blob: 2590962b1ac84fbca961baafd144537530d2f38b [file] [log] [blame]
djm@openbsd.org65d6fd02020-01-30 07:20:57 +00001/* $OpenBSD: clientloop.c,v 1.338 2020/01/30 07:20:57 djm Exp $ */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002/*
Damien Miller95def091999-11-25 00:26:21 +11003 * Author: Tatu Ylonen <ylo@cs.hut.fi>
Damien Miller95def091999-11-25 00:26:21 +11004 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved
Damien Miller95def091999-11-25 00:26:21 +11006 * The main loop for the interactive session (client side).
Damien Miller4af51302000-04-16 11:18:38 +10007 *
Damien Millere4340be2000-09-16 13:29:08 +11008 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
13 *
14 *
15 * Copyright (c) 1999 Theo de Raadt. All rights reserved.
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions
19 * are met:
20 * 1. Redistributions of source code must retain the above copyright
21 * notice, this list of conditions and the following disclaimer.
22 * 2. Redistributions in binary form must reproduce the above copyright
23 * notice, this list of conditions and the following disclaimer in the
24 * documentation and/or other materials provided with the distribution.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36 *
37 *
Damien Miller1383bd82000-04-06 12:32:37 +100038 * SSH2 support added by Markus Friedl.
Ben Lindstrom44697232001-07-04 03:32:30 +000039 * Copyright (c) 1999, 2000, 2001 Markus Friedl. All rights reserved.
Damien Millere4340be2000-09-16 13:29:08 +110040 *
41 * Redistribution and use in source and binary forms, with or without
42 * modification, are permitted provided that the following conditions
43 * are met:
44 * 1. Redistributions of source code must retain the above copyright
45 * notice, this list of conditions and the following disclaimer.
46 * 2. Redistributions in binary form must reproduce the above copyright
47 * notice, this list of conditions and the following disclaimer in the
48 * documentation and/or other materials provided with the distribution.
49 *
50 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
51 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
52 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
53 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
54 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
55 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
56 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
57 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
58 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
59 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Damien Miller95def091999-11-25 00:26:21 +110060 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100061
62#include "includes.h"
Damien Miller17e91c02006-03-15 11:28:34 +110063
Damien Millerf17883e2006-03-15 11:45:54 +110064#include <sys/types.h>
Damien Miller9aec9192006-08-05 10:57:45 +100065#include <sys/ioctl.h>
Damien Millerf17883e2006-03-15 11:45:54 +110066#ifdef HAVE_SYS_STAT_H
67# include <sys/stat.h>
68#endif
Damien Miller9aec9192006-08-05 10:57:45 +100069#ifdef HAVE_SYS_TIME_H
70# include <sys/time.h>
71#endif
Damien Millere3b60b52006-07-10 21:08:03 +100072#include <sys/socket.h>
Damien Miller99bd21e2006-03-15 11:11:28 +110073
Damien Millerc7b06362006-03-15 11:53:45 +110074#include <ctype.h>
Darren Tucker39972492006-07-12 22:22:46 +100075#include <errno.h>
Damien Miller6645e7a2006-03-15 14:42:54 +110076#ifdef HAVE_PATHS_H
Damien Miller03e20032006-03-15 11:16:59 +110077#include <paths.h>
Damien Miller6645e7a2006-03-15 14:42:54 +110078#endif
Damien Miller6ff3cad2006-03-15 11:52:09 +110079#include <signal.h>
Damien Millera7a73ee2006-08-05 11:37:59 +100080#include <stdio.h>
Damien Millere7a1e5c2006-08-05 11:34:19 +100081#include <stdlib.h>
Damien Millere3476ed2006-07-24 14:13:33 +100082#include <string.h>
deraadt@openbsd.org72687c82019-11-13 04:47:52 +000083#include <stdarg.h>
Damien Miller99bd21e2006-03-15 11:11:28 +110084#include <termios.h>
Damien Millerd7834352006-08-05 12:39:39 +100085#include <pwd.h>
Damien Millere6b3b612006-07-24 14:01:23 +100086#include <unistd.h>
deraadt@openbsd.org087266e2015-01-20 23:14:00 +000087#include <limits.h>
Damien Millerd4a8b7e1999-10-27 13:42:43 +100088
Damien Millerb84886b2008-05-19 15:05:07 +100089#include "openbsd-compat/sys-queue.h"
Damien Millerd7834352006-08-05 12:39:39 +100090#include "xmalloc.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100091#include "ssh.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000092#include "ssh2.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100093#include "packet.h"
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +000094#include "sshbuf.h"
Damien Millerb38eff82000-04-01 11:09:21 +100095#include "compat.h"
Ben Lindstromc7637672001-06-09 00:36:26 +000096#include "channels.h"
Damien Millerb38eff82000-04-01 11:09:21 +100097#include "dispatch.h"
markus@openbsd.org5467fbc2018-07-11 18:53:29 +000098#include "sshkey.h"
Damien Millerd7834352006-08-05 12:39:39 +100099#include "cipher.h"
Ben Lindstromf28f6342001-04-04 02:03:04 +0000100#include "kex.h"
markus@openbsd.org3a1638d2015-07-10 06:21:53 +0000101#include "myproposal.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000102#include "log.h"
Damien Miller7acefbb2014-07-18 14:11:24 +1000103#include "misc.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000104#include "readconf.h"
Ben Lindstrombf555ba2001-01-18 02:04:35 +0000105#include "clientloop.h"
Damien Milleraeb31d62005-12-13 19:29:36 +1100106#include "sshconnect.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000107#include "authfd.h"
108#include "atomicio.h"
Darren Tucker06f2bd82004-05-13 16:06:46 +1000109#include "sshpty.h"
Damien Miller0e220db2004-06-15 10:34:08 +1000110#include "match.h"
111#include "msg.h"
djm@openbsd.org141efe42015-01-14 20:05:27 +0000112#include "ssherr.h"
djm@openbsd.org8d4f8722015-01-26 03:04:45 +0000113#include "hostfile.h"
Damien Miller69b69aa2000-10-28 14:19:58 +1100114
115/* import options */
116extern Options options;
117
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000118/* Flag indicating that stdin should be redirected from /dev/null. */
119extern int stdin_null_flag;
120
Damien Millerd6965512003-12-17 16:31:53 +1100121/* Flag indicating that no shell has been requested */
122extern int no_shell_flag;
123
djm@openbsd.org368dd972016-07-23 02:54:08 +0000124/* Flag indicating that ssh should daemonise after authentication is complete */
125extern int fork_after_authentication_flag;
126
Damien Miller0e220db2004-06-15 10:34:08 +1000127/* Control socket */
Damien Millere1537f92010-01-26 13:26:22 +1100128extern int muxserver_sock; /* XXX use mux_client_cleanup() instead */
Damien Miller0e220db2004-06-15 10:34:08 +1000129
Damien Miller5428f641999-11-25 11:54:57 +1100130/*
131 * Name of the host we are connecting to. This is the name given on the
jmc@openbsd.org73491492019-06-12 11:31:50 +0000132 * command line, or the Hostname specified for the user-supplied name in a
Damien Miller5428f641999-11-25 11:54:57 +1100133 * configuration file.
134 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000135extern char *host;
136
Damien Miller5428f641999-11-25 11:54:57 +1100137/*
djm@openbsd.org40be78f2019-12-21 02:19:13 +0000138 * If this field is not NULL, the ForwardAgent socket is this path and different
139 * instead of SSH_AUTH_SOCK.
140 */
141extern char *forward_agent_sock_path;
142
143/*
Damien Miller5428f641999-11-25 11:54:57 +1100144 * Flag to indicate that we have received a window change signal which has
145 * not yet been processed. This will cause a message indicating the new
146 * window size to be sent to the server a little later. This is volatile
147 * because this is updated in a signal handler.
148 */
Ben Lindstrom5e71c542001-12-06 16:48:14 +0000149static volatile sig_atomic_t received_window_change_signal = 0;
150static volatile sig_atomic_t received_signal = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000151
Damien Miller788f2122005-11-05 15:14:59 +1100152/* Flag indicating whether the user's terminal is in non-blocking mode. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000153static int in_non_blocking_mode = 0;
154
Damien Millere11e1ea2010-08-03 16:04:46 +1000155/* Time when backgrounded control master using ControlPersist should exit */
156static time_t control_persist_exit_time = 0;
157
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000158/* Common data for the client loop code. */
Damien Millere1537f92010-01-26 13:26:22 +1100159volatile sig_atomic_t quit_pending; /* Set non-zero to quit the loop. */
Damien Miller95def091999-11-25 00:26:21 +1100160static int last_was_cr; /* Last character was a newline. */
Darren Tucker4d5cd332008-06-13 04:51:14 +1000161static int exit_status; /* Used to store the command exit status. */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000162static struct sshbuf *stderr_buffer; /* Used for final exit message. */
Damien Miller95def091999-11-25 00:26:21 +1100163static int connection_in; /* Connection to server (input). */
164static int connection_out; /* Connection to server (output). */
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000165static int need_rekeying; /* Set to non-zero if rekeying is requested. */
Damien Miller1ab6a512010-06-26 10:02:24 +1000166static int session_closed; /* In SSH2: login session closed. */
djm@openbsd.org1bf477d2015-07-01 02:26:31 +0000167static u_int x11_refuse_time; /* If >0, refuse x11 opens after this time. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000168
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +0000169static void client_init_dispatch(struct ssh *ssh);
Damien Miller1383bd82000-04-06 12:32:37 +1000170int session_ident = -1;
171
Darren Tucker2fb66ca2008-06-13 04:49:33 +1000172/* Track escape per proto2 channel */
173struct escape_filter_ctx {
174 int escape_pending;
175 int escape_char;
176};
177
178/* Context for channel confirmation replies */
Damien Miller5771ed72008-05-19 15:35:33 +1000179struct channel_reply_ctx {
180 const char *request_type;
Damien Miller555f3b82011-05-15 08:48:05 +1000181 int id;
182 enum confirm_action action;
Damien Miller5771ed72008-05-19 15:35:33 +1000183};
184
Darren Tucker9f407c42008-06-13 04:50:27 +1000185/* Global request success/failure callbacks */
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000186/* XXX move to struct ssh? */
Darren Tucker9f407c42008-06-13 04:50:27 +1000187struct global_confirm {
188 TAILQ_ENTRY(global_confirm) entry;
189 global_confirm_cb *cb;
190 void *ctx;
191 int ref_count;
192};
193TAILQ_HEAD(global_confirms, global_confirm);
194static struct global_confirms global_confirms =
195 TAILQ_HEAD_INITIALIZER(global_confirms);
196
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000197void ssh_process_session2_setup(int, int, int, struct sshbuf *);
Damien Miller0e220db2004-06-15 10:34:08 +1000198
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000199/* Restores stdin to blocking mode. */
200
Ben Lindstrombba81212001-06-25 05:01:22 +0000201static void
Ben Lindstrom31ca54a2001-02-09 02:11:24 +0000202leave_non_blocking(void)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000203{
Damien Miller95def091999-11-25 00:26:21 +1100204 if (in_non_blocking_mode) {
Damien Miller03e66f62004-06-15 15:47:51 +1000205 unset_nonblock(fileno(stdin));
Damien Miller95def091999-11-25 00:26:21 +1100206 in_non_blocking_mode = 0;
Damien Miller95def091999-11-25 00:26:21 +1100207 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000208}
209
Damien Miller5428f641999-11-25 11:54:57 +1100210/*
211 * Signal handler for the window change signal (SIGWINCH). This just sets a
212 * flag indicating that the window has changed.
213 */
Damien Millerf0b15df2006-03-26 13:59:20 +1100214/*ARGSUSED */
Ben Lindstrombba81212001-06-25 05:01:22 +0000215static void
Damien Miller95def091999-11-25 00:26:21 +1100216window_change_handler(int sig)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000217{
Damien Miller95def091999-11-25 00:26:21 +1100218 received_window_change_signal = 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000219}
220
Damien Miller5428f641999-11-25 11:54:57 +1100221/*
222 * Signal handler for signals that cause the program to terminate. These
223 * signals must be trapped to restore terminal modes.
224 */
Damien Millerf0b15df2006-03-26 13:59:20 +1100225/*ARGSUSED */
Ben Lindstrombba81212001-06-25 05:01:22 +0000226static void
Damien Miller95def091999-11-25 00:26:21 +1100227signal_handler(int sig)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000228{
Ben Lindstromec46e0b2001-06-09 01:27:31 +0000229 received_signal = sig;
230 quit_pending = 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000231}
232
Damien Miller5428f641999-11-25 11:54:57 +1100233/*
Damien Millere11e1ea2010-08-03 16:04:46 +1000234 * Sets control_persist_exit_time to the absolute time when the
235 * backgrounded control master should exit due to expiry of the
236 * ControlPersist timeout. Sets it to 0 if we are not a backgrounded
237 * control master process, or if there is no ControlPersist timeout.
238 */
239static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000240set_control_persist_exit_time(struct ssh *ssh)
Damien Millere11e1ea2010-08-03 16:04:46 +1000241{
242 if (muxserver_sock == -1 || !options.control_persist
Damien Miller6c3eec72011-05-05 14:16:22 +1000243 || options.control_persist_timeout == 0) {
Damien Millere11e1ea2010-08-03 16:04:46 +1000244 /* not using a ControlPersist timeout */
245 control_persist_exit_time = 0;
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000246 } else if (channel_still_open(ssh)) {
Damien Millere11e1ea2010-08-03 16:04:46 +1000247 /* some client connections are still open */
248 if (control_persist_exit_time > 0)
249 debug2("%s: cancel scheduled exit", __func__);
250 control_persist_exit_time = 0;
251 } else if (control_persist_exit_time <= 0) {
252 /* a client connection has recently closed */
Darren Tuckerb759c9c2013-06-02 07:46:16 +1000253 control_persist_exit_time = monotime() +
Damien Millere11e1ea2010-08-03 16:04:46 +1000254 (time_t)options.control_persist_timeout;
255 debug2("%s: schedule exit in %d seconds", __func__,
256 options.control_persist_timeout);
257 }
258 /* else we are already counting down to the timeout */
259}
260
Damien Miller8d60be52012-02-11 08:18:17 +1100261#define SSH_X11_VALID_DISPLAY_CHARS ":/.-_"
262static int
263client_x11_display_valid(const char *display)
264{
265 size_t i, dlen;
266
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000267 if (display == NULL)
268 return 0;
269
Damien Miller8d60be52012-02-11 08:18:17 +1100270 dlen = strlen(display);
271 for (i = 0; i < dlen; i++) {
Damien Millerfdb23062013-11-21 13:57:15 +1100272 if (!isalnum((u_char)display[i]) &&
Damien Miller8d60be52012-02-11 08:18:17 +1100273 strchr(SSH_X11_VALID_DISPLAY_CHARS, display[i]) == NULL) {
274 debug("Invalid character '%c' in DISPLAY", display[i]);
275 return 0;
276 }
277 }
278 return 1;
279}
280
djm@openbsd.org1bf477d2015-07-01 02:26:31 +0000281#define SSH_X11_PROTO "MIT-MAGIC-COOKIE-1"
282#define X11_TIMEOUT_SLACK 60
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000283int
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000284client_x11_get_proto(struct ssh *ssh, const char *display,
285 const char *xauth_path, u_int trusted, u_int timeout,
286 char **_proto, char **_data)
Damien Miller17e7ed02005-06-17 12:54:33 +1000287{
djm@openbsd.orgb5e412a2018-09-21 12:46:22 +0000288 char *cmd, line[512], xdisplay[512];
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000289 char xauthfile[PATH_MAX], xauthdir[PATH_MAX];
Damien Miller17e7ed02005-06-17 12:54:33 +1000290 static char proto[512], data[512];
291 FILE *f;
tedu@openbsd.org10363562016-09-17 18:00:27 +0000292 int got_data = 0, generated = 0, do_unlink = 0, r;
Damien Miller17e7ed02005-06-17 12:54:33 +1000293 struct stat st;
djm@openbsd.org1bf477d2015-07-01 02:26:31 +0000294 u_int now, x11_timeout_real;
Damien Miller17e7ed02005-06-17 12:54:33 +1000295
Damien Miller17e7ed02005-06-17 12:54:33 +1000296 *_proto = proto;
297 *_data = data;
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000298 proto[0] = data[0] = xauthfile[0] = xauthdir[0] = '\0';
Damien Miller17e7ed02005-06-17 12:54:33 +1000299
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000300 if (!client_x11_display_valid(display)) {
millert@openbsd.org5658ef22016-02-01 21:18:17 +0000301 if (display != NULL)
302 logit("DISPLAY \"%s\" invalid; disabling X11 forwarding",
303 display);
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000304 return -1;
305 }
306 if (xauth_path != NULL && stat(xauth_path, &st) == -1) {
307 debug("No xauth program.");
308 xauth_path = NULL;
309 }
310
311 if (xauth_path != NULL) {
Damien Miller17e7ed02005-06-17 12:54:33 +1000312 /*
313 * Handle FamilyLocal case where $DISPLAY does
314 * not match an authorization entry. For this we
315 * just try "xauth list unix:displaynum.screennum".
316 * XXX: "localhost" match to determine FamilyLocal
317 * is not perfect.
318 */
319 if (strncmp(display, "localhost:", 10) == 0) {
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000320 if ((r = snprintf(xdisplay, sizeof(xdisplay), "unix:%s",
321 display + 10)) < 0 ||
322 (size_t)r >= sizeof(xdisplay)) {
323 error("%s: display name too long", __func__);
324 return -1;
325 }
Damien Miller17e7ed02005-06-17 12:54:33 +1000326 display = xdisplay;
327 }
328 if (trusted == 0) {
djm@openbsd.org1bf477d2015-07-01 02:26:31 +0000329 /*
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000330 * Generate an untrusted X11 auth cookie.
331 *
djm@openbsd.org1bf477d2015-07-01 02:26:31 +0000332 * The authentication cookie should briefly outlive
333 * ssh's willingness to forward X11 connections to
334 * avoid nasty fail-open behaviour in the X server.
335 */
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000336 mktemp_proto(xauthdir, sizeof(xauthdir));
337 if (mkdtemp(xauthdir) == NULL) {
338 error("%s: mkdtemp: %s",
339 __func__, strerror(errno));
340 return -1;
341 }
342 do_unlink = 1;
343 if ((r = snprintf(xauthfile, sizeof(xauthfile),
344 "%s/xauthfile", xauthdir)) < 0 ||
345 (size_t)r >= sizeof(xauthfile)) {
346 error("%s: xauthfile path too long", __func__);
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000347 rmdir(xauthdir);
348 return -1;
349 }
350
djm@openbsd.orgb5e412a2018-09-21 12:46:22 +0000351 if (timeout == 0) {
352 /* auth doesn't time out */
353 xasprintf(&cmd, "%s -f %s generate %s %s "
354 "untrusted 2>%s",
355 xauth_path, xauthfile, display,
356 SSH_X11_PROTO, _PATH_DEVNULL);
357 } else {
358 /* Add some slack to requested expiry */
359 if (timeout < UINT_MAX - X11_TIMEOUT_SLACK)
360 x11_timeout_real = timeout +
361 X11_TIMEOUT_SLACK;
362 else {
363 /* Don't overflow on long timeouts */
364 x11_timeout_real = UINT_MAX;
365 }
366 xasprintf(&cmd, "%s -f %s generate %s %s "
367 "untrusted timeout %u 2>%s",
368 xauth_path, xauthfile, display,
369 SSH_X11_PROTO, x11_timeout_real,
370 _PATH_DEVNULL);
371 }
djm@openbsd.org9d7b2882019-03-29 11:31:40 +0000372 debug2("%s: xauth command: %s", __func__, cmd);
djm@openbsd.orgb5e412a2018-09-21 12:46:22 +0000373
374 if (timeout != 0 && x11_refuse_time == 0) {
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000375 now = monotime() + 1;
376 if (UINT_MAX - timeout < now)
377 x11_refuse_time = UINT_MAX;
378 else
379 x11_refuse_time = now + timeout;
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000380 channel_set_x11_refuse_time(ssh,
381 x11_refuse_time);
Damien Miller17e7ed02005-06-17 12:54:33 +1000382 }
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000383 if (system(cmd) == 0)
384 generated = 1;
djm@openbsd.orgb5e412a2018-09-21 12:46:22 +0000385 free(cmd);
Damien Miller17e7ed02005-06-17 12:54:33 +1000386 }
Darren Tucker513d13a2007-08-15 19:13:41 +1000387
388 /*
389 * When in untrusted mode, we read the cookie only if it was
390 * successfully generated as an untrusted one in the step
391 * above.
392 */
393 if (trusted || generated) {
djm@openbsd.orgb5e412a2018-09-21 12:46:22 +0000394 xasprintf(&cmd,
Darren Tucker513d13a2007-08-15 19:13:41 +1000395 "%s %s%s list %s 2>" _PATH_DEVNULL,
396 xauth_path,
397 generated ? "-f " : "" ,
398 generated ? xauthfile : "",
399 display);
400 debug2("x11_get_proto: %s", cmd);
401 f = popen(cmd, "r");
402 if (f && fgets(line, sizeof(line), f) &&
403 sscanf(line, "%*s %511s %511s", proto, data) == 2)
404 got_data = 1;
405 if (f)
406 pclose(f);
djm@openbsd.orgb5e412a2018-09-21 12:46:22 +0000407 free(cmd);
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000408 }
Damien Miller17e7ed02005-06-17 12:54:33 +1000409 }
410
411 if (do_unlink) {
412 unlink(xauthfile);
413 rmdir(xauthdir);
414 }
Damien Miller17e7ed02005-06-17 12:54:33 +1000415
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000416 /* Don't fall back to fake X11 data for untrusted forwarding */
417 if (!trusted && !got_data) {
418 error("Warning: untrusted X11 forwarding setup failed: "
419 "xauth key data not generated");
420 return -1;
421 }
422
Damien Miller17e7ed02005-06-17 12:54:33 +1000423 /*
424 * If we didn't get authentication data, just make up some
425 * data. The forwarding code will check the validity of the
426 * response anyway, and substitute this data. The X11
427 * server, however, will ignore this fake data and use
428 * whatever authentication mechanisms it was using otherwise
429 * for the local connection.
430 */
431 if (!got_data) {
tedu@openbsd.org10363562016-09-17 18:00:27 +0000432 u_int8_t rnd[16];
433 u_int i;
Damien Miller17e7ed02005-06-17 12:54:33 +1000434
435 logit("Warning: No xauth data; "
436 "using fake authentication data for X11 forwarding.");
437 strlcpy(proto, SSH_X11_PROTO, sizeof proto);
tedu@openbsd.org10363562016-09-17 18:00:27 +0000438 arc4random_buf(rnd, sizeof(rnd));
439 for (i = 0; i < sizeof(rnd); i++) {
Damien Miller17e7ed02005-06-17 12:54:33 +1000440 snprintf(data + 2 * i, sizeof data - 2 * i, "%02x",
tedu@openbsd.org10363562016-09-17 18:00:27 +0000441 rnd[i]);
Damien Miller17e7ed02005-06-17 12:54:33 +1000442 }
443 }
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000444
445 return 0;
Damien Miller17e7ed02005-06-17 12:54:33 +1000446}
447
Damien Miller5428f641999-11-25 11:54:57 +1100448/*
Damien Miller5428f641999-11-25 11:54:57 +1100449 * Checks if the client window has changed, and sends a packet about it to
450 * the server if so. The actual change is detected elsewhere (by a software
451 * interrupt on Unix); this just checks the flag and sends a message if
452 * appropriate.
453 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000454
Ben Lindstrombba81212001-06-25 05:01:22 +0000455static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000456client_check_window_change(struct ssh *ssh)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000457{
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000458 if (!received_window_change_signal)
Damien Miller1383bd82000-04-06 12:32:37 +1000459 return;
460 /** XXX race */
461 received_window_change_signal = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000462
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000463 debug2("%s: changed", __func__);
Damien Miller1383bd82000-04-06 12:32:37 +1000464
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000465 channel_send_window_changes(ssh);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000466}
467
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000468static int
markus@openbsd.org2ae666a2017-05-30 14:23:52 +0000469client_global_request_reply(int type, u_int32_t seq, struct ssh *ssh)
Damien Miller509b0102003-12-17 16:33:10 +1100470{
Darren Tucker9f407c42008-06-13 04:50:27 +1000471 struct global_confirm *gc;
472
473 if ((gc = TAILQ_FIRST(&global_confirms)) == NULL)
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000474 return 0;
Darren Tucker9f407c42008-06-13 04:50:27 +1000475 if (gc->cb != NULL)
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000476 gc->cb(ssh, type, seq, gc->ctx);
Darren Tucker9f407c42008-06-13 04:50:27 +1000477 if (--gc->ref_count <= 0) {
478 TAILQ_REMOVE(&global_confirms, gc, entry);
Damien Miller1d2c4562014-02-04 11:18:20 +1100479 explicit_bzero(gc, sizeof(*gc));
Darren Tuckera627d422013-06-02 07:31:17 +1000480 free(gc);
Darren Tucker9f407c42008-06-13 04:50:27 +1000481 }
482
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000483 ssh_packet_set_alive_timeouts(ssh, 0);
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000484 return 0;
Damien Miller509b0102003-12-17 16:33:10 +1100485}
486
487static void
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000488server_alive_check(struct ssh *ssh)
Damien Miller509b0102003-12-17 16:33:10 +1100489{
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000490 int r;
491
492 if (ssh_packet_inc_alive_timeouts(ssh) > options.server_alive_count_max) {
Damien Millerb73b6fd2011-01-11 17:18:56 +1100493 logit("Timeout, server %s not responding.", host);
Damien Miller985a4482006-10-24 03:02:41 +1000494 cleanup_exit(255);
495 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000496 if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 ||
497 (r = sshpkt_put_cstring(ssh, "keepalive@openssh.com")) != 0 ||
498 (r = sshpkt_put_u8(ssh, 1)) != 0 || /* boolean: want reply */
499 (r = sshpkt_send(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +0000500 fatal("%s: send packet: %s", __func__, ssh_err(r));
Darren Tucker9f407c42008-06-13 04:50:27 +1000501 /* Insert an empty placeholder to maintain ordering */
502 client_register_global_confirm(NULL, NULL);
Damien Miller509b0102003-12-17 16:33:10 +1100503}
504
Damien Miller5428f641999-11-25 11:54:57 +1100505/*
506 * Waits until the client can do something (some data becomes available on
507 * one of the file descriptors).
508 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000509static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000510client_wait_until_can_do_something(struct ssh *ssh,
511 fd_set **readsetp, fd_set **writesetp,
Darren Tuckerc7a6fc42004-08-13 21:18:00 +1000512 int *maxfdp, u_int *nallocp, int rekeying)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000513{
Damien Miller509b0102003-12-17 16:33:10 +1100514 struct timeval tv, *tvp;
Damien Millere11e1ea2010-08-03 16:04:46 +1000515 int timeout_secs;
Darren Tuckerb759c9c2013-06-02 07:46:16 +1000516 time_t minwait_secs = 0, server_alive_time = 0, now = monotime();
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000517 int r, ret;
Damien Miller509b0102003-12-17 16:33:10 +1100518
Damien Miller5e953212001-01-30 09:14:00 +1100519 /* Add any selections by the channel mechanism. */
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +0000520 channel_prepare_select(ssh, readsetp, writesetp, maxfdp,
djm@openbsd.org71e5a532017-08-30 03:59:08 +0000521 nallocp, &minwait_secs);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000522
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000523 /* channel_prepare_select could have closed the last channel */
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000524 if (session_closed && !channel_still_open(ssh) &&
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000525 !ssh_packet_have_data_to_write(ssh)) {
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000526 /* clear mask since we did not call select() */
527 memset(*readsetp, 0, *nallocp);
528 memset(*writesetp, 0, *nallocp);
529 return;
Damien Miller1383bd82000-04-06 12:32:37 +1000530 }
531
djm@openbsd.org05164352017-04-30 23:21:54 +0000532 FD_SET(connection_in, *readsetp);
533
Damien Miller95def091999-11-25 00:26:21 +1100534 /* Select server connection if have data to write to the server. */
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000535 if (ssh_packet_have_data_to_write(ssh))
Damien Miller5e953212001-01-30 09:14:00 +1100536 FD_SET(connection_out, *writesetp);
Damien Miller95def091999-11-25 00:26:21 +1100537
Damien Miller5428f641999-11-25 11:54:57 +1100538 /*
539 * Wait for something to happen. This will suspend the process until
540 * some selected descriptor can be read, written, or has some other
Damien Millere11e1ea2010-08-03 16:04:46 +1000541 * event pending, or a timeout expires.
Damien Miller5428f641999-11-25 11:54:57 +1100542 */
Damien Miller95def091999-11-25 00:26:21 +1100543
Damien Millere11e1ea2010-08-03 16:04:46 +1000544 timeout_secs = INT_MAX; /* we use INT_MAX to mean no timeout */
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000545 if (options.server_alive_interval > 0) {
Damien Millere11e1ea2010-08-03 16:04:46 +1000546 timeout_secs = options.server_alive_interval;
Darren Tuckerc53c2af2013-05-16 20:28:16 +1000547 server_alive_time = now + options.server_alive_interval;
548 }
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000549 if (options.rekey_interval > 0 && !rekeying)
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000550 timeout_secs = MINIMUM(timeout_secs,
551 ssh_packet_get_rekey_timeout(ssh));
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000552 set_control_persist_exit_time(ssh);
Damien Millere11e1ea2010-08-03 16:04:46 +1000553 if (control_persist_exit_time > 0) {
deraadt@openbsd.org9136ec12016-09-12 01:22:38 +0000554 timeout_secs = MINIMUM(timeout_secs,
Darren Tuckerc53c2af2013-05-16 20:28:16 +1000555 control_persist_exit_time - now);
Damien Millere11e1ea2010-08-03 16:04:46 +1000556 if (timeout_secs < 0)
557 timeout_secs = 0;
558 }
Damien Millera6508752012-04-22 11:21:10 +1000559 if (minwait_secs != 0)
deraadt@openbsd.org9136ec12016-09-12 01:22:38 +0000560 timeout_secs = MINIMUM(timeout_secs, (int)minwait_secs);
Damien Millere11e1ea2010-08-03 16:04:46 +1000561 if (timeout_secs == INT_MAX)
Damien Miller509b0102003-12-17 16:33:10 +1100562 tvp = NULL;
Darren Tuckerfc959702004-07-17 16:12:08 +1000563 else {
Damien Millere11e1ea2010-08-03 16:04:46 +1000564 tv.tv_sec = timeout_secs;
Damien Miller509b0102003-12-17 16:33:10 +1100565 tv.tv_usec = 0;
566 tvp = &tv;
567 }
Damien Millere11e1ea2010-08-03 16:04:46 +1000568
Damien Miller509b0102003-12-17 16:33:10 +1100569 ret = select((*maxfdp)+1, *readsetp, *writesetp, NULL, tvp);
deraadt@openbsd.org4d28fa72019-06-28 13:35:04 +0000570 if (ret == -1) {
Ben Lindstromf9452512001-02-15 03:12:08 +0000571 /*
572 * We have to clear the select masks, because we return.
573 * We have to return, because the mainloop checks for the flags
574 * set by the signal handlers.
575 */
Damien Miller79faeff2001-11-12 11:06:32 +1100576 memset(*readsetp, 0, *nallocp);
577 memset(*writesetp, 0, *nallocp);
Ben Lindstromf9452512001-02-15 03:12:08 +0000578
Damien Miller95def091999-11-25 00:26:21 +1100579 if (errno == EINTR)
580 return;
581 /* Note: we might still have data in the buffers. */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000582 if ((r = sshbuf_putf(stderr_buffer,
583 "select: %s\r\n", strerror(errno))) != 0)
584 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Damien Miller95def091999-11-25 00:26:21 +1100585 quit_pending = 1;
Darren Tuckerc53c2af2013-05-16 20:28:16 +1000586 } else if (ret == 0) {
587 /*
588 * Timeout. Could have been either keepalive or rekeying.
589 * Keepalive we check here, rekeying is checked in clientloop.
590 */
Darren Tuckerb759c9c2013-06-02 07:46:16 +1000591 if (server_alive_time != 0 && server_alive_time <= monotime())
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000592 server_alive_check(ssh);
Darren Tuckerc53c2af2013-05-16 20:28:16 +1000593 }
594
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000595}
596
Ben Lindstrombba81212001-06-25 05:01:22 +0000597static void
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000598client_suspend_self(struct sshbuf *bin, struct sshbuf *bout, struct sshbuf *berr)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000599{
Damien Miller95def091999-11-25 00:26:21 +1100600 /* Flush stdout and stderr buffers. */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000601 if (sshbuf_len(bout) > 0)
602 atomicio(vwrite, fileno(stdout), sshbuf_mutable_ptr(bout),
603 sshbuf_len(bout));
604 if (sshbuf_len(berr) > 0)
605 atomicio(vwrite, fileno(stderr), sshbuf_mutable_ptr(berr),
606 sshbuf_len(berr));
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000607
Damien Miller21771e22011-05-15 08:45:50 +1000608 leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000609
djm@openbsd.org5b8da1f2017-09-19 04:24:22 +0000610 sshbuf_reset(bin);
611 sshbuf_reset(bout);
612 sshbuf_reset(berr);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000613
Damien Miller95def091999-11-25 00:26:21 +1100614 /* Send the suspend signal to the program itself. */
615 kill(getpid(), SIGTSTP);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000616
Darren Tucker5d78de62004-11-05 20:35:44 +1100617 /* Reset window sizes in case they have changed */
618 received_window_change_signal = 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000619
Damien Miller21771e22011-05-15 08:45:50 +1000620 enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000621}
622
Ben Lindstrombba81212001-06-25 05:01:22 +0000623static void
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000624client_process_net_input(struct ssh *ssh, fd_set *readset)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000625{
Darren Tucker86e30a02009-08-28 11:21:06 +1000626 char buf[SSH_IOBUFSZ];
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000627 int r, len;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000628
Damien Miller5428f641999-11-25 11:54:57 +1100629 /*
630 * Read input from the server, and add any such data to the buffer of
631 * the packet subsystem.
632 */
Damien Miller95def091999-11-25 00:26:21 +1100633 if (FD_ISSET(connection_in, readset)) {
634 /* Read as much as possible. */
markus@openbsd.orga3068632016-01-14 16:17:39 +0000635 len = read(connection_in, buf, sizeof(buf));
636 if (len == 0) {
Darren Tucker4d5cd332008-06-13 04:51:14 +1000637 /*
638 * Received EOF. The remote host has closed the
639 * connection.
640 */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000641 if ((r = sshbuf_putf(stderr_buffer,
Darren Tucker4d5cd332008-06-13 04:51:14 +1000642 "Connection to %.300s closed by remote host.\r\n",
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000643 host)) != 0)
644 fatal("%s: buffer error: %s",
645 __func__, ssh_err(r));
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000646 quit_pending = 1;
647 return;
Damien Miller95def091999-11-25 00:26:21 +1100648 }
Damien Miller5428f641999-11-25 11:54:57 +1100649 /*
650 * There is a kernel bug on Solaris that causes select to
651 * sometimes wake up even though there is no data available.
652 */
deraadt@openbsd.org4d28fa72019-06-28 13:35:04 +0000653 if (len == -1 &&
Damien Millerd8968ad2008-07-04 23:10:49 +1000654 (errno == EAGAIN || errno == EINTR || errno == EWOULDBLOCK))
Damien Miller95def091999-11-25 00:26:21 +1100655 len = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000656
deraadt@openbsd.org4d28fa72019-06-28 13:35:04 +0000657 if (len == -1) {
Darren Tucker4d5cd332008-06-13 04:51:14 +1000658 /*
659 * An error has encountered. Perhaps there is a
660 * network problem.
661 */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000662 if ((r = sshbuf_putf(stderr_buffer,
Darren Tucker4d5cd332008-06-13 04:51:14 +1000663 "Read from remote host %.300s: %.100s\r\n",
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000664 host, strerror(errno))) != 0)
665 fatal("%s: buffer error: %s",
666 __func__, ssh_err(r));
Damien Miller95def091999-11-25 00:26:21 +1100667 quit_pending = 1;
668 return;
669 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000670 ssh_packet_process_incoming(ssh, buf, len);
Damien Miller95def091999-11-25 00:26:21 +1100671 }
Damien Miller1383bd82000-04-06 12:32:37 +1000672}
673
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000674static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000675client_status_confirm(struct ssh *ssh, int type, Channel *c, void *ctx)
Damien Miller0e220db2004-06-15 10:34:08 +1000676{
Damien Miller5771ed72008-05-19 15:35:33 +1000677 struct channel_reply_ctx *cr = (struct channel_reply_ctx *)ctx;
678 char errmsg[256];
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000679 int r, tochan;
Darren Tuckerfc959702004-07-17 16:12:08 +1000680
Damien Miller555f3b82011-05-15 08:48:05 +1000681 /*
682 * If a TTY was explicitly requested, then a failure to allocate
683 * one is fatal.
684 */
685 if (cr->action == CONFIRM_TTY &&
686 (options.request_tty == REQUEST_TTY_FORCE ||
687 options.request_tty == REQUEST_TTY_YES))
688 cr->action = CONFIRM_CLOSE;
689
djm@openbsd.org001aa552018-04-10 00:10:49 +0000690 /* XXX suppress on mux _client_ quietmode */
Damien Miller5771ed72008-05-19 15:35:33 +1000691 tochan = options.log_level >= SYSLOG_LEVEL_ERROR &&
Damien Millere1537f92010-01-26 13:26:22 +1100692 c->ctl_chan != -1 && c->extended_usage == CHAN_EXTENDED_WRITE;
Damien Miller0e220db2004-06-15 10:34:08 +1000693
Damien Miller5771ed72008-05-19 15:35:33 +1000694 if (type == SSH2_MSG_CHANNEL_SUCCESS) {
695 debug2("%s request accepted on channel %d",
696 cr->request_type, c->self);
697 } else if (type == SSH2_MSG_CHANNEL_FAILURE) {
698 if (tochan) {
699 snprintf(errmsg, sizeof(errmsg),
700 "%s request failed\r\n", cr->request_type);
701 } else {
702 snprintf(errmsg, sizeof(errmsg),
703 "%s request failed on channel %d",
704 cr->request_type, c->self);
705 }
706 /* If error occurred on primary session channel, then exit */
Damien Miller555f3b82011-05-15 08:48:05 +1000707 if (cr->action == CONFIRM_CLOSE && c->self == session_ident)
Damien Miller5771ed72008-05-19 15:35:33 +1000708 fatal("%s", errmsg);
Damien Miller555f3b82011-05-15 08:48:05 +1000709 /*
710 * If error occurred on mux client, append to
711 * their stderr.
712 */
713 if (tochan) {
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000714 if ((r = sshbuf_put(c->extended, errmsg,
715 strlen(errmsg))) != 0)
716 fatal("%s: buffer error %s", __func__,
717 ssh_err(r));
Damien Miller555f3b82011-05-15 08:48:05 +1000718 } else
Damien Miller5771ed72008-05-19 15:35:33 +1000719 error("%s", errmsg);
Damien Miller555f3b82011-05-15 08:48:05 +1000720 if (cr->action == CONFIRM_TTY) {
721 /*
722 * If a TTY allocation error occurred, then arrange
723 * for the correct TTY to leave raw mode.
724 */
725 if (c->self == session_ident)
726 leave_raw_mode(0);
727 else
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000728 mux_tty_alloc_failed(ssh, c);
Damien Miller555f3b82011-05-15 08:48:05 +1000729 } else if (cr->action == CONFIRM_CLOSE) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000730 chan_read_failed(ssh, c);
731 chan_write_failed(ssh, c);
Damien Miller5771ed72008-05-19 15:35:33 +1000732 }
Damien Miller0e220db2004-06-15 10:34:08 +1000733 }
Darren Tuckera627d422013-06-02 07:31:17 +1000734 free(cr);
Damien Miller5771ed72008-05-19 15:35:33 +1000735}
Damien Miller0e220db2004-06-15 10:34:08 +1000736
Damien Miller5771ed72008-05-19 15:35:33 +1000737static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000738client_abandon_status_confirm(struct ssh *ssh, Channel *c, void *ctx)
Damien Miller5771ed72008-05-19 15:35:33 +1000739{
Darren Tuckera627d422013-06-02 07:31:17 +1000740 free(ctx);
Damien Miller5771ed72008-05-19 15:35:33 +1000741}
742
Damien Miller6d7b4372011-06-23 08:31:57 +1000743void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000744client_expect_confirm(struct ssh *ssh, int id, const char *request,
Damien Miller555f3b82011-05-15 08:48:05 +1000745 enum confirm_action action)
Damien Miller5771ed72008-05-19 15:35:33 +1000746{
Damien Miller6c81fee2013-11-08 12:19:55 +1100747 struct channel_reply_ctx *cr = xcalloc(1, sizeof(*cr));
Damien Miller5771ed72008-05-19 15:35:33 +1000748
749 cr->request_type = request;
Damien Miller555f3b82011-05-15 08:48:05 +1000750 cr->action = action;
Damien Miller5771ed72008-05-19 15:35:33 +1000751
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000752 channel_register_status_confirm(ssh, id, client_status_confirm,
Damien Miller5771ed72008-05-19 15:35:33 +1000753 client_abandon_status_confirm, cr);
Damien Miller0e220db2004-06-15 10:34:08 +1000754}
755
Darren Tucker9f407c42008-06-13 04:50:27 +1000756void
757client_register_global_confirm(global_confirm_cb *cb, void *ctx)
758{
Damien Millerb9d3bee2008-07-16 22:40:52 +1000759 struct global_confirm *gc, *last_gc;
Darren Tucker9f407c42008-06-13 04:50:27 +1000760
761 /* Coalesce identical callbacks */
Damien Millerb9d3bee2008-07-16 22:40:52 +1000762 last_gc = TAILQ_LAST(&global_confirms, global_confirms);
763 if (last_gc && last_gc->cb == cb && last_gc->ctx == ctx) {
764 if (++last_gc->ref_count >= INT_MAX)
765 fatal("%s: last_gc->ref_count = %d",
766 __func__, last_gc->ref_count);
Darren Tucker9f407c42008-06-13 04:50:27 +1000767 return;
768 }
769
Damien Miller6c81fee2013-11-08 12:19:55 +1100770 gc = xcalloc(1, sizeof(*gc));
Darren Tucker9f407c42008-06-13 04:50:27 +1000771 gc->cb = cb;
772 gc->ctx = ctx;
773 gc->ref_count = 1;
774 TAILQ_INSERT_TAIL(&global_confirms, gc, entry);
775}
776
Damien Miller0e220db2004-06-15 10:34:08 +1000777static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000778process_cmdline(struct ssh *ssh)
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000779{
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000780 void (*handler)(int);
Damien Miller7acefbb2014-07-18 14:11:24 +1000781 char *s, *cmd;
782 int ok, delete = 0, local = 0, remote = 0, dynamic = 0;
783 struct Forward fwd;
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000784
Damien Miller1d2c4562014-02-04 11:18:20 +1100785 memset(&fwd, 0, sizeof(fwd));
Darren Tucker23ae8ca2007-12-02 23:12:30 +1100786
Damien Miller21771e22011-05-15 08:45:50 +1000787 leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
dtucker@openbsd.org3bf2a6a2020-01-23 07:10:22 +0000788 handler = ssh_signal(SIGINT, SIG_IGN);
Ben Lindstrom681d9322002-03-22 03:53:00 +0000789 cmd = s = read_passphrase("\r\nssh> ", RP_ECHO);
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000790 if (s == NULL)
791 goto out;
Damien Millerfdb23062013-11-21 13:57:15 +1100792 while (isspace((u_char)*s))
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000793 s++;
Darren Tuckere7066df2004-05-24 10:18:05 +1000794 if (*s == '-')
795 s++; /* Skip cmdline '-', if any */
Darren Tuckere1675822004-05-24 10:13:07 +1000796 if (*s == '\0')
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000797 goto out;
Darren Tuckere7066df2004-05-24 10:18:05 +1000798
Darren Tucker1973c882004-05-24 10:34:36 +1000799 if (*s == 'h' || *s == 'H' || *s == '?') {
Darren Tuckere7066df2004-05-24 10:18:05 +1000800 logit("Commands:");
Damien Miller43020952006-07-10 20:16:12 +1000801 logit(" -L[bind_address:]port:host:hostport "
802 "Request local forward");
803 logit(" -R[bind_address:]port:host:hostport "
804 "Request remote forward");
Damien Miller0164cb82008-11-05 16:30:31 +1100805 logit(" -D[bind_address:]port "
806 "Request dynamic forward");
Damien Millerff773642011-09-22 21:39:48 +1000807 logit(" -KL[bind_address:]port "
808 "Cancel local forward");
Damien Miller57e8ad32006-07-10 20:20:52 +1000809 logit(" -KR[bind_address:]port "
Damien Miller43020952006-07-10 20:16:12 +1000810 "Cancel remote forward");
Damien Millerff773642011-09-22 21:39:48 +1000811 logit(" -KD[bind_address:]port "
812 "Cancel dynamic forward");
Damien Millerd27b9472005-12-13 19:29:02 +1100813 if (!options.permit_local_command)
814 goto out;
Damien Miller43020952006-07-10 20:16:12 +1000815 logit(" !args "
816 "Execute local command");
Damien Millerd27b9472005-12-13 19:29:02 +1100817 goto out;
818 }
819
820 if (*s == '!' && options.permit_local_command) {
821 s++;
822 ssh_local_cmd(s);
Darren Tuckere7066df2004-05-24 10:18:05 +1000823 goto out;
824 }
825
826 if (*s == 'K') {
827 delete = 1;
828 s++;
829 }
Damien Miller0164cb82008-11-05 16:30:31 +1100830 if (*s == 'L')
831 local = 1;
832 else if (*s == 'R')
833 remote = 1;
834 else if (*s == 'D')
835 dynamic = 1;
836 else {
Damien Miller996acd22003-04-09 20:59:48 +1000837 logit("Invalid command.");
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000838 goto out;
839 }
Damien Miller0164cb82008-11-05 16:30:31 +1100840
Damien Millerfdb23062013-11-21 13:57:15 +1100841 while (isspace((u_char)*++s))
Darren Tucker03b1cdb2007-03-21 20:46:03 +1100842 ;
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000843
Damien Millere1537f92010-01-26 13:26:22 +1100844 /* XXX update list of forwards in options */
Darren Tuckere7066df2004-05-24 10:18:05 +1000845 if (delete) {
Damien Miller7acefbb2014-07-18 14:11:24 +1000846 /* We pass 1 for dynamicfwd to restrict to 1 or 2 fields. */
847 if (!parse_forward(&fwd, s, 1, 0)) {
848 logit("Bad forwarding close specification.");
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000849 goto out;
850 }
Damien Millerff773642011-09-22 21:39:48 +1000851 if (remote)
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000852 ok = channel_request_rforward_cancel(ssh, &fwd) == 0;
Damien Millerff773642011-09-22 21:39:48 +1000853 else if (dynamic)
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000854 ok = channel_cancel_lport_listener(ssh, &fwd,
Damien Miller7acefbb2014-07-18 14:11:24 +1000855 0, &options.fwd_opts) > 0;
Damien Millerff773642011-09-22 21:39:48 +1000856 else
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000857 ok = channel_cancel_lport_listener(ssh, &fwd,
Damien Miller7acefbb2014-07-18 14:11:24 +1000858 CHANNEL_CANCEL_PORT_STATIC,
859 &options.fwd_opts) > 0;
Damien Millerff773642011-09-22 21:39:48 +1000860 if (!ok) {
dtucker@openbsd.org9390b002017-01-29 21:35:23 +0000861 logit("Unknown port forwarding.");
Damien Millerff773642011-09-22 21:39:48 +1000862 goto out;
863 }
864 logit("Canceled forwarding.");
Darren Tuckere7066df2004-05-24 10:18:05 +1000865 } else {
Damien Miller4bf648f2009-02-14 16:28:21 +1100866 if (!parse_forward(&fwd, s, dynamic, remote)) {
Darren Tuckere7066df2004-05-24 10:18:05 +1000867 logit("Bad forwarding specification.");
868 goto out;
869 }
Damien Miller0164cb82008-11-05 16:30:31 +1100870 if (local || dynamic) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000871 if (!channel_setup_local_fwd_listener(ssh, &fwd,
Damien Miller7acefbb2014-07-18 14:11:24 +1000872 &options.fwd_opts)) {
Darren Tuckere7066df2004-05-24 10:18:05 +1000873 logit("Port forwarding failed.");
874 goto out;
875 }
Damien Millerf91ee4c2005-03-01 21:24:33 +1100876 } else {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000877 if (channel_request_remote_forwarding(ssh, &fwd) < 0) {
Darren Tuckere7d4b192006-07-12 22:17:10 +1000878 logit("Port forwarding failed.");
879 goto out;
880 }
Damien Millerf91ee4c2005-03-01 21:24:33 +1100881 }
Darren Tuckere7066df2004-05-24 10:18:05 +1000882 logit("Forwarding port.");
883 }
884
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000885out:
dtucker@openbsd.org3bf2a6a2020-01-23 07:10:22 +0000886 ssh_signal(SIGINT, handler);
Damien Miller21771e22011-05-15 08:45:50 +1000887 enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Darren Tuckera627d422013-06-02 07:31:17 +1000888 free(cmd);
889 free(fwd.listen_host);
Damien Miller7acefbb2014-07-18 14:11:24 +1000890 free(fwd.listen_path);
Darren Tuckera627d422013-06-02 07:31:17 +1000891 free(fwd.connect_host);
Damien Miller7acefbb2014-07-18 14:11:24 +1000892 free(fwd.connect_path);
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000893}
894
Darren Tucker92a39cf2012-09-07 11:20:20 +1000895/* reasons to suppress output of an escape command in help output */
896#define SUPPRESS_NEVER 0 /* never suppress, always show */
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000897#define SUPPRESS_MUXCLIENT 1 /* don't show in mux client sessions */
898#define SUPPRESS_MUXMASTER 2 /* don't show in mux master sessions */
899#define SUPPRESS_SYSLOG 4 /* don't show when logging to syslog */
Darren Tucker92a39cf2012-09-07 11:20:20 +1000900struct escape_help_text {
901 const char *cmd;
902 const char *text;
903 unsigned int flags;
904};
905static struct escape_help_text esc_txt[] = {
906 {".", "terminate session", SUPPRESS_MUXMASTER},
907 {".", "terminate connection (and any multiplexed sessions)",
908 SUPPRESS_MUXCLIENT},
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000909 {"B", "send a BREAK to the remote system", SUPPRESS_NEVER},
Darren Tucker92a39cf2012-09-07 11:20:20 +1000910 {"C", "open a command line", SUPPRESS_MUXCLIENT},
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000911 {"R", "request rekey", SUPPRESS_NEVER},
Darren Tuckerca0d0fd2012-09-07 11:22:24 +1000912 {"V/v", "decrease/increase verbosity (LogLevel)", SUPPRESS_MUXCLIENT},
Darren Tucker92a39cf2012-09-07 11:20:20 +1000913 {"^Z", "suspend ssh", SUPPRESS_MUXCLIENT},
914 {"#", "list forwarded connections", SUPPRESS_NEVER},
915 {"&", "background ssh (when waiting for connections to terminate)",
916 SUPPRESS_MUXCLIENT},
917 {"?", "this message", SUPPRESS_NEVER},
918};
919
920static void
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000921print_escape_help(struct sshbuf *b, int escape_char, int mux_client,
922 int using_stderr)
Darren Tucker92a39cf2012-09-07 11:20:20 +1000923{
924 unsigned int i, suppress_flags;
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000925 int r;
Darren Tucker92a39cf2012-09-07 11:20:20 +1000926
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000927 if ((r = sshbuf_putf(b,
928 "%c?\r\nSupported escape sequences:\r\n", escape_char)) != 0)
929 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Darren Tucker92a39cf2012-09-07 11:20:20 +1000930
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000931 suppress_flags =
Darren Tucker92a39cf2012-09-07 11:20:20 +1000932 (mux_client ? SUPPRESS_MUXCLIENT : 0) |
933 (mux_client ? 0 : SUPPRESS_MUXMASTER) |
934 (using_stderr ? 0 : SUPPRESS_SYSLOG);
935
936 for (i = 0; i < sizeof(esc_txt)/sizeof(esc_txt[0]); i++) {
937 if (esc_txt[i].flags & suppress_flags)
938 continue;
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000939 if ((r = sshbuf_putf(b, " %c%-3s - %s\r\n",
940 escape_char, esc_txt[i].cmd, esc_txt[i].text)) != 0)
941 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Darren Tucker92a39cf2012-09-07 11:20:20 +1000942 }
943
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000944 if ((r = sshbuf_putf(b,
Darren Tuckerca0d0fd2012-09-07 11:22:24 +1000945 " %c%c - send the escape character by typing it twice\r\n"
Darren Tucker92a39cf2012-09-07 11:20:20 +1000946 "(Note that escapes are only recognized immediately after "
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000947 "newline.)\r\n", escape_char, escape_char)) != 0)
948 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Darren Tucker92a39cf2012-09-07 11:20:20 +1000949}
950
djm@openbsd.org84623e02018-06-26 02:02:36 +0000951/*
naddy@openbsd.org768405f2017-05-03 21:08:09 +0000952 * Process the characters one by one.
Darren Tucker2fb66ca2008-06-13 04:49:33 +1000953 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000954static int
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000955process_escapes(struct ssh *ssh, Channel *c,
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000956 struct sshbuf *bin, struct sshbuf *bout, struct sshbuf *berr,
Darren Tucker2fb66ca2008-06-13 04:49:33 +1000957 char *buf, int len)
Damien Millerad833b32000-08-23 10:46:23 +1000958{
Damien Millerad833b32000-08-23 10:46:23 +1000959 pid_t pid;
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000960 int r, bytes = 0;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000961 u_int i;
962 u_char ch;
Damien Millerad833b32000-08-23 10:46:23 +1000963 char *s;
djm@openbsd.org05164352017-04-30 23:21:54 +0000964 struct escape_filter_ctx *efc = c->filter_ctx == NULL ?
965 NULL : (struct escape_filter_ctx *)c->filter_ctx;
Damien Millerad833b32000-08-23 10:46:23 +1000966
djm@openbsd.org05164352017-04-30 23:21:54 +0000967 if (c->filter_ctx == NULL)
968 return 0;
djm@openbsd.org84623e02018-06-26 02:02:36 +0000969
Damien Millereccb9de2005-06-17 12:59:34 +1000970 if (len <= 0)
971 return (0);
972
973 for (i = 0; i < (u_int)len; i++) {
Damien Millerad833b32000-08-23 10:46:23 +1000974 /* Get one character at a time. */
975 ch = buf[i];
976
djm@openbsd.org05164352017-04-30 23:21:54 +0000977 if (efc->escape_pending) {
Damien Millerad833b32000-08-23 10:46:23 +1000978 /* We have previously seen an escape character. */
979 /* Clear the flag now. */
djm@openbsd.org05164352017-04-30 23:21:54 +0000980 efc->escape_pending = 0;
Damien Millerad833b32000-08-23 10:46:23 +1000981
982 /* Process the escaped character. */
983 switch (ch) {
984 case '.':
985 /* Terminate the connection. */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000986 if ((r = sshbuf_putf(berr, "%c.\r\n",
987 efc->escape_char)) != 0)
988 fatal("%s: buffer error: %s",
989 __func__, ssh_err(r));
Damien Millere1537f92010-01-26 13:26:22 +1100990 if (c && c->ctl_chan != -1) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000991 chan_read_failed(ssh, c);
992 chan_write_failed(ssh, c);
993 if (c->detach_user) {
994 c->detach_user(ssh,
995 c->self, NULL);
996 }
Damien Miller36187092013-06-10 13:07:11 +1000997 c->type = SSH_CHANNEL_ABANDONED;
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000998 sshbuf_reset(c->input);
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000999 chan_ibuf_empty(ssh, c);
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001000 return 0;
1001 } else
1002 quit_pending = 1;
Damien Millerad833b32000-08-23 10:46:23 +10001003 return -1;
1004
1005 case 'Z' - 64:
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001006 /* XXX support this for mux clients */
Damien Millere1537f92010-01-26 13:26:22 +11001007 if (c && c->ctl_chan != -1) {
Darren Tuckerf111d402012-09-07 11:21:42 +10001008 char b[16];
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001009 noescape:
Darren Tuckerf111d402012-09-07 11:21:42 +10001010 if (ch == 'Z' - 64)
1011 snprintf(b, sizeof b, "^Z");
1012 else
1013 snprintf(b, sizeof b, "%c", ch);
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001014 if ((r = sshbuf_putf(berr,
Darren Tuckerf111d402012-09-07 11:21:42 +10001015 "%c%s escape not available to "
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001016 "multiplexed sessions\r\n",
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001017 efc->escape_char, b)) != 0)
1018 fatal("%s: buffer error: %s",
1019 __func__, ssh_err(r));
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001020 continue;
1021 }
Darren Tucker4d5cd332008-06-13 04:51:14 +10001022 /* Suspend the program. Inform the user */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001023 if ((r = sshbuf_putf(berr,
1024 "%c^Z [suspend ssh]\r\n",
1025 efc->escape_char)) != 0)
1026 fatal("%s: buffer error: %s",
1027 __func__, ssh_err(r));
Damien Millerad833b32000-08-23 10:46:23 +10001028
1029 /* Restore terminal modes and suspend. */
1030 client_suspend_self(bin, bout, berr);
1031
1032 /* We have been continued. */
1033 continue;
1034
Damien Miller54c45982003-05-15 10:20:13 +10001035 case 'B':
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001036 if ((r = sshbuf_putf(berr,
1037 "%cB\r\n", efc->escape_char)) != 0)
1038 fatal("%s: buffer error: %s",
1039 __func__, ssh_err(r));
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001040 channel_request_start(ssh, c->self, "break", 0);
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001041 if ((r = sshpkt_put_u32(ssh, 1000)) != 0 ||
1042 (r = sshpkt_send(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00001043 fatal("%s: send packet: %s", __func__,
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001044 ssh_err(r));
Damien Miller54c45982003-05-15 10:20:13 +10001045 continue;
1046
Ben Lindstromf28f6342001-04-04 02:03:04 +00001047 case 'R':
djm@openbsd.org97f4d302017-04-30 23:13:25 +00001048 if (datafellows & SSH_BUG_NOREKEY)
1049 logit("Server does not "
1050 "support re-keying");
1051 else
1052 need_rekeying = 1;
Ben Lindstromf28f6342001-04-04 02:03:04 +00001053 continue;
1054
Darren Tucker50a48d02012-09-06 21:25:37 +10001055 case 'V':
1056 /* FALLTHROUGH */
1057 case 'v':
1058 if (c && c->ctl_chan != -1)
1059 goto noescape;
1060 if (!log_is_on_stderr()) {
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001061 if ((r = sshbuf_putf(berr,
Darren Tucker50a48d02012-09-06 21:25:37 +10001062 "%c%c [Logging to syslog]\r\n",
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001063 efc->escape_char, ch)) != 0)
1064 fatal("%s: buffer error: %s",
1065 __func__, ssh_err(r));
Darren Tucker50a48d02012-09-06 21:25:37 +10001066 continue;
1067 }
1068 if (ch == 'V' && options.log_level >
1069 SYSLOG_LEVEL_QUIET)
1070 log_change_level(--options.log_level);
1071 if (ch == 'v' && options.log_level <
1072 SYSLOG_LEVEL_DEBUG3)
1073 log_change_level(++options.log_level);
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001074 if ((r = sshbuf_putf(berr,
djm@openbsd.org05164352017-04-30 23:21:54 +00001075 "%c%c [LogLevel %s]\r\n",
1076 efc->escape_char, ch,
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001077 log_level_name(options.log_level))) != 0)
1078 fatal("%s: buffer error: %s",
1079 __func__, ssh_err(r));
Darren Tucker50a48d02012-09-06 21:25:37 +10001080 continue;
1081
Damien Millerad833b32000-08-23 10:46:23 +10001082 case '&':
Damien Millere1537f92010-01-26 13:26:22 +11001083 if (c && c->ctl_chan != -1)
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001084 goto noescape;
Damien Millerad833b32000-08-23 10:46:23 +10001085 /*
Darren Tucker4d5cd332008-06-13 04:51:14 +10001086 * Detach the program (continue to serve
1087 * connections, but put in background and no
1088 * more new connections).
Damien Millerad833b32000-08-23 10:46:23 +10001089 */
Damien Miller96507ef2001-11-12 10:52:25 +11001090 /* Restore tty modes. */
Damien Miller21771e22011-05-15 08:45:50 +10001091 leave_raw_mode(
1092 options.request_tty == REQUEST_TTY_FORCE);
Damien Miller96507ef2001-11-12 10:52:25 +11001093
1094 /* Stop listening for new connections. */
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001095 channel_stop_listening(ssh);
Damien Miller96507ef2001-11-12 10:52:25 +11001096
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001097 if ((r = sshbuf_putf(berr,
1098 "%c& [backgrounded]\n", efc->escape_char))
1099 != 0)
1100 fatal("%s: buffer error: %s",
1101 __func__, ssh_err(r));
Damien Miller96507ef2001-11-12 10:52:25 +11001102
1103 /* Fork into background. */
1104 pid = fork();
deraadt@openbsd.org4d28fa72019-06-28 13:35:04 +00001105 if (pid == -1) {
Damien Miller96507ef2001-11-12 10:52:25 +11001106 error("fork: %.100s", strerror(errno));
1107 continue;
1108 }
1109 if (pid != 0) { /* This is the parent. */
1110 /* The parent just exits. */
1111 exit(0);
1112 }
1113 /* The child continues serving connections. */
djm@openbsd.org97f4d302017-04-30 23:13:25 +00001114 /* fake EOF on stdin */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001115 if ((r = sshbuf_put_u8(bin, 4)) != 0)
1116 fatal("%s: buffer error: %s",
1117 __func__, ssh_err(r));
djm@openbsd.org97f4d302017-04-30 23:13:25 +00001118 return -1;
Damien Millerad833b32000-08-23 10:46:23 +10001119 case '?':
djm@openbsd.org05164352017-04-30 23:21:54 +00001120 print_escape_help(berr, efc->escape_char,
Darren Tucker92a39cf2012-09-07 11:20:20 +10001121 (c && c->ctl_chan != -1),
1122 log_is_on_stderr());
Damien Millerad833b32000-08-23 10:46:23 +10001123 continue;
1124
1125 case '#':
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001126 if ((r = sshbuf_putf(berr, "%c#\r\n",
1127 efc->escape_char)) != 0)
1128 fatal("%s: buffer error: %s",
1129 __func__, ssh_err(r));
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001130 s = channel_open_message(ssh);
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001131 if ((r = sshbuf_put(berr, s, strlen(s))) != 0)
1132 fatal("%s: buffer error: %s",
1133 __func__, ssh_err(r));
Darren Tuckera627d422013-06-02 07:31:17 +10001134 free(s);
Damien Millerad833b32000-08-23 10:46:23 +10001135 continue;
1136
Ben Lindstrom5589f4b2002-03-22 03:24:32 +00001137 case 'C':
Damien Millere1537f92010-01-26 13:26:22 +11001138 if (c && c->ctl_chan != -1)
Damien Miller586b0052008-12-09 14:11:32 +11001139 goto noescape;
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001140 process_cmdline(ssh);
Ben Lindstrom5589f4b2002-03-22 03:24:32 +00001141 continue;
1142
Damien Millerad833b32000-08-23 10:46:23 +10001143 default:
djm@openbsd.org05164352017-04-30 23:21:54 +00001144 if (ch != efc->escape_char) {
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001145 if ((r = sshbuf_put_u8(bin,
1146 efc->escape_char)) != 0)
1147 fatal("%s: buffer error: %s",
1148 __func__, ssh_err(r));
Damien Millerad833b32000-08-23 10:46:23 +10001149 bytes++;
1150 }
1151 /* Escaped characters fall through here */
1152 break;
1153 }
1154 } else {
1155 /*
Darren Tucker4d5cd332008-06-13 04:51:14 +10001156 * The previous character was not an escape char.
1157 * Check if this is an escape.
Damien Millerad833b32000-08-23 10:46:23 +10001158 */
djm@openbsd.org05164352017-04-30 23:21:54 +00001159 if (last_was_cr && ch == efc->escape_char) {
Darren Tucker4d5cd332008-06-13 04:51:14 +10001160 /*
1161 * It is. Set the flag and continue to
1162 * next character.
1163 */
djm@openbsd.org05164352017-04-30 23:21:54 +00001164 efc->escape_pending = 1;
Damien Millerad833b32000-08-23 10:46:23 +10001165 continue;
1166 }
1167 }
1168
1169 /*
1170 * Normal character. Record whether it was a newline,
1171 * and append it to the buffer.
1172 */
1173 last_was_cr = (ch == '\r' || ch == '\n');
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001174 if ((r = sshbuf_put_u8(bin, ch)) != 0)
1175 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Damien Millerad833b32000-08-23 10:46:23 +10001176 bytes++;
1177 }
1178 return bytes;
1179}
1180
Damien Miller5428f641999-11-25 11:54:57 +11001181/*
Damien Millerb38eff82000-04-01 11:09:21 +10001182 * Get packets from the connection input buffer, and process them as long as
1183 * there are packets available.
1184 *
1185 * Any unknown packets received during the actual
1186 * session cause the session to terminate. This is
1187 * intended to make debugging easier since no
1188 * confirmations are sent. Any compatible protocol
1189 * extensions must be negotiated during the
1190 * preparatory phase.
1191 */
1192
Ben Lindstrombba81212001-06-25 05:01:22 +00001193static void
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001194client_process_buffered_input_packets(struct ssh *ssh)
Damien Millerb38eff82000-04-01 11:09:21 +10001195{
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001196 ssh_dispatch_run_fatal(ssh, DISPATCH_NONBLOCK, &quit_pending);
Damien Millerb38eff82000-04-01 11:09:21 +10001197}
1198
Damien Millerad833b32000-08-23 10:46:23 +10001199/* scan buf[] for '~' before sending data to the peer */
1200
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001201/* Helper: allocate a new escape_filter_ctx and fill in its escape char */
1202void *
1203client_new_escape_filter_ctx(int escape_char)
1204{
1205 struct escape_filter_ctx *ret;
1206
Damien Miller6c81fee2013-11-08 12:19:55 +11001207 ret = xcalloc(1, sizeof(*ret));
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001208 ret->escape_pending = 0;
1209 ret->escape_char = escape_char;
1210 return (void *)ret;
1211}
1212
Darren Tucker84c56f52008-06-13 04:55:46 +10001213/* Free the escape filter context on channel free */
1214void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001215client_filter_cleanup(struct ssh *ssh, int cid, void *ctx)
Darren Tucker84c56f52008-06-13 04:55:46 +10001216{
Darren Tuckera627d422013-06-02 07:31:17 +10001217 free(ctx);
Darren Tucker84c56f52008-06-13 04:55:46 +10001218}
1219
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001220int
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001221client_simple_escape_filter(struct ssh *ssh, Channel *c, char *buf, int len)
Damien Millerad833b32000-08-23 10:46:23 +10001222{
Damien Miller5771ed72008-05-19 15:35:33 +10001223 if (c->extended_usage != CHAN_EXTENDED_WRITE)
1224 return 0;
1225
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001226 return process_escapes(ssh, c, c->input, c->output, c->extended,
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001227 buf, len);
Damien Millerad833b32000-08-23 10:46:23 +10001228}
1229
Ben Lindstrombba81212001-06-25 05:01:22 +00001230static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001231client_channel_closed(struct ssh *ssh, int id, void *arg)
Ben Lindstrom4c3f77d2001-04-05 23:37:36 +00001232{
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001233 channel_cancel_cleanup(ssh, id);
Ben Lindstrom4c3f77d2001-04-05 23:37:36 +00001234 session_closed = 1;
Damien Miller21771e22011-05-15 08:45:50 +10001235 leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Ben Lindstrom4c3f77d2001-04-05 23:37:36 +00001236}
1237
Damien Millerb38eff82000-04-01 11:09:21 +10001238/*
Damien Miller5428f641999-11-25 11:54:57 +11001239 * Implements the interactive session with the server. This is called after
1240 * the user has been authenticated, and a command has been started on the
Ben Lindstrom2b1f71b2001-06-05 20:32:21 +00001241 * remote host. If escape_char != SSH_ESCAPECHAR_NONE, it is the character
1242 * used as an escape character for terminating or suspending the session.
Damien Miller5428f641999-11-25 11:54:57 +11001243 */
Damien Miller4af51302000-04-16 11:18:38 +10001244int
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001245client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
1246 int ssh2_chan_id)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001247{
Damien Miller5e953212001-01-30 09:14:00 +11001248 fd_set *readset = NULL, *writeset = NULL;
Damien Miller95def091999-11-25 00:26:21 +11001249 double start_time, total_time;
djm@openbsd.org19bcf2e2016-02-08 10:57:07 +00001250 int r, max_fd = 0, max_fd2 = 0, len;
Damien Millerb61f3fc2008-07-11 17:36:48 +10001251 u_int64_t ibytes, obytes;
Darren Tuckerc7a6fc42004-08-13 21:18:00 +10001252 u_int nalloc = 0;
Damien Miller95def091999-11-25 00:26:21 +11001253 char buf[100];
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001254
Damien Miller95def091999-11-25 00:26:21 +11001255 debug("Entering interactive session.");
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001256
semarie@openbsd.orgd7d2bc92015-12-26 07:46:03 +00001257 if (options.control_master &&
djm@openbsd.org368dd972016-07-23 02:54:08 +00001258 !option_clear_or_none(options.control_path)) {
semarie@openbsd.orgd7d2bc92015-12-26 07:46:03 +00001259 debug("pledge: id");
mestre@openbsd.org7adf6c42019-07-24 08:57:00 +00001260 if (pledge("stdio rpath wpath cpath unix inet dns recvfd sendfd proc exec id tty",
semarie@openbsd.orgd7d2bc92015-12-26 07:46:03 +00001261 NULL) == -1)
1262 fatal("%s pledge(): %s", __func__, strerror(errno));
1263
1264 } else if (options.forward_x11 || options.permit_local_command) {
semarie@openbsd.orgb91926a2015-12-03 17:00:18 +00001265 debug("pledge: exec");
1266 if (pledge("stdio rpath wpath cpath unix inet dns proc exec tty",
1267 NULL) == -1)
1268 fatal("%s pledge(): %s", __func__, strerror(errno));
1269
1270 } else if (options.update_hostkeys) {
1271 debug("pledge: filesystem full");
1272 if (pledge("stdio rpath wpath cpath unix inet dns proc tty",
1273 NULL) == -1)
1274 fatal("%s pledge(): %s", __func__, strerror(errno));
1275
djm@openbsd.org368dd972016-07-23 02:54:08 +00001276 } else if (!option_clear_or_none(options.proxy_command) ||
1277 fork_after_authentication_flag) {
semarie@openbsd.orgb91926a2015-12-03 17:00:18 +00001278 debug("pledge: proc");
1279 if (pledge("stdio cpath unix inet dns proc tty", NULL) == -1)
1280 fatal("%s pledge(): %s", __func__, strerror(errno));
1281
semarie@openbsd.orgb91926a2015-12-03 17:00:18 +00001282 } else {
1283 debug("pledge: network");
mestre@openbsd.orge2386452017-06-23 07:24:48 +00001284 if (pledge("stdio unix inet dns proc tty", NULL) == -1)
semarie@openbsd.orgb91926a2015-12-03 17:00:18 +00001285 fatal("%s pledge(): %s", __func__, strerror(errno));
1286 }
1287
dtucker@openbsd.org@openbsd.org2d638e92017-11-25 05:58:47 +00001288 start_time = monotime_double();
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001289
Damien Miller95def091999-11-25 00:26:21 +11001290 /* Initialize variables. */
Damien Miller95def091999-11-25 00:26:21 +11001291 last_was_cr = 1;
1292 exit_status = -1;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001293 connection_in = ssh_packet_get_connection_in(ssh);
1294 connection_out = ssh_packet_get_connection_out(ssh);
deraadt@openbsd.org9136ec12016-09-12 01:22:38 +00001295 max_fd = MAXIMUM(connection_in, connection_out);
Damien Miller5e953212001-01-30 09:14:00 +11001296
Damien Miller95def091999-11-25 00:26:21 +11001297 quit_pending = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001298
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001299 /* Initialize buffer. */
1300 if ((stderr_buffer = sshbuf_new()) == NULL)
1301 fatal("%s: sshbuf_new failed", __func__);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001302
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001303 client_init_dispatch(ssh);
Damien Millerb38eff82000-04-01 11:09:21 +10001304
Ben Lindstromf49dbff2002-12-23 02:01:55 +00001305 /*
1306 * Set signal handlers, (e.g. to restore non-blocking mode)
1307 * but don't overwrite SIG_IGN, matches behaviour from rsh(1)
1308 */
dtucker@openbsd.org3bf2a6a2020-01-23 07:10:22 +00001309 if (ssh_signal(SIGHUP, SIG_IGN) != SIG_IGN)
1310 ssh_signal(SIGHUP, signal_handler);
1311 if (ssh_signal(SIGINT, SIG_IGN) != SIG_IGN)
1312 ssh_signal(SIGINT, signal_handler);
1313 if (ssh_signal(SIGQUIT, SIG_IGN) != SIG_IGN)
1314 ssh_signal(SIGQUIT, signal_handler);
1315 if (ssh_signal(SIGTERM, SIG_IGN) != SIG_IGN)
1316 ssh_signal(SIGTERM, signal_handler);
1317 ssh_signal(SIGWINCH, window_change_handler);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001318
Damien Miller95def091999-11-25 00:26:21 +11001319 if (have_pty)
Damien Miller21771e22011-05-15 08:45:50 +10001320 enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001321
djm@openbsd.org97f4d302017-04-30 23:13:25 +00001322 session_ident = ssh2_chan_id;
1323 if (session_ident != -1) {
1324 if (escape_char_arg != SSH_ESCAPECHAR_NONE) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001325 channel_register_filter(ssh, session_ident,
djm@openbsd.org97f4d302017-04-30 23:13:25 +00001326 client_simple_escape_filter, NULL,
1327 client_filter_cleanup,
1328 client_new_escape_filter_ctx(
1329 escape_char_arg));
Damien Miller6c3eec72011-05-05 14:16:22 +10001330 }
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001331 channel_register_cleanup(ssh, session_ident,
djm@openbsd.org97f4d302017-04-30 23:13:25 +00001332 client_channel_closed, 0);
Ben Lindstrom5b828322001-02-09 01:34:36 +00001333 }
Damien Millerad833b32000-08-23 10:46:23 +10001334
Damien Miller95def091999-11-25 00:26:21 +11001335 /* Main loop of the client for the interactive session mode. */
1336 while (!quit_pending) {
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001337
Damien Miller5428f641999-11-25 11:54:57 +11001338 /* Process buffered packets sent by the server. */
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001339 client_process_buffered_input_packets(ssh);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001340
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001341 if (session_closed && !channel_still_open(ssh))
Damien Miller1383bd82000-04-06 12:32:37 +10001342 break;
Ben Lindstrom4c3f77d2001-04-05 23:37:36 +00001343
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001344 if (ssh_packet_is_rekeying(ssh)) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +00001345 debug("rekeying in progress");
djm@openbsd.org19bcf2e2016-02-08 10:57:07 +00001346 } else if (need_rekeying) {
1347 /* manual rekey request */
1348 debug("need rekeying");
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001349 if ((r = kex_start_rekex(ssh)) != 0)
djm@openbsd.org19bcf2e2016-02-08 10:57:07 +00001350 fatal("%s: kex_start_rekex: %s", __func__,
1351 ssh_err(r));
1352 need_rekeying = 0;
Ben Lindstrombe2cc432001-04-04 23:46:07 +00001353 } else {
1354 /*
Ben Lindstrombe2cc432001-04-04 23:46:07 +00001355 * Make packets from buffered channel data, and
1356 * enqueue them for sending to the server.
1357 */
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001358 if (ssh_packet_not_very_much_data_to_write(ssh))
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001359 channel_output_poll(ssh);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001360
Ben Lindstrombe2cc432001-04-04 23:46:07 +00001361 /*
1362 * Check if the window size has changed, and buffer a
1363 * message about it to the server if so.
1364 */
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001365 client_check_window_change(ssh);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001366
Ben Lindstrombe2cc432001-04-04 23:46:07 +00001367 if (quit_pending)
1368 break;
1369 }
Damien Miller5428f641999-11-25 11:54:57 +11001370 /*
1371 * Wait until we have something to do (something becomes
1372 * available on one of the descriptors).
1373 */
Ben Lindstrom16d29d52001-07-18 16:01:46 +00001374 max_fd2 = max_fd;
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001375 client_wait_until_can_do_something(ssh, &readset, &writeset,
1376 &max_fd2, &nalloc, ssh_packet_is_rekeying(ssh));
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001377
Damien Miller95def091999-11-25 00:26:21 +11001378 if (quit_pending)
1379 break;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001380
Ben Lindstrombe2cc432001-04-04 23:46:07 +00001381 /* Do channel operations unless rekeying in progress. */
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001382 if (!ssh_packet_is_rekeying(ssh))
1383 channel_after_select(ssh, readset, writeset);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001384
Damien Miller1383bd82000-04-06 12:32:37 +10001385 /* Buffer input from the connection. */
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001386 client_process_net_input(ssh, readset);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001387
Damien Miller1383bd82000-04-06 12:32:37 +10001388 if (quit_pending)
1389 break;
1390
Darren Tucker4d5cd332008-06-13 04:51:14 +10001391 /*
1392 * Send as much buffered packet data as possible to the
1393 * sender.
1394 */
djm@openbsd.org65d6fd02020-01-30 07:20:57 +00001395 if (FD_ISSET(connection_out, writeset)) {
1396 if ((r = ssh_packet_write_poll(ssh)) != 0) {
1397 sshpkt_fatal(ssh, r,
1398 "%s: ssh_packet_write_poll", __func__);
1399 }
1400 }
Damien Millere11e1ea2010-08-03 16:04:46 +10001401
1402 /*
1403 * If we are a backgrounded control master, and the
1404 * timeout has expired without any active client
1405 * connections, then quit.
1406 */
1407 if (control_persist_exit_time > 0) {
Darren Tuckerb759c9c2013-06-02 07:46:16 +10001408 if (monotime() >= control_persist_exit_time) {
Damien Millere11e1ea2010-08-03 16:04:46 +10001409 debug("ControlPersist timeout expired");
1410 break;
1411 }
1412 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001413 }
Darren Tuckera627d422013-06-02 07:31:17 +10001414 free(readset);
1415 free(writeset);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001416
Damien Miller95def091999-11-25 00:26:21 +11001417 /* Terminate the session. */
1418
1419 /* Stop watching for window change. */
dtucker@openbsd.org3bf2a6a2020-01-23 07:10:22 +00001420 ssh_signal(SIGWINCH, SIG_DFL);
Damien Miller95def091999-11-25 00:26:21 +11001421
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001422 if ((r = sshpkt_start(ssh, SSH2_MSG_DISCONNECT)) != 0 ||
1423 (r = sshpkt_put_u32(ssh, SSH2_DISCONNECT_BY_APPLICATION)) != 0 ||
1424 (r = sshpkt_put_cstring(ssh, "disconnected by user")) != 0 ||
1425 (r = sshpkt_put_cstring(ssh, "")) != 0 || /* language tag */
1426 (r = sshpkt_send(ssh)) != 0 ||
1427 (r = ssh_packet_write_wait(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00001428 fatal("%s: send disconnect: %s", __func__, ssh_err(r));
Darren Tucker12b4a652009-06-21 18:14:48 +10001429
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001430 channel_free_all(ssh);
Damien Miller95def091999-11-25 00:26:21 +11001431
Ben Lindstromec46e0b2001-06-09 01:27:31 +00001432 if (have_pty)
Damien Miller21771e22011-05-15 08:45:50 +10001433 leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Ben Lindstromc93e84c2001-05-12 00:08:37 +00001434
1435 /* restore blocking io */
1436 if (!isatty(fileno(stdin)))
1437 unset_nonblock(fileno(stdin));
1438 if (!isatty(fileno(stdout)))
1439 unset_nonblock(fileno(stdout));
1440 if (!isatty(fileno(stderr)))
1441 unset_nonblock(fileno(stderr));
1442
Damien Millerd6965512003-12-17 16:31:53 +11001443 /*
1444 * If there was no shell or command requested, there will be no remote
1445 * exit status to be returned. In that case, clear error code if the
1446 * connection was deliberately terminated at this end.
1447 */
1448 if (no_shell_flag && received_signal == SIGTERM) {
1449 received_signal = 0;
1450 exit_status = 0;
1451 }
1452
dtucker@openbsd.orgb1e72df2017-07-14 03:18:21 +00001453 if (received_signal) {
1454 verbose("Killed by signal %d.", (int) received_signal);
1455 cleanup_exit(0);
1456 }
Ben Lindstromec46e0b2001-06-09 01:27:31 +00001457
1458 /*
1459 * In interactive mode (with pseudo tty) display a message indicating
1460 * that the connection has been closed.
1461 */
1462 if (have_pty && options.log_level != SYSLOG_LEVEL_QUIET) {
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001463 if ((r = sshbuf_putf(stderr_buffer,
1464 "Connection to %.64s closed.\r\n", host)) != 0)
1465 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Ben Lindstromec46e0b2001-06-09 01:27:31 +00001466 }
1467
Damien Miller95def091999-11-25 00:26:21 +11001468 /* Output any buffered data for stderr. */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001469 if (sshbuf_len(stderr_buffer) > 0) {
Damien Miller4791f9d2011-01-16 23:16:53 +11001470 len = atomicio(vwrite, fileno(stderr),
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001471 (u_char *)sshbuf_ptr(stderr_buffer),
1472 sshbuf_len(stderr_buffer));
1473 if (len < 0 || (u_int)len != sshbuf_len(stderr_buffer))
Damien Miller95def091999-11-25 00:26:21 +11001474 error("Write failed flushing stderr buffer.");
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001475 else if ((r = sshbuf_consume(stderr_buffer, len)) != 0)
1476 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Damien Miller95def091999-11-25 00:26:21 +11001477 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001478
Damien Miller95def091999-11-25 00:26:21 +11001479 /* Clear and free any buffers. */
jsg@openbsd.org458abc22016-01-23 05:31:35 +00001480 explicit_bzero(buf, sizeof(buf));
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001481 sshbuf_free(stderr_buffer);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001482
Damien Miller95def091999-11-25 00:26:21 +11001483 /* Report bytes transferred, and transfer rates. */
dtucker@openbsd.org@openbsd.org2d638e92017-11-25 05:58:47 +00001484 total_time = monotime_double() - start_time;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001485 ssh_packet_get_bytes(ssh, &ibytes, &obytes);
Damien Millerb61f3fc2008-07-11 17:36:48 +10001486 verbose("Transferred: sent %llu, received %llu bytes, in %.1f seconds",
Damien Miller821de0a2011-01-11 17:20:29 +11001487 (unsigned long long)obytes, (unsigned long long)ibytes, total_time);
Damien Miller95def091999-11-25 00:26:21 +11001488 if (total_time > 0)
Damien Millerb61f3fc2008-07-11 17:36:48 +10001489 verbose("Bytes per second: sent %.1f, received %.1f",
1490 obytes / total_time, ibytes / total_time);
Damien Miller95def091999-11-25 00:26:21 +11001491 /* Return the exit status of the program. */
1492 debug("Exit status %d", exit_status);
1493 return exit_status;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001494}
Damien Millerb38eff82000-04-01 11:09:21 +10001495
1496/*********/
1497
Ben Lindstrombba81212001-06-25 05:01:22 +00001498static Channel *
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001499client_request_forwarded_tcpip(struct ssh *ssh, const char *request_type,
1500 int rchan, u_int rwindow, u_int rmaxpack)
Damien Miller0bc1bd82000-11-13 22:57:25 +11001501{
Ben Lindstroma962c2f2002-07-04 00:14:17 +00001502 Channel *c = NULL;
markus@openbsd.org8d057842016-09-30 09:19:13 +00001503 struct sshbuf *b = NULL;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001504 char *listen_address, *originator_address;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001505 u_int listen_port, originator_port;
markus@openbsd.org8d057842016-09-30 09:19:13 +00001506 int r;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001507
1508 /* Get rest of the packet */
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001509 if ((r = sshpkt_get_cstring(ssh, &listen_address, NULL)) != 0 ||
1510 (r = sshpkt_get_u32(ssh, &listen_port)) != 0 ||
1511 (r = sshpkt_get_cstring(ssh, &originator_address, NULL)) != 0 ||
1512 (r = sshpkt_get_u32(ssh, &originator_port)) != 0 ||
1513 (r = sshpkt_get_end(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00001514 fatal("%s: parse packet: %s", __func__, ssh_err(r));
Damien Miller0bc1bd82000-11-13 22:57:25 +11001515
Damien Miller7acefbb2014-07-18 14:11:24 +10001516 debug("%s: listen %s port %d, originator %s port %d", __func__,
1517 listen_address, listen_port, originator_address, originator_port);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001518
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001519 if (listen_port > 0xffff)
1520 error("%s: invalid listen port", __func__);
1521 else if (originator_port > 0xffff)
1522 error("%s: invalid originator port", __func__);
1523 else {
1524 c = channel_connect_by_listen_address(ssh,
1525 listen_address, listen_port, "forwarded-tcpip",
1526 originator_address);
1527 }
Damien Millerbd740252008-05-19 15:37:09 +10001528
markus@openbsd.org8d057842016-09-30 09:19:13 +00001529 if (c != NULL && c->type == SSH_CHANNEL_MUX_CLIENT) {
1530 if ((b = sshbuf_new()) == NULL) {
1531 error("%s: alloc reply", __func__);
1532 goto out;
1533 }
1534 /* reconstruct and send to muxclient */
1535 if ((r = sshbuf_put_u8(b, 0)) != 0 || /* padlen */
1536 (r = sshbuf_put_u8(b, SSH2_MSG_CHANNEL_OPEN)) != 0 ||
1537 (r = sshbuf_put_cstring(b, request_type)) != 0 ||
1538 (r = sshbuf_put_u32(b, rchan)) != 0 ||
1539 (r = sshbuf_put_u32(b, rwindow)) != 0 ||
1540 (r = sshbuf_put_u32(b, rmaxpack)) != 0 ||
1541 (r = sshbuf_put_cstring(b, listen_address)) != 0 ||
1542 (r = sshbuf_put_u32(b, listen_port)) != 0 ||
1543 (r = sshbuf_put_cstring(b, originator_address)) != 0 ||
1544 (r = sshbuf_put_u32(b, originator_port)) != 0 ||
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001545 (r = sshbuf_put_stringb(c->output, b)) != 0) {
markus@openbsd.org8d057842016-09-30 09:19:13 +00001546 error("%s: compose for muxclient %s", __func__,
1547 ssh_err(r));
1548 goto out;
1549 }
1550 }
1551
1552 out:
1553 sshbuf_free(b);
Darren Tuckera627d422013-06-02 07:31:17 +10001554 free(originator_address);
1555 free(listen_address);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001556 return c;
1557}
1558
Ben Lindstroma962c2f2002-07-04 00:14:17 +00001559static Channel *
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001560client_request_forwarded_streamlocal(struct ssh *ssh,
1561 const char *request_type, int rchan)
Damien Miller7acefbb2014-07-18 14:11:24 +10001562{
1563 Channel *c = NULL;
1564 char *listen_path;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001565 int r;
Damien Miller7acefbb2014-07-18 14:11:24 +10001566
1567 /* Get the remote path. */
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001568 if ((r = sshpkt_get_cstring(ssh, &listen_path, NULL)) != 0 ||
1569 (r = sshpkt_get_string(ssh, NULL, NULL)) != 0 || /* reserved */
1570 (r = sshpkt_get_end(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00001571 fatal("%s: parse packet: %s", __func__, ssh_err(r));
Damien Miller7acefbb2014-07-18 14:11:24 +10001572
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00001573 debug("%s: request: %s", __func__, listen_path);
Damien Miller7acefbb2014-07-18 14:11:24 +10001574
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001575 c = channel_connect_by_listen_path(ssh, listen_path,
Damien Miller7acefbb2014-07-18 14:11:24 +10001576 "forwarded-streamlocal@openssh.com", "forwarded-streamlocal");
1577 free(listen_path);
1578 return c;
1579}
1580
1581static Channel *
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001582client_request_x11(struct ssh *ssh, const char *request_type, int rchan)
Damien Miller0bc1bd82000-11-13 22:57:25 +11001583{
1584 Channel *c = NULL;
1585 char *originator;
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001586 u_int originator_port;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001587 int r, sock;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001588
1589 if (!options.forward_x11) {
1590 error("Warning: ssh server tried X11 forwarding.");
Darren Tucker4d5cd332008-06-13 04:51:14 +10001591 error("Warning: this is probably a break-in attempt by a "
1592 "malicious server.");
Damien Miller0bc1bd82000-11-13 22:57:25 +11001593 return NULL;
1594 }
djm@openbsd.org1bf477d2015-07-01 02:26:31 +00001595 if (x11_refuse_time != 0 && (u_int)monotime() >= x11_refuse_time) {
Damien Miller1ab6a512010-06-26 10:02:24 +10001596 verbose("Rejected X11 connection after ForwardX11Timeout "
1597 "expired");
1598 return NULL;
1599 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001600 if ((r = sshpkt_get_cstring(ssh, &originator, NULL)) != 0 ||
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001601 (r = sshpkt_get_u32(ssh, &originator_port)) != 0 ||
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001602 (r = sshpkt_get_end(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00001603 fatal("%s: parse packet: %s", __func__, ssh_err(r));
Damien Miller0bc1bd82000-11-13 22:57:25 +11001604 /* XXX check permission */
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001605 /* XXX range check originator port? */
1606 debug("client_request_x11: request from %s %u", originator,
Damien Millerd83ff352001-01-30 09:19:34 +11001607 originator_port);
Darren Tuckera627d422013-06-02 07:31:17 +10001608 free(originator);
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001609 sock = x11_connect_display(ssh);
Ben Lindstrom99c73b32001-05-05 04:09:47 +00001610 if (sock < 0)
1611 return NULL;
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001612 c = channel_new(ssh, "x11",
Ben Lindstrom99c73b32001-05-05 04:09:47 +00001613 SSH_CHANNEL_X11_OPEN, sock, sock, -1,
Damien Millerb1ca8bb2003-05-14 13:45:42 +10001614 CHAN_TCP_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 0, "x11", 1);
Ben Lindstrom944c4f02001-09-18 05:51:13 +00001615 c->force_drain = 1;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001616 return c;
1617}
1618
Ben Lindstroma962c2f2002-07-04 00:14:17 +00001619static Channel *
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001620client_request_agent(struct ssh *ssh, const char *request_type, int rchan)
Damien Miller0bc1bd82000-11-13 22:57:25 +11001621{
1622 Channel *c = NULL;
djm@openbsd.org141efe42015-01-14 20:05:27 +00001623 int r, sock;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001624
1625 if (!options.forward_agent) {
1626 error("Warning: ssh server tried agent forwarding.");
Darren Tucker4d5cd332008-06-13 04:51:14 +10001627 error("Warning: this is probably a break-in attempt by a "
1628 "malicious server.");
Damien Miller0bc1bd82000-11-13 22:57:25 +11001629 return NULL;
1630 }
djm@openbsd.org40be78f2019-12-21 02:19:13 +00001631 if (forward_agent_sock_path == NULL) {
1632 r = ssh_get_authentication_socket(&sock);
1633 } else {
1634 r = ssh_get_authentication_socket_path(forward_agent_sock_path, &sock);
1635 }
1636 if (r != 0) {
djm@openbsd.org141efe42015-01-14 20:05:27 +00001637 if (r != SSH_ERR_AGENT_NOT_PRESENT)
1638 debug("%s: ssh_get_authentication_socket: %s",
1639 __func__, ssh_err(r));
Ben Lindstrom99c73b32001-05-05 04:09:47 +00001640 return NULL;
djm@openbsd.org141efe42015-01-14 20:05:27 +00001641 }
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001642 c = channel_new(ssh, "authentication agent connection",
Ben Lindstrom99c73b32001-05-05 04:09:47 +00001643 SSH_CHANNEL_OPEN, sock, sock, -1,
Darren Tucker5baa1702007-12-29 09:37:10 +11001644 CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0,
Damien Millerb1ca8bb2003-05-14 13:45:42 +10001645 "authentication agent connection", 1);
Ben Lindstrom944c4f02001-09-18 05:51:13 +00001646 c->force_drain = 1;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001647 return c;
1648}
1649
djm@openbsd.orgb7548b12017-10-23 05:08:00 +00001650char *
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001651client_request_tun_fwd(struct ssh *ssh, int tun_mode,
1652 int local_tun, int remote_tun)
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001653{
1654 Channel *c;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001655 int r, fd;
djm@openbsd.orgb7548b12017-10-23 05:08:00 +00001656 char *ifname = NULL;
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001657
1658 if (tun_mode == SSH_TUNMODE_NO)
1659 return 0;
1660
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001661 debug("Requesting tun unit %d in mode %d", local_tun, tun_mode);
1662
1663 /* Open local tunnel device */
djm@openbsd.orgb7548b12017-10-23 05:08:00 +00001664 if ((fd = tun_open(local_tun, tun_mode, &ifname)) == -1) {
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001665 error("Tunnel device open failed.");
djm@openbsd.orgb7548b12017-10-23 05:08:00 +00001666 return NULL;
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001667 }
djm@openbsd.orgb7548b12017-10-23 05:08:00 +00001668 debug("Tunnel forwarding using interface %s", ifname);
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001669
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001670 c = channel_new(ssh, "tun", SSH_CHANNEL_OPENING, fd, fd, -1,
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001671 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
1672 c->datagram = 1;
1673
1674#if defined(SSH_TUN_FILTER)
1675 if (options.tun_open == SSH_TUNMODE_POINTOPOINT)
Damien Miller871f1e42017-09-12 18:01:35 +10001676 channel_register_filter(ssh, c->self, sys_tun_infilter,
Darren Tucker1cf65ae2008-06-13 05:09:18 +10001677 sys_tun_outfilter, NULL, NULL);
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001678#endif
1679
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001680 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_OPEN)) != 0 ||
1681 (r = sshpkt_put_cstring(ssh, "tun@openssh.com")) != 0 ||
1682 (r = sshpkt_put_u32(ssh, c->self)) != 0 ||
1683 (r = sshpkt_put_u32(ssh, c->local_window_max)) != 0 ||
1684 (r = sshpkt_put_u32(ssh, c->local_maxpacket)) != 0 ||
1685 (r = sshpkt_put_u32(ssh, tun_mode)) != 0 ||
1686 (r = sshpkt_put_u32(ssh, remote_tun)) != 0 ||
1687 (r = sshpkt_send(ssh)) != 0)
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001688 sshpkt_fatal(ssh, r, "%s: send reply", __func__);
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001689
djm@openbsd.orgb7548b12017-10-23 05:08:00 +00001690 return ifname;
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001691}
1692
Damien Millerbd483e72000-04-30 10:00:53 +10001693/* XXXX move to generic input handler */
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +00001694static int
markus@openbsd.org2ae666a2017-05-30 14:23:52 +00001695client_input_channel_open(int type, u_int32_t seq, struct ssh *ssh)
Damien Millerbd483e72000-04-30 10:00:53 +10001696{
1697 Channel *c = NULL;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001698 char *ctype = NULL;
1699 int r;
1700 u_int rchan;
1701 size_t len;
1702 u_int rmaxpack, rwindow;
Damien Millerbd483e72000-04-30 10:00:53 +10001703
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001704 if ((r = sshpkt_get_cstring(ssh, &ctype, &len)) != 0 ||
1705 (r = sshpkt_get_u32(ssh, &rchan)) != 0 ||
1706 (r = sshpkt_get_u32(ssh, &rwindow)) != 0 ||
1707 (r = sshpkt_get_u32(ssh, &rmaxpack)) != 0)
1708 goto out;
Damien Millerbd483e72000-04-30 10:00:53 +10001709
Damien Millere247cc42000-05-07 12:03:14 +10001710 debug("client_input_channel_open: ctype %s rchan %d win %d max %d",
Damien Millerbd483e72000-04-30 10:00:53 +10001711 ctype, rchan, rwindow, rmaxpack);
1712
Damien Miller0bc1bd82000-11-13 22:57:25 +11001713 if (strcmp(ctype, "forwarded-tcpip") == 0) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001714 c = client_request_forwarded_tcpip(ssh, ctype, rchan, rwindow,
markus@openbsd.org8d057842016-09-30 09:19:13 +00001715 rmaxpack);
Damien Miller7acefbb2014-07-18 14:11:24 +10001716 } else if (strcmp(ctype, "forwarded-streamlocal@openssh.com") == 0) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001717 c = client_request_forwarded_streamlocal(ssh, ctype, rchan);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001718 } else if (strcmp(ctype, "x11") == 0) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001719 c = client_request_x11(ssh, ctype, rchan);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001720 } else if (strcmp(ctype, "auth-agent@openssh.com") == 0) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001721 c = client_request_agent(ssh, ctype, rchan);
Damien Millerbd483e72000-04-30 10:00:53 +10001722 }
markus@openbsd.org8d057842016-09-30 09:19:13 +00001723 if (c != NULL && c->type == SSH_CHANNEL_MUX_CLIENT) {
1724 debug3("proxied to downstream: %s", ctype);
1725 } else if (c != NULL) {
Damien Millerbd483e72000-04-30 10:00:53 +10001726 debug("confirm %s", ctype);
1727 c->remote_id = rchan;
djm@openbsd.org9f532292017-09-12 06:35:31 +00001728 c->have_remote_id = 1;
Damien Millerbd483e72000-04-30 10:00:53 +10001729 c->remote_window = rwindow;
1730 c->remote_maxpacket = rmaxpack;
Ben Lindstroma69d89b2001-05-09 00:01:18 +00001731 if (c->type != SSH_CHANNEL_CONNECTING) {
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001732 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_OPEN_CONFIRMATION)) != 0 ||
1733 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 ||
1734 (r = sshpkt_put_u32(ssh, c->self)) != 0 ||
1735 (r = sshpkt_put_u32(ssh, c->local_window)) != 0 ||
1736 (r = sshpkt_put_u32(ssh, c->local_maxpacket)) != 0 ||
1737 (r = sshpkt_send(ssh)) != 0)
1738 sshpkt_fatal(ssh, r, "%s: send reply", __func__);
Ben Lindstroma69d89b2001-05-09 00:01:18 +00001739 }
Damien Millerbd483e72000-04-30 10:00:53 +10001740 } else {
1741 debug("failure %s", ctype);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001742 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_OPEN_FAILURE)) != 0 ||
1743 (r = sshpkt_put_u32(ssh, rchan)) != 0 ||
1744 (r = sshpkt_put_u32(ssh, SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED)) != 0 ||
1745 (r = sshpkt_put_cstring(ssh, "open failed")) != 0 ||
1746 (r = sshpkt_put_cstring(ssh, "")) != 0 ||
1747 (r = sshpkt_send(ssh)) != 0)
1748 sshpkt_fatal(ssh, r, "%s: send failure", __func__);
Damien Millerbd483e72000-04-30 10:00:53 +10001749 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001750 r = 0;
1751 out:
Darren Tuckera627d422013-06-02 07:31:17 +10001752 free(ctype);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001753 return r;
Damien Millerbd483e72000-04-30 10:00:53 +10001754}
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00001755
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +00001756static int
markus@openbsd.org2ae666a2017-05-30 14:23:52 +00001757client_input_channel_req(int type, u_int32_t seq, struct ssh *ssh)
Ben Lindstrom5b828322001-02-09 01:34:36 +00001758{
1759 Channel *c = NULL;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001760 char *rtype = NULL;
1761 u_char reply;
1762 u_int id, exitval;
1763 int r, success = 0;
Ben Lindstrom5b828322001-02-09 01:34:36 +00001764
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001765 if ((r = sshpkt_get_u32(ssh, &id)) != 0)
1766 return r;
1767 if (id <= INT_MAX)
1768 c = channel_lookup(ssh, id);
markus@openbsd.org2ae666a2017-05-30 14:23:52 +00001769 if (channel_proxy_upstream(c, type, seq, ssh))
markus@openbsd.org8d057842016-09-30 09:19:13 +00001770 return 0;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001771 if ((r = sshpkt_get_cstring(ssh, &rtype, NULL)) != 0 ||
1772 (r = sshpkt_get_u8(ssh, &reply)) != 0)
1773 goto out;
Ben Lindstrom5b828322001-02-09 01:34:36 +00001774
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001775 debug("client_input_channel_req: channel %u rtype %s reply %d",
Ben Lindstrom5b828322001-02-09 01:34:36 +00001776 id, rtype, reply);
1777
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001778 if (c == NULL) {
Darren Tucker4d5cd332008-06-13 04:51:14 +10001779 error("client_input_channel_req: channel %d: "
1780 "unknown channel", id);
Damien Millerbab9bd42008-05-19 16:06:47 +10001781 } else if (strcmp(rtype, "eow@openssh.com") == 0) {
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001782 if ((r = sshpkt_get_end(ssh)) != 0)
1783 goto out;
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001784 chan_rcvd_eow(ssh, c);
Ben Lindstrom5b828322001-02-09 01:34:36 +00001785 } else if (strcmp(rtype, "exit-status") == 0) {
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001786 if ((r = sshpkt_get_u32(ssh, &exitval)) != 0)
1787 goto out;
Damien Millere1537f92010-01-26 13:26:22 +11001788 if (c->ctl_chan != -1) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001789 mux_exit_message(ssh, c, exitval);
Damien Miller0e220db2004-06-15 10:34:08 +10001790 success = 1;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001791 } else if ((int)id == session_ident) {
Darren Tucker29440822010-01-08 17:08:35 +11001792 /* Record exit value of local session */
1793 success = 1;
1794 exit_status = exitval;
1795 } else {
Damien Miller36f57eb2010-01-30 17:28:34 +11001796 /* Probably for a mux channel that has already closed */
1797 debug("%s: no sink for exit-status on channel %d",
1798 __func__, id);
Damien Miller0e220db2004-06-15 10:34:08 +10001799 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001800 if ((r = sshpkt_get_end(ssh)) != 0)
1801 goto out;
Ben Lindstrom5b828322001-02-09 01:34:36 +00001802 }
Damien Millerc5893782014-05-15 13:48:49 +10001803 if (reply && c != NULL && !(c->flags & CHAN_CLOSE_SENT)) {
djm@openbsd.org9f532292017-09-12 06:35:31 +00001804 if (!c->have_remote_id)
1805 fatal("%s: channel %d: no remote_id",
1806 __func__, c->self);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001807 if ((r = sshpkt_start(ssh, success ?
1808 SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE)) != 0 ||
1809 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 ||
1810 (r = sshpkt_send(ssh)) != 0)
1811 sshpkt_fatal(ssh, r, "%s: send failure", __func__);
Ben Lindstrom5b828322001-02-09 01:34:36 +00001812 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001813 r = 0;
1814 out:
Darren Tuckera627d422013-06-02 07:31:17 +10001815 free(rtype);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001816 return r;
Ben Lindstrom5b828322001-02-09 01:34:36 +00001817}
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00001818
djm@openbsd.org523463a2015-02-16 22:13:32 +00001819struct hostkeys_update_ctx {
1820 /* The hostname and (optionally) IP address string for the server */
1821 char *host_str, *ip_str;
1822
1823 /*
1824 * Keys received from the server and a flag for each indicating
1825 * whether they already exist in known_hosts.
1826 * keys_seen is filled in by hostkeys_find() and later (for new
1827 * keys) by client_global_hostkeys_private_confirm().
1828 */
1829 struct sshkey **keys;
1830 int *keys_seen;
djm@openbsd.org84623e02018-06-26 02:02:36 +00001831 size_t nkeys, nnew;
djm@openbsd.org523463a2015-02-16 22:13:32 +00001832
1833 /*
1834 * Keys that are in known_hosts, but were not present in the update
1835 * from the server (i.e. scheduled to be deleted).
1836 * Filled in by hostkeys_find().
1837 */
1838 struct sshkey **old_keys;
1839 size_t nold;
1840};
1841
1842static void
1843hostkeys_update_ctx_free(struct hostkeys_update_ctx *ctx)
1844{
1845 size_t i;
1846
1847 if (ctx == NULL)
1848 return;
1849 for (i = 0; i < ctx->nkeys; i++)
1850 sshkey_free(ctx->keys[i]);
1851 free(ctx->keys);
1852 free(ctx->keys_seen);
1853 for (i = 0; i < ctx->nold; i++)
1854 sshkey_free(ctx->old_keys[i]);
1855 free(ctx->old_keys);
1856 free(ctx->host_str);
1857 free(ctx->ip_str);
1858 free(ctx);
1859}
1860
1861static int
1862hostkeys_find(struct hostkey_foreach_line *l, void *_ctx)
1863{
1864 struct hostkeys_update_ctx *ctx = (struct hostkeys_update_ctx *)_ctx;
1865 size_t i;
1866 struct sshkey **tmp;
1867
djm@openbsd.org873d3e72017-04-30 23:18:44 +00001868 if (l->status != HKF_STATUS_MATCHED || l->key == NULL)
djm@openbsd.org523463a2015-02-16 22:13:32 +00001869 return 0;
1870
1871 /* Mark off keys we've already seen for this host */
1872 for (i = 0; i < ctx->nkeys; i++) {
1873 if (sshkey_equal(l->key, ctx->keys[i])) {
1874 debug3("%s: found %s key at %s:%ld", __func__,
1875 sshkey_ssh_name(ctx->keys[i]), l->path, l->linenum);
1876 ctx->keys_seen[i] = 1;
1877 return 0;
1878 }
1879 }
1880 /* This line contained a key that not offered by the server */
1881 debug3("%s: deprecated %s key at %s:%ld", __func__,
1882 sshkey_ssh_name(l->key), l->path, l->linenum);
deraadt@openbsd.org9e509d42017-05-31 09:15:42 +00001883 if ((tmp = recallocarray(ctx->old_keys, ctx->nold, ctx->nold + 1,
djm@openbsd.org523463a2015-02-16 22:13:32 +00001884 sizeof(*ctx->old_keys))) == NULL)
deraadt@openbsd.org9e509d42017-05-31 09:15:42 +00001885 fatal("%s: recallocarray failed nold = %zu",
djm@openbsd.org523463a2015-02-16 22:13:32 +00001886 __func__, ctx->nold);
1887 ctx->old_keys = tmp;
1888 ctx->old_keys[ctx->nold++] = l->key;
1889 l->key = NULL;
1890
1891 return 0;
1892}
1893
1894static void
djm@openbsd.org14ef4ef2020-01-29 08:17:49 +00001895hostkey_change_preamble(LogLevel loglevel)
djm@openbsd.org523463a2015-02-16 22:13:32 +00001896{
djm@openbsd.org101ebc32020-01-29 07:51:30 +00001897 do_log2(loglevel, "The server has updated its host keys.");
1898 do_log2(loglevel, "These changes were verified by the server's "
1899 "existing trusted key.");
1900}
1901
1902static void
1903update_known_hosts(struct hostkeys_update_ctx *ctx)
1904{
1905 int r, was_raw = 0, first = 1;
1906 int asking = options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK;
1907 LogLevel loglevel = asking ? SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_VERBOSE;
djm@openbsd.org523463a2015-02-16 22:13:32 +00001908 char *fp, *response;
1909 size_t i;
djm@openbsd.org79556332020-01-25 00:21:08 +00001910 struct stat sb;
djm@openbsd.org523463a2015-02-16 22:13:32 +00001911
1912 for (i = 0; i < ctx->nkeys; i++) {
1913 if (ctx->keys_seen[i] != 2)
1914 continue;
1915 if ((fp = sshkey_fingerprint(ctx->keys[i],
1916 options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
1917 fatal("%s: sshkey_fingerprint failed", __func__);
djm@openbsd.org101ebc32020-01-29 07:51:30 +00001918 if (first && asking)
djm@openbsd.org14ef4ef2020-01-29 08:17:49 +00001919 hostkey_change_preamble(loglevel);
djm@openbsd.org523463a2015-02-16 22:13:32 +00001920 do_log2(loglevel, "Learned new hostkey: %s %s",
1921 sshkey_type(ctx->keys[i]), fp);
djm@openbsd.org101ebc32020-01-29 07:51:30 +00001922 first = 0;
djm@openbsd.org523463a2015-02-16 22:13:32 +00001923 free(fp);
1924 }
1925 for (i = 0; i < ctx->nold; i++) {
1926 if ((fp = sshkey_fingerprint(ctx->old_keys[i],
1927 options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
1928 fatal("%s: sshkey_fingerprint failed", __func__);
djm@openbsd.org101ebc32020-01-29 07:51:30 +00001929 if (first && asking)
djm@openbsd.org14ef4ef2020-01-29 08:17:49 +00001930 hostkey_change_preamble(loglevel);
djm@openbsd.org523463a2015-02-16 22:13:32 +00001931 do_log2(loglevel, "Deprecating obsolete hostkey: %s %s",
1932 sshkey_type(ctx->old_keys[i]), fp);
djm@openbsd.org101ebc32020-01-29 07:51:30 +00001933 first = 0;
djm@openbsd.org523463a2015-02-16 22:13:32 +00001934 free(fp);
1935 }
1936 if (options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK) {
djm@openbsd.orgf2293a62015-02-23 16:33:25 +00001937 if (get_saved_tio() != NULL) {
1938 leave_raw_mode(1);
1939 was_raw = 1;
1940 }
djm@openbsd.org523463a2015-02-16 22:13:32 +00001941 response = NULL;
1942 for (i = 0; !quit_pending && i < 3; i++) {
1943 free(response);
1944 response = read_passphrase("Accept updated hostkeys? "
1945 "(yes/no): ", RP_ECHO);
1946 if (strcasecmp(response, "yes") == 0)
1947 break;
1948 else if (quit_pending || response == NULL ||
1949 strcasecmp(response, "no") == 0) {
1950 options.update_hostkeys = 0;
1951 break;
1952 } else {
1953 do_log2(loglevel, "Please enter "
1954 "\"yes\" or \"no\"");
1955 }
1956 }
1957 if (quit_pending || i >= 3 || response == NULL)
1958 options.update_hostkeys = 0;
1959 free(response);
djm@openbsd.orgf2293a62015-02-23 16:33:25 +00001960 if (was_raw)
1961 enter_raw_mode(1);
djm@openbsd.org523463a2015-02-16 22:13:32 +00001962 }
djm@openbsd.org79556332020-01-25 00:21:08 +00001963 if (options.update_hostkeys == 0)
1964 return;
djm@openbsd.org523463a2015-02-16 22:13:32 +00001965 /*
1966 * Now that all the keys are verified, we can go ahead and replace
1967 * them in known_hosts (assuming SSH_UPDATE_HOSTKEYS_ASK didn't
1968 * cancel the operation).
1969 */
djm@openbsd.org79556332020-01-25 00:21:08 +00001970 for (i = 0; i < options.num_user_hostfiles; i++) {
1971 /*
1972 * NB. keys are only added to hostfiles[0], for the rest we
1973 * just delete the hostname entries.
1974 */
1975 if (stat(options.user_hostfiles[i], &sb) != 0) {
1976 if (errno == ENOENT) {
1977 debug("%s: known hosts file %s does not exist",
1978 __func__, strerror(errno));
1979 } else {
1980 error("%s: known hosts file %s inaccessible",
1981 __func__, strerror(errno));
1982 }
1983 continue;
1984 }
1985 if ((r = hostfile_replace_entries(options.user_hostfiles[i],
1986 ctx->host_str, ctx->ip_str,
1987 i == 0 ? ctx->keys : NULL, i == 0 ? ctx->nkeys : 0,
1988 options.hash_known_hosts, 0,
1989 options.fingerprint_hash)) != 0) {
1990 error("%s: hostfile_replace_entries failed for %s: %s",
1991 __func__, options.user_hostfiles[i], ssh_err(r));
1992 }
1993 }
djm@openbsd.org523463a2015-02-16 22:13:32 +00001994}
1995
1996static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001997client_global_hostkeys_private_confirm(struct ssh *ssh, int type,
1998 u_int32_t seq, void *_ctx)
djm@openbsd.org523463a2015-02-16 22:13:32 +00001999{
djm@openbsd.org523463a2015-02-16 22:13:32 +00002000 struct hostkeys_update_ctx *ctx = (struct hostkeys_update_ctx *)_ctx;
2001 size_t i, ndone;
2002 struct sshbuf *signdata;
djm@openbsd.org78607312017-12-18 23:16:23 +00002003 int r, kexsigtype, use_kexsigtype;
djm@openbsd.org523463a2015-02-16 22:13:32 +00002004 const u_char *sig;
2005 size_t siglen;
2006
2007 if (ctx->nnew == 0)
2008 fatal("%s: ctx->nnew == 0", __func__); /* sanity */
2009 if (type != SSH2_MSG_REQUEST_SUCCESS) {
2010 error("Server failed to confirm ownership of "
2011 "private host keys");
2012 hostkeys_update_ctx_free(ctx);
2013 return;
2014 }
djm@openbsd.org78607312017-12-18 23:16:23 +00002015 kexsigtype = sshkey_type_plain(
2016 sshkey_type_from_name(ssh->kex->hostkey_alg));
2017
djm@openbsd.org523463a2015-02-16 22:13:32 +00002018 if ((signdata = sshbuf_new()) == NULL)
2019 fatal("%s: sshbuf_new failed", __func__);
2020 /* Don't want to accidentally accept an unbound signature */
2021 if (ssh->kex->session_id_len == 0)
2022 fatal("%s: ssh->kex->session_id_len == 0", __func__);
2023 /*
2024 * Expect a signature for each of the ctx->nnew private keys we
2025 * haven't seen before. They will be in the same order as the
2026 * ctx->keys where the corresponding ctx->keys_seen[i] == 0.
2027 */
2028 for (ndone = i = 0; i < ctx->nkeys; i++) {
2029 if (ctx->keys_seen[i])
2030 continue;
2031 /* Prepare data to be signed: session ID, unique string, key */
2032 sshbuf_reset(signdata);
djm@openbsd.org44732de2015-02-20 22:17:21 +00002033 if ( (r = sshbuf_put_cstring(signdata,
2034 "hostkeys-prove-00@openssh.com")) != 0 ||
2035 (r = sshbuf_put_string(signdata, ssh->kex->session_id,
djm@openbsd.org523463a2015-02-16 22:13:32 +00002036 ssh->kex->session_id_len)) != 0 ||
djm@openbsd.org523463a2015-02-16 22:13:32 +00002037 (r = sshkey_puts(ctx->keys[i], signdata)) != 0)
2038 fatal("%s: failed to prepare signature: %s",
2039 __func__, ssh_err(r));
2040 /* Extract and verify signature */
2041 if ((r = sshpkt_get_string_direct(ssh, &sig, &siglen)) != 0) {
2042 error("%s: couldn't parse message: %s",
2043 __func__, ssh_err(r));
2044 goto out;
2045 }
djm@openbsd.org78607312017-12-18 23:16:23 +00002046 /*
2047 * For RSA keys, prefer to use the signature type negotiated
2048 * during KEX to the default (SHA1).
2049 */
2050 use_kexsigtype = kexsigtype == KEY_RSA &&
2051 sshkey_type_plain(ctx->keys[i]->type) == KEY_RSA;
djm@openbsd.org523463a2015-02-16 22:13:32 +00002052 if ((r = sshkey_verify(ctx->keys[i], sig, siglen,
djm@openbsd.org04c7e282017-12-18 02:25:15 +00002053 sshbuf_ptr(signdata), sshbuf_len(signdata),
djm@openbsd.orgb7e74ea2019-11-25 00:51:37 +00002054 use_kexsigtype ? ssh->kex->hostkey_alg : NULL, 0,
2055 NULL)) != 0) {
djm@openbsd.org523463a2015-02-16 22:13:32 +00002056 error("%s: server gave bad signature for %s key %zu",
2057 __func__, sshkey_type(ctx->keys[i]), i);
2058 goto out;
2059 }
2060 /* Key is good. Mark it as 'seen' */
2061 ctx->keys_seen[i] = 2;
2062 ndone++;
2063 }
2064 if (ndone != ctx->nnew)
2065 fatal("%s: ndone != ctx->nnew (%zu / %zu)", __func__,
2066 ndone, ctx->nnew); /* Shouldn't happen */
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002067 if ((r = sshpkt_get_end(ssh)) != 0) {
2068 error("%s: protocol error", __func__);
2069 goto out;
2070 }
djm@openbsd.org523463a2015-02-16 22:13:32 +00002071
2072 /* Make the edits to known_hosts */
2073 update_known_hosts(ctx);
2074 out:
2075 hostkeys_update_ctx_free(ctx);
2076}
2077
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002078/*
djm@openbsd.org894221a2017-03-10 05:01:13 +00002079 * Returns non-zero if the key is accepted by HostkeyAlgorithms.
2080 * Made slightly less trivial by the multiple RSA signature algorithm names.
2081 */
2082static int
2083key_accepted_by_hostkeyalgs(const struct sshkey *key)
2084{
2085 const char *ktype = sshkey_ssh_name(key);
dtucker@openbsd.orgc4b3a122020-01-23 02:46:49 +00002086 const char *hostkeyalgs = options.hostkeyalgorithms;
djm@openbsd.org894221a2017-03-10 05:01:13 +00002087
2088 if (key == NULL || key->type == KEY_UNSPEC)
2089 return 0;
2090 if (key->type == KEY_RSA &&
2091 (match_pattern_list("rsa-sha2-256", hostkeyalgs, 0) == 1 ||
2092 match_pattern_list("rsa-sha2-512", hostkeyalgs, 0) == 1))
2093 return 1;
2094 return match_pattern_list(ktype, hostkeyalgs, 0) == 1;
2095}
2096
2097/*
djm@openbsd.org44732de2015-02-20 22:17:21 +00002098 * Handle hostkeys-00@openssh.com global request to inform the client of all
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002099 * the server's hostkeys. The keys are checked against the user's
2100 * HostkeyAlgorithms preference before they are accepted.
2101 */
2102static int
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002103client_input_hostkeys(struct ssh *ssh)
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002104{
2105 const u_char *blob = NULL;
djm@openbsd.org523463a2015-02-16 22:13:32 +00002106 size_t i, len = 0;
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002107 struct sshbuf *buf = NULL;
djm@openbsd.org523463a2015-02-16 22:13:32 +00002108 struct sshkey *key = NULL, **tmp;
2109 int r;
2110 char *fp;
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002111 static int hostkeys_seen = 0; /* XXX use struct ssh */
djm@openbsd.org6c5c9492015-02-16 22:08:57 +00002112 extern struct sockaddr_storage hostaddr; /* XXX from ssh.c */
djm@openbsd.orga63cfa22015-02-25 19:54:02 +00002113 struct hostkeys_update_ctx *ctx = NULL;
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002114
2115 if (hostkeys_seen)
2116 fatal("%s: server already sent hostkeys", __func__);
djm@openbsd.org523463a2015-02-16 22:13:32 +00002117 if (options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK &&
2118 options.batch_mode)
2119 return 1; /* won't ask in batchmode, so don't even try */
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002120 if (!options.update_hostkeys || options.num_user_hostfiles <= 0)
2121 return 1;
djm@openbsd.orga63cfa22015-02-25 19:54:02 +00002122
2123 ctx = xcalloc(1, sizeof(*ctx));
djm@openbsd.org523463a2015-02-16 22:13:32 +00002124 while (ssh_packet_remaining(ssh) > 0) {
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002125 sshkey_free(key);
2126 key = NULL;
djm@openbsd.org523463a2015-02-16 22:13:32 +00002127 if ((r = sshpkt_get_string_direct(ssh, &blob, &len)) != 0) {
2128 error("%s: couldn't parse message: %s",
2129 __func__, ssh_err(r));
2130 goto out;
2131 }
djm@openbsd.org44732de2015-02-20 22:17:21 +00002132 if ((r = sshkey_from_blob(blob, len, &key)) != 0) {
djm@openbsd.org74dfc2c2020-01-26 00:14:45 +00002133 do_log2(r == SSH_ERR_KEY_TYPE_UNKNOWN ?
2134 SYSLOG_LEVEL_DEBUG1 : SYSLOG_LEVEL_ERROR,
2135 "%s: parse key: %s", __func__, ssh_err(r));
2136 continue;
djm@openbsd.org44732de2015-02-20 22:17:21 +00002137 }
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002138 fp = sshkey_fingerprint(key, options.fingerprint_hash,
2139 SSH_FP_DEFAULT);
2140 debug3("%s: received %s key %s", __func__,
2141 sshkey_type(key), fp);
2142 free(fp);
markus@openbsd.org3a1638d2015-07-10 06:21:53 +00002143
djm@openbsd.org894221a2017-03-10 05:01:13 +00002144 if (!key_accepted_by_hostkeyalgs(key)) {
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002145 debug3("%s: %s key not permitted by HostkeyAlgorithms",
2146 __func__, sshkey_ssh_name(key));
2147 continue;
2148 }
djm@openbsd.org523463a2015-02-16 22:13:32 +00002149 /* Skip certs */
2150 if (sshkey_is_cert(key)) {
2151 debug3("%s: %s key is a certificate; skipping",
2152 __func__, sshkey_ssh_name(key));
2153 continue;
2154 }
2155 /* Ensure keys are unique */
2156 for (i = 0; i < ctx->nkeys; i++) {
2157 if (sshkey_equal(key, ctx->keys[i])) {
2158 error("%s: received duplicated %s host key",
2159 __func__, sshkey_ssh_name(key));
2160 goto out;
2161 }
2162 }
2163 /* Key is good, record it */
deraadt@openbsd.org9e509d42017-05-31 09:15:42 +00002164 if ((tmp = recallocarray(ctx->keys, ctx->nkeys, ctx->nkeys + 1,
djm@openbsd.org523463a2015-02-16 22:13:32 +00002165 sizeof(*ctx->keys))) == NULL)
deraadt@openbsd.org9e509d42017-05-31 09:15:42 +00002166 fatal("%s: recallocarray failed nkeys = %zu",
djm@openbsd.org523463a2015-02-16 22:13:32 +00002167 __func__, ctx->nkeys);
2168 ctx->keys = tmp;
2169 ctx->keys[ctx->nkeys++] = key;
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002170 key = NULL;
2171 }
2172
djm@openbsd.org523463a2015-02-16 22:13:32 +00002173 if (ctx->nkeys == 0) {
djm@openbsd.org44732de2015-02-20 22:17:21 +00002174 debug("%s: server sent no hostkeys", __func__);
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002175 goto out;
2176 }
djm@openbsd.org44732de2015-02-20 22:17:21 +00002177
djm@openbsd.org523463a2015-02-16 22:13:32 +00002178 if ((ctx->keys_seen = calloc(ctx->nkeys,
2179 sizeof(*ctx->keys_seen))) == NULL)
2180 fatal("%s: calloc failed", __func__);
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002181
djm@openbsd.org6c5c9492015-02-16 22:08:57 +00002182 get_hostfile_hostname_ipaddr(host,
2183 options.check_host_ip ? (struct sockaddr *)&hostaddr : NULL,
djm@openbsd.org523463a2015-02-16 22:13:32 +00002184 options.port, &ctx->host_str,
2185 options.check_host_ip ? &ctx->ip_str : NULL);
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002186
djm@openbsd.org523463a2015-02-16 22:13:32 +00002187 /* Find which keys we already know about. */
djm@openbsd.org79556332020-01-25 00:21:08 +00002188 for (i = 0; i < options.num_user_hostfiles; i++) {
2189 debug("%s: searching %s for %s / %s", __func__,
2190 options.user_hostfiles[i], ctx->host_str, ctx->ip_str);
2191 if ((r = hostkeys_foreach(options.user_hostfiles[i],
2192 hostkeys_find, ctx, ctx->host_str, ctx->ip_str,
2193 HKF_WANT_PARSE_KEY|HKF_WANT_MATCH)) != 0) {
2194 if (r == SSH_ERR_SYSTEM_ERROR && errno == ENOENT) {
djm@openbsd.orgb5961822020-01-26 00:13:20 +00002195 debug("%s: hostkeys file %s does not exist",
djm@openbsd.org79556332020-01-25 00:21:08 +00002196 __func__, options.user_hostfiles[i]);
2197 continue;
2198 }
2199 error("%s: hostkeys_foreach failed for %s: %s",
2200 __func__, options.user_hostfiles[i], ssh_err(r));
2201 goto out;
2202 }
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002203 }
2204
djm@openbsd.org523463a2015-02-16 22:13:32 +00002205 /* Figure out if we have any new keys to add */
2206 ctx->nnew = 0;
2207 for (i = 0; i < ctx->nkeys; i++) {
2208 if (!ctx->keys_seen[i])
2209 ctx->nnew++;
2210 }
2211
2212 debug3("%s: %zu keys from server: %zu new, %zu retained. %zu to remove",
2213 __func__, ctx->nkeys, ctx->nnew, ctx->nkeys - ctx->nnew, ctx->nold);
2214
2215 if (ctx->nnew == 0 && ctx->nold != 0) {
2216 /* We have some keys to remove. Just do it. */
2217 update_known_hosts(ctx);
2218 } else if (ctx->nnew != 0) {
2219 /*
2220 * We have received hitherto-unseen keys from the server.
2221 * Ask the server to confirm ownership of the private halves.
2222 */
2223 debug3("%s: asking server to prove ownership for %zu keys",
2224 __func__, ctx->nnew);
2225 if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 ||
2226 (r = sshpkt_put_cstring(ssh,
djm@openbsd.org44732de2015-02-20 22:17:21 +00002227 "hostkeys-prove-00@openssh.com")) != 0 ||
djm@openbsd.org523463a2015-02-16 22:13:32 +00002228 (r = sshpkt_put_u8(ssh, 1)) != 0) /* bool: want reply */
2229 fatal("%s: cannot prepare packet: %s",
2230 __func__, ssh_err(r));
2231 if ((buf = sshbuf_new()) == NULL)
2232 fatal("%s: sshbuf_new", __func__);
2233 for (i = 0; i < ctx->nkeys; i++) {
2234 if (ctx->keys_seen[i])
2235 continue;
2236 sshbuf_reset(buf);
2237 if ((r = sshkey_putb(ctx->keys[i], buf)) != 0)
2238 fatal("%s: sshkey_putb: %s",
2239 __func__, ssh_err(r));
2240 if ((r = sshpkt_put_stringb(ssh, buf)) != 0)
2241 fatal("%s: sshpkt_put_string: %s",
2242 __func__, ssh_err(r));
2243 }
2244 if ((r = sshpkt_send(ssh)) != 0)
2245 fatal("%s: sshpkt_send: %s", __func__, ssh_err(r));
2246 client_register_global_confirm(
2247 client_global_hostkeys_private_confirm, ctx);
2248 ctx = NULL; /* will be freed in callback */
2249 }
2250
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002251 /* Success */
2252 out:
djm@openbsd.org523463a2015-02-16 22:13:32 +00002253 hostkeys_update_ctx_free(ctx);
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002254 sshkey_free(key);
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002255 sshbuf_free(buf);
djm@openbsd.org523463a2015-02-16 22:13:32 +00002256 /*
2257 * NB. Return success for all cases. The server doesn't need to know
2258 * what the client does with its hosts file.
2259 */
2260 return 1;
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002261}
2262
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +00002263static int
markus@openbsd.org2ae666a2017-05-30 14:23:52 +00002264client_input_global_request(int type, u_int32_t seq, struct ssh *ssh)
Damien Millerc3fa4072002-01-22 23:21:58 +11002265{
2266 char *rtype;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002267 u_char want_reply;
2268 int r, success = 0;
Damien Millerc3fa4072002-01-22 23:21:58 +11002269
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002270 if ((r = sshpkt_get_cstring(ssh, &rtype, NULL)) != 0 ||
2271 (r = sshpkt_get_u8(ssh, &want_reply)) != 0)
2272 goto out;
Damien Miller509b0102003-12-17 16:33:10 +11002273 debug("client_input_global_request: rtype %s want_reply %d",
2274 rtype, want_reply);
djm@openbsd.org44732de2015-02-20 22:17:21 +00002275 if (strcmp(rtype, "hostkeys-00@openssh.com") == 0)
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002276 success = client_input_hostkeys(ssh);
Damien Millerc3fa4072002-01-22 23:21:58 +11002277 if (want_reply) {
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002278 if ((r = sshpkt_start(ssh, success ? SSH2_MSG_REQUEST_SUCCESS :
2279 SSH2_MSG_REQUEST_FAILURE)) != 0 ||
2280 (r = sshpkt_send(ssh)) != 0 ||
2281 (r = ssh_packet_write_wait(ssh)) != 0)
2282 goto out;
Damien Millerc3fa4072002-01-22 23:21:58 +11002283 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002284 r = 0;
2285 out:
Darren Tuckera627d422013-06-02 07:31:17 +10002286 free(rtype);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002287 return r;
Damien Millerc3fa4072002-01-22 23:21:58 +11002288}
Damien Millerbd483e72000-04-30 10:00:53 +10002289
Damien Miller0e220db2004-06-15 10:34:08 +10002290void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002291client_session2_setup(struct ssh *ssh, int id, int want_tty, int want_subsystem,
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00002292 const char *term, struct termios *tiop, int in_fd, struct sshbuf *cmd,
2293 char **env)
Damien Miller0e220db2004-06-15 10:34:08 +10002294{
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002295 int i, j, matched, len, r;
djm@openbsd.org7082bb52018-06-09 03:01:12 +00002296 char *name, *val;
Darren Tucker5d78de62004-11-05 20:35:44 +11002297 Channel *c = NULL;
Damien Miller0e220db2004-06-15 10:34:08 +10002298
2299 debug2("%s: id %d", __func__, id);
2300
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002301 if ((c = channel_lookup(ssh, id)) == NULL)
2302 fatal("%s: channel %d: unknown channel", __func__, id);
Darren Tucker5d78de62004-11-05 20:35:44 +11002303
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002304 ssh_packet_set_interactive(ssh, want_tty,
Damien Miller0dac6fb2010-11-20 15:19:38 +11002305 options.ip_qos_interactive, options.ip_qos_bulk);
2306
Damien Miller0e220db2004-06-15 10:34:08 +10002307 if (want_tty) {
2308 struct winsize ws;
Damien Miller0e220db2004-06-15 10:34:08 +10002309
2310 /* Store window size in the packet. */
deraadt@openbsd.org4d28fa72019-06-28 13:35:04 +00002311 if (ioctl(in_fd, TIOCGWINSZ, &ws) == -1)
Damien Miller0e220db2004-06-15 10:34:08 +10002312 memset(&ws, 0, sizeof(ws));
2313
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002314 channel_request_start(ssh, id, "pty-req", 1);
2315 client_expect_confirm(ssh, id, "PTY allocation", CONFIRM_TTY);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002316 if ((r = sshpkt_put_cstring(ssh, term != NULL ? term : ""))
2317 != 0 ||
2318 (r = sshpkt_put_u32(ssh, (u_int)ws.ws_col)) != 0 ||
2319 (r = sshpkt_put_u32(ssh, (u_int)ws.ws_row)) != 0 ||
2320 (r = sshpkt_put_u32(ssh, (u_int)ws.ws_xpixel)) != 0 ||
2321 (r = sshpkt_put_u32(ssh, (u_int)ws.ws_ypixel)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00002322 fatal("%s: build packet: %s", __func__, ssh_err(r));
Darren Tuckerdf189fb2008-06-08 12:55:32 +10002323 if (tiop == NULL)
2324 tiop = get_saved_tio();
markus@openbsd.org89dd6152018-07-09 21:20:26 +00002325 ssh_tty_make_modes(ssh, -1, tiop);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002326 if ((r = sshpkt_send(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00002327 fatal("%s: send packet: %s", __func__, ssh_err(r));
Damien Miller0e220db2004-06-15 10:34:08 +10002328 /* XXX wait for reply */
Darren Tucker5d78de62004-11-05 20:35:44 +11002329 c->client_tty = 1;
Damien Miller0e220db2004-06-15 10:34:08 +10002330 }
2331
2332 /* Transfer any environment variables from client to server */
Damien Miller3756dce2004-06-18 01:17:29 +10002333 if (options.num_send_env != 0 && env != NULL) {
Damien Miller0e220db2004-06-15 10:34:08 +10002334 debug("Sending environment.");
Damien Miller3756dce2004-06-18 01:17:29 +10002335 for (i = 0; env[i] != NULL; i++) {
Damien Miller0e220db2004-06-15 10:34:08 +10002336 /* Split */
Damien Miller3756dce2004-06-18 01:17:29 +10002337 name = xstrdup(env[i]);
Damien Miller0e220db2004-06-15 10:34:08 +10002338 if ((val = strchr(name, '=')) == NULL) {
Darren Tuckera627d422013-06-02 07:31:17 +10002339 free(name);
Damien Miller0e220db2004-06-15 10:34:08 +10002340 continue;
2341 }
2342 *val++ = '\0';
2343
2344 matched = 0;
2345 for (j = 0; j < options.num_send_env; j++) {
2346 if (match_pattern(name, options.send_env[j])) {
2347 matched = 1;
2348 break;
2349 }
2350 }
2351 if (!matched) {
2352 debug3("Ignored env %s", name);
Darren Tuckera627d422013-06-02 07:31:17 +10002353 free(name);
Damien Miller0e220db2004-06-15 10:34:08 +10002354 continue;
2355 }
2356
2357 debug("Sending env %s = %s", name, val);
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002358 channel_request_start(ssh, id, "env", 0);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002359 if ((r = sshpkt_put_cstring(ssh, name)) != 0 ||
2360 (r = sshpkt_put_cstring(ssh, val)) != 0 ||
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00002361 (r = sshpkt_send(ssh)) != 0) {
2362 fatal("%s: send packet: %s",
2363 __func__, ssh_err(r));
2364 }
Darren Tuckera627d422013-06-02 07:31:17 +10002365 free(name);
Damien Miller0e220db2004-06-15 10:34:08 +10002366 }
2367 }
djm@openbsd.org7082bb52018-06-09 03:01:12 +00002368 for (i = 0; i < options.num_setenv; i++) {
2369 /* Split */
2370 name = xstrdup(options.setenv[i]);
2371 if ((val = strchr(name, '=')) == NULL) {
2372 free(name);
2373 continue;
2374 }
2375 *val++ = '\0';
2376
2377 debug("Setting env %s = %s", name, val);
2378 channel_request_start(ssh, id, "env", 0);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002379 if ((r = sshpkt_put_cstring(ssh, name)) != 0 ||
2380 (r = sshpkt_put_cstring(ssh, val)) != 0 ||
2381 (r = sshpkt_send(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00002382 fatal("%s: send packet: %s", __func__, ssh_err(r));
djm@openbsd.org7082bb52018-06-09 03:01:12 +00002383 free(name);
2384 }
Damien Miller0e220db2004-06-15 10:34:08 +10002385
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00002386 len = sshbuf_len(cmd);
Damien Miller0e220db2004-06-15 10:34:08 +10002387 if (len > 0) {
2388 if (len > 900)
2389 len = 900;
2390 if (want_subsystem) {
Damien Miller5771ed72008-05-19 15:35:33 +10002391 debug("Sending subsystem: %.*s",
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00002392 len, (const u_char*)sshbuf_ptr(cmd));
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002393 channel_request_start(ssh, id, "subsystem", 1);
2394 client_expect_confirm(ssh, id, "subsystem",
2395 CONFIRM_CLOSE);
Damien Miller0e220db2004-06-15 10:34:08 +10002396 } else {
Damien Miller5771ed72008-05-19 15:35:33 +10002397 debug("Sending command: %.*s",
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00002398 len, (const u_char*)sshbuf_ptr(cmd));
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002399 channel_request_start(ssh, id, "exec", 1);
2400 client_expect_confirm(ssh, id, "exec", CONFIRM_CLOSE);
Damien Miller0e220db2004-06-15 10:34:08 +10002401 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002402 if ((r = sshpkt_put_stringb(ssh, cmd)) != 0 ||
2403 (r = sshpkt_send(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00002404 fatal("%s: send command: %s", __func__, ssh_err(r));
Damien Miller0e220db2004-06-15 10:34:08 +10002405 } else {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002406 channel_request_start(ssh, id, "shell", 1);
2407 client_expect_confirm(ssh, id, "shell", CONFIRM_CLOSE);
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00002408 if ((r = sshpkt_send(ssh)) != 0) {
2409 fatal("%s: send shell request: %s",
2410 __func__, ssh_err(r));
2411 }
Damien Miller0e220db2004-06-15 10:34:08 +10002412 }
2413}
2414
Ben Lindstrombba81212001-06-25 05:01:22 +00002415static void
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002416client_init_dispatch(struct ssh *ssh)
Damien Miller1383bd82000-04-06 12:32:37 +10002417{
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002418 ssh_dispatch_init(ssh, &dispatch_protocol_error);
Damien Miller2797f7f2002-04-23 21:09:44 +10002419
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002420 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_CLOSE, &channel_input_oclose);
2421 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_DATA, &channel_input_data);
2422 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_EOF, &channel_input_ieof);
2423 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_EXTENDED_DATA, &channel_input_extended_data);
2424 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_OPEN, &client_input_channel_open);
2425 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation);
2426 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure);
2427 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_REQUEST, &client_input_channel_req);
2428 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust);
2429 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_SUCCESS, &channel_input_status_confirm);
2430 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_FAILURE, &channel_input_status_confirm);
2431 ssh_dispatch_set(ssh, SSH2_MSG_GLOBAL_REQUEST, &client_input_global_request);
Ben Lindstrom8ac91062001-04-04 17:57:54 +00002432
2433 /* rekeying */
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002434 ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_input_kexinit);
Damien Miller2797f7f2002-04-23 21:09:44 +10002435
2436 /* global request reply messages */
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002437 ssh_dispatch_set(ssh, SSH2_MSG_REQUEST_FAILURE, &client_global_request_reply);
2438 ssh_dispatch_set(ssh, SSH2_MSG_REQUEST_SUCCESS, &client_global_request_reply);
Damien Miller1383bd82000-04-06 12:32:37 +10002439}
Darren Tucker4d5cd332008-06-13 04:51:14 +10002440
Damien Miller6c3eec72011-05-05 14:16:22 +10002441void
2442client_stop_mux(void)
2443{
2444 if (options.control_path != NULL && muxserver_sock != -1)
2445 unlink(options.control_path);
2446 /*
Darren Tucker48bf4b02012-09-07 16:38:53 +10002447 * If we are in persist mode, or don't have a shell, signal that we
2448 * should close when all active channels are closed.
Damien Miller6c3eec72011-05-05 14:16:22 +10002449 */
Darren Tucker48bf4b02012-09-07 16:38:53 +10002450 if (options.control_persist || no_shell_flag) {
Damien Miller6c3eec72011-05-05 14:16:22 +10002451 session_closed = 1;
Damien Miller4ac99c32011-06-20 14:43:31 +10002452 setproctitle("[stopped mux]");
2453 }
Damien Miller6c3eec72011-05-05 14:16:22 +10002454}
2455
Darren Tucker9a2c4cd2003-09-22 21:16:05 +10002456/* client specific fatal cleanup */
2457void
Darren Tucker3e33cec2003-10-02 16:12:36 +10002458cleanup_exit(int i)
Darren Tucker9a2c4cd2003-09-22 21:16:05 +10002459{
Damien Miller21771e22011-05-15 08:45:50 +10002460 leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Darren Tucker9a2c4cd2003-09-22 21:16:05 +10002461 leave_non_blocking();
Damien Millerb1cbfa22008-05-19 16:00:08 +10002462 if (options.control_path != NULL && muxserver_sock != -1)
Damien Miller0e220db2004-06-15 10:34:08 +10002463 unlink(options.control_path);
Damien Millera41ccca2010-10-07 22:07:32 +11002464 ssh_kill_proxy_command();
Darren Tucker3e33cec2003-10-02 16:12:36 +10002465 _exit(i);
Darren Tucker9a2c4cd2003-09-22 21:16:05 +10002466}