blob: b5a1f70385ff1315c67b982092e159abdad6f030 [file] [log] [blame]
mestre@openbsd.org7adf6c42019-07-24 08:57:00 +00001/* $OpenBSD: clientloop.c,v 1.327 2019/07/24 08:57:00 mestre Exp $ */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002/*
Damien Miller95def091999-11-25 00:26:21 +11003 * Author: Tatu Ylonen <ylo@cs.hut.fi>
Damien Miller95def091999-11-25 00:26:21 +11004 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved
Damien Miller95def091999-11-25 00:26:21 +11006 * The main loop for the interactive session (client side).
Damien Miller4af51302000-04-16 11:18:38 +10007 *
Damien Millere4340be2000-09-16 13:29:08 +11008 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
13 *
14 *
15 * Copyright (c) 1999 Theo de Raadt. All rights reserved.
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions
19 * are met:
20 * 1. Redistributions of source code must retain the above copyright
21 * notice, this list of conditions and the following disclaimer.
22 * 2. Redistributions in binary form must reproduce the above copyright
23 * notice, this list of conditions and the following disclaimer in the
24 * documentation and/or other materials provided with the distribution.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36 *
37 *
Damien Miller1383bd82000-04-06 12:32:37 +100038 * SSH2 support added by Markus Friedl.
Ben Lindstrom44697232001-07-04 03:32:30 +000039 * Copyright (c) 1999, 2000, 2001 Markus Friedl. All rights reserved.
Damien Millere4340be2000-09-16 13:29:08 +110040 *
41 * Redistribution and use in source and binary forms, with or without
42 * modification, are permitted provided that the following conditions
43 * are met:
44 * 1. Redistributions of source code must retain the above copyright
45 * notice, this list of conditions and the following disclaimer.
46 * 2. Redistributions in binary form must reproduce the above copyright
47 * notice, this list of conditions and the following disclaimer in the
48 * documentation and/or other materials provided with the distribution.
49 *
50 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
51 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
52 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
53 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
54 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
55 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
56 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
57 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
58 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
59 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Damien Miller95def091999-11-25 00:26:21 +110060 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100061
62#include "includes.h"
Damien Miller17e91c02006-03-15 11:28:34 +110063
Damien Millerf17883e2006-03-15 11:45:54 +110064#include <sys/types.h>
Damien Miller9aec9192006-08-05 10:57:45 +100065#include <sys/ioctl.h>
Damien Millerf17883e2006-03-15 11:45:54 +110066#ifdef HAVE_SYS_STAT_H
67# include <sys/stat.h>
68#endif
Damien Miller9aec9192006-08-05 10:57:45 +100069#ifdef HAVE_SYS_TIME_H
70# include <sys/time.h>
71#endif
Damien Millere3b60b52006-07-10 21:08:03 +100072#include <sys/socket.h>
Damien Miller99bd21e2006-03-15 11:11:28 +110073
Damien Millerc7b06362006-03-15 11:53:45 +110074#include <ctype.h>
Darren Tucker39972492006-07-12 22:22:46 +100075#include <errno.h>
Damien Miller6645e7a2006-03-15 14:42:54 +110076#ifdef HAVE_PATHS_H
Damien Miller03e20032006-03-15 11:16:59 +110077#include <paths.h>
Damien Miller6645e7a2006-03-15 14:42:54 +110078#endif
Damien Miller6ff3cad2006-03-15 11:52:09 +110079#include <signal.h>
Damien Millerded319c2006-09-01 15:38:36 +100080#include <stdarg.h>
Damien Millera7a73ee2006-08-05 11:37:59 +100081#include <stdio.h>
Damien Millere7a1e5c2006-08-05 11:34:19 +100082#include <stdlib.h>
Damien Millere3476ed2006-07-24 14:13:33 +100083#include <string.h>
Damien Miller99bd21e2006-03-15 11:11:28 +110084#include <termios.h>
Damien Millerd7834352006-08-05 12:39:39 +100085#include <pwd.h>
Damien Millere6b3b612006-07-24 14:01:23 +100086#include <unistd.h>
deraadt@openbsd.org087266e2015-01-20 23:14:00 +000087#include <limits.h>
Damien Millerd4a8b7e1999-10-27 13:42:43 +100088
Damien Millerb84886b2008-05-19 15:05:07 +100089#include "openbsd-compat/sys-queue.h"
Damien Millerd7834352006-08-05 12:39:39 +100090#include "xmalloc.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100091#include "ssh.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000092#include "ssh2.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100093#include "packet.h"
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +000094#include "sshbuf.h"
Damien Millerb38eff82000-04-01 11:09:21 +100095#include "compat.h"
Ben Lindstromc7637672001-06-09 00:36:26 +000096#include "channels.h"
Damien Millerb38eff82000-04-01 11:09:21 +100097#include "dispatch.h"
markus@openbsd.org5467fbc2018-07-11 18:53:29 +000098#include "sshkey.h"
Damien Millerd7834352006-08-05 12:39:39 +100099#include "cipher.h"
Ben Lindstromf28f6342001-04-04 02:03:04 +0000100#include "kex.h"
markus@openbsd.org3a1638d2015-07-10 06:21:53 +0000101#include "myproposal.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000102#include "log.h"
Damien Miller7acefbb2014-07-18 14:11:24 +1000103#include "misc.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000104#include "readconf.h"
Ben Lindstrombf555ba2001-01-18 02:04:35 +0000105#include "clientloop.h"
Damien Milleraeb31d62005-12-13 19:29:36 +1100106#include "sshconnect.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000107#include "authfd.h"
108#include "atomicio.h"
Darren Tucker06f2bd82004-05-13 16:06:46 +1000109#include "sshpty.h"
Damien Miller0e220db2004-06-15 10:34:08 +1000110#include "match.h"
111#include "msg.h"
djm@openbsd.org141efe42015-01-14 20:05:27 +0000112#include "ssherr.h"
djm@openbsd.org8d4f8722015-01-26 03:04:45 +0000113#include "hostfile.h"
Damien Miller69b69aa2000-10-28 14:19:58 +1100114
115/* import options */
116extern Options options;
117
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000118/* Flag indicating that stdin should be redirected from /dev/null. */
119extern int stdin_null_flag;
120
Damien Millerd6965512003-12-17 16:31:53 +1100121/* Flag indicating that no shell has been requested */
122extern int no_shell_flag;
123
djm@openbsd.org368dd972016-07-23 02:54:08 +0000124/* Flag indicating that ssh should daemonise after authentication is complete */
125extern int fork_after_authentication_flag;
126
Damien Miller0e220db2004-06-15 10:34:08 +1000127/* Control socket */
Damien Millere1537f92010-01-26 13:26:22 +1100128extern int muxserver_sock; /* XXX use mux_client_cleanup() instead */
Damien Miller0e220db2004-06-15 10:34:08 +1000129
Damien Miller5428f641999-11-25 11:54:57 +1100130/*
131 * Name of the host we are connecting to. This is the name given on the
jmc@openbsd.org73491492019-06-12 11:31:50 +0000132 * command line, or the Hostname specified for the user-supplied name in a
Damien Miller5428f641999-11-25 11:54:57 +1100133 * configuration file.
134 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000135extern char *host;
136
Damien Miller5428f641999-11-25 11:54:57 +1100137/*
138 * Flag to indicate that we have received a window change signal which has
139 * not yet been processed. This will cause a message indicating the new
140 * window size to be sent to the server a little later. This is volatile
141 * because this is updated in a signal handler.
142 */
Ben Lindstrom5e71c542001-12-06 16:48:14 +0000143static volatile sig_atomic_t received_window_change_signal = 0;
144static volatile sig_atomic_t received_signal = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000145
Damien Miller788f2122005-11-05 15:14:59 +1100146/* Flag indicating whether the user's terminal is in non-blocking mode. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000147static int in_non_blocking_mode = 0;
148
Damien Millere11e1ea2010-08-03 16:04:46 +1000149/* Time when backgrounded control master using ControlPersist should exit */
150static time_t control_persist_exit_time = 0;
151
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000152/* Common data for the client loop code. */
Damien Millere1537f92010-01-26 13:26:22 +1100153volatile sig_atomic_t quit_pending; /* Set non-zero to quit the loop. */
Damien Miller95def091999-11-25 00:26:21 +1100154static int last_was_cr; /* Last character was a newline. */
Darren Tucker4d5cd332008-06-13 04:51:14 +1000155static int exit_status; /* Used to store the command exit status. */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000156static struct sshbuf *stderr_buffer; /* Used for final exit message. */
Damien Miller95def091999-11-25 00:26:21 +1100157static int connection_in; /* Connection to server (input). */
158static int connection_out; /* Connection to server (output). */
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000159static int need_rekeying; /* Set to non-zero if rekeying is requested. */
Damien Miller1ab6a512010-06-26 10:02:24 +1000160static int session_closed; /* In SSH2: login session closed. */
djm@openbsd.org1bf477d2015-07-01 02:26:31 +0000161static u_int x11_refuse_time; /* If >0, refuse x11 opens after this time. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000162
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +0000163static void client_init_dispatch(struct ssh *ssh);
Damien Miller1383bd82000-04-06 12:32:37 +1000164int session_ident = -1;
165
Darren Tucker2fb66ca2008-06-13 04:49:33 +1000166/* Track escape per proto2 channel */
167struct escape_filter_ctx {
168 int escape_pending;
169 int escape_char;
170};
171
172/* Context for channel confirmation replies */
Damien Miller5771ed72008-05-19 15:35:33 +1000173struct channel_reply_ctx {
174 const char *request_type;
Damien Miller555f3b82011-05-15 08:48:05 +1000175 int id;
176 enum confirm_action action;
Damien Miller5771ed72008-05-19 15:35:33 +1000177};
178
Darren Tucker9f407c42008-06-13 04:50:27 +1000179/* Global request success/failure callbacks */
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000180/* XXX move to struct ssh? */
Darren Tucker9f407c42008-06-13 04:50:27 +1000181struct global_confirm {
182 TAILQ_ENTRY(global_confirm) entry;
183 global_confirm_cb *cb;
184 void *ctx;
185 int ref_count;
186};
187TAILQ_HEAD(global_confirms, global_confirm);
188static struct global_confirms global_confirms =
189 TAILQ_HEAD_INITIALIZER(global_confirms);
190
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000191void ssh_process_session2_setup(int, int, int, struct sshbuf *);
Damien Miller0e220db2004-06-15 10:34:08 +1000192
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000193/* Restores stdin to blocking mode. */
194
Ben Lindstrombba81212001-06-25 05:01:22 +0000195static void
Ben Lindstrom31ca54a2001-02-09 02:11:24 +0000196leave_non_blocking(void)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000197{
Damien Miller95def091999-11-25 00:26:21 +1100198 if (in_non_blocking_mode) {
Damien Miller03e66f62004-06-15 15:47:51 +1000199 unset_nonblock(fileno(stdin));
Damien Miller95def091999-11-25 00:26:21 +1100200 in_non_blocking_mode = 0;
Damien Miller95def091999-11-25 00:26:21 +1100201 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000202}
203
Damien Miller5428f641999-11-25 11:54:57 +1100204/*
205 * Signal handler for the window change signal (SIGWINCH). This just sets a
206 * flag indicating that the window has changed.
207 */
Damien Millerf0b15df2006-03-26 13:59:20 +1100208/*ARGSUSED */
Ben Lindstrombba81212001-06-25 05:01:22 +0000209static void
Damien Miller95def091999-11-25 00:26:21 +1100210window_change_handler(int sig)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000211{
Damien Miller95def091999-11-25 00:26:21 +1100212 received_window_change_signal = 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000213}
214
Damien Miller5428f641999-11-25 11:54:57 +1100215/*
216 * Signal handler for signals that cause the program to terminate. These
217 * signals must be trapped to restore terminal modes.
218 */
Damien Millerf0b15df2006-03-26 13:59:20 +1100219/*ARGSUSED */
Ben Lindstrombba81212001-06-25 05:01:22 +0000220static void
Damien Miller95def091999-11-25 00:26:21 +1100221signal_handler(int sig)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000222{
Ben Lindstromec46e0b2001-06-09 01:27:31 +0000223 received_signal = sig;
224 quit_pending = 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000225}
226
Damien Miller5428f641999-11-25 11:54:57 +1100227/*
Damien Millere11e1ea2010-08-03 16:04:46 +1000228 * Sets control_persist_exit_time to the absolute time when the
229 * backgrounded control master should exit due to expiry of the
230 * ControlPersist timeout. Sets it to 0 if we are not a backgrounded
231 * control master process, or if there is no ControlPersist timeout.
232 */
233static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000234set_control_persist_exit_time(struct ssh *ssh)
Damien Millere11e1ea2010-08-03 16:04:46 +1000235{
236 if (muxserver_sock == -1 || !options.control_persist
Damien Miller6c3eec72011-05-05 14:16:22 +1000237 || options.control_persist_timeout == 0) {
Damien Millere11e1ea2010-08-03 16:04:46 +1000238 /* not using a ControlPersist timeout */
239 control_persist_exit_time = 0;
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000240 } else if (channel_still_open(ssh)) {
Damien Millere11e1ea2010-08-03 16:04:46 +1000241 /* some client connections are still open */
242 if (control_persist_exit_time > 0)
243 debug2("%s: cancel scheduled exit", __func__);
244 control_persist_exit_time = 0;
245 } else if (control_persist_exit_time <= 0) {
246 /* a client connection has recently closed */
Darren Tuckerb759c9c2013-06-02 07:46:16 +1000247 control_persist_exit_time = monotime() +
Damien Millere11e1ea2010-08-03 16:04:46 +1000248 (time_t)options.control_persist_timeout;
249 debug2("%s: schedule exit in %d seconds", __func__,
250 options.control_persist_timeout);
251 }
252 /* else we are already counting down to the timeout */
253}
254
Damien Miller8d60be52012-02-11 08:18:17 +1100255#define SSH_X11_VALID_DISPLAY_CHARS ":/.-_"
256static int
257client_x11_display_valid(const char *display)
258{
259 size_t i, dlen;
260
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000261 if (display == NULL)
262 return 0;
263
Damien Miller8d60be52012-02-11 08:18:17 +1100264 dlen = strlen(display);
265 for (i = 0; i < dlen; i++) {
Damien Millerfdb23062013-11-21 13:57:15 +1100266 if (!isalnum((u_char)display[i]) &&
Damien Miller8d60be52012-02-11 08:18:17 +1100267 strchr(SSH_X11_VALID_DISPLAY_CHARS, display[i]) == NULL) {
268 debug("Invalid character '%c' in DISPLAY", display[i]);
269 return 0;
270 }
271 }
272 return 1;
273}
274
djm@openbsd.org1bf477d2015-07-01 02:26:31 +0000275#define SSH_X11_PROTO "MIT-MAGIC-COOKIE-1"
276#define X11_TIMEOUT_SLACK 60
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000277int
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000278client_x11_get_proto(struct ssh *ssh, const char *display,
279 const char *xauth_path, u_int trusted, u_int timeout,
280 char **_proto, char **_data)
Damien Miller17e7ed02005-06-17 12:54:33 +1000281{
djm@openbsd.orgb5e412a2018-09-21 12:46:22 +0000282 char *cmd, line[512], xdisplay[512];
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000283 char xauthfile[PATH_MAX], xauthdir[PATH_MAX];
Damien Miller17e7ed02005-06-17 12:54:33 +1000284 static char proto[512], data[512];
285 FILE *f;
tedu@openbsd.org10363562016-09-17 18:00:27 +0000286 int got_data = 0, generated = 0, do_unlink = 0, r;
Damien Miller17e7ed02005-06-17 12:54:33 +1000287 struct stat st;
djm@openbsd.org1bf477d2015-07-01 02:26:31 +0000288 u_int now, x11_timeout_real;
Damien Miller17e7ed02005-06-17 12:54:33 +1000289
Damien Miller17e7ed02005-06-17 12:54:33 +1000290 *_proto = proto;
291 *_data = data;
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000292 proto[0] = data[0] = xauthfile[0] = xauthdir[0] = '\0';
Damien Miller17e7ed02005-06-17 12:54:33 +1000293
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000294 if (!client_x11_display_valid(display)) {
millert@openbsd.org5658ef22016-02-01 21:18:17 +0000295 if (display != NULL)
296 logit("DISPLAY \"%s\" invalid; disabling X11 forwarding",
297 display);
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000298 return -1;
299 }
300 if (xauth_path != NULL && stat(xauth_path, &st) == -1) {
301 debug("No xauth program.");
302 xauth_path = NULL;
303 }
304
305 if (xauth_path != NULL) {
Damien Miller17e7ed02005-06-17 12:54:33 +1000306 /*
307 * Handle FamilyLocal case where $DISPLAY does
308 * not match an authorization entry. For this we
309 * just try "xauth list unix:displaynum.screennum".
310 * XXX: "localhost" match to determine FamilyLocal
311 * is not perfect.
312 */
313 if (strncmp(display, "localhost:", 10) == 0) {
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000314 if ((r = snprintf(xdisplay, sizeof(xdisplay), "unix:%s",
315 display + 10)) < 0 ||
316 (size_t)r >= sizeof(xdisplay)) {
317 error("%s: display name too long", __func__);
318 return -1;
319 }
Damien Miller17e7ed02005-06-17 12:54:33 +1000320 display = xdisplay;
321 }
322 if (trusted == 0) {
djm@openbsd.org1bf477d2015-07-01 02:26:31 +0000323 /*
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000324 * Generate an untrusted X11 auth cookie.
325 *
djm@openbsd.org1bf477d2015-07-01 02:26:31 +0000326 * The authentication cookie should briefly outlive
327 * ssh's willingness to forward X11 connections to
328 * avoid nasty fail-open behaviour in the X server.
329 */
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000330 mktemp_proto(xauthdir, sizeof(xauthdir));
331 if (mkdtemp(xauthdir) == NULL) {
332 error("%s: mkdtemp: %s",
333 __func__, strerror(errno));
334 return -1;
335 }
336 do_unlink = 1;
337 if ((r = snprintf(xauthfile, sizeof(xauthfile),
338 "%s/xauthfile", xauthdir)) < 0 ||
339 (size_t)r >= sizeof(xauthfile)) {
340 error("%s: xauthfile path too long", __func__);
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000341 rmdir(xauthdir);
342 return -1;
343 }
344
djm@openbsd.orgb5e412a2018-09-21 12:46:22 +0000345 if (timeout == 0) {
346 /* auth doesn't time out */
347 xasprintf(&cmd, "%s -f %s generate %s %s "
348 "untrusted 2>%s",
349 xauth_path, xauthfile, display,
350 SSH_X11_PROTO, _PATH_DEVNULL);
351 } else {
352 /* Add some slack to requested expiry */
353 if (timeout < UINT_MAX - X11_TIMEOUT_SLACK)
354 x11_timeout_real = timeout +
355 X11_TIMEOUT_SLACK;
356 else {
357 /* Don't overflow on long timeouts */
358 x11_timeout_real = UINT_MAX;
359 }
360 xasprintf(&cmd, "%s -f %s generate %s %s "
361 "untrusted timeout %u 2>%s",
362 xauth_path, xauthfile, display,
363 SSH_X11_PROTO, x11_timeout_real,
364 _PATH_DEVNULL);
365 }
djm@openbsd.org9d7b2882019-03-29 11:31:40 +0000366 debug2("%s: xauth command: %s", __func__, cmd);
djm@openbsd.orgb5e412a2018-09-21 12:46:22 +0000367
368 if (timeout != 0 && x11_refuse_time == 0) {
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000369 now = monotime() + 1;
370 if (UINT_MAX - timeout < now)
371 x11_refuse_time = UINT_MAX;
372 else
373 x11_refuse_time = now + timeout;
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000374 channel_set_x11_refuse_time(ssh,
375 x11_refuse_time);
Damien Miller17e7ed02005-06-17 12:54:33 +1000376 }
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000377 if (system(cmd) == 0)
378 generated = 1;
djm@openbsd.orgb5e412a2018-09-21 12:46:22 +0000379 free(cmd);
Damien Miller17e7ed02005-06-17 12:54:33 +1000380 }
Darren Tucker513d13a2007-08-15 19:13:41 +1000381
382 /*
383 * When in untrusted mode, we read the cookie only if it was
384 * successfully generated as an untrusted one in the step
385 * above.
386 */
387 if (trusted || generated) {
djm@openbsd.orgb5e412a2018-09-21 12:46:22 +0000388 xasprintf(&cmd,
Darren Tucker513d13a2007-08-15 19:13:41 +1000389 "%s %s%s list %s 2>" _PATH_DEVNULL,
390 xauth_path,
391 generated ? "-f " : "" ,
392 generated ? xauthfile : "",
393 display);
394 debug2("x11_get_proto: %s", cmd);
395 f = popen(cmd, "r");
396 if (f && fgets(line, sizeof(line), f) &&
397 sscanf(line, "%*s %511s %511s", proto, data) == 2)
398 got_data = 1;
399 if (f)
400 pclose(f);
djm@openbsd.orgb5e412a2018-09-21 12:46:22 +0000401 free(cmd);
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000402 }
Damien Miller17e7ed02005-06-17 12:54:33 +1000403 }
404
405 if (do_unlink) {
406 unlink(xauthfile);
407 rmdir(xauthdir);
408 }
Damien Miller17e7ed02005-06-17 12:54:33 +1000409
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000410 /* Don't fall back to fake X11 data for untrusted forwarding */
411 if (!trusted && !got_data) {
412 error("Warning: untrusted X11 forwarding setup failed: "
413 "xauth key data not generated");
414 return -1;
415 }
416
Damien Miller17e7ed02005-06-17 12:54:33 +1000417 /*
418 * If we didn't get authentication data, just make up some
419 * data. The forwarding code will check the validity of the
420 * response anyway, and substitute this data. The X11
421 * server, however, will ignore this fake data and use
422 * whatever authentication mechanisms it was using otherwise
423 * for the local connection.
424 */
425 if (!got_data) {
tedu@openbsd.org10363562016-09-17 18:00:27 +0000426 u_int8_t rnd[16];
427 u_int i;
Damien Miller17e7ed02005-06-17 12:54:33 +1000428
429 logit("Warning: No xauth data; "
430 "using fake authentication data for X11 forwarding.");
431 strlcpy(proto, SSH_X11_PROTO, sizeof proto);
tedu@openbsd.org10363562016-09-17 18:00:27 +0000432 arc4random_buf(rnd, sizeof(rnd));
433 for (i = 0; i < sizeof(rnd); i++) {
Damien Miller17e7ed02005-06-17 12:54:33 +1000434 snprintf(data + 2 * i, sizeof data - 2 * i, "%02x",
tedu@openbsd.org10363562016-09-17 18:00:27 +0000435 rnd[i]);
Damien Miller17e7ed02005-06-17 12:54:33 +1000436 }
437 }
djm@openbsd.orged4ce822016-01-13 23:04:47 +0000438
439 return 0;
Damien Miller17e7ed02005-06-17 12:54:33 +1000440}
441
Damien Miller5428f641999-11-25 11:54:57 +1100442/*
Damien Miller5428f641999-11-25 11:54:57 +1100443 * Checks if the client window has changed, and sends a packet about it to
444 * the server if so. The actual change is detected elsewhere (by a software
445 * interrupt on Unix); this just checks the flag and sends a message if
446 * appropriate.
447 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000448
Ben Lindstrombba81212001-06-25 05:01:22 +0000449static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000450client_check_window_change(struct ssh *ssh)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000451{
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000452 if (!received_window_change_signal)
Damien Miller1383bd82000-04-06 12:32:37 +1000453 return;
454 /** XXX race */
455 received_window_change_signal = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000456
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000457 debug2("%s: changed", __func__);
Damien Miller1383bd82000-04-06 12:32:37 +1000458
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000459 channel_send_window_changes(ssh);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000460}
461
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000462static int
markus@openbsd.org2ae666a2017-05-30 14:23:52 +0000463client_global_request_reply(int type, u_int32_t seq, struct ssh *ssh)
Damien Miller509b0102003-12-17 16:33:10 +1100464{
Darren Tucker9f407c42008-06-13 04:50:27 +1000465 struct global_confirm *gc;
466
467 if ((gc = TAILQ_FIRST(&global_confirms)) == NULL)
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000468 return 0;
Darren Tucker9f407c42008-06-13 04:50:27 +1000469 if (gc->cb != NULL)
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000470 gc->cb(ssh, type, seq, gc->ctx);
Darren Tucker9f407c42008-06-13 04:50:27 +1000471 if (--gc->ref_count <= 0) {
472 TAILQ_REMOVE(&global_confirms, gc, entry);
Damien Miller1d2c4562014-02-04 11:18:20 +1100473 explicit_bzero(gc, sizeof(*gc));
Darren Tuckera627d422013-06-02 07:31:17 +1000474 free(gc);
Darren Tucker9f407c42008-06-13 04:50:27 +1000475 }
476
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000477 ssh_packet_set_alive_timeouts(ssh, 0);
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +0000478 return 0;
Damien Miller509b0102003-12-17 16:33:10 +1100479}
480
481static void
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000482server_alive_check(struct ssh *ssh)
Damien Miller509b0102003-12-17 16:33:10 +1100483{
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000484 int r;
485
486 if (ssh_packet_inc_alive_timeouts(ssh) > options.server_alive_count_max) {
Damien Millerb73b6fd2011-01-11 17:18:56 +1100487 logit("Timeout, server %s not responding.", host);
Damien Miller985a4482006-10-24 03:02:41 +1000488 cleanup_exit(255);
489 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000490 if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 ||
491 (r = sshpkt_put_cstring(ssh, "keepalive@openssh.com")) != 0 ||
492 (r = sshpkt_put_u8(ssh, 1)) != 0 || /* boolean: want reply */
493 (r = sshpkt_send(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +0000494 fatal("%s: send packet: %s", __func__, ssh_err(r));
Darren Tucker9f407c42008-06-13 04:50:27 +1000495 /* Insert an empty placeholder to maintain ordering */
496 client_register_global_confirm(NULL, NULL);
Damien Miller509b0102003-12-17 16:33:10 +1100497}
498
Damien Miller5428f641999-11-25 11:54:57 +1100499/*
500 * Waits until the client can do something (some data becomes available on
501 * one of the file descriptors).
502 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000503static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000504client_wait_until_can_do_something(struct ssh *ssh,
505 fd_set **readsetp, fd_set **writesetp,
Darren Tuckerc7a6fc42004-08-13 21:18:00 +1000506 int *maxfdp, u_int *nallocp, int rekeying)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000507{
Damien Miller509b0102003-12-17 16:33:10 +1100508 struct timeval tv, *tvp;
Damien Millere11e1ea2010-08-03 16:04:46 +1000509 int timeout_secs;
Darren Tuckerb759c9c2013-06-02 07:46:16 +1000510 time_t minwait_secs = 0, server_alive_time = 0, now = monotime();
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000511 int r, ret;
Damien Miller509b0102003-12-17 16:33:10 +1100512
Damien Miller5e953212001-01-30 09:14:00 +1100513 /* Add any selections by the channel mechanism. */
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +0000514 channel_prepare_select(ssh, readsetp, writesetp, maxfdp,
djm@openbsd.org71e5a532017-08-30 03:59:08 +0000515 nallocp, &minwait_secs);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000516
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000517 /* channel_prepare_select could have closed the last channel */
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000518 if (session_closed && !channel_still_open(ssh) &&
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000519 !ssh_packet_have_data_to_write(ssh)) {
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000520 /* clear mask since we did not call select() */
521 memset(*readsetp, 0, *nallocp);
522 memset(*writesetp, 0, *nallocp);
523 return;
Damien Miller1383bd82000-04-06 12:32:37 +1000524 }
525
djm@openbsd.org05164352017-04-30 23:21:54 +0000526 FD_SET(connection_in, *readsetp);
527
Damien Miller95def091999-11-25 00:26:21 +1100528 /* Select server connection if have data to write to the server. */
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000529 if (ssh_packet_have_data_to_write(ssh))
Damien Miller5e953212001-01-30 09:14:00 +1100530 FD_SET(connection_out, *writesetp);
Damien Miller95def091999-11-25 00:26:21 +1100531
Damien Miller5428f641999-11-25 11:54:57 +1100532 /*
533 * Wait for something to happen. This will suspend the process until
534 * some selected descriptor can be read, written, or has some other
Damien Millere11e1ea2010-08-03 16:04:46 +1000535 * event pending, or a timeout expires.
Damien Miller5428f641999-11-25 11:54:57 +1100536 */
Damien Miller95def091999-11-25 00:26:21 +1100537
Damien Millere11e1ea2010-08-03 16:04:46 +1000538 timeout_secs = INT_MAX; /* we use INT_MAX to mean no timeout */
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000539 if (options.server_alive_interval > 0) {
Damien Millere11e1ea2010-08-03 16:04:46 +1000540 timeout_secs = options.server_alive_interval;
Darren Tuckerc53c2af2013-05-16 20:28:16 +1000541 server_alive_time = now + options.server_alive_interval;
542 }
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000543 if (options.rekey_interval > 0 && !rekeying)
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000544 timeout_secs = MINIMUM(timeout_secs,
545 ssh_packet_get_rekey_timeout(ssh));
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000546 set_control_persist_exit_time(ssh);
Damien Millere11e1ea2010-08-03 16:04:46 +1000547 if (control_persist_exit_time > 0) {
deraadt@openbsd.org9136ec12016-09-12 01:22:38 +0000548 timeout_secs = MINIMUM(timeout_secs,
Darren Tuckerc53c2af2013-05-16 20:28:16 +1000549 control_persist_exit_time - now);
Damien Millere11e1ea2010-08-03 16:04:46 +1000550 if (timeout_secs < 0)
551 timeout_secs = 0;
552 }
Damien Millera6508752012-04-22 11:21:10 +1000553 if (minwait_secs != 0)
deraadt@openbsd.org9136ec12016-09-12 01:22:38 +0000554 timeout_secs = MINIMUM(timeout_secs, (int)minwait_secs);
Damien Millere11e1ea2010-08-03 16:04:46 +1000555 if (timeout_secs == INT_MAX)
Damien Miller509b0102003-12-17 16:33:10 +1100556 tvp = NULL;
Darren Tuckerfc959702004-07-17 16:12:08 +1000557 else {
Damien Millere11e1ea2010-08-03 16:04:46 +1000558 tv.tv_sec = timeout_secs;
Damien Miller509b0102003-12-17 16:33:10 +1100559 tv.tv_usec = 0;
560 tvp = &tv;
561 }
Damien Millere11e1ea2010-08-03 16:04:46 +1000562
Damien Miller509b0102003-12-17 16:33:10 +1100563 ret = select((*maxfdp)+1, *readsetp, *writesetp, NULL, tvp);
deraadt@openbsd.org4d28fa72019-06-28 13:35:04 +0000564 if (ret == -1) {
Ben Lindstromf9452512001-02-15 03:12:08 +0000565 /*
566 * We have to clear the select masks, because we return.
567 * We have to return, because the mainloop checks for the flags
568 * set by the signal handlers.
569 */
Damien Miller79faeff2001-11-12 11:06:32 +1100570 memset(*readsetp, 0, *nallocp);
571 memset(*writesetp, 0, *nallocp);
Ben Lindstromf9452512001-02-15 03:12:08 +0000572
Damien Miller95def091999-11-25 00:26:21 +1100573 if (errno == EINTR)
574 return;
575 /* Note: we might still have data in the buffers. */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000576 if ((r = sshbuf_putf(stderr_buffer,
577 "select: %s\r\n", strerror(errno))) != 0)
578 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Damien Miller95def091999-11-25 00:26:21 +1100579 quit_pending = 1;
Darren Tuckerc53c2af2013-05-16 20:28:16 +1000580 } else if (ret == 0) {
581 /*
582 * Timeout. Could have been either keepalive or rekeying.
583 * Keepalive we check here, rekeying is checked in clientloop.
584 */
Darren Tuckerb759c9c2013-06-02 07:46:16 +1000585 if (server_alive_time != 0 && server_alive_time <= monotime())
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000586 server_alive_check(ssh);
Darren Tuckerc53c2af2013-05-16 20:28:16 +1000587 }
588
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000589}
590
Ben Lindstrombba81212001-06-25 05:01:22 +0000591static void
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000592client_suspend_self(struct sshbuf *bin, struct sshbuf *bout, struct sshbuf *berr)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000593{
Damien Miller95def091999-11-25 00:26:21 +1100594 /* Flush stdout and stderr buffers. */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000595 if (sshbuf_len(bout) > 0)
596 atomicio(vwrite, fileno(stdout), sshbuf_mutable_ptr(bout),
597 sshbuf_len(bout));
598 if (sshbuf_len(berr) > 0)
599 atomicio(vwrite, fileno(stderr), sshbuf_mutable_ptr(berr),
600 sshbuf_len(berr));
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000601
Damien Miller21771e22011-05-15 08:45:50 +1000602 leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000603
djm@openbsd.org5b8da1f2017-09-19 04:24:22 +0000604 sshbuf_reset(bin);
605 sshbuf_reset(bout);
606 sshbuf_reset(berr);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000607
Damien Miller95def091999-11-25 00:26:21 +1100608 /* Send the suspend signal to the program itself. */
609 kill(getpid(), SIGTSTP);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000610
Darren Tucker5d78de62004-11-05 20:35:44 +1100611 /* Reset window sizes in case they have changed */
612 received_window_change_signal = 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000613
Damien Miller21771e22011-05-15 08:45:50 +1000614 enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000615}
616
Ben Lindstrombba81212001-06-25 05:01:22 +0000617static void
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000618client_process_net_input(struct ssh *ssh, fd_set *readset)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000619{
Darren Tucker86e30a02009-08-28 11:21:06 +1000620 char buf[SSH_IOBUFSZ];
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000621 int r, len;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000622
Damien Miller5428f641999-11-25 11:54:57 +1100623 /*
624 * Read input from the server, and add any such data to the buffer of
625 * the packet subsystem.
626 */
Damien Miller95def091999-11-25 00:26:21 +1100627 if (FD_ISSET(connection_in, readset)) {
628 /* Read as much as possible. */
markus@openbsd.orga3068632016-01-14 16:17:39 +0000629 len = read(connection_in, buf, sizeof(buf));
630 if (len == 0) {
Darren Tucker4d5cd332008-06-13 04:51:14 +1000631 /*
632 * Received EOF. The remote host has closed the
633 * connection.
634 */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000635 if ((r = sshbuf_putf(stderr_buffer,
Darren Tucker4d5cd332008-06-13 04:51:14 +1000636 "Connection to %.300s closed by remote host.\r\n",
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000637 host)) != 0)
638 fatal("%s: buffer error: %s",
639 __func__, ssh_err(r));
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000640 quit_pending = 1;
641 return;
Damien Miller95def091999-11-25 00:26:21 +1100642 }
Damien Miller5428f641999-11-25 11:54:57 +1100643 /*
644 * There is a kernel bug on Solaris that causes select to
645 * sometimes wake up even though there is no data available.
646 */
deraadt@openbsd.org4d28fa72019-06-28 13:35:04 +0000647 if (len == -1 &&
Damien Millerd8968ad2008-07-04 23:10:49 +1000648 (errno == EAGAIN || errno == EINTR || errno == EWOULDBLOCK))
Damien Miller95def091999-11-25 00:26:21 +1100649 len = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000650
deraadt@openbsd.org4d28fa72019-06-28 13:35:04 +0000651 if (len == -1) {
Darren Tucker4d5cd332008-06-13 04:51:14 +1000652 /*
653 * An error has encountered. Perhaps there is a
654 * network problem.
655 */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000656 if ((r = sshbuf_putf(stderr_buffer,
Darren Tucker4d5cd332008-06-13 04:51:14 +1000657 "Read from remote host %.300s: %.100s\r\n",
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000658 host, strerror(errno))) != 0)
659 fatal("%s: buffer error: %s",
660 __func__, ssh_err(r));
Damien Miller95def091999-11-25 00:26:21 +1100661 quit_pending = 1;
662 return;
663 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +0000664 ssh_packet_process_incoming(ssh, buf, len);
Damien Miller95def091999-11-25 00:26:21 +1100665 }
Damien Miller1383bd82000-04-06 12:32:37 +1000666}
667
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000668static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000669client_status_confirm(struct ssh *ssh, int type, Channel *c, void *ctx)
Damien Miller0e220db2004-06-15 10:34:08 +1000670{
Damien Miller5771ed72008-05-19 15:35:33 +1000671 struct channel_reply_ctx *cr = (struct channel_reply_ctx *)ctx;
672 char errmsg[256];
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000673 int r, tochan;
Darren Tuckerfc959702004-07-17 16:12:08 +1000674
Damien Miller555f3b82011-05-15 08:48:05 +1000675 /*
676 * If a TTY was explicitly requested, then a failure to allocate
677 * one is fatal.
678 */
679 if (cr->action == CONFIRM_TTY &&
680 (options.request_tty == REQUEST_TTY_FORCE ||
681 options.request_tty == REQUEST_TTY_YES))
682 cr->action = CONFIRM_CLOSE;
683
djm@openbsd.org001aa552018-04-10 00:10:49 +0000684 /* XXX suppress on mux _client_ quietmode */
Damien Miller5771ed72008-05-19 15:35:33 +1000685 tochan = options.log_level >= SYSLOG_LEVEL_ERROR &&
Damien Millere1537f92010-01-26 13:26:22 +1100686 c->ctl_chan != -1 && c->extended_usage == CHAN_EXTENDED_WRITE;
Damien Miller0e220db2004-06-15 10:34:08 +1000687
Damien Miller5771ed72008-05-19 15:35:33 +1000688 if (type == SSH2_MSG_CHANNEL_SUCCESS) {
689 debug2("%s request accepted on channel %d",
690 cr->request_type, c->self);
691 } else if (type == SSH2_MSG_CHANNEL_FAILURE) {
692 if (tochan) {
693 snprintf(errmsg, sizeof(errmsg),
694 "%s request failed\r\n", cr->request_type);
695 } else {
696 snprintf(errmsg, sizeof(errmsg),
697 "%s request failed on channel %d",
698 cr->request_type, c->self);
699 }
700 /* If error occurred on primary session channel, then exit */
Damien Miller555f3b82011-05-15 08:48:05 +1000701 if (cr->action == CONFIRM_CLOSE && c->self == session_ident)
Damien Miller5771ed72008-05-19 15:35:33 +1000702 fatal("%s", errmsg);
Damien Miller555f3b82011-05-15 08:48:05 +1000703 /*
704 * If error occurred on mux client, append to
705 * their stderr.
706 */
707 if (tochan) {
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000708 if ((r = sshbuf_put(c->extended, errmsg,
709 strlen(errmsg))) != 0)
710 fatal("%s: buffer error %s", __func__,
711 ssh_err(r));
Damien Miller555f3b82011-05-15 08:48:05 +1000712 } else
Damien Miller5771ed72008-05-19 15:35:33 +1000713 error("%s", errmsg);
Damien Miller555f3b82011-05-15 08:48:05 +1000714 if (cr->action == CONFIRM_TTY) {
715 /*
716 * If a TTY allocation error occurred, then arrange
717 * for the correct TTY to leave raw mode.
718 */
719 if (c->self == session_ident)
720 leave_raw_mode(0);
721 else
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000722 mux_tty_alloc_failed(ssh, c);
Damien Miller555f3b82011-05-15 08:48:05 +1000723 } else if (cr->action == CONFIRM_CLOSE) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000724 chan_read_failed(ssh, c);
725 chan_write_failed(ssh, c);
Damien Miller5771ed72008-05-19 15:35:33 +1000726 }
Damien Miller0e220db2004-06-15 10:34:08 +1000727 }
Darren Tuckera627d422013-06-02 07:31:17 +1000728 free(cr);
Damien Miller5771ed72008-05-19 15:35:33 +1000729}
Damien Miller0e220db2004-06-15 10:34:08 +1000730
Damien Miller5771ed72008-05-19 15:35:33 +1000731static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000732client_abandon_status_confirm(struct ssh *ssh, Channel *c, void *ctx)
Damien Miller5771ed72008-05-19 15:35:33 +1000733{
Darren Tuckera627d422013-06-02 07:31:17 +1000734 free(ctx);
Damien Miller5771ed72008-05-19 15:35:33 +1000735}
736
Damien Miller6d7b4372011-06-23 08:31:57 +1000737void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000738client_expect_confirm(struct ssh *ssh, int id, const char *request,
Damien Miller555f3b82011-05-15 08:48:05 +1000739 enum confirm_action action)
Damien Miller5771ed72008-05-19 15:35:33 +1000740{
Damien Miller6c81fee2013-11-08 12:19:55 +1100741 struct channel_reply_ctx *cr = xcalloc(1, sizeof(*cr));
Damien Miller5771ed72008-05-19 15:35:33 +1000742
743 cr->request_type = request;
Damien Miller555f3b82011-05-15 08:48:05 +1000744 cr->action = action;
Damien Miller5771ed72008-05-19 15:35:33 +1000745
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000746 channel_register_status_confirm(ssh, id, client_status_confirm,
Damien Miller5771ed72008-05-19 15:35:33 +1000747 client_abandon_status_confirm, cr);
Damien Miller0e220db2004-06-15 10:34:08 +1000748}
749
Darren Tucker9f407c42008-06-13 04:50:27 +1000750void
751client_register_global_confirm(global_confirm_cb *cb, void *ctx)
752{
Damien Millerb9d3bee2008-07-16 22:40:52 +1000753 struct global_confirm *gc, *last_gc;
Darren Tucker9f407c42008-06-13 04:50:27 +1000754
755 /* Coalesce identical callbacks */
Damien Millerb9d3bee2008-07-16 22:40:52 +1000756 last_gc = TAILQ_LAST(&global_confirms, global_confirms);
757 if (last_gc && last_gc->cb == cb && last_gc->ctx == ctx) {
758 if (++last_gc->ref_count >= INT_MAX)
759 fatal("%s: last_gc->ref_count = %d",
760 __func__, last_gc->ref_count);
Darren Tucker9f407c42008-06-13 04:50:27 +1000761 return;
762 }
763
Damien Miller6c81fee2013-11-08 12:19:55 +1100764 gc = xcalloc(1, sizeof(*gc));
Darren Tucker9f407c42008-06-13 04:50:27 +1000765 gc->cb = cb;
766 gc->ctx = ctx;
767 gc->ref_count = 1;
768 TAILQ_INSERT_TAIL(&global_confirms, gc, entry);
769}
770
Damien Miller0e220db2004-06-15 10:34:08 +1000771static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000772process_cmdline(struct ssh *ssh)
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000773{
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000774 void (*handler)(int);
Damien Miller7acefbb2014-07-18 14:11:24 +1000775 char *s, *cmd;
776 int ok, delete = 0, local = 0, remote = 0, dynamic = 0;
777 struct Forward fwd;
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000778
Damien Miller1d2c4562014-02-04 11:18:20 +1100779 memset(&fwd, 0, sizeof(fwd));
Darren Tucker23ae8ca2007-12-02 23:12:30 +1100780
Damien Miller21771e22011-05-15 08:45:50 +1000781 leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Ben Lindstrom5a6abda2002-06-09 19:41:48 +0000782 handler = signal(SIGINT, SIG_IGN);
Ben Lindstrom681d9322002-03-22 03:53:00 +0000783 cmd = s = read_passphrase("\r\nssh> ", RP_ECHO);
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000784 if (s == NULL)
785 goto out;
Damien Millerfdb23062013-11-21 13:57:15 +1100786 while (isspace((u_char)*s))
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000787 s++;
Darren Tuckere7066df2004-05-24 10:18:05 +1000788 if (*s == '-')
789 s++; /* Skip cmdline '-', if any */
Darren Tuckere1675822004-05-24 10:13:07 +1000790 if (*s == '\0')
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000791 goto out;
Darren Tuckere7066df2004-05-24 10:18:05 +1000792
Darren Tucker1973c882004-05-24 10:34:36 +1000793 if (*s == 'h' || *s == 'H' || *s == '?') {
Darren Tuckere7066df2004-05-24 10:18:05 +1000794 logit("Commands:");
Damien Miller43020952006-07-10 20:16:12 +1000795 logit(" -L[bind_address:]port:host:hostport "
796 "Request local forward");
797 logit(" -R[bind_address:]port:host:hostport "
798 "Request remote forward");
Damien Miller0164cb82008-11-05 16:30:31 +1100799 logit(" -D[bind_address:]port "
800 "Request dynamic forward");
Damien Millerff773642011-09-22 21:39:48 +1000801 logit(" -KL[bind_address:]port "
802 "Cancel local forward");
Damien Miller57e8ad32006-07-10 20:20:52 +1000803 logit(" -KR[bind_address:]port "
Damien Miller43020952006-07-10 20:16:12 +1000804 "Cancel remote forward");
Damien Millerff773642011-09-22 21:39:48 +1000805 logit(" -KD[bind_address:]port "
806 "Cancel dynamic forward");
Damien Millerd27b9472005-12-13 19:29:02 +1100807 if (!options.permit_local_command)
808 goto out;
Damien Miller43020952006-07-10 20:16:12 +1000809 logit(" !args "
810 "Execute local command");
Damien Millerd27b9472005-12-13 19:29:02 +1100811 goto out;
812 }
813
814 if (*s == '!' && options.permit_local_command) {
815 s++;
816 ssh_local_cmd(s);
Darren Tuckere7066df2004-05-24 10:18:05 +1000817 goto out;
818 }
819
820 if (*s == 'K') {
821 delete = 1;
822 s++;
823 }
Damien Miller0164cb82008-11-05 16:30:31 +1100824 if (*s == 'L')
825 local = 1;
826 else if (*s == 'R')
827 remote = 1;
828 else if (*s == 'D')
829 dynamic = 1;
830 else {
Damien Miller996acd22003-04-09 20:59:48 +1000831 logit("Invalid command.");
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000832 goto out;
833 }
Damien Miller0164cb82008-11-05 16:30:31 +1100834
Damien Millerfdb23062013-11-21 13:57:15 +1100835 while (isspace((u_char)*++s))
Darren Tucker03b1cdb2007-03-21 20:46:03 +1100836 ;
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000837
Damien Millere1537f92010-01-26 13:26:22 +1100838 /* XXX update list of forwards in options */
Darren Tuckere7066df2004-05-24 10:18:05 +1000839 if (delete) {
Damien Miller7acefbb2014-07-18 14:11:24 +1000840 /* We pass 1 for dynamicfwd to restrict to 1 or 2 fields. */
841 if (!parse_forward(&fwd, s, 1, 0)) {
842 logit("Bad forwarding close specification.");
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000843 goto out;
844 }
Damien Millerff773642011-09-22 21:39:48 +1000845 if (remote)
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000846 ok = channel_request_rforward_cancel(ssh, &fwd) == 0;
Damien Millerff773642011-09-22 21:39:48 +1000847 else if (dynamic)
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000848 ok = channel_cancel_lport_listener(ssh, &fwd,
Damien Miller7acefbb2014-07-18 14:11:24 +1000849 0, &options.fwd_opts) > 0;
Damien Millerff773642011-09-22 21:39:48 +1000850 else
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000851 ok = channel_cancel_lport_listener(ssh, &fwd,
Damien Miller7acefbb2014-07-18 14:11:24 +1000852 CHANNEL_CANCEL_PORT_STATIC,
853 &options.fwd_opts) > 0;
Damien Millerff773642011-09-22 21:39:48 +1000854 if (!ok) {
dtucker@openbsd.org9390b002017-01-29 21:35:23 +0000855 logit("Unknown port forwarding.");
Damien Millerff773642011-09-22 21:39:48 +1000856 goto out;
857 }
858 logit("Canceled forwarding.");
Darren Tuckere7066df2004-05-24 10:18:05 +1000859 } else {
Damien Miller4bf648f2009-02-14 16:28:21 +1100860 if (!parse_forward(&fwd, s, dynamic, remote)) {
Darren Tuckere7066df2004-05-24 10:18:05 +1000861 logit("Bad forwarding specification.");
862 goto out;
863 }
Damien Miller0164cb82008-11-05 16:30:31 +1100864 if (local || dynamic) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000865 if (!channel_setup_local_fwd_listener(ssh, &fwd,
Damien Miller7acefbb2014-07-18 14:11:24 +1000866 &options.fwd_opts)) {
Darren Tuckere7066df2004-05-24 10:18:05 +1000867 logit("Port forwarding failed.");
868 goto out;
869 }
Damien Millerf91ee4c2005-03-01 21:24:33 +1100870 } else {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000871 if (channel_request_remote_forwarding(ssh, &fwd) < 0) {
Darren Tuckere7d4b192006-07-12 22:17:10 +1000872 logit("Port forwarding failed.");
873 goto out;
874 }
Damien Millerf91ee4c2005-03-01 21:24:33 +1100875 }
Darren Tuckere7066df2004-05-24 10:18:05 +1000876 logit("Forwarding port.");
877 }
878
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000879out:
880 signal(SIGINT, handler);
Damien Miller21771e22011-05-15 08:45:50 +1000881 enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Darren Tuckera627d422013-06-02 07:31:17 +1000882 free(cmd);
883 free(fwd.listen_host);
Damien Miller7acefbb2014-07-18 14:11:24 +1000884 free(fwd.listen_path);
Darren Tuckera627d422013-06-02 07:31:17 +1000885 free(fwd.connect_host);
Damien Miller7acefbb2014-07-18 14:11:24 +1000886 free(fwd.connect_path);
Ben Lindstrom5589f4b2002-03-22 03:24:32 +0000887}
888
Darren Tucker92a39cf2012-09-07 11:20:20 +1000889/* reasons to suppress output of an escape command in help output */
890#define SUPPRESS_NEVER 0 /* never suppress, always show */
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000891#define SUPPRESS_MUXCLIENT 1 /* don't show in mux client sessions */
892#define SUPPRESS_MUXMASTER 2 /* don't show in mux master sessions */
893#define SUPPRESS_SYSLOG 4 /* don't show when logging to syslog */
Darren Tucker92a39cf2012-09-07 11:20:20 +1000894struct escape_help_text {
895 const char *cmd;
896 const char *text;
897 unsigned int flags;
898};
899static struct escape_help_text esc_txt[] = {
900 {".", "terminate session", SUPPRESS_MUXMASTER},
901 {".", "terminate connection (and any multiplexed sessions)",
902 SUPPRESS_MUXCLIENT},
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000903 {"B", "send a BREAK to the remote system", SUPPRESS_NEVER},
Darren Tucker92a39cf2012-09-07 11:20:20 +1000904 {"C", "open a command line", SUPPRESS_MUXCLIENT},
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000905 {"R", "request rekey", SUPPRESS_NEVER},
Darren Tuckerca0d0fd2012-09-07 11:22:24 +1000906 {"V/v", "decrease/increase verbosity (LogLevel)", SUPPRESS_MUXCLIENT},
Darren Tucker92a39cf2012-09-07 11:20:20 +1000907 {"^Z", "suspend ssh", SUPPRESS_MUXCLIENT},
908 {"#", "list forwarded connections", SUPPRESS_NEVER},
909 {"&", "background ssh (when waiting for connections to terminate)",
910 SUPPRESS_MUXCLIENT},
911 {"?", "this message", SUPPRESS_NEVER},
912};
913
914static void
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000915print_escape_help(struct sshbuf *b, int escape_char, int mux_client,
916 int using_stderr)
Darren Tucker92a39cf2012-09-07 11:20:20 +1000917{
918 unsigned int i, suppress_flags;
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000919 int r;
Darren Tucker92a39cf2012-09-07 11:20:20 +1000920
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000921 if ((r = sshbuf_putf(b,
922 "%c?\r\nSupported escape sequences:\r\n", escape_char)) != 0)
923 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Darren Tucker92a39cf2012-09-07 11:20:20 +1000924
djm@openbsd.org97f4d302017-04-30 23:13:25 +0000925 suppress_flags =
Darren Tucker92a39cf2012-09-07 11:20:20 +1000926 (mux_client ? SUPPRESS_MUXCLIENT : 0) |
927 (mux_client ? 0 : SUPPRESS_MUXMASTER) |
928 (using_stderr ? 0 : SUPPRESS_SYSLOG);
929
930 for (i = 0; i < sizeof(esc_txt)/sizeof(esc_txt[0]); i++) {
931 if (esc_txt[i].flags & suppress_flags)
932 continue;
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000933 if ((r = sshbuf_putf(b, " %c%-3s - %s\r\n",
934 escape_char, esc_txt[i].cmd, esc_txt[i].text)) != 0)
935 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Darren Tucker92a39cf2012-09-07 11:20:20 +1000936 }
937
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000938 if ((r = sshbuf_putf(b,
Darren Tuckerca0d0fd2012-09-07 11:22:24 +1000939 " %c%c - send the escape character by typing it twice\r\n"
Darren Tucker92a39cf2012-09-07 11:20:20 +1000940 "(Note that escapes are only recognized immediately after "
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000941 "newline.)\r\n", escape_char, escape_char)) != 0)
942 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Darren Tucker92a39cf2012-09-07 11:20:20 +1000943}
944
djm@openbsd.org84623e02018-06-26 02:02:36 +0000945/*
naddy@openbsd.org768405f2017-05-03 21:08:09 +0000946 * Process the characters one by one.
Darren Tucker2fb66ca2008-06-13 04:49:33 +1000947 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000948static int
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000949process_escapes(struct ssh *ssh, Channel *c,
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000950 struct sshbuf *bin, struct sshbuf *bout, struct sshbuf *berr,
Darren Tucker2fb66ca2008-06-13 04:49:33 +1000951 char *buf, int len)
Damien Millerad833b32000-08-23 10:46:23 +1000952{
Damien Millerad833b32000-08-23 10:46:23 +1000953 pid_t pid;
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000954 int r, bytes = 0;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000955 u_int i;
956 u_char ch;
Damien Millerad833b32000-08-23 10:46:23 +1000957 char *s;
djm@openbsd.org05164352017-04-30 23:21:54 +0000958 struct escape_filter_ctx *efc = c->filter_ctx == NULL ?
959 NULL : (struct escape_filter_ctx *)c->filter_ctx;
Damien Millerad833b32000-08-23 10:46:23 +1000960
djm@openbsd.org05164352017-04-30 23:21:54 +0000961 if (c->filter_ctx == NULL)
962 return 0;
djm@openbsd.org84623e02018-06-26 02:02:36 +0000963
Damien Millereccb9de2005-06-17 12:59:34 +1000964 if (len <= 0)
965 return (0);
966
967 for (i = 0; i < (u_int)len; i++) {
Damien Millerad833b32000-08-23 10:46:23 +1000968 /* Get one character at a time. */
969 ch = buf[i];
970
djm@openbsd.org05164352017-04-30 23:21:54 +0000971 if (efc->escape_pending) {
Damien Millerad833b32000-08-23 10:46:23 +1000972 /* We have previously seen an escape character. */
973 /* Clear the flag now. */
djm@openbsd.org05164352017-04-30 23:21:54 +0000974 efc->escape_pending = 0;
Damien Millerad833b32000-08-23 10:46:23 +1000975
976 /* Process the escaped character. */
977 switch (ch) {
978 case '.':
979 /* Terminate the connection. */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000980 if ((r = sshbuf_putf(berr, "%c.\r\n",
981 efc->escape_char)) != 0)
982 fatal("%s: buffer error: %s",
983 __func__, ssh_err(r));
Damien Millere1537f92010-01-26 13:26:22 +1100984 if (c && c->ctl_chan != -1) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000985 chan_read_failed(ssh, c);
986 chan_write_failed(ssh, c);
987 if (c->detach_user) {
988 c->detach_user(ssh,
989 c->self, NULL);
990 }
Damien Miller36187092013-06-10 13:07:11 +1000991 c->type = SSH_CHANNEL_ABANDONED;
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +0000992 sshbuf_reset(c->input);
djm@openbsd.orgdbee4112017-09-12 06:32:07 +0000993 chan_ibuf_empty(ssh, c);
Darren Tucker2fb66ca2008-06-13 04:49:33 +1000994 return 0;
995 } else
996 quit_pending = 1;
Damien Millerad833b32000-08-23 10:46:23 +1000997 return -1;
998
999 case 'Z' - 64:
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001000 /* XXX support this for mux clients */
Damien Millere1537f92010-01-26 13:26:22 +11001001 if (c && c->ctl_chan != -1) {
Darren Tuckerf111d402012-09-07 11:21:42 +10001002 char b[16];
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001003 noescape:
Darren Tuckerf111d402012-09-07 11:21:42 +10001004 if (ch == 'Z' - 64)
1005 snprintf(b, sizeof b, "^Z");
1006 else
1007 snprintf(b, sizeof b, "%c", ch);
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001008 if ((r = sshbuf_putf(berr,
Darren Tuckerf111d402012-09-07 11:21:42 +10001009 "%c%s escape not available to "
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001010 "multiplexed sessions\r\n",
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001011 efc->escape_char, b)) != 0)
1012 fatal("%s: buffer error: %s",
1013 __func__, ssh_err(r));
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001014 continue;
1015 }
Darren Tucker4d5cd332008-06-13 04:51:14 +10001016 /* Suspend the program. Inform the user */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001017 if ((r = sshbuf_putf(berr,
1018 "%c^Z [suspend ssh]\r\n",
1019 efc->escape_char)) != 0)
1020 fatal("%s: buffer error: %s",
1021 __func__, ssh_err(r));
Damien Millerad833b32000-08-23 10:46:23 +10001022
1023 /* Restore terminal modes and suspend. */
1024 client_suspend_self(bin, bout, berr);
1025
1026 /* We have been continued. */
1027 continue;
1028
Damien Miller54c45982003-05-15 10:20:13 +10001029 case 'B':
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001030 if ((r = sshbuf_putf(berr,
1031 "%cB\r\n", efc->escape_char)) != 0)
1032 fatal("%s: buffer error: %s",
1033 __func__, ssh_err(r));
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001034 channel_request_start(ssh, c->self, "break", 0);
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001035 if ((r = sshpkt_put_u32(ssh, 1000)) != 0 ||
1036 (r = sshpkt_send(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00001037 fatal("%s: send packet: %s", __func__,
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001038 ssh_err(r));
Damien Miller54c45982003-05-15 10:20:13 +10001039 continue;
1040
Ben Lindstromf28f6342001-04-04 02:03:04 +00001041 case 'R':
djm@openbsd.org97f4d302017-04-30 23:13:25 +00001042 if (datafellows & SSH_BUG_NOREKEY)
1043 logit("Server does not "
1044 "support re-keying");
1045 else
1046 need_rekeying = 1;
Ben Lindstromf28f6342001-04-04 02:03:04 +00001047 continue;
1048
Darren Tucker50a48d02012-09-06 21:25:37 +10001049 case 'V':
1050 /* FALLTHROUGH */
1051 case 'v':
1052 if (c && c->ctl_chan != -1)
1053 goto noescape;
1054 if (!log_is_on_stderr()) {
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001055 if ((r = sshbuf_putf(berr,
Darren Tucker50a48d02012-09-06 21:25:37 +10001056 "%c%c [Logging to syslog]\r\n",
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001057 efc->escape_char, ch)) != 0)
1058 fatal("%s: buffer error: %s",
1059 __func__, ssh_err(r));
Darren Tucker50a48d02012-09-06 21:25:37 +10001060 continue;
1061 }
1062 if (ch == 'V' && options.log_level >
1063 SYSLOG_LEVEL_QUIET)
1064 log_change_level(--options.log_level);
1065 if (ch == 'v' && options.log_level <
1066 SYSLOG_LEVEL_DEBUG3)
1067 log_change_level(++options.log_level);
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001068 if ((r = sshbuf_putf(berr,
djm@openbsd.org05164352017-04-30 23:21:54 +00001069 "%c%c [LogLevel %s]\r\n",
1070 efc->escape_char, ch,
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001071 log_level_name(options.log_level))) != 0)
1072 fatal("%s: buffer error: %s",
1073 __func__, ssh_err(r));
Darren Tucker50a48d02012-09-06 21:25:37 +10001074 continue;
1075
Damien Millerad833b32000-08-23 10:46:23 +10001076 case '&':
Damien Millere1537f92010-01-26 13:26:22 +11001077 if (c && c->ctl_chan != -1)
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001078 goto noescape;
Damien Millerad833b32000-08-23 10:46:23 +10001079 /*
Darren Tucker4d5cd332008-06-13 04:51:14 +10001080 * Detach the program (continue to serve
1081 * connections, but put in background and no
1082 * more new connections).
Damien Millerad833b32000-08-23 10:46:23 +10001083 */
Damien Miller96507ef2001-11-12 10:52:25 +11001084 /* Restore tty modes. */
Damien Miller21771e22011-05-15 08:45:50 +10001085 leave_raw_mode(
1086 options.request_tty == REQUEST_TTY_FORCE);
Damien Miller96507ef2001-11-12 10:52:25 +11001087
1088 /* Stop listening for new connections. */
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001089 channel_stop_listening(ssh);
Damien Miller96507ef2001-11-12 10:52:25 +11001090
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001091 if ((r = sshbuf_putf(berr,
1092 "%c& [backgrounded]\n", efc->escape_char))
1093 != 0)
1094 fatal("%s: buffer error: %s",
1095 __func__, ssh_err(r));
Damien Miller96507ef2001-11-12 10:52:25 +11001096
1097 /* Fork into background. */
1098 pid = fork();
deraadt@openbsd.org4d28fa72019-06-28 13:35:04 +00001099 if (pid == -1) {
Damien Miller96507ef2001-11-12 10:52:25 +11001100 error("fork: %.100s", strerror(errno));
1101 continue;
1102 }
1103 if (pid != 0) { /* This is the parent. */
1104 /* The parent just exits. */
1105 exit(0);
1106 }
1107 /* The child continues serving connections. */
djm@openbsd.org97f4d302017-04-30 23:13:25 +00001108 /* fake EOF on stdin */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001109 if ((r = sshbuf_put_u8(bin, 4)) != 0)
1110 fatal("%s: buffer error: %s",
1111 __func__, ssh_err(r));
djm@openbsd.org97f4d302017-04-30 23:13:25 +00001112 return -1;
Damien Millerad833b32000-08-23 10:46:23 +10001113 case '?':
djm@openbsd.org05164352017-04-30 23:21:54 +00001114 print_escape_help(berr, efc->escape_char,
Darren Tucker92a39cf2012-09-07 11:20:20 +10001115 (c && c->ctl_chan != -1),
1116 log_is_on_stderr());
Damien Millerad833b32000-08-23 10:46:23 +10001117 continue;
1118
1119 case '#':
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001120 if ((r = sshbuf_putf(berr, "%c#\r\n",
1121 efc->escape_char)) != 0)
1122 fatal("%s: buffer error: %s",
1123 __func__, ssh_err(r));
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001124 s = channel_open_message(ssh);
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001125 if ((r = sshbuf_put(berr, s, strlen(s))) != 0)
1126 fatal("%s: buffer error: %s",
1127 __func__, ssh_err(r));
Darren Tuckera627d422013-06-02 07:31:17 +10001128 free(s);
Damien Millerad833b32000-08-23 10:46:23 +10001129 continue;
1130
Ben Lindstrom5589f4b2002-03-22 03:24:32 +00001131 case 'C':
Damien Millere1537f92010-01-26 13:26:22 +11001132 if (c && c->ctl_chan != -1)
Damien Miller586b0052008-12-09 14:11:32 +11001133 goto noescape;
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001134 process_cmdline(ssh);
Ben Lindstrom5589f4b2002-03-22 03:24:32 +00001135 continue;
1136
Damien Millerad833b32000-08-23 10:46:23 +10001137 default:
djm@openbsd.org05164352017-04-30 23:21:54 +00001138 if (ch != efc->escape_char) {
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001139 if ((r = sshbuf_put_u8(bin,
1140 efc->escape_char)) != 0)
1141 fatal("%s: buffer error: %s",
1142 __func__, ssh_err(r));
Damien Millerad833b32000-08-23 10:46:23 +10001143 bytes++;
1144 }
1145 /* Escaped characters fall through here */
1146 break;
1147 }
1148 } else {
1149 /*
Darren Tucker4d5cd332008-06-13 04:51:14 +10001150 * The previous character was not an escape char.
1151 * Check if this is an escape.
Damien Millerad833b32000-08-23 10:46:23 +10001152 */
djm@openbsd.org05164352017-04-30 23:21:54 +00001153 if (last_was_cr && ch == efc->escape_char) {
Darren Tucker4d5cd332008-06-13 04:51:14 +10001154 /*
1155 * It is. Set the flag and continue to
1156 * next character.
1157 */
djm@openbsd.org05164352017-04-30 23:21:54 +00001158 efc->escape_pending = 1;
Damien Millerad833b32000-08-23 10:46:23 +10001159 continue;
1160 }
1161 }
1162
1163 /*
1164 * Normal character. Record whether it was a newline,
1165 * and append it to the buffer.
1166 */
1167 last_was_cr = (ch == '\r' || ch == '\n');
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001168 if ((r = sshbuf_put_u8(bin, ch)) != 0)
1169 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Damien Millerad833b32000-08-23 10:46:23 +10001170 bytes++;
1171 }
1172 return bytes;
1173}
1174
Damien Miller5428f641999-11-25 11:54:57 +11001175/*
Damien Millerb38eff82000-04-01 11:09:21 +10001176 * Get packets from the connection input buffer, and process them as long as
1177 * there are packets available.
1178 *
1179 * Any unknown packets received during the actual
1180 * session cause the session to terminate. This is
1181 * intended to make debugging easier since no
1182 * confirmations are sent. Any compatible protocol
1183 * extensions must be negotiated during the
1184 * preparatory phase.
1185 */
1186
Ben Lindstrombba81212001-06-25 05:01:22 +00001187static void
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001188client_process_buffered_input_packets(struct ssh *ssh)
Damien Millerb38eff82000-04-01 11:09:21 +10001189{
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001190 ssh_dispatch_run_fatal(ssh, DISPATCH_NONBLOCK, &quit_pending);
Damien Millerb38eff82000-04-01 11:09:21 +10001191}
1192
Damien Millerad833b32000-08-23 10:46:23 +10001193/* scan buf[] for '~' before sending data to the peer */
1194
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001195/* Helper: allocate a new escape_filter_ctx and fill in its escape char */
1196void *
1197client_new_escape_filter_ctx(int escape_char)
1198{
1199 struct escape_filter_ctx *ret;
1200
Damien Miller6c81fee2013-11-08 12:19:55 +11001201 ret = xcalloc(1, sizeof(*ret));
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001202 ret->escape_pending = 0;
1203 ret->escape_char = escape_char;
1204 return (void *)ret;
1205}
1206
Darren Tucker84c56f52008-06-13 04:55:46 +10001207/* Free the escape filter context on channel free */
1208void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001209client_filter_cleanup(struct ssh *ssh, int cid, void *ctx)
Darren Tucker84c56f52008-06-13 04:55:46 +10001210{
Darren Tuckera627d422013-06-02 07:31:17 +10001211 free(ctx);
Darren Tucker84c56f52008-06-13 04:55:46 +10001212}
1213
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001214int
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001215client_simple_escape_filter(struct ssh *ssh, Channel *c, char *buf, int len)
Damien Millerad833b32000-08-23 10:46:23 +10001216{
Damien Miller5771ed72008-05-19 15:35:33 +10001217 if (c->extended_usage != CHAN_EXTENDED_WRITE)
1218 return 0;
1219
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001220 return process_escapes(ssh, c, c->input, c->output, c->extended,
Darren Tucker2fb66ca2008-06-13 04:49:33 +10001221 buf, len);
Damien Millerad833b32000-08-23 10:46:23 +10001222}
1223
Ben Lindstrombba81212001-06-25 05:01:22 +00001224static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001225client_channel_closed(struct ssh *ssh, int id, void *arg)
Ben Lindstrom4c3f77d2001-04-05 23:37:36 +00001226{
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001227 channel_cancel_cleanup(ssh, id);
Ben Lindstrom4c3f77d2001-04-05 23:37:36 +00001228 session_closed = 1;
Damien Miller21771e22011-05-15 08:45:50 +10001229 leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Ben Lindstrom4c3f77d2001-04-05 23:37:36 +00001230}
1231
Damien Millerb38eff82000-04-01 11:09:21 +10001232/*
Damien Miller5428f641999-11-25 11:54:57 +11001233 * Implements the interactive session with the server. This is called after
1234 * the user has been authenticated, and a command has been started on the
Ben Lindstrom2b1f71b2001-06-05 20:32:21 +00001235 * remote host. If escape_char != SSH_ESCAPECHAR_NONE, it is the character
1236 * used as an escape character for terminating or suspending the session.
Damien Miller5428f641999-11-25 11:54:57 +11001237 */
Damien Miller4af51302000-04-16 11:18:38 +10001238int
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001239client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
1240 int ssh2_chan_id)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001241{
Damien Miller5e953212001-01-30 09:14:00 +11001242 fd_set *readset = NULL, *writeset = NULL;
Damien Miller95def091999-11-25 00:26:21 +11001243 double start_time, total_time;
djm@openbsd.org19bcf2e2016-02-08 10:57:07 +00001244 int r, max_fd = 0, max_fd2 = 0, len;
Damien Millerb61f3fc2008-07-11 17:36:48 +10001245 u_int64_t ibytes, obytes;
Darren Tuckerc7a6fc42004-08-13 21:18:00 +10001246 u_int nalloc = 0;
Damien Miller95def091999-11-25 00:26:21 +11001247 char buf[100];
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001248
Damien Miller95def091999-11-25 00:26:21 +11001249 debug("Entering interactive session.");
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001250
semarie@openbsd.orgd7d2bc92015-12-26 07:46:03 +00001251 if (options.control_master &&
djm@openbsd.org368dd972016-07-23 02:54:08 +00001252 !option_clear_or_none(options.control_path)) {
semarie@openbsd.orgd7d2bc92015-12-26 07:46:03 +00001253 debug("pledge: id");
mestre@openbsd.org7adf6c42019-07-24 08:57:00 +00001254 if (pledge("stdio rpath wpath cpath unix inet dns recvfd sendfd proc exec id tty",
semarie@openbsd.orgd7d2bc92015-12-26 07:46:03 +00001255 NULL) == -1)
1256 fatal("%s pledge(): %s", __func__, strerror(errno));
1257
1258 } else if (options.forward_x11 || options.permit_local_command) {
semarie@openbsd.orgb91926a2015-12-03 17:00:18 +00001259 debug("pledge: exec");
1260 if (pledge("stdio rpath wpath cpath unix inet dns proc exec tty",
1261 NULL) == -1)
1262 fatal("%s pledge(): %s", __func__, strerror(errno));
1263
1264 } else if (options.update_hostkeys) {
1265 debug("pledge: filesystem full");
1266 if (pledge("stdio rpath wpath cpath unix inet dns proc tty",
1267 NULL) == -1)
1268 fatal("%s pledge(): %s", __func__, strerror(errno));
1269
djm@openbsd.org368dd972016-07-23 02:54:08 +00001270 } else if (!option_clear_or_none(options.proxy_command) ||
1271 fork_after_authentication_flag) {
semarie@openbsd.orgb91926a2015-12-03 17:00:18 +00001272 debug("pledge: proc");
1273 if (pledge("stdio cpath unix inet dns proc tty", NULL) == -1)
1274 fatal("%s pledge(): %s", __func__, strerror(errno));
1275
semarie@openbsd.orgb91926a2015-12-03 17:00:18 +00001276 } else {
1277 debug("pledge: network");
mestre@openbsd.orge2386452017-06-23 07:24:48 +00001278 if (pledge("stdio unix inet dns proc tty", NULL) == -1)
semarie@openbsd.orgb91926a2015-12-03 17:00:18 +00001279 fatal("%s pledge(): %s", __func__, strerror(errno));
1280 }
1281
dtucker@openbsd.org@openbsd.org2d638e92017-11-25 05:58:47 +00001282 start_time = monotime_double();
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001283
Damien Miller95def091999-11-25 00:26:21 +11001284 /* Initialize variables. */
Damien Miller95def091999-11-25 00:26:21 +11001285 last_was_cr = 1;
1286 exit_status = -1;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001287 connection_in = ssh_packet_get_connection_in(ssh);
1288 connection_out = ssh_packet_get_connection_out(ssh);
deraadt@openbsd.org9136ec12016-09-12 01:22:38 +00001289 max_fd = MAXIMUM(connection_in, connection_out);
Damien Miller5e953212001-01-30 09:14:00 +11001290
Damien Miller95def091999-11-25 00:26:21 +11001291 quit_pending = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001292
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001293 /* Initialize buffer. */
1294 if ((stderr_buffer = sshbuf_new()) == NULL)
1295 fatal("%s: sshbuf_new failed", __func__);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001296
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001297 client_init_dispatch(ssh);
Damien Millerb38eff82000-04-01 11:09:21 +10001298
Ben Lindstromf49dbff2002-12-23 02:01:55 +00001299 /*
1300 * Set signal handlers, (e.g. to restore non-blocking mode)
1301 * but don't overwrite SIG_IGN, matches behaviour from rsh(1)
1302 */
Darren Tucker07336da2004-11-05 20:02:16 +11001303 if (signal(SIGHUP, SIG_IGN) != SIG_IGN)
1304 signal(SIGHUP, signal_handler);
Ben Lindstromf49dbff2002-12-23 02:01:55 +00001305 if (signal(SIGINT, SIG_IGN) != SIG_IGN)
1306 signal(SIGINT, signal_handler);
1307 if (signal(SIGQUIT, SIG_IGN) != SIG_IGN)
1308 signal(SIGQUIT, signal_handler);
1309 if (signal(SIGTERM, SIG_IGN) != SIG_IGN)
1310 signal(SIGTERM, signal_handler);
Darren Tucker5d78de62004-11-05 20:35:44 +11001311 signal(SIGWINCH, window_change_handler);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001312
Damien Miller95def091999-11-25 00:26:21 +11001313 if (have_pty)
Damien Miller21771e22011-05-15 08:45:50 +10001314 enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001315
djm@openbsd.org97f4d302017-04-30 23:13:25 +00001316 session_ident = ssh2_chan_id;
1317 if (session_ident != -1) {
1318 if (escape_char_arg != SSH_ESCAPECHAR_NONE) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001319 channel_register_filter(ssh, session_ident,
djm@openbsd.org97f4d302017-04-30 23:13:25 +00001320 client_simple_escape_filter, NULL,
1321 client_filter_cleanup,
1322 client_new_escape_filter_ctx(
1323 escape_char_arg));
Damien Miller6c3eec72011-05-05 14:16:22 +10001324 }
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001325 channel_register_cleanup(ssh, session_ident,
djm@openbsd.org97f4d302017-04-30 23:13:25 +00001326 client_channel_closed, 0);
Ben Lindstrom5b828322001-02-09 01:34:36 +00001327 }
Damien Millerad833b32000-08-23 10:46:23 +10001328
Damien Miller95def091999-11-25 00:26:21 +11001329 /* Main loop of the client for the interactive session mode. */
1330 while (!quit_pending) {
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001331
Damien Miller5428f641999-11-25 11:54:57 +11001332 /* Process buffered packets sent by the server. */
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001333 client_process_buffered_input_packets(ssh);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001334
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001335 if (session_closed && !channel_still_open(ssh))
Damien Miller1383bd82000-04-06 12:32:37 +10001336 break;
Ben Lindstrom4c3f77d2001-04-05 23:37:36 +00001337
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001338 if (ssh_packet_is_rekeying(ssh)) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +00001339 debug("rekeying in progress");
djm@openbsd.org19bcf2e2016-02-08 10:57:07 +00001340 } else if (need_rekeying) {
1341 /* manual rekey request */
1342 debug("need rekeying");
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001343 if ((r = kex_start_rekex(ssh)) != 0)
djm@openbsd.org19bcf2e2016-02-08 10:57:07 +00001344 fatal("%s: kex_start_rekex: %s", __func__,
1345 ssh_err(r));
1346 need_rekeying = 0;
Ben Lindstrombe2cc432001-04-04 23:46:07 +00001347 } else {
1348 /*
Ben Lindstrombe2cc432001-04-04 23:46:07 +00001349 * Make packets from buffered channel data, and
1350 * enqueue them for sending to the server.
1351 */
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001352 if (ssh_packet_not_very_much_data_to_write(ssh))
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001353 channel_output_poll(ssh);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001354
Ben Lindstrombe2cc432001-04-04 23:46:07 +00001355 /*
1356 * Check if the window size has changed, and buffer a
1357 * message about it to the server if so.
1358 */
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001359 client_check_window_change(ssh);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001360
Ben Lindstrombe2cc432001-04-04 23:46:07 +00001361 if (quit_pending)
1362 break;
1363 }
Damien Miller5428f641999-11-25 11:54:57 +11001364 /*
1365 * Wait until we have something to do (something becomes
1366 * available on one of the descriptors).
1367 */
Ben Lindstrom16d29d52001-07-18 16:01:46 +00001368 max_fd2 = max_fd;
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001369 client_wait_until_can_do_something(ssh, &readset, &writeset,
1370 &max_fd2, &nalloc, ssh_packet_is_rekeying(ssh));
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001371
Damien Miller95def091999-11-25 00:26:21 +11001372 if (quit_pending)
1373 break;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001374
Ben Lindstrombe2cc432001-04-04 23:46:07 +00001375 /* Do channel operations unless rekeying in progress. */
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001376 if (!ssh_packet_is_rekeying(ssh))
1377 channel_after_select(ssh, readset, writeset);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001378
Damien Miller1383bd82000-04-06 12:32:37 +10001379 /* Buffer input from the connection. */
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001380 client_process_net_input(ssh, readset);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001381
Damien Miller1383bd82000-04-06 12:32:37 +10001382 if (quit_pending)
1383 break;
1384
Darren Tucker4d5cd332008-06-13 04:51:14 +10001385 /*
1386 * Send as much buffered packet data as possible to the
1387 * sender.
1388 */
Damien Miller5e953212001-01-30 09:14:00 +11001389 if (FD_ISSET(connection_out, writeset))
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001390 ssh_packet_write_poll(ssh);
Damien Millere11e1ea2010-08-03 16:04:46 +10001391
1392 /*
1393 * If we are a backgrounded control master, and the
1394 * timeout has expired without any active client
1395 * connections, then quit.
1396 */
1397 if (control_persist_exit_time > 0) {
Darren Tuckerb759c9c2013-06-02 07:46:16 +10001398 if (monotime() >= control_persist_exit_time) {
Damien Millere11e1ea2010-08-03 16:04:46 +10001399 debug("ControlPersist timeout expired");
1400 break;
1401 }
1402 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001403 }
Darren Tuckera627d422013-06-02 07:31:17 +10001404 free(readset);
1405 free(writeset);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001406
Damien Miller95def091999-11-25 00:26:21 +11001407 /* Terminate the session. */
1408
1409 /* Stop watching for window change. */
Darren Tucker5d78de62004-11-05 20:35:44 +11001410 signal(SIGWINCH, SIG_DFL);
Damien Miller95def091999-11-25 00:26:21 +11001411
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001412 if ((r = sshpkt_start(ssh, SSH2_MSG_DISCONNECT)) != 0 ||
1413 (r = sshpkt_put_u32(ssh, SSH2_DISCONNECT_BY_APPLICATION)) != 0 ||
1414 (r = sshpkt_put_cstring(ssh, "disconnected by user")) != 0 ||
1415 (r = sshpkt_put_cstring(ssh, "")) != 0 || /* language tag */
1416 (r = sshpkt_send(ssh)) != 0 ||
1417 (r = ssh_packet_write_wait(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00001418 fatal("%s: send disconnect: %s", __func__, ssh_err(r));
Darren Tucker12b4a652009-06-21 18:14:48 +10001419
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001420 channel_free_all(ssh);
Damien Miller95def091999-11-25 00:26:21 +11001421
Ben Lindstromec46e0b2001-06-09 01:27:31 +00001422 if (have_pty)
Damien Miller21771e22011-05-15 08:45:50 +10001423 leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Ben Lindstromc93e84c2001-05-12 00:08:37 +00001424
1425 /* restore blocking io */
1426 if (!isatty(fileno(stdin)))
1427 unset_nonblock(fileno(stdin));
1428 if (!isatty(fileno(stdout)))
1429 unset_nonblock(fileno(stdout));
1430 if (!isatty(fileno(stderr)))
1431 unset_nonblock(fileno(stderr));
1432
Damien Millerd6965512003-12-17 16:31:53 +11001433 /*
1434 * If there was no shell or command requested, there will be no remote
1435 * exit status to be returned. In that case, clear error code if the
1436 * connection was deliberately terminated at this end.
1437 */
1438 if (no_shell_flag && received_signal == SIGTERM) {
1439 received_signal = 0;
1440 exit_status = 0;
1441 }
1442
dtucker@openbsd.orgb1e72df2017-07-14 03:18:21 +00001443 if (received_signal) {
1444 verbose("Killed by signal %d.", (int) received_signal);
1445 cleanup_exit(0);
1446 }
Ben Lindstromec46e0b2001-06-09 01:27:31 +00001447
1448 /*
1449 * In interactive mode (with pseudo tty) display a message indicating
1450 * that the connection has been closed.
1451 */
1452 if (have_pty && options.log_level != SYSLOG_LEVEL_QUIET) {
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001453 if ((r = sshbuf_putf(stderr_buffer,
1454 "Connection to %.64s closed.\r\n", host)) != 0)
1455 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Ben Lindstromec46e0b2001-06-09 01:27:31 +00001456 }
1457
Damien Miller95def091999-11-25 00:26:21 +11001458 /* Output any buffered data for stderr. */
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001459 if (sshbuf_len(stderr_buffer) > 0) {
Damien Miller4791f9d2011-01-16 23:16:53 +11001460 len = atomicio(vwrite, fileno(stderr),
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001461 (u_char *)sshbuf_ptr(stderr_buffer),
1462 sshbuf_len(stderr_buffer));
1463 if (len < 0 || (u_int)len != sshbuf_len(stderr_buffer))
Damien Miller95def091999-11-25 00:26:21 +11001464 error("Write failed flushing stderr buffer.");
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001465 else if ((r = sshbuf_consume(stderr_buffer, len)) != 0)
1466 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Damien Miller95def091999-11-25 00:26:21 +11001467 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001468
Damien Miller95def091999-11-25 00:26:21 +11001469 /* Clear and free any buffers. */
jsg@openbsd.org458abc22016-01-23 05:31:35 +00001470 explicit_bzero(buf, sizeof(buf));
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00001471 sshbuf_free(stderr_buffer);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001472
Damien Miller95def091999-11-25 00:26:21 +11001473 /* Report bytes transferred, and transfer rates. */
dtucker@openbsd.org@openbsd.org2d638e92017-11-25 05:58:47 +00001474 total_time = monotime_double() - start_time;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001475 ssh_packet_get_bytes(ssh, &ibytes, &obytes);
Damien Millerb61f3fc2008-07-11 17:36:48 +10001476 verbose("Transferred: sent %llu, received %llu bytes, in %.1f seconds",
Damien Miller821de0a2011-01-11 17:20:29 +11001477 (unsigned long long)obytes, (unsigned long long)ibytes, total_time);
Damien Miller95def091999-11-25 00:26:21 +11001478 if (total_time > 0)
Damien Millerb61f3fc2008-07-11 17:36:48 +10001479 verbose("Bytes per second: sent %.1f, received %.1f",
1480 obytes / total_time, ibytes / total_time);
Damien Miller95def091999-11-25 00:26:21 +11001481 /* Return the exit status of the program. */
1482 debug("Exit status %d", exit_status);
1483 return exit_status;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001484}
Damien Millerb38eff82000-04-01 11:09:21 +10001485
1486/*********/
1487
Ben Lindstrombba81212001-06-25 05:01:22 +00001488static Channel *
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001489client_request_forwarded_tcpip(struct ssh *ssh, const char *request_type,
1490 int rchan, u_int rwindow, u_int rmaxpack)
Damien Miller0bc1bd82000-11-13 22:57:25 +11001491{
Ben Lindstroma962c2f2002-07-04 00:14:17 +00001492 Channel *c = NULL;
markus@openbsd.org8d057842016-09-30 09:19:13 +00001493 struct sshbuf *b = NULL;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001494 char *listen_address, *originator_address;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001495 u_int listen_port, originator_port;
markus@openbsd.org8d057842016-09-30 09:19:13 +00001496 int r;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001497
1498 /* Get rest of the packet */
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001499 if ((r = sshpkt_get_cstring(ssh, &listen_address, NULL)) != 0 ||
1500 (r = sshpkt_get_u32(ssh, &listen_port)) != 0 ||
1501 (r = sshpkt_get_cstring(ssh, &originator_address, NULL)) != 0 ||
1502 (r = sshpkt_get_u32(ssh, &originator_port)) != 0 ||
1503 (r = sshpkt_get_end(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00001504 fatal("%s: parse packet: %s", __func__, ssh_err(r));
Damien Miller0bc1bd82000-11-13 22:57:25 +11001505
Damien Miller7acefbb2014-07-18 14:11:24 +10001506 debug("%s: listen %s port %d, originator %s port %d", __func__,
1507 listen_address, listen_port, originator_address, originator_port);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001508
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001509 if (listen_port > 0xffff)
1510 error("%s: invalid listen port", __func__);
1511 else if (originator_port > 0xffff)
1512 error("%s: invalid originator port", __func__);
1513 else {
1514 c = channel_connect_by_listen_address(ssh,
1515 listen_address, listen_port, "forwarded-tcpip",
1516 originator_address);
1517 }
Damien Millerbd740252008-05-19 15:37:09 +10001518
markus@openbsd.org8d057842016-09-30 09:19:13 +00001519 if (c != NULL && c->type == SSH_CHANNEL_MUX_CLIENT) {
1520 if ((b = sshbuf_new()) == NULL) {
1521 error("%s: alloc reply", __func__);
1522 goto out;
1523 }
1524 /* reconstruct and send to muxclient */
1525 if ((r = sshbuf_put_u8(b, 0)) != 0 || /* padlen */
1526 (r = sshbuf_put_u8(b, SSH2_MSG_CHANNEL_OPEN)) != 0 ||
1527 (r = sshbuf_put_cstring(b, request_type)) != 0 ||
1528 (r = sshbuf_put_u32(b, rchan)) != 0 ||
1529 (r = sshbuf_put_u32(b, rwindow)) != 0 ||
1530 (r = sshbuf_put_u32(b, rmaxpack)) != 0 ||
1531 (r = sshbuf_put_cstring(b, listen_address)) != 0 ||
1532 (r = sshbuf_put_u32(b, listen_port)) != 0 ||
1533 (r = sshbuf_put_cstring(b, originator_address)) != 0 ||
1534 (r = sshbuf_put_u32(b, originator_port)) != 0 ||
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001535 (r = sshbuf_put_stringb(c->output, b)) != 0) {
markus@openbsd.org8d057842016-09-30 09:19:13 +00001536 error("%s: compose for muxclient %s", __func__,
1537 ssh_err(r));
1538 goto out;
1539 }
1540 }
1541
1542 out:
1543 sshbuf_free(b);
Darren Tuckera627d422013-06-02 07:31:17 +10001544 free(originator_address);
1545 free(listen_address);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001546 return c;
1547}
1548
Ben Lindstroma962c2f2002-07-04 00:14:17 +00001549static Channel *
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001550client_request_forwarded_streamlocal(struct ssh *ssh,
1551 const char *request_type, int rchan)
Damien Miller7acefbb2014-07-18 14:11:24 +10001552{
1553 Channel *c = NULL;
1554 char *listen_path;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001555 int r;
Damien Miller7acefbb2014-07-18 14:11:24 +10001556
1557 /* Get the remote path. */
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001558 if ((r = sshpkt_get_cstring(ssh, &listen_path, NULL)) != 0 ||
1559 (r = sshpkt_get_string(ssh, NULL, NULL)) != 0 || /* reserved */
1560 (r = sshpkt_get_end(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00001561 fatal("%s: parse packet: %s", __func__, ssh_err(r));
Damien Miller7acefbb2014-07-18 14:11:24 +10001562
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00001563 debug("%s: request: %s", __func__, listen_path);
Damien Miller7acefbb2014-07-18 14:11:24 +10001564
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001565 c = channel_connect_by_listen_path(ssh, listen_path,
Damien Miller7acefbb2014-07-18 14:11:24 +10001566 "forwarded-streamlocal@openssh.com", "forwarded-streamlocal");
1567 free(listen_path);
1568 return c;
1569}
1570
1571static Channel *
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001572client_request_x11(struct ssh *ssh, const char *request_type, int rchan)
Damien Miller0bc1bd82000-11-13 22:57:25 +11001573{
1574 Channel *c = NULL;
1575 char *originator;
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001576 u_int originator_port;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001577 int r, sock;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001578
1579 if (!options.forward_x11) {
1580 error("Warning: ssh server tried X11 forwarding.");
Darren Tucker4d5cd332008-06-13 04:51:14 +10001581 error("Warning: this is probably a break-in attempt by a "
1582 "malicious server.");
Damien Miller0bc1bd82000-11-13 22:57:25 +11001583 return NULL;
1584 }
djm@openbsd.org1bf477d2015-07-01 02:26:31 +00001585 if (x11_refuse_time != 0 && (u_int)monotime() >= x11_refuse_time) {
Damien Miller1ab6a512010-06-26 10:02:24 +10001586 verbose("Rejected X11 connection after ForwardX11Timeout "
1587 "expired");
1588 return NULL;
1589 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001590 if ((r = sshpkt_get_cstring(ssh, &originator, NULL)) != 0 ||
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001591 (r = sshpkt_get_u32(ssh, &originator_port)) != 0 ||
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001592 (r = sshpkt_get_end(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00001593 fatal("%s: parse packet: %s", __func__, ssh_err(r));
Damien Miller0bc1bd82000-11-13 22:57:25 +11001594 /* XXX check permission */
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001595 /* XXX range check originator port? */
1596 debug("client_request_x11: request from %s %u", originator,
Damien Millerd83ff352001-01-30 09:19:34 +11001597 originator_port);
Darren Tuckera627d422013-06-02 07:31:17 +10001598 free(originator);
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001599 sock = x11_connect_display(ssh);
Ben Lindstrom99c73b32001-05-05 04:09:47 +00001600 if (sock < 0)
1601 return NULL;
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001602 c = channel_new(ssh, "x11",
Ben Lindstrom99c73b32001-05-05 04:09:47 +00001603 SSH_CHANNEL_X11_OPEN, sock, sock, -1,
Damien Millerb1ca8bb2003-05-14 13:45:42 +10001604 CHAN_TCP_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 0, "x11", 1);
Ben Lindstrom944c4f02001-09-18 05:51:13 +00001605 c->force_drain = 1;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001606 return c;
1607}
1608
Ben Lindstroma962c2f2002-07-04 00:14:17 +00001609static Channel *
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001610client_request_agent(struct ssh *ssh, const char *request_type, int rchan)
Damien Miller0bc1bd82000-11-13 22:57:25 +11001611{
1612 Channel *c = NULL;
djm@openbsd.org141efe42015-01-14 20:05:27 +00001613 int r, sock;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001614
1615 if (!options.forward_agent) {
1616 error("Warning: ssh server tried agent forwarding.");
Darren Tucker4d5cd332008-06-13 04:51:14 +10001617 error("Warning: this is probably a break-in attempt by a "
1618 "malicious server.");
Damien Miller0bc1bd82000-11-13 22:57:25 +11001619 return NULL;
1620 }
djm@openbsd.org141efe42015-01-14 20:05:27 +00001621 if ((r = ssh_get_authentication_socket(&sock)) != 0) {
1622 if (r != SSH_ERR_AGENT_NOT_PRESENT)
1623 debug("%s: ssh_get_authentication_socket: %s",
1624 __func__, ssh_err(r));
Ben Lindstrom99c73b32001-05-05 04:09:47 +00001625 return NULL;
djm@openbsd.org141efe42015-01-14 20:05:27 +00001626 }
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001627 c = channel_new(ssh, "authentication agent connection",
Ben Lindstrom99c73b32001-05-05 04:09:47 +00001628 SSH_CHANNEL_OPEN, sock, sock, -1,
Darren Tucker5baa1702007-12-29 09:37:10 +11001629 CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0,
Damien Millerb1ca8bb2003-05-14 13:45:42 +10001630 "authentication agent connection", 1);
Ben Lindstrom944c4f02001-09-18 05:51:13 +00001631 c->force_drain = 1;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001632 return c;
1633}
1634
djm@openbsd.orgb7548b12017-10-23 05:08:00 +00001635char *
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001636client_request_tun_fwd(struct ssh *ssh, int tun_mode,
1637 int local_tun, int remote_tun)
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001638{
1639 Channel *c;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001640 int r, fd;
djm@openbsd.orgb7548b12017-10-23 05:08:00 +00001641 char *ifname = NULL;
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001642
1643 if (tun_mode == SSH_TUNMODE_NO)
1644 return 0;
1645
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001646 debug("Requesting tun unit %d in mode %d", local_tun, tun_mode);
1647
1648 /* Open local tunnel device */
djm@openbsd.orgb7548b12017-10-23 05:08:00 +00001649 if ((fd = tun_open(local_tun, tun_mode, &ifname)) == -1) {
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001650 error("Tunnel device open failed.");
djm@openbsd.orgb7548b12017-10-23 05:08:00 +00001651 return NULL;
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001652 }
djm@openbsd.orgb7548b12017-10-23 05:08:00 +00001653 debug("Tunnel forwarding using interface %s", ifname);
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001654
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001655 c = channel_new(ssh, "tun", SSH_CHANNEL_OPENING, fd, fd, -1,
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001656 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
1657 c->datagram = 1;
1658
1659#if defined(SSH_TUN_FILTER)
1660 if (options.tun_open == SSH_TUNMODE_POINTOPOINT)
Damien Miller871f1e42017-09-12 18:01:35 +10001661 channel_register_filter(ssh, c->self, sys_tun_infilter,
Darren Tucker1cf65ae2008-06-13 05:09:18 +10001662 sys_tun_outfilter, NULL, NULL);
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001663#endif
1664
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001665 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_OPEN)) != 0 ||
1666 (r = sshpkt_put_cstring(ssh, "tun@openssh.com")) != 0 ||
1667 (r = sshpkt_put_u32(ssh, c->self)) != 0 ||
1668 (r = sshpkt_put_u32(ssh, c->local_window_max)) != 0 ||
1669 (r = sshpkt_put_u32(ssh, c->local_maxpacket)) != 0 ||
1670 (r = sshpkt_put_u32(ssh, tun_mode)) != 0 ||
1671 (r = sshpkt_put_u32(ssh, remote_tun)) != 0 ||
1672 (r = sshpkt_send(ssh)) != 0)
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00001673 sshpkt_fatal(ssh, r, "%s: send reply", __func__);
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001674
djm@openbsd.orgb7548b12017-10-23 05:08:00 +00001675 return ifname;
Damien Millerb3ce9fe2007-08-08 14:32:41 +10001676}
1677
Damien Millerbd483e72000-04-30 10:00:53 +10001678/* XXXX move to generic input handler */
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +00001679static int
markus@openbsd.org2ae666a2017-05-30 14:23:52 +00001680client_input_channel_open(int type, u_int32_t seq, struct ssh *ssh)
Damien Millerbd483e72000-04-30 10:00:53 +10001681{
1682 Channel *c = NULL;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001683 char *ctype = NULL;
1684 int r;
1685 u_int rchan;
1686 size_t len;
1687 u_int rmaxpack, rwindow;
Damien Millerbd483e72000-04-30 10:00:53 +10001688
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001689 if ((r = sshpkt_get_cstring(ssh, &ctype, &len)) != 0 ||
1690 (r = sshpkt_get_u32(ssh, &rchan)) != 0 ||
1691 (r = sshpkt_get_u32(ssh, &rwindow)) != 0 ||
1692 (r = sshpkt_get_u32(ssh, &rmaxpack)) != 0)
1693 goto out;
Damien Millerbd483e72000-04-30 10:00:53 +10001694
Damien Millere247cc42000-05-07 12:03:14 +10001695 debug("client_input_channel_open: ctype %s rchan %d win %d max %d",
Damien Millerbd483e72000-04-30 10:00:53 +10001696 ctype, rchan, rwindow, rmaxpack);
1697
Damien Miller0bc1bd82000-11-13 22:57:25 +11001698 if (strcmp(ctype, "forwarded-tcpip") == 0) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001699 c = client_request_forwarded_tcpip(ssh, ctype, rchan, rwindow,
markus@openbsd.org8d057842016-09-30 09:19:13 +00001700 rmaxpack);
Damien Miller7acefbb2014-07-18 14:11:24 +10001701 } else if (strcmp(ctype, "forwarded-streamlocal@openssh.com") == 0) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001702 c = client_request_forwarded_streamlocal(ssh, ctype, rchan);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001703 } else if (strcmp(ctype, "x11") == 0) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001704 c = client_request_x11(ssh, ctype, rchan);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001705 } else if (strcmp(ctype, "auth-agent@openssh.com") == 0) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001706 c = client_request_agent(ssh, ctype, rchan);
Damien Millerbd483e72000-04-30 10:00:53 +10001707 }
markus@openbsd.org8d057842016-09-30 09:19:13 +00001708 if (c != NULL && c->type == SSH_CHANNEL_MUX_CLIENT) {
1709 debug3("proxied to downstream: %s", ctype);
1710 } else if (c != NULL) {
Damien Millerbd483e72000-04-30 10:00:53 +10001711 debug("confirm %s", ctype);
1712 c->remote_id = rchan;
djm@openbsd.org9f532292017-09-12 06:35:31 +00001713 c->have_remote_id = 1;
Damien Millerbd483e72000-04-30 10:00:53 +10001714 c->remote_window = rwindow;
1715 c->remote_maxpacket = rmaxpack;
Ben Lindstroma69d89b2001-05-09 00:01:18 +00001716 if (c->type != SSH_CHANNEL_CONNECTING) {
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001717 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_OPEN_CONFIRMATION)) != 0 ||
1718 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 ||
1719 (r = sshpkt_put_u32(ssh, c->self)) != 0 ||
1720 (r = sshpkt_put_u32(ssh, c->local_window)) != 0 ||
1721 (r = sshpkt_put_u32(ssh, c->local_maxpacket)) != 0 ||
1722 (r = sshpkt_send(ssh)) != 0)
1723 sshpkt_fatal(ssh, r, "%s: send reply", __func__);
Ben Lindstroma69d89b2001-05-09 00:01:18 +00001724 }
Damien Millerbd483e72000-04-30 10:00:53 +10001725 } else {
1726 debug("failure %s", ctype);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001727 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_OPEN_FAILURE)) != 0 ||
1728 (r = sshpkt_put_u32(ssh, rchan)) != 0 ||
1729 (r = sshpkt_put_u32(ssh, SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED)) != 0 ||
1730 (r = sshpkt_put_cstring(ssh, "open failed")) != 0 ||
1731 (r = sshpkt_put_cstring(ssh, "")) != 0 ||
1732 (r = sshpkt_send(ssh)) != 0)
1733 sshpkt_fatal(ssh, r, "%s: send failure", __func__);
Damien Millerbd483e72000-04-30 10:00:53 +10001734 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001735 r = 0;
1736 out:
Darren Tuckera627d422013-06-02 07:31:17 +10001737 free(ctype);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001738 return r;
Damien Millerbd483e72000-04-30 10:00:53 +10001739}
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00001740
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +00001741static int
markus@openbsd.org2ae666a2017-05-30 14:23:52 +00001742client_input_channel_req(int type, u_int32_t seq, struct ssh *ssh)
Ben Lindstrom5b828322001-02-09 01:34:36 +00001743{
1744 Channel *c = NULL;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001745 char *rtype = NULL;
1746 u_char reply;
1747 u_int id, exitval;
1748 int r, success = 0;
Ben Lindstrom5b828322001-02-09 01:34:36 +00001749
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001750 if ((r = sshpkt_get_u32(ssh, &id)) != 0)
1751 return r;
1752 if (id <= INT_MAX)
1753 c = channel_lookup(ssh, id);
markus@openbsd.org2ae666a2017-05-30 14:23:52 +00001754 if (channel_proxy_upstream(c, type, seq, ssh))
markus@openbsd.org8d057842016-09-30 09:19:13 +00001755 return 0;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001756 if ((r = sshpkt_get_cstring(ssh, &rtype, NULL)) != 0 ||
1757 (r = sshpkt_get_u8(ssh, &reply)) != 0)
1758 goto out;
Ben Lindstrom5b828322001-02-09 01:34:36 +00001759
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001760 debug("client_input_channel_req: channel %u rtype %s reply %d",
Ben Lindstrom5b828322001-02-09 01:34:36 +00001761 id, rtype, reply);
1762
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001763 if (c == NULL) {
Darren Tucker4d5cd332008-06-13 04:51:14 +10001764 error("client_input_channel_req: channel %d: "
1765 "unknown channel", id);
Damien Millerbab9bd42008-05-19 16:06:47 +10001766 } else if (strcmp(rtype, "eow@openssh.com") == 0) {
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001767 if ((r = sshpkt_get_end(ssh)) != 0)
1768 goto out;
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001769 chan_rcvd_eow(ssh, c);
Ben Lindstrom5b828322001-02-09 01:34:36 +00001770 } else if (strcmp(rtype, "exit-status") == 0) {
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001771 if ((r = sshpkt_get_u32(ssh, &exitval)) != 0)
1772 goto out;
Damien Millere1537f92010-01-26 13:26:22 +11001773 if (c->ctl_chan != -1) {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001774 mux_exit_message(ssh, c, exitval);
Damien Miller0e220db2004-06-15 10:34:08 +10001775 success = 1;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001776 } else if ((int)id == session_ident) {
Darren Tucker29440822010-01-08 17:08:35 +11001777 /* Record exit value of local session */
1778 success = 1;
1779 exit_status = exitval;
1780 } else {
Damien Miller36f57eb2010-01-30 17:28:34 +11001781 /* Probably for a mux channel that has already closed */
1782 debug("%s: no sink for exit-status on channel %d",
1783 __func__, id);
Damien Miller0e220db2004-06-15 10:34:08 +10001784 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001785 if ((r = sshpkt_get_end(ssh)) != 0)
1786 goto out;
Ben Lindstrom5b828322001-02-09 01:34:36 +00001787 }
Damien Millerc5893782014-05-15 13:48:49 +10001788 if (reply && c != NULL && !(c->flags & CHAN_CLOSE_SENT)) {
djm@openbsd.org9f532292017-09-12 06:35:31 +00001789 if (!c->have_remote_id)
1790 fatal("%s: channel %d: no remote_id",
1791 __func__, c->self);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001792 if ((r = sshpkt_start(ssh, success ?
1793 SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE)) != 0 ||
1794 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 ||
1795 (r = sshpkt_send(ssh)) != 0)
1796 sshpkt_fatal(ssh, r, "%s: send failure", __func__);
Ben Lindstrom5b828322001-02-09 01:34:36 +00001797 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001798 r = 0;
1799 out:
Darren Tuckera627d422013-06-02 07:31:17 +10001800 free(rtype);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00001801 return r;
Ben Lindstrom5b828322001-02-09 01:34:36 +00001802}
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00001803
djm@openbsd.org523463a2015-02-16 22:13:32 +00001804struct hostkeys_update_ctx {
1805 /* The hostname and (optionally) IP address string for the server */
1806 char *host_str, *ip_str;
1807
1808 /*
1809 * Keys received from the server and a flag for each indicating
1810 * whether they already exist in known_hosts.
1811 * keys_seen is filled in by hostkeys_find() and later (for new
1812 * keys) by client_global_hostkeys_private_confirm().
1813 */
1814 struct sshkey **keys;
1815 int *keys_seen;
djm@openbsd.org84623e02018-06-26 02:02:36 +00001816 size_t nkeys, nnew;
djm@openbsd.org523463a2015-02-16 22:13:32 +00001817
1818 /*
1819 * Keys that are in known_hosts, but were not present in the update
1820 * from the server (i.e. scheduled to be deleted).
1821 * Filled in by hostkeys_find().
1822 */
1823 struct sshkey **old_keys;
1824 size_t nold;
1825};
1826
1827static void
1828hostkeys_update_ctx_free(struct hostkeys_update_ctx *ctx)
1829{
1830 size_t i;
1831
1832 if (ctx == NULL)
1833 return;
1834 for (i = 0; i < ctx->nkeys; i++)
1835 sshkey_free(ctx->keys[i]);
1836 free(ctx->keys);
1837 free(ctx->keys_seen);
1838 for (i = 0; i < ctx->nold; i++)
1839 sshkey_free(ctx->old_keys[i]);
1840 free(ctx->old_keys);
1841 free(ctx->host_str);
1842 free(ctx->ip_str);
1843 free(ctx);
1844}
1845
1846static int
1847hostkeys_find(struct hostkey_foreach_line *l, void *_ctx)
1848{
1849 struct hostkeys_update_ctx *ctx = (struct hostkeys_update_ctx *)_ctx;
1850 size_t i;
1851 struct sshkey **tmp;
1852
djm@openbsd.org873d3e72017-04-30 23:18:44 +00001853 if (l->status != HKF_STATUS_MATCHED || l->key == NULL)
djm@openbsd.org523463a2015-02-16 22:13:32 +00001854 return 0;
1855
1856 /* Mark off keys we've already seen for this host */
1857 for (i = 0; i < ctx->nkeys; i++) {
1858 if (sshkey_equal(l->key, ctx->keys[i])) {
1859 debug3("%s: found %s key at %s:%ld", __func__,
1860 sshkey_ssh_name(ctx->keys[i]), l->path, l->linenum);
1861 ctx->keys_seen[i] = 1;
1862 return 0;
1863 }
1864 }
1865 /* This line contained a key that not offered by the server */
1866 debug3("%s: deprecated %s key at %s:%ld", __func__,
1867 sshkey_ssh_name(l->key), l->path, l->linenum);
deraadt@openbsd.org9e509d42017-05-31 09:15:42 +00001868 if ((tmp = recallocarray(ctx->old_keys, ctx->nold, ctx->nold + 1,
djm@openbsd.org523463a2015-02-16 22:13:32 +00001869 sizeof(*ctx->old_keys))) == NULL)
deraadt@openbsd.org9e509d42017-05-31 09:15:42 +00001870 fatal("%s: recallocarray failed nold = %zu",
djm@openbsd.org523463a2015-02-16 22:13:32 +00001871 __func__, ctx->nold);
1872 ctx->old_keys = tmp;
1873 ctx->old_keys[ctx->nold++] = l->key;
1874 l->key = NULL;
1875
1876 return 0;
1877}
1878
1879static void
1880update_known_hosts(struct hostkeys_update_ctx *ctx)
1881{
djm@openbsd.orgf2293a62015-02-23 16:33:25 +00001882 int r, was_raw = 0;
dtucker@openbsd.org3a7db912019-04-23 11:56:41 +00001883 LogLevel loglevel = options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK ?
djm@openbsd.org523463a2015-02-16 22:13:32 +00001884 SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_VERBOSE;
1885 char *fp, *response;
1886 size_t i;
1887
1888 for (i = 0; i < ctx->nkeys; i++) {
1889 if (ctx->keys_seen[i] != 2)
1890 continue;
1891 if ((fp = sshkey_fingerprint(ctx->keys[i],
1892 options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
1893 fatal("%s: sshkey_fingerprint failed", __func__);
1894 do_log2(loglevel, "Learned new hostkey: %s %s",
1895 sshkey_type(ctx->keys[i]), fp);
1896 free(fp);
1897 }
1898 for (i = 0; i < ctx->nold; i++) {
1899 if ((fp = sshkey_fingerprint(ctx->old_keys[i],
1900 options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
1901 fatal("%s: sshkey_fingerprint failed", __func__);
1902 do_log2(loglevel, "Deprecating obsolete hostkey: %s %s",
1903 sshkey_type(ctx->old_keys[i]), fp);
1904 free(fp);
1905 }
1906 if (options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK) {
djm@openbsd.orgf2293a62015-02-23 16:33:25 +00001907 if (get_saved_tio() != NULL) {
1908 leave_raw_mode(1);
1909 was_raw = 1;
1910 }
djm@openbsd.org523463a2015-02-16 22:13:32 +00001911 response = NULL;
1912 for (i = 0; !quit_pending && i < 3; i++) {
1913 free(response);
1914 response = read_passphrase("Accept updated hostkeys? "
1915 "(yes/no): ", RP_ECHO);
1916 if (strcasecmp(response, "yes") == 0)
1917 break;
1918 else if (quit_pending || response == NULL ||
1919 strcasecmp(response, "no") == 0) {
1920 options.update_hostkeys = 0;
1921 break;
1922 } else {
1923 do_log2(loglevel, "Please enter "
1924 "\"yes\" or \"no\"");
1925 }
1926 }
1927 if (quit_pending || i >= 3 || response == NULL)
1928 options.update_hostkeys = 0;
1929 free(response);
djm@openbsd.orgf2293a62015-02-23 16:33:25 +00001930 if (was_raw)
1931 enter_raw_mode(1);
djm@openbsd.org523463a2015-02-16 22:13:32 +00001932 }
1933
1934 /*
1935 * Now that all the keys are verified, we can go ahead and replace
1936 * them in known_hosts (assuming SSH_UPDATE_HOSTKEYS_ASK didn't
1937 * cancel the operation).
1938 */
1939 if (options.update_hostkeys != 0 &&
1940 (r = hostfile_replace_entries(options.user_hostfiles[0],
1941 ctx->host_str, ctx->ip_str, ctx->keys, ctx->nkeys,
1942 options.hash_known_hosts, 0,
1943 options.fingerprint_hash)) != 0)
1944 error("%s: hostfile_replace_entries failed: %s",
1945 __func__, ssh_err(r));
1946}
1947
1948static void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00001949client_global_hostkeys_private_confirm(struct ssh *ssh, int type,
1950 u_int32_t seq, void *_ctx)
djm@openbsd.org523463a2015-02-16 22:13:32 +00001951{
djm@openbsd.org523463a2015-02-16 22:13:32 +00001952 struct hostkeys_update_ctx *ctx = (struct hostkeys_update_ctx *)_ctx;
1953 size_t i, ndone;
1954 struct sshbuf *signdata;
djm@openbsd.org78607312017-12-18 23:16:23 +00001955 int r, kexsigtype, use_kexsigtype;
djm@openbsd.org523463a2015-02-16 22:13:32 +00001956 const u_char *sig;
1957 size_t siglen;
1958
1959 if (ctx->nnew == 0)
1960 fatal("%s: ctx->nnew == 0", __func__); /* sanity */
1961 if (type != SSH2_MSG_REQUEST_SUCCESS) {
1962 error("Server failed to confirm ownership of "
1963 "private host keys");
1964 hostkeys_update_ctx_free(ctx);
1965 return;
1966 }
djm@openbsd.org78607312017-12-18 23:16:23 +00001967 kexsigtype = sshkey_type_plain(
1968 sshkey_type_from_name(ssh->kex->hostkey_alg));
1969
djm@openbsd.org523463a2015-02-16 22:13:32 +00001970 if ((signdata = sshbuf_new()) == NULL)
1971 fatal("%s: sshbuf_new failed", __func__);
1972 /* Don't want to accidentally accept an unbound signature */
1973 if (ssh->kex->session_id_len == 0)
1974 fatal("%s: ssh->kex->session_id_len == 0", __func__);
1975 /*
1976 * Expect a signature for each of the ctx->nnew private keys we
1977 * haven't seen before. They will be in the same order as the
1978 * ctx->keys where the corresponding ctx->keys_seen[i] == 0.
1979 */
1980 for (ndone = i = 0; i < ctx->nkeys; i++) {
1981 if (ctx->keys_seen[i])
1982 continue;
1983 /* Prepare data to be signed: session ID, unique string, key */
1984 sshbuf_reset(signdata);
djm@openbsd.org44732de2015-02-20 22:17:21 +00001985 if ( (r = sshbuf_put_cstring(signdata,
1986 "hostkeys-prove-00@openssh.com")) != 0 ||
1987 (r = sshbuf_put_string(signdata, ssh->kex->session_id,
djm@openbsd.org523463a2015-02-16 22:13:32 +00001988 ssh->kex->session_id_len)) != 0 ||
djm@openbsd.org523463a2015-02-16 22:13:32 +00001989 (r = sshkey_puts(ctx->keys[i], signdata)) != 0)
1990 fatal("%s: failed to prepare signature: %s",
1991 __func__, ssh_err(r));
1992 /* Extract and verify signature */
1993 if ((r = sshpkt_get_string_direct(ssh, &sig, &siglen)) != 0) {
1994 error("%s: couldn't parse message: %s",
1995 __func__, ssh_err(r));
1996 goto out;
1997 }
djm@openbsd.org78607312017-12-18 23:16:23 +00001998 /*
1999 * For RSA keys, prefer to use the signature type negotiated
2000 * during KEX to the default (SHA1).
2001 */
2002 use_kexsigtype = kexsigtype == KEY_RSA &&
2003 sshkey_type_plain(ctx->keys[i]->type) == KEY_RSA;
djm@openbsd.org523463a2015-02-16 22:13:32 +00002004 if ((r = sshkey_verify(ctx->keys[i], sig, siglen,
djm@openbsd.org04c7e282017-12-18 02:25:15 +00002005 sshbuf_ptr(signdata), sshbuf_len(signdata),
djm@openbsd.org78607312017-12-18 23:16:23 +00002006 use_kexsigtype ? ssh->kex->hostkey_alg : NULL, 0)) != 0) {
djm@openbsd.org523463a2015-02-16 22:13:32 +00002007 error("%s: server gave bad signature for %s key %zu",
2008 __func__, sshkey_type(ctx->keys[i]), i);
2009 goto out;
2010 }
2011 /* Key is good. Mark it as 'seen' */
2012 ctx->keys_seen[i] = 2;
2013 ndone++;
2014 }
2015 if (ndone != ctx->nnew)
2016 fatal("%s: ndone != ctx->nnew (%zu / %zu)", __func__,
2017 ndone, ctx->nnew); /* Shouldn't happen */
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002018 if ((r = sshpkt_get_end(ssh)) != 0) {
2019 error("%s: protocol error", __func__);
2020 goto out;
2021 }
djm@openbsd.org523463a2015-02-16 22:13:32 +00002022
2023 /* Make the edits to known_hosts */
2024 update_known_hosts(ctx);
2025 out:
2026 hostkeys_update_ctx_free(ctx);
2027}
2028
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002029/*
djm@openbsd.org894221a2017-03-10 05:01:13 +00002030 * Returns non-zero if the key is accepted by HostkeyAlgorithms.
2031 * Made slightly less trivial by the multiple RSA signature algorithm names.
2032 */
2033static int
2034key_accepted_by_hostkeyalgs(const struct sshkey *key)
2035{
2036 const char *ktype = sshkey_ssh_name(key);
2037 const char *hostkeyalgs = options.hostkeyalgorithms != NULL ?
2038 options.hostkeyalgorithms : KEX_DEFAULT_PK_ALG;
2039
2040 if (key == NULL || key->type == KEY_UNSPEC)
2041 return 0;
2042 if (key->type == KEY_RSA &&
2043 (match_pattern_list("rsa-sha2-256", hostkeyalgs, 0) == 1 ||
2044 match_pattern_list("rsa-sha2-512", hostkeyalgs, 0) == 1))
2045 return 1;
2046 return match_pattern_list(ktype, hostkeyalgs, 0) == 1;
2047}
2048
2049/*
djm@openbsd.org44732de2015-02-20 22:17:21 +00002050 * Handle hostkeys-00@openssh.com global request to inform the client of all
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002051 * the server's hostkeys. The keys are checked against the user's
2052 * HostkeyAlgorithms preference before they are accepted.
2053 */
2054static int
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002055client_input_hostkeys(struct ssh *ssh)
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002056{
2057 const u_char *blob = NULL;
djm@openbsd.org523463a2015-02-16 22:13:32 +00002058 size_t i, len = 0;
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002059 struct sshbuf *buf = NULL;
djm@openbsd.org523463a2015-02-16 22:13:32 +00002060 struct sshkey *key = NULL, **tmp;
2061 int r;
2062 char *fp;
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002063 static int hostkeys_seen = 0; /* XXX use struct ssh */
djm@openbsd.org6c5c9492015-02-16 22:08:57 +00002064 extern struct sockaddr_storage hostaddr; /* XXX from ssh.c */
djm@openbsd.orga63cfa22015-02-25 19:54:02 +00002065 struct hostkeys_update_ctx *ctx = NULL;
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002066
2067 if (hostkeys_seen)
2068 fatal("%s: server already sent hostkeys", __func__);
djm@openbsd.org523463a2015-02-16 22:13:32 +00002069 if (options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK &&
2070 options.batch_mode)
2071 return 1; /* won't ask in batchmode, so don't even try */
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002072 if (!options.update_hostkeys || options.num_user_hostfiles <= 0)
2073 return 1;
djm@openbsd.orga63cfa22015-02-25 19:54:02 +00002074
2075 ctx = xcalloc(1, sizeof(*ctx));
djm@openbsd.org523463a2015-02-16 22:13:32 +00002076 while (ssh_packet_remaining(ssh) > 0) {
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002077 sshkey_free(key);
2078 key = NULL;
djm@openbsd.org523463a2015-02-16 22:13:32 +00002079 if ((r = sshpkt_get_string_direct(ssh, &blob, &len)) != 0) {
2080 error("%s: couldn't parse message: %s",
2081 __func__, ssh_err(r));
2082 goto out;
2083 }
djm@openbsd.org44732de2015-02-20 22:17:21 +00002084 if ((r = sshkey_from_blob(blob, len, &key)) != 0) {
2085 error("%s: parse key: %s", __func__, ssh_err(r));
2086 goto out;
2087 }
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002088 fp = sshkey_fingerprint(key, options.fingerprint_hash,
2089 SSH_FP_DEFAULT);
2090 debug3("%s: received %s key %s", __func__,
2091 sshkey_type(key), fp);
2092 free(fp);
markus@openbsd.org3a1638d2015-07-10 06:21:53 +00002093
djm@openbsd.org894221a2017-03-10 05:01:13 +00002094 if (!key_accepted_by_hostkeyalgs(key)) {
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002095 debug3("%s: %s key not permitted by HostkeyAlgorithms",
2096 __func__, sshkey_ssh_name(key));
2097 continue;
2098 }
djm@openbsd.org523463a2015-02-16 22:13:32 +00002099 /* Skip certs */
2100 if (sshkey_is_cert(key)) {
2101 debug3("%s: %s key is a certificate; skipping",
2102 __func__, sshkey_ssh_name(key));
2103 continue;
2104 }
2105 /* Ensure keys are unique */
2106 for (i = 0; i < ctx->nkeys; i++) {
2107 if (sshkey_equal(key, ctx->keys[i])) {
2108 error("%s: received duplicated %s host key",
2109 __func__, sshkey_ssh_name(key));
2110 goto out;
2111 }
2112 }
2113 /* Key is good, record it */
deraadt@openbsd.org9e509d42017-05-31 09:15:42 +00002114 if ((tmp = recallocarray(ctx->keys, ctx->nkeys, ctx->nkeys + 1,
djm@openbsd.org523463a2015-02-16 22:13:32 +00002115 sizeof(*ctx->keys))) == NULL)
deraadt@openbsd.org9e509d42017-05-31 09:15:42 +00002116 fatal("%s: recallocarray failed nkeys = %zu",
djm@openbsd.org523463a2015-02-16 22:13:32 +00002117 __func__, ctx->nkeys);
2118 ctx->keys = tmp;
2119 ctx->keys[ctx->nkeys++] = key;
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002120 key = NULL;
2121 }
2122
djm@openbsd.org523463a2015-02-16 22:13:32 +00002123 if (ctx->nkeys == 0) {
djm@openbsd.org44732de2015-02-20 22:17:21 +00002124 debug("%s: server sent no hostkeys", __func__);
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002125 goto out;
2126 }
djm@openbsd.org44732de2015-02-20 22:17:21 +00002127
djm@openbsd.org523463a2015-02-16 22:13:32 +00002128 if ((ctx->keys_seen = calloc(ctx->nkeys,
2129 sizeof(*ctx->keys_seen))) == NULL)
2130 fatal("%s: calloc failed", __func__);
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002131
djm@openbsd.org6c5c9492015-02-16 22:08:57 +00002132 get_hostfile_hostname_ipaddr(host,
2133 options.check_host_ip ? (struct sockaddr *)&hostaddr : NULL,
djm@openbsd.org523463a2015-02-16 22:13:32 +00002134 options.port, &ctx->host_str,
2135 options.check_host_ip ? &ctx->ip_str : NULL);
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002136
djm@openbsd.org523463a2015-02-16 22:13:32 +00002137 /* Find which keys we already know about. */
2138 if ((r = hostkeys_foreach(options.user_hostfiles[0], hostkeys_find,
2139 ctx, ctx->host_str, ctx->ip_str,
2140 HKF_WANT_PARSE_KEY|HKF_WANT_MATCH)) != 0) {
2141 error("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r));
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002142 goto out;
2143 }
2144
djm@openbsd.org523463a2015-02-16 22:13:32 +00002145 /* Figure out if we have any new keys to add */
2146 ctx->nnew = 0;
2147 for (i = 0; i < ctx->nkeys; i++) {
2148 if (!ctx->keys_seen[i])
2149 ctx->nnew++;
2150 }
2151
2152 debug3("%s: %zu keys from server: %zu new, %zu retained. %zu to remove",
2153 __func__, ctx->nkeys, ctx->nnew, ctx->nkeys - ctx->nnew, ctx->nold);
2154
2155 if (ctx->nnew == 0 && ctx->nold != 0) {
2156 /* We have some keys to remove. Just do it. */
2157 update_known_hosts(ctx);
2158 } else if (ctx->nnew != 0) {
2159 /*
2160 * We have received hitherto-unseen keys from the server.
2161 * Ask the server to confirm ownership of the private halves.
2162 */
2163 debug3("%s: asking server to prove ownership for %zu keys",
2164 __func__, ctx->nnew);
2165 if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 ||
2166 (r = sshpkt_put_cstring(ssh,
djm@openbsd.org44732de2015-02-20 22:17:21 +00002167 "hostkeys-prove-00@openssh.com")) != 0 ||
djm@openbsd.org523463a2015-02-16 22:13:32 +00002168 (r = sshpkt_put_u8(ssh, 1)) != 0) /* bool: want reply */
2169 fatal("%s: cannot prepare packet: %s",
2170 __func__, ssh_err(r));
2171 if ((buf = sshbuf_new()) == NULL)
2172 fatal("%s: sshbuf_new", __func__);
2173 for (i = 0; i < ctx->nkeys; i++) {
2174 if (ctx->keys_seen[i])
2175 continue;
2176 sshbuf_reset(buf);
2177 if ((r = sshkey_putb(ctx->keys[i], buf)) != 0)
2178 fatal("%s: sshkey_putb: %s",
2179 __func__, ssh_err(r));
2180 if ((r = sshpkt_put_stringb(ssh, buf)) != 0)
2181 fatal("%s: sshpkt_put_string: %s",
2182 __func__, ssh_err(r));
2183 }
2184 if ((r = sshpkt_send(ssh)) != 0)
2185 fatal("%s: sshpkt_send: %s", __func__, ssh_err(r));
2186 client_register_global_confirm(
2187 client_global_hostkeys_private_confirm, ctx);
2188 ctx = NULL; /* will be freed in callback */
2189 }
2190
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002191 /* Success */
2192 out:
djm@openbsd.org523463a2015-02-16 22:13:32 +00002193 hostkeys_update_ctx_free(ctx);
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002194 sshkey_free(key);
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002195 sshbuf_free(buf);
djm@openbsd.org523463a2015-02-16 22:13:32 +00002196 /*
2197 * NB. Return success for all cases. The server doesn't need to know
2198 * what the client does with its hosts file.
2199 */
2200 return 1;
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002201}
2202
markus@openbsd.org3fdc88a2015-01-19 20:07:45 +00002203static int
markus@openbsd.org2ae666a2017-05-30 14:23:52 +00002204client_input_global_request(int type, u_int32_t seq, struct ssh *ssh)
Damien Millerc3fa4072002-01-22 23:21:58 +11002205{
2206 char *rtype;
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002207 u_char want_reply;
2208 int r, success = 0;
Damien Millerc3fa4072002-01-22 23:21:58 +11002209
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002210 if ((r = sshpkt_get_cstring(ssh, &rtype, NULL)) != 0 ||
2211 (r = sshpkt_get_u8(ssh, &want_reply)) != 0)
2212 goto out;
Damien Miller509b0102003-12-17 16:33:10 +11002213 debug("client_input_global_request: rtype %s want_reply %d",
2214 rtype, want_reply);
djm@openbsd.org44732de2015-02-20 22:17:21 +00002215 if (strcmp(rtype, "hostkeys-00@openssh.com") == 0)
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002216 success = client_input_hostkeys(ssh);
Damien Millerc3fa4072002-01-22 23:21:58 +11002217 if (want_reply) {
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002218 if ((r = sshpkt_start(ssh, success ? SSH2_MSG_REQUEST_SUCCESS :
2219 SSH2_MSG_REQUEST_FAILURE)) != 0 ||
2220 (r = sshpkt_send(ssh)) != 0 ||
2221 (r = ssh_packet_write_wait(ssh)) != 0)
2222 goto out;
Damien Millerc3fa4072002-01-22 23:21:58 +11002223 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002224 r = 0;
2225 out:
Darren Tuckera627d422013-06-02 07:31:17 +10002226 free(rtype);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002227 return r;
Damien Millerc3fa4072002-01-22 23:21:58 +11002228}
Damien Millerbd483e72000-04-30 10:00:53 +10002229
Damien Miller0e220db2004-06-15 10:34:08 +10002230void
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002231client_session2_setup(struct ssh *ssh, int id, int want_tty, int want_subsystem,
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00002232 const char *term, struct termios *tiop, int in_fd, struct sshbuf *cmd,
2233 char **env)
Damien Miller0e220db2004-06-15 10:34:08 +10002234{
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002235 int i, j, matched, len, r;
djm@openbsd.org7082bb52018-06-09 03:01:12 +00002236 char *name, *val;
Darren Tucker5d78de62004-11-05 20:35:44 +11002237 Channel *c = NULL;
Damien Miller0e220db2004-06-15 10:34:08 +10002238
2239 debug2("%s: id %d", __func__, id);
2240
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002241 if ((c = channel_lookup(ssh, id)) == NULL)
2242 fatal("%s: channel %d: unknown channel", __func__, id);
Darren Tucker5d78de62004-11-05 20:35:44 +11002243
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002244 ssh_packet_set_interactive(ssh, want_tty,
Damien Miller0dac6fb2010-11-20 15:19:38 +11002245 options.ip_qos_interactive, options.ip_qos_bulk);
2246
Damien Miller0e220db2004-06-15 10:34:08 +10002247 if (want_tty) {
2248 struct winsize ws;
Damien Miller0e220db2004-06-15 10:34:08 +10002249
2250 /* Store window size in the packet. */
deraadt@openbsd.org4d28fa72019-06-28 13:35:04 +00002251 if (ioctl(in_fd, TIOCGWINSZ, &ws) == -1)
Damien Miller0e220db2004-06-15 10:34:08 +10002252 memset(&ws, 0, sizeof(ws));
2253
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002254 channel_request_start(ssh, id, "pty-req", 1);
2255 client_expect_confirm(ssh, id, "PTY allocation", CONFIRM_TTY);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002256 if ((r = sshpkt_put_cstring(ssh, term != NULL ? term : ""))
2257 != 0 ||
2258 (r = sshpkt_put_u32(ssh, (u_int)ws.ws_col)) != 0 ||
2259 (r = sshpkt_put_u32(ssh, (u_int)ws.ws_row)) != 0 ||
2260 (r = sshpkt_put_u32(ssh, (u_int)ws.ws_xpixel)) != 0 ||
2261 (r = sshpkt_put_u32(ssh, (u_int)ws.ws_ypixel)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00002262 fatal("%s: build packet: %s", __func__, ssh_err(r));
Darren Tuckerdf189fb2008-06-08 12:55:32 +10002263 if (tiop == NULL)
2264 tiop = get_saved_tio();
markus@openbsd.org89dd6152018-07-09 21:20:26 +00002265 ssh_tty_make_modes(ssh, -1, tiop);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002266 if ((r = sshpkt_send(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00002267 fatal("%s: send packet: %s", __func__, ssh_err(r));
Damien Miller0e220db2004-06-15 10:34:08 +10002268 /* XXX wait for reply */
Darren Tucker5d78de62004-11-05 20:35:44 +11002269 c->client_tty = 1;
Damien Miller0e220db2004-06-15 10:34:08 +10002270 }
2271
2272 /* Transfer any environment variables from client to server */
Damien Miller3756dce2004-06-18 01:17:29 +10002273 if (options.num_send_env != 0 && env != NULL) {
Damien Miller0e220db2004-06-15 10:34:08 +10002274 debug("Sending environment.");
Damien Miller3756dce2004-06-18 01:17:29 +10002275 for (i = 0; env[i] != NULL; i++) {
Damien Miller0e220db2004-06-15 10:34:08 +10002276 /* Split */
Damien Miller3756dce2004-06-18 01:17:29 +10002277 name = xstrdup(env[i]);
Damien Miller0e220db2004-06-15 10:34:08 +10002278 if ((val = strchr(name, '=')) == NULL) {
Darren Tuckera627d422013-06-02 07:31:17 +10002279 free(name);
Damien Miller0e220db2004-06-15 10:34:08 +10002280 continue;
2281 }
2282 *val++ = '\0';
2283
2284 matched = 0;
2285 for (j = 0; j < options.num_send_env; j++) {
2286 if (match_pattern(name, options.send_env[j])) {
2287 matched = 1;
2288 break;
2289 }
2290 }
2291 if (!matched) {
2292 debug3("Ignored env %s", name);
Darren Tuckera627d422013-06-02 07:31:17 +10002293 free(name);
Damien Miller0e220db2004-06-15 10:34:08 +10002294 continue;
2295 }
2296
2297 debug("Sending env %s = %s", name, val);
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002298 channel_request_start(ssh, id, "env", 0);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002299 if ((r = sshpkt_put_cstring(ssh, name)) != 0 ||
2300 (r = sshpkt_put_cstring(ssh, val)) != 0 ||
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00002301 (r = sshpkt_send(ssh)) != 0) {
2302 fatal("%s: send packet: %s",
2303 __func__, ssh_err(r));
2304 }
Darren Tuckera627d422013-06-02 07:31:17 +10002305 free(name);
Damien Miller0e220db2004-06-15 10:34:08 +10002306 }
2307 }
djm@openbsd.org7082bb52018-06-09 03:01:12 +00002308 for (i = 0; i < options.num_setenv; i++) {
2309 /* Split */
2310 name = xstrdup(options.setenv[i]);
2311 if ((val = strchr(name, '=')) == NULL) {
2312 free(name);
2313 continue;
2314 }
2315 *val++ = '\0';
2316
2317 debug("Setting env %s = %s", name, val);
2318 channel_request_start(ssh, id, "env", 0);
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002319 if ((r = sshpkt_put_cstring(ssh, name)) != 0 ||
2320 (r = sshpkt_put_cstring(ssh, val)) != 0 ||
2321 (r = sshpkt_send(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00002322 fatal("%s: send packet: %s", __func__, ssh_err(r));
djm@openbsd.org7082bb52018-06-09 03:01:12 +00002323 free(name);
2324 }
Damien Miller0e220db2004-06-15 10:34:08 +10002325
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00002326 len = sshbuf_len(cmd);
Damien Miller0e220db2004-06-15 10:34:08 +10002327 if (len > 0) {
2328 if (len > 900)
2329 len = 900;
2330 if (want_subsystem) {
Damien Miller5771ed72008-05-19 15:35:33 +10002331 debug("Sending subsystem: %.*s",
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00002332 len, (const u_char*)sshbuf_ptr(cmd));
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002333 channel_request_start(ssh, id, "subsystem", 1);
2334 client_expect_confirm(ssh, id, "subsystem",
2335 CONFIRM_CLOSE);
Damien Miller0e220db2004-06-15 10:34:08 +10002336 } else {
Damien Miller5771ed72008-05-19 15:35:33 +10002337 debug("Sending command: %.*s",
markus@openbsd.orgcecee2d2018-07-09 21:03:30 +00002338 len, (const u_char*)sshbuf_ptr(cmd));
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002339 channel_request_start(ssh, id, "exec", 1);
2340 client_expect_confirm(ssh, id, "exec", CONFIRM_CLOSE);
Damien Miller0e220db2004-06-15 10:34:08 +10002341 }
djm@openbsd.org23f22a42019-01-19 21:33:57 +00002342 if ((r = sshpkt_put_stringb(ssh, cmd)) != 0 ||
2343 (r = sshpkt_send(ssh)) != 0)
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00002344 fatal("%s: send command: %s", __func__, ssh_err(r));
Damien Miller0e220db2004-06-15 10:34:08 +10002345 } else {
djm@openbsd.orgdbee4112017-09-12 06:32:07 +00002346 channel_request_start(ssh, id, "shell", 1);
2347 client_expect_confirm(ssh, id, "shell", CONFIRM_CLOSE);
djm@openbsd.org9d7b2882019-03-29 11:31:40 +00002348 if ((r = sshpkt_send(ssh)) != 0) {
2349 fatal("%s: send shell request: %s",
2350 __func__, ssh_err(r));
2351 }
Damien Miller0e220db2004-06-15 10:34:08 +10002352 }
2353}
2354
Ben Lindstrombba81212001-06-25 05:01:22 +00002355static void
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002356client_init_dispatch(struct ssh *ssh)
Damien Miller1383bd82000-04-06 12:32:37 +10002357{
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002358 ssh_dispatch_init(ssh, &dispatch_protocol_error);
Damien Miller2797f7f2002-04-23 21:09:44 +10002359
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002360 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_CLOSE, &channel_input_oclose);
2361 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_DATA, &channel_input_data);
2362 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_EOF, &channel_input_ieof);
2363 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_EXTENDED_DATA, &channel_input_extended_data);
2364 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_OPEN, &client_input_channel_open);
2365 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation);
2366 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure);
2367 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_REQUEST, &client_input_channel_req);
2368 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust);
2369 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_SUCCESS, &channel_input_status_confirm);
2370 ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_FAILURE, &channel_input_status_confirm);
2371 ssh_dispatch_set(ssh, SSH2_MSG_GLOBAL_REQUEST, &client_input_global_request);
Ben Lindstrom8ac91062001-04-04 17:57:54 +00002372
2373 /* rekeying */
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002374 ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_input_kexinit);
Damien Miller2797f7f2002-04-23 21:09:44 +10002375
2376 /* global request reply messages */
djm@openbsd.orgbc5e1162019-01-19 21:39:12 +00002377 ssh_dispatch_set(ssh, SSH2_MSG_REQUEST_FAILURE, &client_global_request_reply);
2378 ssh_dispatch_set(ssh, SSH2_MSG_REQUEST_SUCCESS, &client_global_request_reply);
Damien Miller1383bd82000-04-06 12:32:37 +10002379}
Darren Tucker4d5cd332008-06-13 04:51:14 +10002380
Damien Miller6c3eec72011-05-05 14:16:22 +10002381void
2382client_stop_mux(void)
2383{
2384 if (options.control_path != NULL && muxserver_sock != -1)
2385 unlink(options.control_path);
2386 /*
Darren Tucker48bf4b02012-09-07 16:38:53 +10002387 * If we are in persist mode, or don't have a shell, signal that we
2388 * should close when all active channels are closed.
Damien Miller6c3eec72011-05-05 14:16:22 +10002389 */
Darren Tucker48bf4b02012-09-07 16:38:53 +10002390 if (options.control_persist || no_shell_flag) {
Damien Miller6c3eec72011-05-05 14:16:22 +10002391 session_closed = 1;
Damien Miller4ac99c32011-06-20 14:43:31 +10002392 setproctitle("[stopped mux]");
2393 }
Damien Miller6c3eec72011-05-05 14:16:22 +10002394}
2395
Darren Tucker9a2c4cd2003-09-22 21:16:05 +10002396/* client specific fatal cleanup */
2397void
Darren Tucker3e33cec2003-10-02 16:12:36 +10002398cleanup_exit(int i)
Darren Tucker9a2c4cd2003-09-22 21:16:05 +10002399{
Damien Miller21771e22011-05-15 08:45:50 +10002400 leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
Darren Tucker9a2c4cd2003-09-22 21:16:05 +10002401 leave_non_blocking();
Damien Millerb1cbfa22008-05-19 16:00:08 +10002402 if (options.control_path != NULL && muxserver_sock != -1)
Damien Miller0e220db2004-06-15 10:34:08 +10002403 unlink(options.control_path);
Damien Millera41ccca2010-10-07 22:07:32 +11002404 ssh_kill_proxy_command();
Darren Tucker3e33cec2003-10-02 16:12:36 +10002405 _exit(i);
Darren Tucker9a2c4cd2003-09-22 21:16:05 +10002406}