msg, data, len)) != 0)
2133 				fatal_fr(r, "compose");
2134 			send_msg(conn, msg);
2135 			debug3("Sent message SSH2_FXP_WRITE I:%u O:%llu S:%u",
2136 			    id, (unsigned long long)offset, len);
2137 		} else if (TAILQ_FIRST(&acks) == NULL)
2138 			break;
2139 
2140 		if (ack == NULL)
2141 			fatal("Unexpected ACK %u", id);
2142 
2143 		if (id == startid || len == 0 ||
2144 		    id - ackid >= conn->num_requests) {
2145 			u_int rid;
2146 
2147 			sshbuf_reset(msg);
2148 			get_msg(conn, msg);
2149 			if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
2150 			    (r = sshbuf_get_u32(msg, &rid)) != 0)
2151 				fatal_fr(r, "parse");
2152 
2153 			if (type != SSH2_FXP_STATUS)
2154 				fatal("Expected SSH2_FXP_STATUS(%d) packet, "
2155 				    "got %d", SSH2_FXP_STATUS, type);
2156 
2157 			if ((r = sshbuf_get_u32(msg, &status)) != 0)
2158 				fatal_fr(r, "parse status");
2159 			debug3("SSH2_FXP_STATUS %u", status);
2160 
2161 			/* Find the request in our queue */
2162 			if ((ack = request_find(&acks, rid)) == NULL)
2163 				fatal("Can't find request for ID %u", rid);
2164 			TAILQ_REMOVE(&acks, ack, tq);
2165 			debug3("In write loop, ack for %u %zu bytes at %lld",
2166 			    ack->id, ack->len, (unsigned long long)ack->offset);
2167 			++ackid;
2168 			progress_counter += ack->len;
2169 			/*
2170 			 * Track both the highest offset acknowledged and the
2171 			 * highest *contiguous* offset acknowledged.
2172 			 * We'll need the latter for ftruncate()ing
2173 			 * interrupted transfers.
2174 			 */
2175 			if (maxack < ack->offset + ack->len)
2176 				maxack = ack->offset + ack->len;
2177 			if (!reordered && ack->offset <= highwater)
2178 				highwater = maxack;
2179 			else if (!reordered && ack->offset > highwater) {
2180 				debug3_f("server reordered ACKs");
2181 				reordered = 1;
2182 			}
2183 			free(ack);
2184 		}
2185 		offset += len;
2186 		if (offset < 0)
2187 			fatal_f("offset < 0");
2188 	}
2189 	sshbuf_free(msg);
2190 
2191 	if (showprogress)
2192 		stop_progress_meter();
2193 	free(data);
2194 
2195 	if (status == SSH2_FX_OK && !interrupted) {
2196 		/* we got everything */
2197 		highwater = maxack;
2198 	}
2199 	if (status != SSH2_FX_OK) {
2200 		error("write remote \"%s\": %s", remote_path, fx2txt(status));
2201 		status = SSH2_FX_FAILURE;
2202 	}
2203 
2204 	if (inplace_flag || (resume && (status != SSH2_FX_OK || interrupted))) {
2205 		debug("truncating at %llu", (unsigned long long)highwater);
2206 		attrib_clear(&t);
2207 		t.flags = SSH2_FILEXFER_ATTR_SIZE;
2208 		t.size = highwater;
2209 		do_fsetstat(conn, handle, handle_len, &t);
2210 	}
2211 
2212 	if (close(local_fd) == -1) {
2213 		error("close local \"%s\": %s", local_path, strerror(errno));
2214 		status = SSH2_FX_FAILURE;
2215 	}
2216 
2217 	/* Override umask and utimes if asked */
2218 	if (preserve_flag)
2219 		do_fsetstat(conn, handle, handle_len, &a);
2220 
2221 	if (fsync_flag)
2222 		(void)do_fsync(conn, handle, handle_len);
2223 
2224 	if (do_close(conn, handle, handle_len) != 0)
2225 		status = SSH2_FX_FAILURE;
2226 
2227 	free(handle);
2228 
2229 	return status == SSH2_FX_OK ? 0 : -1;
2230 }
2231 
2232 static int
2233 upload_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
2234     int depth, int preserve_flag, int print_flag, int resume, int fsync_flag,
2235     int follow_link_flag, int inplace_flag)
2236 {
2237 	int ret = 0;
2238 	DIR *dirp;
2239 	struct dirent *dp;
2240 	char *filename, *new_src = NULL, *new_dst = NULL;
2241 	struct stat sb;
2242 	Attrib a, *dirattrib;
2243 	u_int32_t saved_perm;
2244 
2245 	debug2_f("upload local dir \"%s\" to remote \"%s\"", src, dst);
2246 
2247 	if (depth >= MAX_DIR_DEPTH) {
2248 		error("Maximum directory depth exceeded: %d levels", depth);
2249 		return -1;
2250 	}
2251 
2252 	if (stat(src, &sb) == -1) {
2253 		error("stat local \"%s\": %s", src, strerror(errno));
2254 		return -1;
2255 	}
2256 	if (!S_ISDIR(sb.st_mode)) {
2257 		error("\"%s\" is not a directory", src);
2258 		return -1;
2259 	}
2260 	if (print_flag && print_flag != SFTP_PROGRESS_ONLY)
2261 		mprintf("Entering %s\n", src);
2262 
2263 	stat_to_attrib(&sb, &a);
2264 	a.flags &= ~SSH2_FILEXFER_ATTR_SIZE;
2265 	a.flags &= ~SSH2_FILEXFER_ATTR_UIDGID;
2266 	a.perm &= 01777;
2267 	if (!preserve_flag)
2268 		a.flags &= ~SSH2_FILEXFER_ATTR_ACMODTIME;
2269 
2270 	/*
2271 	 * sftp lacks a portable status value to match errno EEXIST,
2272 	 * so if we get a failure back then we must check whether
2273 	 * the path already existed and is a directory.  Ensure we can
2274 	 * write to the directory we create for the duration of the transfer.
2275 	 */
2276 	saved_perm = a.perm;
2277 	a.perm |= (S_IWUSR|S_IXUSR);
2278 	if (do_mkdir(conn, dst, &a, 0) != 0) {
2279 		if ((dirattrib = do_stat(conn, dst, 0)) == NULL)
2280 			return -1;
2281 		if (!S_ISDIR(dirattrib->perm)) {
2282 			error("\"%s\" exists but is not a directory", dst);
2283 			return -1;
2284 		}
2285 	}
2286 	a.perm = saved_perm;
2287 
2288 	if ((dirp = opendir(src)) == NULL) {
2289 		error("local opendir \"%s\": %s", src, strerror(errno));
2290 		return -1;
2291 	}
2292 
2293 	while (((dp = readdir(dirp)) != NULL) && !interrupted) {
2294 		if (dp->d_ino == 0)
2295 			continue;
2296 		free(new_dst);
2297 		free(new_src);
2298 		filename = dp->d_name;
2299 		new_dst = path_append(dst, filename);
2300 		new_src = path_append(src, filename);
2301 
2302 		if (lstat(new_src, &sb) == -1) {
2303 			logit("local lstat \"%s\": %s", filename,
2304 			    strerror(errno));
2305 			ret = -1;
2306 		} else if (S_ISDIR(sb.st_mode)) {
2307 			if (strcmp(filename, ".") == 0 ||
2308 			    strcmp(filename, "..") == 0)
2309 				continue;
2310 
2311 			if (upload_dir_internal(conn, new_src, new_dst,
2312 			    depth + 1, preserve_flag, print_flag, resume,
2313 			    fsync_flag, follow_link_flag, inplace_flag) == -1)
2314 				ret = -1;
2315 		} else if (S_ISREG(sb.st_mode) ||
2316 		    (follow_link_flag && S_ISLNK(sb.st_mode))) {
2317 			if (do_upload(conn, new_src, new_dst,
2318 			    preserve_flag, resume, fsync_flag,
2319 			    inplace_flag) == -1) {
2320 				error("upload \"%s\" to \"%s\" failed",
2321 				    new_src, new_dst);
2322 				ret = -1;
2323 			}
2324 		} else
2325 			logit("%s: not a regular file", filename);
2326 	}
2327 	free(new_dst);
2328 	free(new_src);
2329 
2330 	do_setstat(conn, dst, &a);
2331 
2332 	(void) closedir(dirp);
2333 	return ret;
2334 }
2335 
2336 int
2337 upload_dir(struct sftp_conn *conn, const char *src, const char *dst,
2338     int preserve_flag, int print_flag, int resume, int fsync_flag,
2339     int follow_link_flag, int inplace_flag)
2340 {
2341 	char *dst_canon;
2342 	int ret;
2343 
2344 	if ((dst_canon = do_realpath(conn, dst)) == NULL) {
2345 		error("upload \"%s\": path canonicalization failed", dst);
2346 		return -1;
2347 	}
2348 
2349 	ret = upload_dir_internal(conn, src, dst_canon, 0, preserve_flag,
2350 	    print_flag, resume, fsync_flag, follow_link_flag, inplace_flag);
2351 
2352 	free(dst_canon);
2353 	return ret;
2354 }
2355 
2356 static void
2357 handle_dest_replies(struct sftp_conn *to, const char *to_path, int synchronous,
2358     u_int *nreqsp, u_int *write_errorp)
2359 {
2360 	struct sshbuf *msg;
2361 	u_char type;
2362 	u_int id, status;
2363 	int r;
2364 	struct pollfd pfd;
2365 
2366 	if ((msg = sshbuf_new()) == NULL)
2367 		fatal_f("sshbuf_new failed");
2368 
2369 	/* Try to eat replies from the upload side */
2370 	while (*nreqsp > 0) {
2371 		debug3_f("%u outstanding replies", *nreqsp);
2372 		if (!synchronous) {
2373 			/* Bail out if no data is ready to be read */
2374 			pfd.fd = to->fd_in;
2375 			pfd.events = POLLIN;
2376 			if ((r = poll(&pfd, 1, 0)) == -1) {
2377 				if (errno == EINTR)
2378 					break;
2379 				fatal_f("poll: %s", strerror(errno));
2380 			} else if (r == 0)
2381 				break; /* fd not ready */
2382 		}
2383 		sshbuf_reset(msg);
2384 		get_msg(to, msg);
2385 
2386 		if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
2387 		    (r = sshbuf_get_u32(msg, &id)) != 0)
2388 			fatal_fr(r, "dest parse");
2389 		debug3("Received dest reply T:%u I:%u R:%u", type, id, *nreqsp);
2390 		if (type != SSH2_FXP_STATUS) {
2391 			fatal_f("Expected SSH2_FXP_STATUS(%d) packet, got %d",
2392 			    SSH2_FXP_STATUS, type);
2393 		}
2394 		if ((r = sshbuf_get_u32(msg, &status)) != 0)
2395 			fatal_fr(r, "parse dest status");
2396 		debug3("dest SSH2_FXP_STATUS %u", status);
2397 		if (status != SSH2_FX_OK) {
2398 			/* record first error */
2399 			if (*write_errorp == 0)
2400 				*write_errorp = status;
2401 		}
2402 		/*
2403 		 * XXX this doesn't do full reply matching like do_upload and
2404 		 * so cannot gracefully truncate terminated uploads at a
2405 		 * high-water mark. ATM the only caller of this function (scp)
2406 		 * doesn't support transfer resumption, so this doesn't matter
2407 		 * a whole lot.
2408 		 *
2409 		 * To be safe, do_crossload truncates the destination file to
2410 		 * zero length on upload failure, since we can't trust the
2411 		 * server not to have reordered replies that could have
2412 		 * inserted holes where none existed in the source file.
2413 		 *
2414 		 * XXX we could get a more accutate progress bar if we updated
2415 		 * the counter based on the reply from the destination...
2416 		 */
2417 		(*nreqsp)--;
2418 	}
2419 	debug3_f("done: %u outstanding replies", *nreqsp);
2420 	sshbuf_free(msg);
2421 }
2422 
2423 int
2424 do_crossload(struct sftp_conn *from, struct sftp_conn *to,
2425     const char *from_path, const char *to_path,
2426     Attrib *a, int preserve_flag)
2427 {
2428 	struct sshbuf *msg;
2429 	int write_error, read_error, r;
2430 	u_int64_t offset = 0, size;
2431 	u_int id, buflen, num_req, max_req, status = SSH2_FX_OK;
2432 	u_int num_upload_req;
2433 	off_t progress_counter;
2434 	u_char *from_handle, *to_handle;
2435 	size_t from_handle_len, to_handle_len;
2436 	struct requests requests;
2437 	struct request *req;
2438 	u_char type;
2439 
2440 	debug2_f("crossload src \"%s\" to dst \"%s\"", from_path, to_path);
2441 
2442 	TAILQ_INIT(&requests);
2443 
2444 	if (a == NULL && (a = do_stat(from, from_path, 0)) == NULL)
2445 		return -1;
2446 
2447 	if ((a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) &&
2448 	    (!S_ISREG(a->perm))) {
2449 		error("download \"%s\": not a regular file", from_path);
2450 		return(-1);
2451 	}
2452 	if (a->flags & SSH2_FILEXFER_ATTR_SIZE)
2453 		size = a->size;
2454 	else
2455 		size = 0;
2456 
2457 	buflen = from->download_buflen;
2458 	if (buflen > to->upload_buflen)
2459 		buflen = to->upload_buflen;
2460 
2461 	/* Send open request to read side */
2462 	if (send_open(from, from_path, "origin", SSH2_FXF_READ, NULL,
2463 	    &from_handle, &from_handle_len) != 0)
2464 		return -1;
2465 
2466 	/* Send open request to write side */
2467 	a->flags &= ~SSH2_FILEXFER_ATTR_SIZE;
2468 	a->flags &= ~SSH2_FILEXFER_ATTR_UIDGID;
2469 	a->perm &= 0777;
2470 	if (!preserve_flag)
2471 		a->flags &= ~SSH2_FILEXFER_ATTR_ACMODTIME;
2472 	if (send_open(to, to_path, "dest",
2473 	    SSH2_FXF_WRITE|SSH2_FXF_CREAT|SSH2_FXF_TRUNC, a,
2474 	    &to_handle, &to_handle_len) != 0) {
2475 		do_close(from, from_handle, from_handle_len);
2476 		return -1;
2477 	}
2478 
2479 	/* Read from remote "from" and write to remote "to" */
2480 	offset = 0;
2481 	write_error = read_error = num_req = num_upload_req = 0;
2482 	max_req = 1;
2483 	progress_counter = 0;
2484 
2485 	if (showprogress && size != 0) {
2486 		start_progress_meter(progress_meter_path(from_path),
2487 		    size, &progress_counter);
2488 	}
2489 	if ((msg = sshbuf_new()) == NULL)
2490 		fatal_f("sshbuf_new failed");
2491 	while (num_req > 0 || max_req > 0) {
2492 		u_char *data;
2493 		size_t len;
2494 
2495 		/*
2496 		 * Simulate EOF on interrupt: stop sending new requests and
2497 		 * allow outstanding requests to drain gracefully
2498 		 */
2499 		if (interrupted) {
2500 			if (num_req == 0) /* If we haven't started yet... */
2501 				break;
2502 			max_req = 0;
2503 		}
2504 
2505 		/* Send some more requests */
2506 		while (num_req < max_req) {
2507 			debug3("Request range %llu -> %llu (%d/%d)",
2508 			    (unsigned long long)offset,
2509 			    (unsigned long long)offset + buflen - 1,
2510 			    num_req, max_req);
2511 			req = request_enqueue(&requests, from->msg_id++,
2512 			    buflen, offset);
2513 			offset += buflen;
2514 			num_req++;
2515 			send_read_request(from, req->id, req->offset,
2516 			    req->len, from_handle, from_handle_len);
2517 		}
2518 
2519 		/* Try to eat replies from the upload side (nonblocking) */
2520 		handle_dest_replies(to, to_path, 0,
2521 		    &num_upload_req, &write_error);
2522 
2523 		sshbuf_reset(msg);
2524 		get_msg(from, msg);
2525 		if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
2526 		    (r = sshbuf_get_u32(msg, &id)) != 0)
2527 			fatal_fr(r, "parse");
2528 		debug3("Received origin reply T:%u I:%u R:%d",
2529 		    type, id, max_req);
2530 
2531 		/* Find the request in our queue */
2532 		if ((req = request_find(&requests, id)) == NULL)
2533 			fatal("Unexpected reply %u", id);
2534 
2535 		switch (type) {
2536 		case SSH2_FXP_STATUS:
2537 			if ((r = sshbuf_get_u32(msg, &status)) != 0)
2538 				fatal_fr(r, "parse status");
2539 			if (status != SSH2_FX_EOF)
2540 				read_error = 1;
2541 			max_req = 0;
2542 			TAILQ_REMOVE(&requests, req, tq);
2543 			free(req);
2544 			num_req--;
2545 			break;
2546 		case SSH2_FXP_DATA:
2547 			if ((r = sshbuf_get_string(msg, &data, &len)) != 0)
2548 				fatal_fr(r, "parse data");
2549 			debug3("Received data %llu -> %llu",
2550 			    (unsigned long long)req->offset,
2551 			    (unsigned long long)req->offset + len - 1);
2552 			if (len > req->len)
2553 				fatal("Received more data than asked for "
2554 				    "%zu > %zu", len, req->len);
2555 
2556 			/* Write this chunk out to the destination */
2557 			sshbuf_reset(msg);
2558 			if ((r = sshbuf_put_u8(msg, SSH2_FXP_WRITE)) != 0 ||
2559 			    (r = sshbuf_put_u32(msg, to->msg_id++)) != 0 ||
2560 			    (r = sshbuf_put_string(msg, to_handle,
2561 			    to_handle_len)) != 0 ||
2562 			    (r = sshbuf_put_u64(msg, req->offset)) != 0 ||
2563 			    (r = sshbuf_put_string(msg, data, len)) != 0)
2564 				fatal_fr(r, "compose write");
2565 			send_msg(to, msg);
2566 			debug3("Sent message SSH2_FXP_WRITE I:%u O:%llu S:%zu",
2567 			    id, (unsigned long long)offset, len);
2568 			num_upload_req++;
2569 			progress_counter += len;
2570 			free(data);
2571 
2572 			if (len == req->len) {
2573 				TAILQ_REMOVE(&requests, req, tq);
2574 				free(req);
2575 				num_req--;
2576 			} else {
2577 				/* Resend the request for the missing data */
2578 				debug3("Short data block, re-requesting "
2579 				    "%llu -> %llu (%2d)",
2580 				    (unsigned long long)req->offset + len,
2581 				    (unsigned long long)req->offset +
2582 				    req->len - 1, num_req);
2583 				req->id = from->msg_id++;
2584 				req->len -= len;
2585 				req->offset += len;
2586 				send_read_request(from, req->id,
2587 				    req->offset, req->len,
2588 				    from_handle, from_handle_len);
2589 				/* Reduce the request size */
2590 				if (len < buflen)
2591 					buflen = MAXIMUM(MIN_READ_SIZE, len);
2592 			}
2593 			if (max_req > 0) { /* max_req = 0 iff EOF received */
2594 				if (size > 0 && offset > size) {
2595 					/* Only one request at a time
2596 					 * after the expected EOF */
2597 					debug3("Finish at %llu (%2d)",
2598 					    (unsigned long long)offset,
2599 					    num_req);
2600 					max_req = 1;
2601 				} else if (max_req < from->num_requests) {
2602 					++max_req;
2603 				}
2604 			}
2605 			break;
2606 		default:
2607 			fatal("Expected SSH2_FXP_DATA(%u) packet, got %u",
2608 			    SSH2_FXP_DATA, type);
2609 		}
2610 	}
2611 
2612 	if (showprogress && size)
2613 		stop_progress_meter();
2614 
2615 	/* Drain replies from the server (blocking) */
2616 	debug3_f("waiting for %u replies from destination", num_upload_req);
2617 	handle_dest_replies(to, to_path, 1, &num_upload_req, &write_error);
2618 
2619 	/* Sanity check */
2620 	if (TAILQ_FIRST(&requests) != NULL)
2621 		fatal("Transfer complete, but requests still in queue");
2622 	/* Truncate at 0 length on interrupt or error to avoid holes at dest */
2623 	if (read_error || write_error || interrupted) {
2624 		debug("truncating \"%s\" at 0", to_path);
2625 		do_close(to, to_handle, to_handle_len);
2626 		free(to_handle);
2627 		if (send_open(to, to_path, "dest",
2628 		    SSH2_FXF_WRITE|SSH2_FXF_CREAT|SSH2_FXF_TRUNC, a,
2629 		    &to_handle, &to_handle_len) != 0) {
2630 			error("dest truncate \"%s\" failed", to_path);
2631 			to_handle = NULL;
2632 		}
2633 	}
2634 	if (read_error) {
2635 		error("read origin \"%s\": %s", from_path, fx2txt(status));
2636 		status = -1;
2637 		do_close(from, from_handle, from_handle_len);
2638 		if (to_handle != NULL)
2639 			do_close(to, to_handle, to_handle_len);
2640 	} else if (write_error) {
2641 		error("write dest \"%s\": %s", to_path, fx2txt(write_error));
2642 		status = SSH2_FX_FAILURE;
2643 		do_close(from, from_handle, from_handle_len);
2644 		if (to_handle != NULL)
2645 			do_close(to, to_handle, to_handle_len);
2646 	} else {
2647 		if (do_close(from, from_handle, from_handle_len) != 0 ||
2648 		    interrupted)
2649 			status = -1;
2650 		else
2651 			status = SSH2_FX_OK;
2652 		if (to_handle != NULL) {
2653 			/* Need to resend utimes after write */
2654 			if (preserve_flag)
2655 				do_fsetstat(to, to_handle, to_handle_len, a);
2656 			do_close(to, to_handle, to_handle_len);
2657 		}
2658 	}
2659 	sshbuf_free(msg);
2660 	free(from_handle);
2661 	free(to_handle);
2662 
2663 	return status == SSH2_FX_OK ? 0 : -1;
2664 }
2665 
2666 static int
2667 crossload_dir_internal(struct sftp_conn *from, struct sftp_conn *to,
2668     const char *from_path, const char *to_path,
2669     int depth, Attrib *dirattrib, int preserve_flag, int print_flag,
2670     int follow_link_flag)
2671 {
2672 	int i, ret = 0;
2673 	SFTP_DIRENT **dir_entries;
2674 	char *filename, *new_from_path = NULL, *new_to_path = NULL;
2675 	mode_t mode = 0777;
2676 	Attrib curdir;
2677 
2678 	debug2_f("crossload dir src \"%s\" to dst \"%s\"", from_path, to_path);
2679 
2680 	if (depth >= MAX_DIR_DEPTH) {
2681 		error("Maximum directory depth exceeded: %d levels", depth);
2682 		return -1;
2683 	}
2684 
2685 	if (dirattrib == NULL &&
2686 	    (dirattrib = do_stat(from, from_path, 1)) == NULL) {
2687 		error("stat remote \"%s\" failed", from_path);
2688 		return -1;
2689 	}
2690 	if (!S_ISDIR(dirattrib->perm)) {
2691 		error("\"%s\" is not a directory", from_path);
2692 		return -1;
2693 	}
2694 	if (print_flag && print_flag != SFTP_PROGRESS_ONLY)
2695 		mprintf("Retrieving %s\n", from_path);
2696 
2697 	curdir = *dirattrib; /* dirattrib will be clobbered */
2698 	curdir.flags &= ~SSH2_FILEXFER_ATTR_SIZE;
2699 	curdir.flags &= ~SSH2_FILEXFER_ATTR_UIDGID;
2700 	if ((curdir.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) == 0) {
2701 		debug("Origin did not send permissions for "
2702 		    "directory \"%s\"", to_path);
2703 		curdir.perm = S_IWUSR|S_IXUSR;
2704 		curdir.flags |= SSH2_FILEXFER_ATTR_PERMISSIONS;
2705 	}
2706 	/* We need to be able to write to the directory while we transfer it */
2707 	mode = curdir.perm & 01777;
2708 	curdir.perm = mode | (S_IWUSR|S_IXUSR);
2709 
2710 	/*
2711 	 * sftp lacks a portable status value to match errno EEXIST,
2712 	 * so if we get a failure back then we must check whether
2713 	 * the path already existed and is a directory.  Ensure we can
2714 	 * write to the directory we create for the duration of the transfer.
2715 	 */
2716 	if (do_mkdir(to, to_path, &curdir, 0) != 0) {
2717 		if ((dirattrib = do_stat(to, to_path, 0)) == NULL)
2718 			return -1;
2719 		if (!S_ISDIR(dirattrib->perm)) {
2720 			error("\"%s\" exists but is not a directory", to_path);
2721 			return -1;
2722 		}
2723 	}
2724 	curdir.perm = mode;
2725 
2726 	if (do_readdir(from, from_path, &dir_entries) == -1) {
2727 		error("origin readdir \"%s\" failed", from_path);
2728 		return -1;
2729 	}
2730 
2731 	for (i = 0; dir_entries[i] != NULL && !interrupted; i++) {
2732 		free(new_from_path);
2733 		free(new_to_path);
2734 
2735 		filename = dir_entries[i]->filename;
2736 		new_from_path = path_append(from_path, filename);
2737 		new_to_path = path_append(to_path, filename);
2738 
2739 		if (S_ISDIR(dir_entries[i]->a.perm)) {
2740 			if (strcmp(filename, ".") == 0 ||
2741 			    strcmp(filename, "..") == 0)
2742 				continue;
2743 			if (crossload_dir_internal(from, to,
2744 			    new_from_path, new_to_path,
2745 			    depth + 1, &(dir_entries[i]->a), preserve_flag,
2746 			    print_flag, follow_link_flag) == -1)
2747 				ret = -1;
2748 		} else if (S_ISREG(dir_entries[i]->a.perm) ||
2749 		    (follow_link_flag && S_ISLNK(dir_entries[i]->a.perm))) {
2750 			/*
2751 			 * If this is a symlink then don't send the link's
2752 			 * Attrib. do_download() will do a FXP_STAT operation
2753 			 * and get the link target's attributes.
2754 			 */
2755 			if (do_crossload(from, to, new_from_path, new_to_path,
2756 			    S_ISLNK(dir_entries[i]->a.perm) ? NULL :
2757 			    &(dir_entries[i]->a), preserve_flag) == -1) {
2758 				error("crossload \"%s\" to \"%s\" failed",
2759 				    new_from_path, new_to_path);
2760 				ret = -1;
2761 			}
2762 		} else {
2763 			logit("origin \"%s\": not a regular file",
2764 			    new_from_path);
2765 		}
2766 	}
2767 	free(new_to_path);
2768 	free(new_from_path);
2769 
2770 	do_setstat(to, to_path, &curdir);
2771 
2772 	free_sftp_dirents(dir_entries);
2773 
2774 	return ret;
2775 }
2776 
2777 int
2778 crossload_dir(struct sftp_conn *from, struct sftp_conn *to,
2779     const char *from_path, const char *to_path,
2780     Attrib *dirattrib, int preserve_flag, int print_flag, int follow_link_flag)
2781 {
2782 	char *from_path_canon;
2783 	int ret;
2784 
2785 	if ((from_path_canon = do_realpath(from, from_path)) == NULL) {
2786 		error("crossload \"%s\": path canonicalization failed",
2787 		    from_path);
2788 		return -1;
2789 	}
2790 
2791 	ret = crossload_dir_internal(from, to, from_path_canon, to_path, 0,
2792 	    dirattrib, preserve_flag, print_flag, follow_link_flag);
2793 	free(from_path_canon);
2794 	return ret;
2795 }
2796 
2797 int
2798 can_get_users_groups_by_id(struct sftp_conn *conn)
2799 {
2800 	return (conn->exts & SFTP_EXT_GETUSERSGROUPS_BY_ID) != 0;
2801 }
2802 
2803 int
2804 do_get_users_groups_by_id(struct sftp_conn *conn,
2805     const u_int *uids, u_int nuids,
2806     const u_int *gids, u_int ngids,
2807     char ***usernamesp, char ***groupnamesp)
2808 {
2809 	struct sshbuf *msg, *uidbuf, *gidbuf;
2810 	u_int i, expected_id, id;
2811 	char *name, **usernames = NULL, **groupnames = NULL;
2812 	u_char type;
2813 	int r;
2814 
2815 	*usernamesp = *groupnamesp = NULL;
2816 	if (!can_get_users_groups_by_id(conn))
2817 		return SSH_ERR_FEATURE_UNSUPPORTED;
2818 
2819 	if ((msg = sshbuf_new()) == NULL ||
2820 	    (uidbuf = sshbuf_new()) == NULL ||
2821 	    (gidbuf = sshbuf_new()) == NULL)
2822 		fatal_f("sshbuf_new failed");
2823 	expected_id = id = conn->msg_id++;
2824 	debug2("Sending SSH2_FXP_EXTENDED(users-groups-by-id@openssh.com)");
2825 	for (i = 0; i < nuids; i++) {
2826 		if ((r = sshbuf_put_u32(uidbuf, uids[i])) != 0)
2827 			fatal_fr(r, "compose uids");
2828 	}
2829 	for (i = 0; i < ngids; i++) {
2830 		if ((r = sshbuf_put_u32(gidbuf, gids[i])) != 0)
2831 			fatal_fr(r, "compose gids");
2832 	}
2833 	if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
2834 	    (r = sshbuf_put_u32(msg, id)) != 0 ||
2835 	    (r = sshbuf_put_cstring(msg,
2836 	    "users-groups-by-id@openssh.com")) != 0 ||
2837 	    (r = sshbuf_put_stringb(msg, uidbuf)) != 0 ||
2838 	    (r = sshbuf_put_stringb(msg, gidbuf)) != 0)
2839 		fatal_fr(r, "compose");
2840 	send_msg(conn, msg);
2841 	get_msg(conn, msg);
2842 	if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
2843 	    (r = sshbuf_get_u32(msg, &id)) != 0)
2844 		fatal_fr(r, "parse");
2845 	if (id != expected_id)
2846 		fatal("ID mismatch (%u != %u)", id, expected_id);
2847 	if (type == SSH2_FXP_STATUS) {
2848 		u_int status;
2849 		char *errmsg;
2850 
2851 		if ((r = sshbuf_get_u32(msg, &status)) != 0 ||
2852 		    (r = sshbuf_get_cstring(msg, &errmsg, NULL)) != 0)
2853 			fatal_fr(r, "parse status");
2854 		error("users-groups-by-id %s",
2855 		    *errmsg == '\0' ? fx2txt(status) : errmsg);
2856 		free(errmsg);
2857 		sshbuf_free(msg);
2858 		sshbuf_free(uidbuf);
2859 		sshbuf_free(gidbuf);
2860 		return -1;
2861 	} else if (type != SSH2_FXP_EXTENDED_REPLY)
2862 		fatal("Expected SSH2_FXP_EXTENDED_REPLY(%u) packet, got %u",
2863 		    SSH2_FXP_EXTENDED_REPLY, type);
2864 
2865 	/* reuse */
2866 	sshbuf_free(uidbuf);
2867 	sshbuf_free(gidbuf);
2868 	uidbuf = gidbuf = NULL;
2869 	if ((r = sshbuf_froms(msg, &uidbuf)) != 0 ||
2870 	    (r = sshbuf_froms(msg, &gidbuf)) != 0)
2871 		fatal_fr(r, "parse response");
2872 	if (nuids > 0) {
2873 		usernames = xcalloc(nuids, sizeof(*usernames));
2874 		for (i = 0; i < nuids; i++) {
2875 			if ((r = sshbuf_get_cstring(uidbuf, &name, NULL)) != 0)
2876 				fatal_fr(r, "parse user name");
2877 			/* Handle unresolved names */
2878 			if (*name == '\0') {
2879 				free(name);
2880 				name = NULL;
2881 			}
2882 			usernames[i] = name;
2883 		}
2884 	}
2885 	if (ngids > 0) {
2886 		groupnames = xcalloc(ngids, sizeof(*groupnames));
2887 		for (i = 0; i < ngids; i++) {
2888 			if ((r = sshbuf_get_cstring(gidbuf, &name, NULL)) != 0)
2889 				fatal_fr(r, "parse user name");
2890 			/* Handle unresolved names */
2891 			if (*name == '\0') {
2892 				free(name);
2893 				name = NULL;
2894 			}
2895 			groupnames[i] = name;
2896 		}
2897 	}
2898 	if (sshbuf_len(uidbuf) != 0)
2899 		fatal_f("unexpected extra username data");
2900 	if (sshbuf_len(gidbuf) != 0)
2901 		fatal_f("unexpected extra groupname data");
2902 	sshbuf_free(uidbuf);
2903 	sshbuf_free(gidbuf);
2904 	sshbuf_free(msg);
2905 	/* success */
2906 	*usernamesp = usernames;
2907 	*groupnamesp = groupnames;
2908 	return 0;
2909 }
2910 
2911 char *
2912 path_append(const char *p1, const char *p2)
2913 {
2914 	char *ret;
2915 	size_t len = strlen(p1) + strlen(p2) + 2;
2916 
2917 	ret = xmalloc(len);
2918 	strlcpy(ret, p1, len);
2919 	if (p1[0] != '\0' && p1[strlen(p1) - 1] != '/')
2920 		strlcat(ret, "/", len);
2921 	strlcat(ret, p2, len);
2922 
2923 	return(ret);
2924 }
2925 
2926 /*
2927  * Arg p must be dynamically allocated.  It will either be returned or
2928  * freed and a replacement allocated.  Caller must free returned string.
2929  */
2930 char *
2931 make_absolute(char *p, const char *pwd)
2932 {
2933 	char *abs_str;
2934 
2935 	/* Derelativise */
2936 	if (p && !path_absolute(p)) {
2937 		abs_str = path_append(pwd, p);
2938 		free(p);
2939 		return(abs_str);
2940 	} else
2941 		return(p);
2942 }
2943 
2944 int
2945 remote_is_dir(struct sftp_conn *conn, const char *path)
2946 {
2947 	Attrib *a;
2948 
2949 	/* XXX: report errors? */
2950 	if ((a = do_stat(conn, path, 1)) == NULL)
2951 		return(0);
2952 	if (!(a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS))
2953 		return(0);
2954 	return(S_ISDIR(a->perm));
2955 }
2956 
2957 
2958 int
2959 local_is_dir(const char *path)
2960 {
2961 	struct stat sb;
2962 
2963 	/* XXX: report errors? */
2964 	if (stat(path, &sb) == -1)
2965 		return(0);
2966 
2967 	return(S_ISDIR(sb.st_mode));
2968 }
2969 
2970 /* Check whether path returned from glob(..., GLOB_MARK, ...) is a directory */
2971 int
2972 globpath_is_dir(const char *pathname)
2973 {
2974 	size_t l = strlen(pathname);
2975 
2976 	return l > 0 && pathname[l - 1] == '/';
2977 }
2978 
2979