Annotation of src/usr.bin/ssh/mux.c, Revision 1.76
1.76 ! djm 1: /* $OpenBSD: mux.c,v 1.75 2018/07/31 03:07:24 djm Exp $ */
1.1 djm 2: /*
3: * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
4: *
5: * Permission to use, copy, modify, and distribute this software for any
6: * purpose with or without fee is hereby granted, provided that the above
7: * copyright notice and this permission notice appear in all copies.
8: *
9: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16: */
17:
18: /* ssh session multiplexing support */
19:
1.2 djm 20: /*
21: * TODO:
1.10 djm 22: * - Better signalling from master to slave, especially passing of
1.2 djm 23: * error messages
1.10 djm 24: * - Better fall-back from mux slave error to new connection.
25: * - ExitOnForwardingFailure
26: * - Maybe extension mechanisms for multi-X11/multi-agent forwarding
27: * - Support ~^Z in mux slaves.
28: * - Inspect or control sessions in master.
29: * - If we ever support the "signal" channel request, send signals on
30: * sessions in master.
1.2 djm 31: */
32:
1.1 djm 33: #include <sys/types.h>
34: #include <sys/queue.h>
35: #include <sys/stat.h>
36: #include <sys/socket.h>
37: #include <sys/un.h>
38:
39: #include <errno.h>
40: #include <fcntl.h>
1.10 djm 41: #include <poll.h>
1.1 djm 42: #include <signal.h>
43: #include <stdarg.h>
44: #include <stddef.h>
45: #include <stdlib.h>
46: #include <stdio.h>
47: #include <string.h>
48: #include <unistd.h>
49: #include <util.h>
50: #include <paths.h>
51:
1.10 djm 52: #include "atomicio.h"
1.1 djm 53: #include "xmalloc.h"
54: #include "log.h"
55: #include "ssh.h"
1.18 markus 56: #include "ssh2.h"
1.1 djm 57: #include "pathnames.h"
58: #include "misc.h"
59: #include "match.h"
1.73 markus 60: #include "sshbuf.h"
1.1 djm 61: #include "channels.h"
62: #include "msg.h"
63: #include "packet.h"
64: #include "monitor_fdpass.h"
65: #include "sshpty.h"
1.74 markus 66: #include "sshkey.h"
1.1 djm 67: #include "readconf.h"
68: #include "clientloop.h"
1.62 markus 69: #include "ssherr.h"
1.1 djm 70:
71: /* from ssh.c */
72: extern int tty_flag;
73: extern Options options;
74: extern int stdin_null_flag;
75: extern char *host;
1.8 dtucker 76: extern int subsystem_flag;
1.72 markus 77: extern struct sshbuf *command;
1.10 djm 78: extern volatile sig_atomic_t quit_pending;
1.1 djm 79:
1.2 djm 80: /* Context for session open confirmation callback */
81: struct mux_session_confirm_ctx {
1.10 djm 82: u_int want_tty;
83: u_int want_subsys;
84: u_int want_x_fwd;
85: u_int want_agent_fwd;
1.73 markus 86: struct sshbuf *cmd;
1.2 djm 87: char *term;
88: struct termios tio;
89: char **env;
1.17 djm 90: u_int rid;
1.2 djm 91: };
92:
1.48 djm 93: /* Context for stdio fwd open confirmation callback */
94: struct mux_stdio_confirm_ctx {
95: u_int rid;
96: };
97:
1.18 markus 98: /* Context for global channel callback */
99: struct mux_channel_confirm_ctx {
100: u_int cid; /* channel id */
101: u_int rid; /* request id */
102: int fid; /* forward id */
103: };
104:
1.1 djm 105: /* fd to control socket */
106: int muxserver_sock = -1;
107:
1.10 djm 108: /* client request id */
109: u_int muxclient_request_id = 0;
110:
1.1 djm 111: /* Multiplexing control command */
112: u_int muxclient_command = 0;
113:
114: /* Set when signalled. */
115: static volatile sig_atomic_t muxclient_terminate = 0;
116:
117: /* PID of multiplex server */
118: static u_int muxserver_pid = 0;
119:
1.10 djm 120: static Channel *mux_listener_channel = NULL;
121:
122: struct mux_master_state {
123: int hello_rcvd;
124: };
1.1 djm 125:
1.10 djm 126: /* mux protocol messages */
127: #define MUX_MSG_HELLO 0x00000001
128: #define MUX_C_NEW_SESSION 0x10000002
129: #define MUX_C_ALIVE_CHECK 0x10000004
130: #define MUX_C_TERMINATE 0x10000005
131: #define MUX_C_OPEN_FWD 0x10000006
132: #define MUX_C_CLOSE_FWD 0x10000007
133: #define MUX_C_NEW_STDIO_FWD 0x10000008
1.25 djm 134: #define MUX_C_STOP_LISTENING 0x10000009
1.62 markus 135: #define MUX_C_PROXY 0x1000000f
1.10 djm 136: #define MUX_S_OK 0x80000001
137: #define MUX_S_PERMISSION_DENIED 0x80000002
138: #define MUX_S_FAILURE 0x80000003
139: #define MUX_S_EXIT_MESSAGE 0x80000004
140: #define MUX_S_ALIVE 0x80000005
141: #define MUX_S_SESSION_OPENED 0x80000006
1.18 markus 142: #define MUX_S_REMOTE_PORT 0x80000007
1.28 djm 143: #define MUX_S_TTY_ALLOC_FAIL 0x80000008
1.62 markus 144: #define MUX_S_PROXY 0x8000000f
1.10 djm 145:
146: /* type codes for MUX_C_OPEN_FWD and MUX_C_CLOSE_FWD */
147: #define MUX_FWD_LOCAL 1
148: #define MUX_FWD_REMOTE 2
149: #define MUX_FWD_DYNAMIC 3
150:
1.66 djm 151: static void mux_session_confirm(struct ssh *, int, int, void *);
152: static void mux_stdio_confirm(struct ssh *, int, int, void *);
1.10 djm 153:
1.76 ! djm 154: static int mux_master_process_hello(struct ssh *, u_int,
1.66 djm 155: Channel *, struct sshbuf *, struct sshbuf *);
1.76 ! djm 156: static int mux_master_process_new_session(struct ssh *, u_int,
1.66 djm 157: Channel *, struct sshbuf *, struct sshbuf *);
1.76 ! djm 158: static int mux_master_process_alive_check(struct ssh *, u_int,
1.66 djm 159: Channel *, struct sshbuf *, struct sshbuf *);
1.76 ! djm 160: static int mux_master_process_terminate(struct ssh *, u_int,
1.66 djm 161: Channel *, struct sshbuf *, struct sshbuf *);
1.76 ! djm 162: static int mux_master_process_open_fwd(struct ssh *, u_int,
1.66 djm 163: Channel *, struct sshbuf *, struct sshbuf *);
1.76 ! djm 164: static int mux_master_process_close_fwd(struct ssh *, u_int,
1.66 djm 165: Channel *, struct sshbuf *, struct sshbuf *);
1.76 ! djm 166: static int mux_master_process_stdio_fwd(struct ssh *, u_int,
1.66 djm 167: Channel *, struct sshbuf *, struct sshbuf *);
1.76 ! djm 168: static int mux_master_process_stop_listening(struct ssh *, u_int,
1.66 djm 169: Channel *, struct sshbuf *, struct sshbuf *);
1.76 ! djm 170: static int mux_master_process_proxy(struct ssh *, u_int,
1.66 djm 171: Channel *, struct sshbuf *, struct sshbuf *);
1.10 djm 172:
173: static const struct {
174: u_int type;
1.66 djm 175: int (*handler)(struct ssh *, u_int, Channel *,
176: struct sshbuf *, struct sshbuf *);
1.10 djm 177: } mux_master_handlers[] = {
1.76 ! djm 178: { MUX_MSG_HELLO, mux_master_process_hello },
! 179: { MUX_C_NEW_SESSION, mux_master_process_new_session },
! 180: { MUX_C_ALIVE_CHECK, mux_master_process_alive_check },
! 181: { MUX_C_TERMINATE, mux_master_process_terminate },
! 182: { MUX_C_OPEN_FWD, mux_master_process_open_fwd },
! 183: { MUX_C_CLOSE_FWD, mux_master_process_close_fwd },
! 184: { MUX_C_NEW_STDIO_FWD, mux_master_process_stdio_fwd },
! 185: { MUX_C_STOP_LISTENING, mux_master_process_stop_listening },
! 186: { MUX_C_PROXY, mux_master_process_proxy },
1.10 djm 187: { 0, NULL }
188: };
1.1 djm 189:
1.10 djm 190: /* Cleanup callback fired on closure of mux slave _session_ channel */
191: /* ARGSUSED */
1.42 dtucker 192: static void
1.66 djm 193: mux_master_session_cleanup_cb(struct ssh *ssh, int cid, void *unused)
1.1 djm 194: {
1.66 djm 195: Channel *cc, *c = channel_by_id(ssh, cid);
1.1 djm 196:
1.10 djm 197: debug3("%s: entering for channel %d", __func__, cid);
198: if (c == NULL)
199: fatal("%s: channel_by_id(%i) == NULL", __func__, cid);
200: if (c->ctl_chan != -1) {
1.66 djm 201: if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.10 djm 202: fatal("%s: channel %d missing control channel %d",
203: __func__, c->self, c->ctl_chan);
204: c->ctl_chan = -1;
1.67 djm 205: cc->remote_id = 0;
206: cc->have_remote_id = 0;
1.66 djm 207: chan_rcvd_oclose(ssh, cc);
1.1 djm 208: }
1.66 djm 209: channel_cancel_cleanup(ssh, c->self);
1.1 djm 210: }
211:
1.10 djm 212: /* Cleanup callback fired on closure of mux slave _control_ channel */
213: /* ARGSUSED */
1.1 djm 214: static void
1.66 djm 215: mux_master_control_cleanup_cb(struct ssh *ssh, int cid, void *unused)
1.1 djm 216: {
1.66 djm 217: Channel *sc, *c = channel_by_id(ssh, cid);
1.1 djm 218:
1.10 djm 219: debug3("%s: entering for channel %d", __func__, cid);
220: if (c == NULL)
221: fatal("%s: channel_by_id(%i) == NULL", __func__, cid);
1.67 djm 222: if (c->have_remote_id) {
1.66 djm 223: if ((sc = channel_by_id(ssh, c->remote_id)) == NULL)
1.67 djm 224: fatal("%s: channel %d missing session channel %u",
1.10 djm 225: __func__, c->self, c->remote_id);
1.67 djm 226: c->remote_id = 0;
227: c->have_remote_id = 0;
1.10 djm 228: sc->ctl_chan = -1;
1.39 djm 229: if (sc->type != SSH_CHANNEL_OPEN &&
230: sc->type != SSH_CHANNEL_OPENING) {
1.12 djm 231: debug2("%s: channel %d: not open", __func__, sc->self);
1.66 djm 232: chan_mark_dead(ssh, sc);
1.12 djm 233: } else {
1.14 djm 234: if (sc->istate == CHAN_INPUT_OPEN)
1.66 djm 235: chan_read_failed(ssh, sc);
1.14 djm 236: if (sc->ostate == CHAN_OUTPUT_OPEN)
1.66 djm 237: chan_write_failed(ssh, sc);
1.12 djm 238: }
1.1 djm 239: }
1.66 djm 240: channel_cancel_cleanup(ssh, c->self);
1.1 djm 241: }
242:
1.10 djm 243: /* Check mux client environment variables before passing them to mux master. */
244: static int
245: env_permitted(char *env)
1.1 djm 246: {
1.10 djm 247: int i, ret;
248: char name[1024], *cp;
1.1 djm 249:
1.10 djm 250: if ((cp = strchr(env, '=')) == NULL || cp == env)
1.1 djm 251: return 0;
1.10 djm 252: ret = snprintf(name, sizeof(name), "%.*s", (int)(cp - env), env);
253: if (ret <= 0 || (size_t)ret >= sizeof(name)) {
1.76 ! djm 254: error("%s: name '%.100s...' too long", __func__, env);
1.1 djm 255: return 0;
256: }
257:
1.10 djm 258: for (i = 0; i < options.num_send_env; i++)
259: if (match_pattern(name, options.send_env[i]))
260: return 1;
1.1 djm 261:
1.10 djm 262: return 0;
263: }
1.1 djm 264:
1.10 djm 265: /* Mux master protocol message handlers */
1.1 djm 266:
1.10 djm 267: static int
1.76 ! djm 268: mux_master_process_hello(struct ssh *ssh, u_int rid,
1.73 markus 269: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 270: {
271: u_int ver;
272: struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx;
1.73 markus 273: int r;
1.1 djm 274:
1.10 djm 275: if (state == NULL)
276: fatal("%s: channel %d: c->mux_ctx == NULL", __func__, c->self);
277: if (state->hello_rcvd) {
278: error("%s: HELLO received twice", __func__);
279: return -1;
280: }
1.73 markus 281: if ((r = sshbuf_get_u32(m, &ver)) != 0) {
282: error("%s: malformed message: %s", __func__, ssh_err(r));
1.10 djm 283: return -1;
284: }
285: if (ver != SSHMUX_VER) {
1.76 ! djm 286: error("%s: unsupported multiplexing protocol version %u "
! 287: "(expected %u)", __func__, ver, SSHMUX_VER);
1.10 djm 288: return -1;
289: }
290: debug2("%s: channel %d slave version %u", __func__, c->self, ver);
291:
292: /* No extensions are presently defined */
1.73 markus 293: while (sshbuf_len(m) > 0) {
294: char *name = NULL;
1.76 ! djm 295: size_t value_len = 0;
1.73 markus 296:
297: if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 ||
1.76 ! djm 298: (r = sshbuf_get_string_direct(m, NULL, &value_len)) != 0) {
1.73 markus 299: error("%s: malformed extension: %s",
300: __func__, ssh_err(r));
301: return -1;
1.1 djm 302: }
1.76 ! djm 303: debug2("%s: Unrecognised extension \"%s\" length %zu",
! 304: __func__, name, value_len);
1.41 djm 305: free(name);
1.1 djm 306: }
1.10 djm 307: state->hello_rcvd = 1;
308: return 0;
309: }
310:
1.73 markus 311: /* Enqueue a "ok" response to the reply buffer */
312: static void
313: reply_ok(struct sshbuf *reply, u_int rid)
314: {
315: int r;
316:
317: if ((r = sshbuf_put_u32(reply, MUX_S_OK)) != 0 ||
318: (r = sshbuf_put_u32(reply, rid)) != 0)
319: fatal("%s: reply: %s", __func__, ssh_err(r));
320: }
321:
322: /* Enqueue an error response to the reply buffer */
323: static void
324: reply_error(struct sshbuf *reply, u_int type, u_int rid, const char *msg)
325: {
326: int r;
327:
328: if ((r = sshbuf_put_u32(reply, type)) != 0 ||
329: (r = sshbuf_put_u32(reply, rid)) != 0 ||
330: (r = sshbuf_put_cstring(reply, msg)) != 0)
331: fatal("%s: reply: %s", __func__, ssh_err(r));
332: }
333:
1.10 djm 334: static int
1.76 ! djm 335: mux_master_process_new_session(struct ssh *ssh, u_int rid,
1.73 markus 336: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 337: {
338: Channel *nc;
339: struct mux_session_confirm_ctx *cctx;
1.73 markus 340: char *cmd, *cp;
341: u_int i, j, env_len, escape_char, window, packetmax;
342: int r, new_fd[3];
1.1 djm 343:
344: /* Reply for SSHMUX_COMMAND_OPEN */
1.10 djm 345: cctx = xcalloc(1, sizeof(*cctx));
346: cctx->term = NULL;
1.17 djm 347: cctx->rid = rid;
1.73 markus 348: cmd = NULL;
1.36 djm 349: cctx->env = NULL;
350: env_len = 0;
1.73 markus 351: if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */
352: (r = sshbuf_get_u32(m, &cctx->want_tty)) != 0 ||
353: (r = sshbuf_get_u32(m, &cctx->want_x_fwd)) != 0 ||
354: (r = sshbuf_get_u32(m, &cctx->want_agent_fwd)) != 0 ||
355: (r = sshbuf_get_u32(m, &cctx->want_subsys)) != 0 ||
356: (r = sshbuf_get_u32(m, &escape_char)) != 0 ||
357: (r = sshbuf_get_cstring(m, &cctx->term, NULL)) != 0 ||
358: (r = sshbuf_get_cstring(m, &cmd, NULL)) != 0) {
1.10 djm 359: malf:
1.41 djm 360: free(cmd);
1.36 djm 361: for (j = 0; j < env_len; j++)
1.41 djm 362: free(cctx->env[j]);
363: free(cctx->env);
364: free(cctx->term);
365: free(cctx);
1.10 djm 366: error("%s: malformed message", __func__);
367: return -1;
1.1 djm 368: }
369:
1.10 djm 370: #define MUX_MAX_ENV_VARS 4096
1.73 markus 371: while (sshbuf_len(m) > 0) {
372: if ((r = sshbuf_get_cstring(m, &cp, NULL)) != 0)
1.10 djm 373: goto malf;
374: if (!env_permitted(cp)) {
1.41 djm 375: free(cp);
1.10 djm 376: continue;
377: }
1.51 deraadt 378: cctx->env = xreallocarray(cctx->env, env_len + 2,
1.10 djm 379: sizeof(*cctx->env));
380: cctx->env[env_len++] = cp;
381: cctx->env[env_len] = NULL;
382: if (env_len > MUX_MAX_ENV_VARS) {
1.76 ! djm 383: error("%s: >%d environment variables received, "
! 384: "ignoring additional", __func__, MUX_MAX_ENV_VARS);
1.10 djm 385: break;
386: }
1.1 djm 387: }
388:
1.10 djm 389: debug2("%s: channel %d: request tty %d, X %d, agent %d, subsys %d, "
390: "term \"%s\", cmd \"%s\", env %u", __func__, c->self,
391: cctx->want_tty, cctx->want_x_fwd, cctx->want_agent_fwd,
392: cctx->want_subsys, cctx->term, cmd, env_len);
1.1 djm 393:
1.73 markus 394: if ((cctx->cmd = sshbuf_new()) == NULL)
395: fatal("%s: sshbuf_new", __func__);
396: if ((r = sshbuf_put(cctx->cmd, cmd, strlen(cmd))) != 0)
397: fatal("%s: sshbuf_put: %s", __func__, ssh_err(r));
1.41 djm 398: free(cmd);
1.11 djm 399: cmd = NULL;
1.1 djm 400:
401: /* Gather fds from client */
402: for(i = 0; i < 3; i++) {
1.10 djm 403: if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) {
1.1 djm 404: error("%s: failed to receive fd %d from slave",
405: __func__, i);
406: for (j = 0; j < i; j++)
407: close(new_fd[j]);
408: for (j = 0; j < env_len; j++)
1.41 djm 409: free(cctx->env[j]);
410: free(cctx->env);
411: free(cctx->term);
1.73 markus 412: sshbuf_free(cctx->cmd);
1.41 djm 413: free(cctx);
1.73 markus 414: reply_error(reply, MUX_S_FAILURE, rid,
1.10 djm 415: "did not receive file descriptors");
416: return -1;
1.1 djm 417: }
418: }
419:
1.10 djm 420: debug3("%s: got fds stdin %d, stdout %d, stderr %d", __func__,
1.1 djm 421: new_fd[0], new_fd[1], new_fd[2]);
422:
1.10 djm 423: /* XXX support multiple child sessions in future */
1.67 djm 424: if (c->have_remote_id) {
1.10 djm 425: debug2("%s: session already open", __func__);
1.73 markus 426: reply_error(reply, MUX_S_FAILURE, rid,
427: "Multiple sessions not supported");
1.10 djm 428: cleanup:
1.1 djm 429: close(new_fd[0]);
430: close(new_fd[1]);
431: close(new_fd[2]);
1.41 djm 432: free(cctx->term);
1.1 djm 433: if (env_len != 0) {
434: for (i = 0; i < env_len; i++)
1.41 djm 435: free(cctx->env[i]);
436: free(cctx->env);
1.1 djm 437: }
1.73 markus 438: sshbuf_free(cctx->cmd);
1.41 djm 439: free(cctx);
1.1 djm 440: return 0;
441: }
1.10 djm 442:
443: if (options.control_master == SSHCTL_MASTER_ASK ||
444: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
445: if (!ask_permission("Allow shared connection to %s? ", host)) {
446: debug2("%s: session refused by user", __func__);
1.73 markus 447: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
448: "Permission denied");
1.10 djm 449: goto cleanup;
450: }
451: }
452:
453: /* Try to pick up ttymodes from client before it goes raw */
454: if (cctx->want_tty && tcgetattr(new_fd[0], &cctx->tio) == -1)
455: error("%s: tcgetattr: %s", __func__, strerror(errno));
1.1 djm 456:
457: /* enable nonblocking unless tty */
458: if (!isatty(new_fd[0]))
459: set_nonblock(new_fd[0]);
460: if (!isatty(new_fd[1]))
461: set_nonblock(new_fd[1]);
462: if (!isatty(new_fd[2]))
463: set_nonblock(new_fd[2]);
464:
465: window = CHAN_SES_WINDOW_DEFAULT;
466: packetmax = CHAN_SES_PACKET_DEFAULT;
467: if (cctx->want_tty) {
468: window >>= 1;
469: packetmax >>= 1;
470: }
1.10 djm 471:
1.66 djm 472: nc = channel_new(ssh, "session", SSH_CHANNEL_OPENING,
1.1 djm 473: new_fd[0], new_fd[1], new_fd[2], window, packetmax,
474: CHAN_EXTENDED_WRITE, "client-session", /*nonblock*/0);
475:
1.10 djm 476: nc->ctl_chan = c->self; /* link session -> control channel */
477: c->remote_id = nc->self; /* link control -> session channel */
1.67 djm 478: c->have_remote_id = 1;
1.10 djm 479:
1.2 djm 480: if (cctx->want_tty && escape_char != 0xffffffff) {
1.66 djm 481: channel_register_filter(ssh, nc->self,
1.2 djm 482: client_simple_escape_filter, NULL,
1.4 djm 483: client_filter_cleanup,
1.2 djm 484: client_new_escape_filter_ctx((int)escape_char));
485: }
1.1 djm 486:
1.10 djm 487: debug2("%s: channel_new: %d linked to control channel %d",
488: __func__, nc->self, nc->ctl_chan);
489:
1.66 djm 490: channel_send_open(ssh, nc->self);
491: channel_register_open_confirm(ssh, nc->self, mux_session_confirm, cctx);
1.17 djm 492: c->mux_pause = 1; /* stop handling messages until open_confirm done */
1.66 djm 493: channel_register_cleanup(ssh, nc->self,
494: mux_master_session_cleanup_cb, 1);
1.10 djm 495:
1.17 djm 496: /* reply is deferred, sent by mux_session_confirm */
1.1 djm 497: return 0;
498: }
499:
1.10 djm 500: static int
1.76 ! djm 501: mux_master_process_alive_check(struct ssh *ssh, u_int rid,
1.73 markus 502: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.1 djm 503: {
1.73 markus 504: int r;
505:
1.10 djm 506: debug2("%s: channel %d: alive check", __func__, c->self);
1.1 djm 507:
1.10 djm 508: /* prepare reply */
1.73 markus 509: if ((r = sshbuf_put_u32(reply, MUX_S_ALIVE)) != 0 ||
510: (r = sshbuf_put_u32(reply, rid)) != 0 ||
511: (r = sshbuf_put_u32(reply, (u_int)getpid())) != 0)
512: fatal("%s: reply: %s", __func__, ssh_err(r));
1.1 djm 513:
1.10 djm 514: return 0;
1.1 djm 515: }
516:
517: static int
1.76 ! djm 518: mux_master_process_terminate(struct ssh *ssh, u_int rid,
1.73 markus 519: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.1 djm 520: {
1.10 djm 521: debug2("%s: channel %d: terminate request", __func__, c->self);
1.1 djm 522:
1.10 djm 523: if (options.control_master == SSHCTL_MASTER_ASK ||
524: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
525: if (!ask_permission("Terminate shared connection to %s? ",
526: host)) {
527: debug2("%s: termination refused by user", __func__);
1.73 markus 528: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
529: "Permission denied");
1.10 djm 530: return 0;
531: }
532: }
1.1 djm 533:
1.10 djm 534: quit_pending = 1;
1.73 markus 535: reply_ok(reply, rid);
1.10 djm 536: /* XXX exit happens too soon - message never makes it to client */
537: return 0;
1.1 djm 538: }
539:
1.10 djm 540: static char *
1.46 millert 541: format_forward(u_int ftype, struct Forward *fwd)
1.1 djm 542: {
1.10 djm 543: char *ret;
1.1 djm 544:
1.10 djm 545: switch (ftype) {
546: case MUX_FWD_LOCAL:
547: xasprintf(&ret, "local forward %.200s:%d -> %.200s:%d",
1.46 millert 548: (fwd->listen_path != NULL) ? fwd->listen_path :
1.10 djm 549: (fwd->listen_host == NULL) ?
1.46 millert 550: (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
1.10 djm 551: fwd->listen_host, fwd->listen_port,
1.46 millert 552: (fwd->connect_path != NULL) ? fwd->connect_path :
1.10 djm 553: fwd->connect_host, fwd->connect_port);
554: break;
555: case MUX_FWD_DYNAMIC:
556: xasprintf(&ret, "dynamic forward %.200s:%d -> *",
557: (fwd->listen_host == NULL) ?
1.46 millert 558: (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
1.10 djm 559: fwd->listen_host, fwd->listen_port);
560: break;
561: case MUX_FWD_REMOTE:
562: xasprintf(&ret, "remote forward %.200s:%d -> %.200s:%d",
1.46 millert 563: (fwd->listen_path != NULL) ? fwd->listen_path :
1.10 djm 564: (fwd->listen_host == NULL) ?
565: "LOCALHOST" : fwd->listen_host,
566: fwd->listen_port,
1.46 millert 567: (fwd->connect_path != NULL) ? fwd->connect_path :
1.10 djm 568: fwd->connect_host, fwd->connect_port);
1.1 djm 569: break;
570: default:
1.10 djm 571: fatal("%s: unknown forward type %u", __func__, ftype);
1.1 djm 572: }
1.10 djm 573: return ret;
574: }
1.1 djm 575:
1.10 djm 576: static int
577: compare_host(const char *a, const char *b)
578: {
579: if (a == NULL && b == NULL)
580: return 1;
581: if (a == NULL || b == NULL)
582: return 0;
583: return strcmp(a, b) == 0;
584: }
1.1 djm 585:
1.10 djm 586: static int
1.46 millert 587: compare_forward(struct Forward *a, struct Forward *b)
1.10 djm 588: {
589: if (!compare_host(a->listen_host, b->listen_host))
590: return 0;
1.46 millert 591: if (!compare_host(a->listen_path, b->listen_path))
592: return 0;
1.10 djm 593: if (a->listen_port != b->listen_port)
594: return 0;
595: if (!compare_host(a->connect_host, b->connect_host))
596: return 0;
1.46 millert 597: if (!compare_host(a->connect_path, b->connect_path))
598: return 0;
1.10 djm 599: if (a->connect_port != b->connect_port)
600: return 0;
1.1 djm 601:
1.10 djm 602: return 1;
603: }
1.1 djm 604:
1.18 markus 605: static void
1.66 djm 606: mux_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
1.18 markus 607: {
608: struct mux_channel_confirm_ctx *fctx = ctxt;
609: char *failmsg = NULL;
1.46 millert 610: struct Forward *rfwd;
1.18 markus 611: Channel *c;
1.73 markus 612: struct sshbuf *out;
613: int r;
1.18 markus 614:
1.66 djm 615: if ((c = channel_by_id(ssh, fctx->cid)) == NULL) {
1.18 markus 616: /* no channel for reply */
617: error("%s: unknown channel", __func__);
618: return;
619: }
1.73 markus 620: if ((out = sshbuf_new()) == NULL)
621: fatal("%s: sshbuf_new", __func__);
1.53 djm 622: if (fctx->fid >= options.num_remote_forwards ||
623: (options.remote_forwards[fctx->fid].connect_path == NULL &&
624: options.remote_forwards[fctx->fid].connect_host == NULL)) {
1.18 markus 625: xasprintf(&failmsg, "unknown forwarding id %d", fctx->fid);
626: goto fail;
627: }
628: rfwd = &options.remote_forwards[fctx->fid];
629: debug("%s: %s for: listen %d, connect %s:%d", __func__,
630: type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
1.46 millert 631: rfwd->listen_port, rfwd->connect_path ? rfwd->connect_path :
632: rfwd->connect_host, rfwd->connect_port);
1.18 markus 633: if (type == SSH2_MSG_REQUEST_SUCCESS) {
634: if (rfwd->listen_port == 0) {
635: rfwd->allocated_port = packet_get_int();
1.52 djm 636: debug("Allocated port %u for mux remote forward"
1.18 markus 637: " to %s:%d", rfwd->allocated_port,
638: rfwd->connect_host, rfwd->connect_port);
1.73 markus 639: if ((r = sshbuf_put_u32(out,
640: MUX_S_REMOTE_PORT)) != 0 ||
641: (r = sshbuf_put_u32(out, fctx->rid)) != 0 ||
642: (r = sshbuf_put_u32(out,
643: rfwd->allocated_port)) != 0)
644: fatal("%s: reply: %s", __func__, ssh_err(r));
1.70 djm 645: channel_update_permission(ssh, rfwd->handle,
1.31 markus 646: rfwd->allocated_port);
1.18 markus 647: } else {
1.73 markus 648: reply_ok(out, fctx->rid);
1.18 markus 649: }
650: goto out;
651: } else {
1.31 markus 652: if (rfwd->listen_port == 0)
1.70 djm 653: channel_update_permission(ssh, rfwd->handle, -1);
1.46 millert 654: if (rfwd->listen_path != NULL)
655: xasprintf(&failmsg, "remote port forwarding failed for "
656: "listen path %s", rfwd->listen_path);
657: else
658: xasprintf(&failmsg, "remote port forwarding failed for "
659: "listen port %d", rfwd->listen_port);
1.53 djm 660:
661: debug2("%s: clearing registered forwarding for listen %d, "
662: "connect %s:%d", __func__, rfwd->listen_port,
663: rfwd->connect_path ? rfwd->connect_path :
664: rfwd->connect_host, rfwd->connect_port);
665:
666: free(rfwd->listen_host);
667: free(rfwd->listen_path);
668: free(rfwd->connect_host);
669: free(rfwd->connect_path);
670: memset(rfwd, 0, sizeof(*rfwd));
1.18 markus 671: }
672: fail:
673: error("%s: %s", __func__, failmsg);
1.73 markus 674: reply_error(out, MUX_S_FAILURE, fctx->rid, failmsg);
1.41 djm 675: free(failmsg);
1.18 markus 676: out:
1.73 markus 677: if ((r = sshbuf_put_stringb(c->output, out)) != 0)
678: fatal("%s: sshbuf_put_stringb: %s", __func__, ssh_err(r));
679: sshbuf_free(out);
1.18 markus 680: if (c->mux_pause <= 0)
681: fatal("%s: mux_pause %d", __func__, c->mux_pause);
682: c->mux_pause = 0; /* start processing messages again */
683: }
684:
1.10 djm 685: static int
1.76 ! djm 686: mux_master_process_open_fwd(struct ssh *ssh, u_int rid,
1.73 markus 687: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 688: {
1.46 millert 689: struct Forward fwd;
1.10 djm 690: char *fwd_desc = NULL;
1.46 millert 691: char *listen_addr, *connect_addr;
1.10 djm 692: u_int ftype;
1.44 djm 693: u_int lport, cport;
1.73 markus 694: int r, i, ret = 0, freefwd = 1;
1.10 djm 695:
1.54 djm 696: memset(&fwd, 0, sizeof(fwd));
697:
1.46 millert 698: /* XXX - lport/cport check redundant */
1.73 markus 699: if ((r = sshbuf_get_u32(m, &ftype)) != 0 ||
700: (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 ||
701: (r = sshbuf_get_u32(m, &lport)) != 0 ||
702: (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 ||
703: (r = sshbuf_get_u32(m, &cport)) != 0 ||
1.46 millert 704: (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
705: (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
1.10 djm 706: error("%s: malformed message", __func__);
707: ret = -1;
708: goto out;
709: }
1.46 millert 710: if (*listen_addr == '\0') {
711: free(listen_addr);
712: listen_addr = NULL;
713: }
714: if (*connect_addr == '\0') {
715: free(connect_addr);
716: connect_addr = NULL;
717: }
718:
719: memset(&fwd, 0, sizeof(fwd));
1.44 djm 720: fwd.listen_port = lport;
1.46 millert 721: if (fwd.listen_port == PORT_STREAMLOCAL)
722: fwd.listen_path = listen_addr;
723: else
724: fwd.listen_host = listen_addr;
1.44 djm 725: fwd.connect_port = cport;
1.46 millert 726: if (fwd.connect_port == PORT_STREAMLOCAL)
727: fwd.connect_path = connect_addr;
728: else
729: fwd.connect_host = connect_addr;
1.10 djm 730:
731: debug2("%s: channel %d: request %s", __func__, c->self,
732: (fwd_desc = format_forward(ftype, &fwd)));
733:
734: if (ftype != MUX_FWD_LOCAL && ftype != MUX_FWD_REMOTE &&
735: ftype != MUX_FWD_DYNAMIC) {
736: logit("%s: invalid forwarding type %u", __func__, ftype);
737: invalid:
1.46 millert 738: free(listen_addr);
739: free(connect_addr);
1.73 markus 740: reply_error(reply, MUX_S_FAILURE, rid,
741: "Invalid forwarding request");
1.10 djm 742: return 0;
743: }
1.46 millert 744: if (ftype == MUX_FWD_DYNAMIC && fwd.listen_path) {
745: logit("%s: streamlocal and dynamic forwards "
746: "are mutually exclusive", __func__);
747: goto invalid;
748: }
749: if (fwd.listen_port != PORT_STREAMLOCAL && fwd.listen_port >= 65536) {
1.10 djm 750: logit("%s: invalid listen port %u", __func__,
751: fwd.listen_port);
752: goto invalid;
753: }
1.66 djm 754: if ((fwd.connect_port != PORT_STREAMLOCAL &&
755: fwd.connect_port >= 65536) ||
756: (ftype != MUX_FWD_DYNAMIC && ftype != MUX_FWD_REMOTE &&
757: fwd.connect_port == 0)) {
1.10 djm 758: logit("%s: invalid connect port %u", __func__,
759: fwd.connect_port);
760: goto invalid;
761: }
1.66 djm 762: if (ftype != MUX_FWD_DYNAMIC && fwd.connect_host == NULL &&
763: fwd.connect_path == NULL) {
1.10 djm 764: logit("%s: missing connect host", __func__);
765: goto invalid;
766: }
767:
768: /* Skip forwards that have already been requested */
769: switch (ftype) {
770: case MUX_FWD_LOCAL:
771: case MUX_FWD_DYNAMIC:
772: for (i = 0; i < options.num_local_forwards; i++) {
773: if (compare_forward(&fwd,
774: options.local_forwards + i)) {
775: exists:
776: debug2("%s: found existing forwarding",
777: __func__);
1.73 markus 778: reply_ok(reply, rid);
1.10 djm 779: goto out;
780: }
781: }
782: break;
783: case MUX_FWD_REMOTE:
784: for (i = 0; i < options.num_remote_forwards; i++) {
1.73 markus 785: if (!compare_forward(&fwd, options.remote_forwards + i))
786: continue;
787: if (fwd.listen_port != 0)
788: goto exists;
789: debug2("%s: found allocated port", __func__);
790: if ((r = sshbuf_put_u32(reply,
791: MUX_S_REMOTE_PORT)) != 0 ||
792: (r = sshbuf_put_u32(reply, rid)) != 0 ||
793: (r = sshbuf_put_u32(reply,
794: options.remote_forwards[i].allocated_port)) != 0)
795: fatal("%s: reply: %s", __func__, ssh_err(r));
796: goto out;
1.10 djm 797: }
798: break;
799: }
800:
801: if (options.control_master == SSHCTL_MASTER_ASK ||
802: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
803: if (!ask_permission("Open %s on %s?", fwd_desc, host)) {
804: debug2("%s: forwarding refused by user", __func__);
1.73 markus 805: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
806: "Permission denied");
1.10 djm 807: goto out;
808: }
809: }
810:
811: if (ftype == MUX_FWD_LOCAL || ftype == MUX_FWD_DYNAMIC) {
1.66 djm 812: if (!channel_setup_local_fwd_listener(ssh, &fwd,
1.46 millert 813: &options.fwd_opts)) {
1.10 djm 814: fail:
1.76 ! djm 815: logit("%s: requested %s failed", __func__, fwd_desc);
1.73 markus 816: reply_error(reply, MUX_S_FAILURE, rid,
817: "Port forwarding failed");
1.10 djm 818: goto out;
819: }
820: add_local_forward(&options, &fwd);
821: freefwd = 0;
822: } else {
1.18 markus 823: struct mux_channel_confirm_ctx *fctx;
824:
1.66 djm 825: fwd.handle = channel_request_remote_forwarding(ssh, &fwd);
1.31 markus 826: if (fwd.handle < 0)
1.10 djm 827: goto fail;
828: add_remote_forward(&options, &fwd);
1.18 markus 829: fctx = xcalloc(1, sizeof(*fctx));
830: fctx->cid = c->self;
831: fctx->rid = rid;
1.20 djm 832: fctx->fid = options.num_remote_forwards - 1;
1.18 markus 833: client_register_global_confirm(mux_confirm_remote_forward,
834: fctx);
1.10 djm 835: freefwd = 0;
1.18 markus 836: c->mux_pause = 1; /* wait for mux_confirm_remote_forward */
837: /* delayed reply in mux_confirm_remote_forward */
838: goto out;
1.10 djm 839: }
1.73 markus 840: reply_ok(reply, rid);
1.10 djm 841: out:
1.41 djm 842: free(fwd_desc);
1.10 djm 843: if (freefwd) {
1.41 djm 844: free(fwd.listen_host);
1.46 millert 845: free(fwd.listen_path);
1.41 djm 846: free(fwd.connect_host);
1.46 millert 847: free(fwd.connect_path);
1.10 djm 848: }
849: return ret;
850: }
851:
852: static int
1.76 ! djm 853: mux_master_process_close_fwd(struct ssh *ssh, u_int rid,
1.73 markus 854: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 855: {
1.46 millert 856: struct Forward fwd, *found_fwd;
1.10 djm 857: char *fwd_desc = NULL;
1.30 djm 858: const char *error_reason = NULL;
1.46 millert 859: char *listen_addr = NULL, *connect_addr = NULL;
1.10 djm 860: u_int ftype;
1.73 markus 861: int r, i, ret = 0;
1.44 djm 862: u_int lport, cport;
1.54 djm 863:
864: memset(&fwd, 0, sizeof(fwd));
1.10 djm 865:
1.73 markus 866: if ((r = sshbuf_get_u32(m, &ftype)) != 0 ||
867: (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 ||
868: (r = sshbuf_get_u32(m, &lport)) != 0 ||
869: (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 ||
870: (r = sshbuf_get_u32(m, &cport)) != 0 ||
1.46 millert 871: (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
872: (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
1.10 djm 873: error("%s: malformed message", __func__);
874: ret = -1;
875: goto out;
876: }
877:
1.46 millert 878: if (*listen_addr == '\0') {
879: free(listen_addr);
880: listen_addr = NULL;
1.10 djm 881: }
1.46 millert 882: if (*connect_addr == '\0') {
883: free(connect_addr);
884: connect_addr = NULL;
1.10 djm 885: }
886:
1.46 millert 887: memset(&fwd, 0, sizeof(fwd));
888: fwd.listen_port = lport;
889: if (fwd.listen_port == PORT_STREAMLOCAL)
890: fwd.listen_path = listen_addr;
891: else
892: fwd.listen_host = listen_addr;
893: fwd.connect_port = cport;
894: if (fwd.connect_port == PORT_STREAMLOCAL)
895: fwd.connect_path = connect_addr;
896: else
897: fwd.connect_host = connect_addr;
898:
1.30 djm 899: debug2("%s: channel %d: request cancel %s", __func__, c->self,
1.10 djm 900: (fwd_desc = format_forward(ftype, &fwd)));
901:
1.30 djm 902: /* make sure this has been requested */
903: found_fwd = NULL;
904: switch (ftype) {
905: case MUX_FWD_LOCAL:
906: case MUX_FWD_DYNAMIC:
907: for (i = 0; i < options.num_local_forwards; i++) {
908: if (compare_forward(&fwd,
909: options.local_forwards + i)) {
910: found_fwd = options.local_forwards + i;
911: break;
912: }
913: }
914: break;
915: case MUX_FWD_REMOTE:
916: for (i = 0; i < options.num_remote_forwards; i++) {
917: if (compare_forward(&fwd,
918: options.remote_forwards + i)) {
919: found_fwd = options.remote_forwards + i;
920: break;
921: }
922: }
923: break;
924: }
925:
926: if (found_fwd == NULL)
927: error_reason = "port not forwarded";
928: else if (ftype == MUX_FWD_REMOTE) {
929: /*
930: * This shouldn't fail unless we confused the host/port
931: * between options.remote_forwards and permitted_opens.
1.31 markus 932: * However, for dynamic allocated listen ports we need
1.46 millert 933: * to use the actual listen port.
1.30 djm 934: */
1.66 djm 935: if (channel_request_rforward_cancel(ssh, found_fwd) == -1)
1.30 djm 936: error_reason = "port not in permitted opens";
937: } else { /* local and dynamic forwards */
938: /* Ditto */
1.66 djm 939: if (channel_cancel_lport_listener(ssh, &fwd, fwd.connect_port,
1.46 millert 940: &options.fwd_opts) == -1)
1.30 djm 941: error_reason = "port not found";
942: }
943:
1.73 markus 944: if (error_reason != NULL)
945: reply_error(reply, MUX_S_FAILURE, rid, error_reason);
946: else {
947: reply_ok(reply, rid);
1.41 djm 948: free(found_fwd->listen_host);
1.46 millert 949: free(found_fwd->listen_path);
1.41 djm 950: free(found_fwd->connect_host);
1.46 millert 951: free(found_fwd->connect_path);
1.30 djm 952: found_fwd->listen_host = found_fwd->connect_host = NULL;
1.46 millert 953: found_fwd->listen_path = found_fwd->connect_path = NULL;
1.30 djm 954: found_fwd->listen_port = found_fwd->connect_port = 0;
955: }
1.10 djm 956: out:
1.41 djm 957: free(fwd_desc);
1.46 millert 958: free(listen_addr);
959: free(connect_addr);
1.10 djm 960:
961: return ret;
962: }
963:
964: static int
1.76 ! djm 965: mux_master_process_stdio_fwd(struct ssh *ssh, u_int rid,
1.73 markus 966: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 967: {
968: Channel *nc;
1.73 markus 969: char *chost = NULL;
1.10 djm 970: u_int cport, i, j;
1.73 markus 971: int r, new_fd[2];
1.48 djm 972: struct mux_stdio_confirm_ctx *cctx;
1.10 djm 973:
1.73 markus 974: if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */
975: (r = sshbuf_get_cstring(m, &chost, NULL)) != 0 ||
976: (r = sshbuf_get_u32(m, &cport)) != 0) {
1.41 djm 977: free(chost);
1.10 djm 978: error("%s: malformed message", __func__);
979: return -1;
980: }
981:
982: debug2("%s: channel %d: request stdio fwd to %s:%u",
983: __func__, c->self, chost, cport);
984:
985: /* Gather fds from client */
986: for(i = 0; i < 2; i++) {
987: if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) {
988: error("%s: failed to receive fd %d from slave",
989: __func__, i);
990: for (j = 0; j < i; j++)
991: close(new_fd[j]);
1.41 djm 992: free(chost);
1.10 djm 993:
994: /* prepare reply */
1.73 markus 995: reply_error(reply, MUX_S_FAILURE, rid,
1.10 djm 996: "did not receive file descriptors");
997: return -1;
998: }
999: }
1000:
1001: debug3("%s: got fds stdin %d, stdout %d", __func__,
1002: new_fd[0], new_fd[1]);
1003:
1004: /* XXX support multiple child sessions in future */
1.67 djm 1005: if (c->have_remote_id) {
1.10 djm 1006: debug2("%s: session already open", __func__);
1.73 markus 1007: reply_error(reply, MUX_S_FAILURE, rid,
1008: "Multiple sessions not supported");
1.10 djm 1009: cleanup:
1010: close(new_fd[0]);
1011: close(new_fd[1]);
1.41 djm 1012: free(chost);
1.10 djm 1013: return 0;
1014: }
1015:
1016: if (options.control_master == SSHCTL_MASTER_ASK ||
1017: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
1.23 dtucker 1018: if (!ask_permission("Allow forward to %s:%u? ",
1.10 djm 1019: chost, cport)) {
1020: debug2("%s: stdio fwd refused by user", __func__);
1.73 markus 1021: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
1022: "Permission denied");
1.10 djm 1023: goto cleanup;
1024: }
1025: }
1026:
1027: /* enable nonblocking unless tty */
1028: if (!isatty(new_fd[0]))
1029: set_nonblock(new_fd[0]);
1030: if (!isatty(new_fd[1]))
1031: set_nonblock(new_fd[1]);
1032:
1.66 djm 1033: nc = channel_connect_stdio_fwd(ssh, chost, cport, new_fd[0], new_fd[1]);
1.75 djm 1034: free(chost);
1.10 djm 1035:
1036: nc->ctl_chan = c->self; /* link session -> control channel */
1037: c->remote_id = nc->self; /* link control -> session channel */
1.67 djm 1038: c->have_remote_id = 1;
1.10 djm 1039:
1040: debug2("%s: channel_new: %d linked to control channel %d",
1041: __func__, nc->self, nc->ctl_chan);
1042:
1.66 djm 1043: channel_register_cleanup(ssh, nc->self,
1044: mux_master_session_cleanup_cb, 1);
1.10 djm 1045:
1.48 djm 1046: cctx = xcalloc(1, sizeof(*cctx));
1047: cctx->rid = rid;
1.66 djm 1048: channel_register_open_confirm(ssh, nc->self, mux_stdio_confirm, cctx);
1.48 djm 1049: c->mux_pause = 1; /* stop handling messages until open_confirm done */
1050:
1051: /* reply is deferred, sent by mux_session_confirm */
1052: return 0;
1053: }
1054:
1055: /* Callback on open confirmation in mux master for a mux stdio fwd session. */
1056: static void
1.66 djm 1057: mux_stdio_confirm(struct ssh *ssh, int id, int success, void *arg)
1.48 djm 1058: {
1059: struct mux_stdio_confirm_ctx *cctx = arg;
1060: Channel *c, *cc;
1.73 markus 1061: struct sshbuf *reply;
1062: int r;
1.48 djm 1063:
1064: if (cctx == NULL)
1065: fatal("%s: cctx == NULL", __func__);
1.66 djm 1066: if ((c = channel_by_id(ssh, id)) == NULL)
1.48 djm 1067: fatal("%s: no channel for id %d", __func__, id);
1.66 djm 1068: if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.48 djm 1069: fatal("%s: channel %d lacks control channel %d", __func__,
1070: id, c->ctl_chan);
1.73 markus 1071: if ((reply = sshbuf_new()) == NULL)
1072: fatal("%s: sshbuf_new", __func__);
1.48 djm 1073:
1074: if (!success) {
1075: debug3("%s: sending failure reply", __func__);
1.73 markus 1076: reply_error(reply, MUX_S_FAILURE, cctx->rid,
1077: "Session open refused by peer");
1.48 djm 1078: /* prepare reply */
1079: goto done;
1080: }
1081:
1082: debug3("%s: sending success reply", __func__);
1.10 djm 1083: /* prepare reply */
1.73 markus 1084: if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 ||
1085: (r = sshbuf_put_u32(reply, cctx->rid)) != 0 ||
1086: (r = sshbuf_put_u32(reply, c->self)) != 0)
1087: fatal("%s: reply: %s", __func__, ssh_err(r));
1.48 djm 1088:
1089: done:
1090: /* Send reply */
1.73 markus 1091: if ((r = sshbuf_put_stringb(cc->output, reply)) != 0)
1092: fatal("%s: sshbuf_put_stringb: %s", __func__, ssh_err(r));
1093: sshbuf_free(reply);
1.10 djm 1094:
1.48 djm 1095: if (cc->mux_pause <= 0)
1096: fatal("%s: mux_pause %d", __func__, cc->mux_pause);
1097: cc->mux_pause = 0; /* start processing messages again */
1098: c->open_confirm_ctx = NULL;
1099: free(cctx);
1.10 djm 1100: }
1101:
1.25 djm 1102: static int
1.76 ! djm 1103: mux_master_process_stop_listening(struct ssh *ssh, u_int rid,
1.73 markus 1104: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.25 djm 1105: {
1106: debug("%s: channel %d: stop listening", __func__, c->self);
1107:
1108: if (options.control_master == SSHCTL_MASTER_ASK ||
1109: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
1110: if (!ask_permission("Disable further multiplexing on shared "
1111: "connection to %s? ", host)) {
1112: debug2("%s: stop listen refused by user", __func__);
1.73 markus 1113: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
1114: "Permission denied");
1.25 djm 1115: return 0;
1116: }
1117: }
1118:
1119: if (mux_listener_channel != NULL) {
1.66 djm 1120: channel_free(ssh, mux_listener_channel);
1.25 djm 1121: client_stop_mux();
1.41 djm 1122: free(options.control_path);
1.25 djm 1123: options.control_path = NULL;
1124: mux_listener_channel = NULL;
1125: muxserver_sock = -1;
1126: }
1127:
1.73 markus 1128: reply_ok(reply, rid);
1.25 djm 1129: return 0;
1130: }
1131:
1.62 markus 1132: static int
1.76 ! djm 1133: mux_master_process_proxy(struct ssh *ssh, u_int rid,
1.73 markus 1134: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.62 markus 1135: {
1.73 markus 1136: int r;
1137:
1.62 markus 1138: debug("%s: channel %d: proxy request", __func__, c->self);
1139:
1140: c->mux_rcb = channel_proxy_downstream;
1.73 markus 1141: if ((r = sshbuf_put_u32(reply, MUX_S_PROXY)) != 0 ||
1142: (r = sshbuf_put_u32(reply, rid)) != 0)
1143: fatal("%s: reply: %s", __func__, ssh_err(r));
1.62 markus 1144:
1145: return 0;
1146: }
1147:
1.10 djm 1148: /* Channel callbacks fired on read/write from mux slave fd */
1149: static int
1.66 djm 1150: mux_master_read_cb(struct ssh *ssh, Channel *c)
1.10 djm 1151: {
1152: struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx;
1.73 markus 1153: struct sshbuf *in = NULL, *out = NULL;
1154: u_int type, rid, i;
1155: int r, ret = -1;
1156:
1157: if ((out = sshbuf_new()) == NULL)
1158: fatal("%s: sshbuf_new", __func__);
1.10 djm 1159:
1160: /* Setup ctx and */
1161: if (c->mux_ctx == NULL) {
1.19 djm 1162: state = xcalloc(1, sizeof(*state));
1.10 djm 1163: c->mux_ctx = state;
1.66 djm 1164: channel_register_cleanup(ssh, c->self,
1.10 djm 1165: mux_master_control_cleanup_cb, 0);
1166:
1167: /* Send hello */
1.73 markus 1168: if ((r = sshbuf_put_u32(out, MUX_MSG_HELLO)) != 0 ||
1169: (r = sshbuf_put_u32(out, SSHMUX_VER)) != 0)
1170: fatal("%s: reply: %s", __func__, ssh_err(r));
1.10 djm 1171: /* no extensions */
1.73 markus 1172: if ((r = sshbuf_put_stringb(c->output, out)) != 0)
1173: fatal("%s: sshbuf_put_stringb: %s",
1174: __func__, ssh_err(r));
1.10 djm 1175: debug3("%s: channel %d: hello sent", __func__, c->self);
1.73 markus 1176: ret = 0;
1177: goto out;
1.10 djm 1178: }
1179:
1180: /* Channel code ensures that we receive whole packets */
1.73 markus 1181: if ((r = sshbuf_froms(c->input, &in)) != 0) {
1.10 djm 1182: malf:
1183: error("%s: malformed message", __func__);
1184: goto out;
1185: }
1186:
1.73 markus 1187: if ((r = sshbuf_get_u32(in, &type)) != 0)
1.10 djm 1188: goto malf;
1.73 markus 1189: debug3("%s: channel %d packet type 0x%08x len %zu",
1190: __func__, c->self, type, sshbuf_len(in));
1.10 djm 1191:
1192: if (type == MUX_MSG_HELLO)
1193: rid = 0;
1194: else {
1195: if (!state->hello_rcvd) {
1196: error("%s: expected MUX_MSG_HELLO(0x%08x), "
1197: "received 0x%08x", __func__, MUX_MSG_HELLO, type);
1198: goto out;
1.1 djm 1199: }
1.73 markus 1200: if ((r = sshbuf_get_u32(in, &rid)) != 0)
1.10 djm 1201: goto malf;
1202: }
1203:
1204: for (i = 0; mux_master_handlers[i].handler != NULL; i++) {
1205: if (type == mux_master_handlers[i].type) {
1.66 djm 1206: ret = mux_master_handlers[i].handler(ssh, rid,
1.73 markus 1207: c, in, out);
1.10 djm 1208: break;
1.1 djm 1209: }
1.10 djm 1210: }
1211: if (mux_master_handlers[i].handler == NULL) {
1212: error("%s: unsupported mux message 0x%08x", __func__, type);
1.73 markus 1213: reply_error(out, MUX_S_FAILURE, rid, "unsupported request");
1.10 djm 1214: ret = 0;
1215: }
1216: /* Enqueue reply packet */
1.73 markus 1217: if (sshbuf_len(out) != 0) {
1218: if ((r = sshbuf_put_stringb(c->output, out)) != 0)
1219: fatal("%s: sshbuf_put_stringb: %s",
1220: __func__, ssh_err(r));
1.10 djm 1221: }
1222: out:
1.73 markus 1223: sshbuf_free(in);
1224: sshbuf_free(out);
1.10 djm 1225: return ret;
1226: }
1227:
1228: void
1.66 djm 1229: mux_exit_message(struct ssh *ssh, Channel *c, int exitval)
1.10 djm 1230: {
1.73 markus 1231: struct sshbuf *m;
1.10 djm 1232: Channel *mux_chan;
1.73 markus 1233: int r;
1.10 djm 1234:
1.40 dtucker 1235: debug3("%s: channel %d: exit message, exitval %d", __func__, c->self,
1.10 djm 1236: exitval);
1237:
1.66 djm 1238: if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.10 djm 1239: fatal("%s: channel %d missing mux channel %d",
1240: __func__, c->self, c->ctl_chan);
1241:
1242: /* Append exit message packet to control socket output queue */
1.73 markus 1243: if ((m = sshbuf_new()) == NULL)
1244: fatal("%s: sshbuf_new", __func__);
1245: if ((r = sshbuf_put_u32(m, MUX_S_EXIT_MESSAGE)) != 0 ||
1246: (r = sshbuf_put_u32(m, c->self)) != 0 ||
1247: (r = sshbuf_put_u32(m, exitval)) != 0 ||
1248: (r = sshbuf_put_stringb(mux_chan->output, m)) != 0)
1249: fatal("%s: reply: %s", __func__, ssh_err(r));
1250: sshbuf_free(m);
1.10 djm 1251: }
1252:
1.28 djm 1253: void
1.66 djm 1254: mux_tty_alloc_failed(struct ssh *ssh, Channel *c)
1.28 djm 1255: {
1.73 markus 1256: struct sshbuf *m;
1.28 djm 1257: Channel *mux_chan;
1.73 markus 1258: int r;
1.28 djm 1259:
1260: debug3("%s: channel %d: TTY alloc failed", __func__, c->self);
1261:
1.66 djm 1262: if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.28 djm 1263: fatal("%s: channel %d missing mux channel %d",
1264: __func__, c->self, c->ctl_chan);
1265:
1266: /* Append exit message packet to control socket output queue */
1.73 markus 1267: if ((m = sshbuf_new()) == NULL)
1268: fatal("%s: sshbuf_new", __func__);
1269: if ((r = sshbuf_put_u32(m, MUX_S_TTY_ALLOC_FAIL)) != 0 ||
1270: (r = sshbuf_put_u32(m, c->self)) != 0 ||
1271: (r = sshbuf_put_stringb(mux_chan->output, m)) != 0)
1272: fatal("%s: reply: %s", __func__, ssh_err(r));
1273: sshbuf_free(m);
1.28 djm 1274: }
1275:
1.10 djm 1276: /* Prepare a mux master to listen on a Unix domain socket. */
1277: void
1.66 djm 1278: muxserver_listen(struct ssh *ssh)
1.10 djm 1279: {
1280: mode_t old_umask;
1.22 djm 1281: char *orig_control_path = options.control_path;
1282: char rbuf[16+1];
1283: u_int i, r;
1.47 djm 1284: int oerrno;
1.10 djm 1285:
1286: if (options.control_path == NULL ||
1287: options.control_master == SSHCTL_MASTER_NO)
1.1 djm 1288: return;
1.10 djm 1289:
1290: debug("setting up multiplex master socket");
1291:
1.22 djm 1292: /*
1293: * Use a temporary path before listen so we can pseudo-atomically
1294: * establish the listening socket in its final location to avoid
1295: * other processes racing in between bind() and listen() and hitting
1296: * an unready socket.
1297: */
1298: for (i = 0; i < sizeof(rbuf) - 1; i++) {
1299: r = arc4random_uniform(26+26+10);
1300: rbuf[i] = (r < 26) ? 'a' + r :
1301: (r < 26*2) ? 'A' + r - 26 :
1302: '0' + r - 26 - 26;
1303: }
1304: rbuf[sizeof(rbuf) - 1] = '\0';
1305: options.control_path = NULL;
1306: xasprintf(&options.control_path, "%s.%s", orig_control_path, rbuf);
1307: debug3("%s: temporary control path %s", __func__, options.control_path);
1308:
1.10 djm 1309: old_umask = umask(0177);
1.46 millert 1310: muxserver_sock = unix_listener(options.control_path, 64, 0);
1.47 djm 1311: oerrno = errno;
1.46 millert 1312: umask(old_umask);
1313: if (muxserver_sock < 0) {
1.47 djm 1314: if (oerrno == EINVAL || oerrno == EADDRINUSE) {
1.10 djm 1315: error("ControlSocket %s already exists, "
1316: "disabling multiplexing", options.control_path);
1.22 djm 1317: disable_mux_master:
1.26 djm 1318: if (muxserver_sock != -1) {
1319: close(muxserver_sock);
1320: muxserver_sock = -1;
1321: }
1.41 djm 1322: free(orig_control_path);
1323: free(options.control_path);
1.10 djm 1324: options.control_path = NULL;
1325: options.control_master = SSHCTL_MASTER_NO;
1326: return;
1.46 millert 1327: } else {
1328: /* unix_listener() logs the error */
1329: cleanup_exit(255);
1330: }
1.10 djm 1331: }
1332:
1.22 djm 1333: /* Now atomically "move" the mux socket into position */
1334: if (link(options.control_path, orig_control_path) != 0) {
1335: if (errno != EEXIST) {
1.59 djm 1336: fatal("%s: link mux listener %s => %s: %s", __func__,
1.22 djm 1337: options.control_path, orig_control_path,
1338: strerror(errno));
1339: }
1340: error("ControlSocket %s already exists, disabling multiplexing",
1341: orig_control_path);
1342: unlink(options.control_path);
1343: goto disable_mux_master;
1344: }
1345: unlink(options.control_path);
1.41 djm 1346: free(options.control_path);
1.22 djm 1347: options.control_path = orig_control_path;
1348:
1.10 djm 1349: set_nonblock(muxserver_sock);
1350:
1.66 djm 1351: mux_listener_channel = channel_new(ssh, "mux listener",
1.10 djm 1352: SSH_CHANNEL_MUX_LISTENER, muxserver_sock, muxserver_sock, -1,
1353: CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1.22 djm 1354: 0, options.control_path, 1);
1.10 djm 1355: mux_listener_channel->mux_rcb = mux_master_read_cb;
1356: debug3("%s: mux listener channel %d fd %d", __func__,
1357: mux_listener_channel->self, mux_listener_channel->sock);
1358: }
1359:
1360: /* Callback on open confirmation in mux master for a mux client session. */
1361: static void
1.66 djm 1362: mux_session_confirm(struct ssh *ssh, int id, int success, void *arg)
1.10 djm 1363: {
1364: struct mux_session_confirm_ctx *cctx = arg;
1365: const char *display;
1.17 djm 1366: Channel *c, *cc;
1.73 markus 1367: int i, r;
1368: struct sshbuf *reply;
1.10 djm 1369:
1370: if (cctx == NULL)
1371: fatal("%s: cctx == NULL", __func__);
1.66 djm 1372: if ((c = channel_by_id(ssh, id)) == NULL)
1.10 djm 1373: fatal("%s: no channel for id %d", __func__, id);
1.66 djm 1374: if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.17 djm 1375: fatal("%s: channel %d lacks control channel %d", __func__,
1376: id, c->ctl_chan);
1.73 markus 1377: if ((reply = sshbuf_new()) == NULL)
1378: fatal("%s: sshbuf_new", __func__);
1.17 djm 1379:
1380: if (!success) {
1381: debug3("%s: sending failure reply", __func__);
1.73 markus 1382: reply_error(reply, MUX_S_FAILURE, cctx->rid,
1383: "Session open refused by peer");
1.17 djm 1384: goto done;
1385: }
1.10 djm 1386:
1387: display = getenv("DISPLAY");
1388: if (cctx->want_x_fwd && options.forward_x11 && display != NULL) {
1389: char *proto, *data;
1.21 djm 1390:
1.10 djm 1391: /* Get reasonable local authentication information. */
1.66 djm 1392: if (client_x11_get_proto(ssh, display, options.xauth_location,
1.21 djm 1393: options.forward_x11_trusted, options.forward_x11_timeout,
1.58 djm 1394: &proto, &data) == 0) {
1395: /* Request forwarding with authentication spoofing. */
1396: debug("Requesting X11 forwarding with authentication "
1397: "spoofing.");
1.66 djm 1398: x11_request_forwarding_with_spoofing(ssh, id,
1399: display, proto, data, 1);
1.58 djm 1400: /* XXX exit_on_forward_failure */
1.66 djm 1401: client_expect_confirm(ssh, id, "X11 forwarding",
1.58 djm 1402: CONFIRM_WARN);
1403: }
1.10 djm 1404: }
1405:
1406: if (cctx->want_agent_fwd && options.forward_agent) {
1407: debug("Requesting authentication agent forwarding.");
1.66 djm 1408: channel_request_start(ssh, id, "auth-agent-req@openssh.com", 0);
1.10 djm 1409: packet_send();
1410: }
1411:
1.66 djm 1412: client_session2_setup(ssh, id, cctx->want_tty, cctx->want_subsys,
1.73 markus 1413: cctx->term, &cctx->tio, c->rfd, cctx->cmd, cctx->env);
1.10 djm 1414:
1.17 djm 1415: debug3("%s: sending success reply", __func__);
1416: /* prepare reply */
1.73 markus 1417: if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 ||
1418: (r = sshbuf_put_u32(reply, cctx->rid)) != 0 ||
1419: (r = sshbuf_put_u32(reply, c->self)) != 0)
1420: fatal("%s: reply: %s", __func__, ssh_err(r));
1.17 djm 1421:
1422: done:
1423: /* Send reply */
1.73 markus 1424: if ((r = sshbuf_put_stringb(cc->output, reply)) != 0)
1425: fatal("%s: sshbuf_put_stringb: %s", __func__, ssh_err(r));
1426: sshbuf_free(reply);
1.17 djm 1427:
1428: if (cc->mux_pause <= 0)
1429: fatal("%s: mux_pause %d", __func__, cc->mux_pause);
1430: cc->mux_pause = 0; /* start processing messages again */
1.10 djm 1431: c->open_confirm_ctx = NULL;
1.73 markus 1432: sshbuf_free(cctx->cmd);
1.41 djm 1433: free(cctx->term);
1.10 djm 1434: if (cctx->env != NULL) {
1435: for (i = 0; cctx->env[i] != NULL; i++)
1.41 djm 1436: free(cctx->env[i]);
1437: free(cctx->env);
1.1 djm 1438: }
1.41 djm 1439: free(cctx);
1.10 djm 1440: }
1441:
1442: /* ** Multiplexing client support */
1443:
1444: /* Exit signal handler */
1445: static void
1446: control_client_sighandler(int signo)
1447: {
1448: muxclient_terminate = signo;
1449: }
1450:
1451: /*
1452: * Relay signal handler - used to pass some signals from mux client to
1453: * mux master.
1454: */
1455: static void
1456: control_client_sigrelay(int signo)
1457: {
1458: int save_errno = errno;
1459:
1460: if (muxserver_pid > 1)
1461: kill(muxserver_pid, signo);
1462:
1463: errno = save_errno;
1464: }
1.1 djm 1465:
1.10 djm 1466: static int
1.73 markus 1467: mux_client_read(int fd, struct sshbuf *b, size_t need)
1.10 djm 1468: {
1.73 markus 1469: size_t have;
1.10 djm 1470: ssize_t len;
1471: u_char *p;
1472: struct pollfd pfd;
1.73 markus 1473: int r;
1.10 djm 1474:
1475: pfd.fd = fd;
1476: pfd.events = POLLIN;
1.73 markus 1477: if ((r = sshbuf_reserve(b, need, &p)) != 0)
1478: fatal("%s: reserve: %s", __func__, ssh_err(r));
1.10 djm 1479: for (have = 0; have < need; ) {
1480: if (muxclient_terminate) {
1481: errno = EINTR;
1482: return -1;
1483: }
1484: len = read(fd, p + have, need - have);
1485: if (len < 0) {
1486: switch (errno) {
1487: case EAGAIN:
1488: (void)poll(&pfd, 1, -1);
1489: /* FALLTHROUGH */
1490: case EINTR:
1491: continue;
1492: default:
1493: return -1;
1494: }
1495: }
1496: if (len == 0) {
1497: errno = EPIPE;
1498: return -1;
1499: }
1.73 markus 1500: have += (size_t)len;
1.1 djm 1501: }
1.10 djm 1502: return 0;
1503: }
1.1 djm 1504:
1.10 djm 1505: static int
1.73 markus 1506: mux_client_write_packet(int fd, struct sshbuf *m)
1.10 djm 1507: {
1.73 markus 1508: struct sshbuf *queue;
1.10 djm 1509: u_int have, need;
1.73 markus 1510: int r, oerrno, len;
1511: const u_char *ptr;
1.10 djm 1512: struct pollfd pfd;
1513:
1514: pfd.fd = fd;
1515: pfd.events = POLLOUT;
1.73 markus 1516: if ((queue = sshbuf_new()) == NULL)
1517: fatal("%s: sshbuf_new", __func__);
1518: if ((r = sshbuf_put_stringb(queue, m)) != 0)
1519: fatal("%s: sshbuf_put_stringb: %s", __func__, ssh_err(r));
1.10 djm 1520:
1.73 markus 1521: need = sshbuf_len(queue);
1522: ptr = sshbuf_ptr(queue);
1.10 djm 1523:
1524: for (have = 0; have < need; ) {
1525: if (muxclient_terminate) {
1.73 markus 1526: sshbuf_free(queue);
1.10 djm 1527: errno = EINTR;
1528: return -1;
1529: }
1530: len = write(fd, ptr + have, need - have);
1531: if (len < 0) {
1532: switch (errno) {
1533: case EAGAIN:
1534: (void)poll(&pfd, 1, -1);
1535: /* FALLTHROUGH */
1536: case EINTR:
1537: continue;
1538: default:
1539: oerrno = errno;
1.73 markus 1540: sshbuf_free(queue);
1.10 djm 1541: errno = oerrno;
1542: return -1;
1543: }
1544: }
1545: if (len == 0) {
1.73 markus 1546: sshbuf_free(queue);
1.10 djm 1547: errno = EPIPE;
1548: return -1;
1549: }
1550: have += (u_int)len;
1551: }
1.73 markus 1552: sshbuf_free(queue);
1.10 djm 1553: return 0;
1554: }
1.1 djm 1555:
1.10 djm 1556: static int
1.73 markus 1557: mux_client_read_packet(int fd, struct sshbuf *m)
1.10 djm 1558: {
1.73 markus 1559: struct sshbuf *queue;
1560: size_t need, have;
1.45 djm 1561: const u_char *ptr;
1.73 markus 1562: int r, oerrno;
1.10 djm 1563:
1.73 markus 1564: if ((queue = sshbuf_new()) == NULL)
1565: fatal("%s: sshbuf_new", __func__);
1566: if (mux_client_read(fd, queue, 4) != 0) {
1.10 djm 1567: if ((oerrno = errno) == EPIPE)
1.43 dtucker 1568: debug3("%s: read header failed: %s", __func__,
1569: strerror(errno));
1.73 markus 1570: sshbuf_free(queue);
1.10 djm 1571: errno = oerrno;
1572: return -1;
1573: }
1.73 markus 1574: need = PEEK_U32(sshbuf_ptr(queue));
1575: if (mux_client_read(fd, queue, need) != 0) {
1.10 djm 1576: oerrno = errno;
1577: debug3("%s: read body failed: %s", __func__, strerror(errno));
1.73 markus 1578: sshbuf_free(queue);
1.10 djm 1579: errno = oerrno;
1580: return -1;
1581: }
1.73 markus 1582: if ((r = sshbuf_get_string_direct(queue, &ptr, &have)) != 0 ||
1583: (r = sshbuf_put(m, ptr, have)) != 0)
1584: fatal("%s: buffer error: %s", __func__, ssh_err(r));
1585: sshbuf_free(queue);
1.10 djm 1586: return 0;
1587: }
1.1 djm 1588:
1.10 djm 1589: static int
1590: mux_client_hello_exchange(int fd)
1591: {
1.73 markus 1592: struct sshbuf *m;
1.10 djm 1593: u_int type, ver;
1.73 markus 1594: int r, ret = -1;
1.1 djm 1595:
1.73 markus 1596: if ((m = sshbuf_new()) == NULL)
1597: fatal("%s: sshbuf_new", __func__);
1598: if ((r = sshbuf_put_u32(m, MUX_MSG_HELLO)) != 0 ||
1599: (r = sshbuf_put_u32(m, SSHMUX_VER)) != 0)
1600: fatal("%s: hello: %s", __func__, ssh_err(r));
1.10 djm 1601: /* no extensions */
1602:
1.73 markus 1603: if (mux_client_write_packet(fd, m) != 0) {
1.65 djm 1604: debug("%s: write packet: %s", __func__, strerror(errno));
1605: goto out;
1606: }
1.1 djm 1607:
1.73 markus 1608: sshbuf_reset(m);
1.10 djm 1609:
1610: /* Read their HELLO */
1.73 markus 1611: if (mux_client_read_packet(fd, m) != 0) {
1.65 djm 1612: debug("%s: read packet failed", __func__);
1613: goto out;
1.10 djm 1614: }
1615:
1.73 markus 1616: if ((r = sshbuf_get_u32(m, &type)) != 0)
1617: fatal("%s: decode type: %s", __func__, ssh_err(r));
1.65 djm 1618: if (type != MUX_MSG_HELLO) {
1619: error("%s: expected HELLO (%u) received %u",
1.10 djm 1620: __func__, MUX_MSG_HELLO, type);
1.65 djm 1621: goto out;
1622: }
1.73 markus 1623: if ((r = sshbuf_get_u32(m, &ver)) != 0)
1624: fatal("%s: decode version: %s", __func__, ssh_err(r));
1.65 djm 1625: if (ver != SSHMUX_VER) {
1626: error("Unsupported multiplexing protocol version %d "
1.10 djm 1627: "(expected %d)", ver, SSHMUX_VER);
1.65 djm 1628: goto out;
1629: }
1.10 djm 1630: debug2("%s: master version %u", __func__, ver);
1631: /* No extensions are presently defined */
1.73 markus 1632: while (sshbuf_len(m) > 0) {
1633: char *name = NULL;
1.10 djm 1634:
1.73 markus 1635: if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 ||
1636: (r = sshbuf_skip_string(m)) != 0) { /* value */
1637: error("%s: malformed extension: %s",
1638: __func__, ssh_err(r));
1639: goto out;
1640: }
1.10 djm 1641: debug2("Unrecognised master extension \"%s\"", name);
1.41 djm 1642: free(name);
1.5 djm 1643: }
1.65 djm 1644: /* success */
1645: ret = 0;
1646: out:
1.73 markus 1647: sshbuf_free(m);
1.65 djm 1648: return ret;
1.10 djm 1649: }
1650:
1651: static u_int
1652: mux_client_request_alive(int fd)
1653: {
1.73 markus 1654: struct sshbuf *m;
1.10 djm 1655: char *e;
1656: u_int pid, type, rid;
1.73 markus 1657: int r;
1.10 djm 1658:
1659: debug3("%s: entering", __func__);
1660:
1.73 markus 1661: if ((m = sshbuf_new()) == NULL)
1662: fatal("%s: sshbuf_new", __func__);
1663: if ((r = sshbuf_put_u32(m, MUX_C_ALIVE_CHECK)) != 0 ||
1664: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1665: fatal("%s: request: %s", __func__, ssh_err(r));
1.10 djm 1666:
1.73 markus 1667: if (mux_client_write_packet(fd, m) != 0)
1.10 djm 1668: fatal("%s: write packet: %s", __func__, strerror(errno));
1669:
1.73 markus 1670: sshbuf_reset(m);
1.1 djm 1671:
1.10 djm 1672: /* Read their reply */
1.73 markus 1673: if (mux_client_read_packet(fd, m) != 0) {
1674: sshbuf_free(m);
1.10 djm 1675: return 0;
1676: }
1677:
1.73 markus 1678: if ((r = sshbuf_get_u32(m, &type)) != 0)
1679: fatal("%s: decode type: %s", __func__, ssh_err(r));
1.10 djm 1680: if (type != MUX_S_ALIVE) {
1.73 markus 1681: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1682: fatal("%s: decode error: %s", __func__, ssh_err(r));
1.10 djm 1683: fatal("%s: master returned error: %s", __func__, e);
1.5 djm 1684: }
1.10 djm 1685:
1.73 markus 1686: if ((r = sshbuf_get_u32(m, &rid)) != 0)
1687: fatal("%s: decode remote ID: %s", __func__, ssh_err(r));
1688: if (rid != muxclient_request_id)
1.10 djm 1689: fatal("%s: out of sequence reply: my id %u theirs %u",
1690: __func__, muxclient_request_id, rid);
1.73 markus 1691: if ((r = sshbuf_get_u32(m, &pid)) != 0)
1692: fatal("%s: decode PID: %s", __func__, ssh_err(r));
1693: sshbuf_free(m);
1.10 djm 1694:
1695: debug3("%s: done pid = %u", __func__, pid);
1696:
1697: muxclient_request_id++;
1698:
1699: return pid;
1700: }
1701:
1702: static void
1703: mux_client_request_terminate(int fd)
1704: {
1.73 markus 1705: struct sshbuf *m;
1.10 djm 1706: char *e;
1707: u_int type, rid;
1.73 markus 1708: int r;
1.10 djm 1709:
1710: debug3("%s: entering", __func__);
1711:
1.73 markus 1712: if ((m = sshbuf_new()) == NULL)
1713: fatal("%s: sshbuf_new", __func__);
1714: if ((r = sshbuf_put_u32(m, MUX_C_TERMINATE)) != 0 ||
1715: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1716: fatal("%s: request: %s", __func__, ssh_err(r));
1.10 djm 1717:
1.73 markus 1718: if (mux_client_write_packet(fd, m) != 0)
1.10 djm 1719: fatal("%s: write packet: %s", __func__, strerror(errno));
1.1 djm 1720:
1.73 markus 1721: sshbuf_reset(m);
1.1 djm 1722:
1.10 djm 1723: /* Read their reply */
1.73 markus 1724: if (mux_client_read_packet(fd, m) != 0) {
1.10 djm 1725: /* Remote end exited already */
1726: if (errno == EPIPE) {
1.73 markus 1727: sshbuf_free(m);
1.10 djm 1728: return;
1.2 djm 1729: }
1.10 djm 1730: fatal("%s: read from master failed: %s",
1731: __func__, strerror(errno));
1732: }
1733:
1.73 markus 1734: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1735: (r = sshbuf_get_u32(m, &rid)) != 0)
1736: fatal("%s: decode: %s", __func__, ssh_err(r));
1737: if (rid != muxclient_request_id)
1.10 djm 1738: fatal("%s: out of sequence reply: my id %u theirs %u",
1739: __func__, muxclient_request_id, rid);
1740: switch (type) {
1741: case MUX_S_OK:
1742: break;
1743: case MUX_S_PERMISSION_DENIED:
1.73 markus 1744: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1745: fatal("%s: decode error: %s", __func__, ssh_err(r));
1.10 djm 1746: fatal("Master refused termination request: %s", e);
1747: case MUX_S_FAILURE:
1.73 markus 1748: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1749: fatal("%s: decode error: %s", __func__, ssh_err(r));
1.10 djm 1750: fatal("%s: termination request failed: %s", __func__, e);
1751: default:
1752: fatal("%s: unexpected response from master 0x%08x",
1753: __func__, type);
1754: }
1.73 markus 1755: sshbuf_free(m);
1.10 djm 1756: muxclient_request_id++;
1757: }
1758:
1759: static int
1.46 millert 1760: mux_client_forward(int fd, int cancel_flag, u_int ftype, struct Forward *fwd)
1.10 djm 1761: {
1.73 markus 1762: struct sshbuf *m;
1.10 djm 1763: char *e, *fwd_desc;
1.73 markus 1764: const char *lhost, *chost;
1.10 djm 1765: u_int type, rid;
1.73 markus 1766: int r;
1.10 djm 1767:
1768: fwd_desc = format_forward(ftype, fwd);
1.30 djm 1769: debug("Requesting %s %s",
1770: cancel_flag ? "cancellation of" : "forwarding of", fwd_desc);
1.41 djm 1771: free(fwd_desc);
1.10 djm 1772:
1.73 markus 1773: type = cancel_flag ? MUX_C_CLOSE_FWD : MUX_C_OPEN_FWD;
1774: if (fwd->listen_path != NULL)
1775: lhost = fwd->listen_path;
1776: else if (fwd->listen_host == NULL)
1777: lhost = "";
1778: else if (*fwd->listen_host == '\0')
1779: lhost = "*";
1780: else
1781: lhost = fwd->listen_host;
1782:
1783: if (fwd->connect_path != NULL)
1784: chost = fwd->connect_path;
1785: else if (fwd->connect_host == NULL)
1786: chost = "";
1787: else
1788: chost = fwd->connect_host;
1789:
1790: if ((m = sshbuf_new()) == NULL)
1791: fatal("%s: sshbuf_new", __func__);
1792: if ((r = sshbuf_put_u32(m, type)) != 0 ||
1793: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
1794: (r = sshbuf_put_u32(m, ftype)) != 0 ||
1795: (r = sshbuf_put_cstring(m, lhost)) != 0 ||
1796: (r = sshbuf_put_u32(m, fwd->listen_port)) != 0 ||
1797: (r = sshbuf_put_cstring(m, chost)) != 0 ||
1798: (r = sshbuf_put_u32(m, fwd->connect_port)) != 0)
1799: fatal("%s: request: %s", __func__, ssh_err(r));
1.10 djm 1800:
1.73 markus 1801: if (mux_client_write_packet(fd, m) != 0)
1.10 djm 1802: fatal("%s: write packet: %s", __func__, strerror(errno));
1803:
1.73 markus 1804: sshbuf_reset(m);
1.10 djm 1805:
1806: /* Read their reply */
1.73 markus 1807: if (mux_client_read_packet(fd, m) != 0) {
1808: sshbuf_free(m);
1.10 djm 1809: return -1;
1810: }
1811:
1.73 markus 1812: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1813: (r = sshbuf_get_u32(m, &rid)) != 0)
1814: fatal("%s: decode: %s", __func__, ssh_err(r));
1815: if (rid != muxclient_request_id)
1.10 djm 1816: fatal("%s: out of sequence reply: my id %u theirs %u",
1817: __func__, muxclient_request_id, rid);
1.73 markus 1818:
1.10 djm 1819: switch (type) {
1820: case MUX_S_OK:
1.1 djm 1821: break;
1.18 markus 1822: case MUX_S_REMOTE_PORT:
1.30 djm 1823: if (cancel_flag)
1824: fatal("%s: got MUX_S_REMOTE_PORT for cancel", __func__);
1.73 markus 1825: if ((r = sshbuf_get_u32(m, &fwd->allocated_port)) != 0)
1826: fatal("%s: decode port: %s", __func__, ssh_err(r));
1.52 djm 1827: verbose("Allocated port %u for remote forward to %s:%d",
1.18 markus 1828: fwd->allocated_port,
1829: fwd->connect_host ? fwd->connect_host : "",
1830: fwd->connect_port);
1831: if (muxclient_command == SSHMUX_COMMAND_FORWARD)
1.55 djm 1832: fprintf(stdout, "%i\n", fwd->allocated_port);
1.18 markus 1833: break;
1.10 djm 1834: case MUX_S_PERMISSION_DENIED:
1.73 markus 1835: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1836: fatal("%s: decode error: %s", __func__, ssh_err(r));
1837: sshbuf_free(m);
1.10 djm 1838: error("Master refused forwarding request: %s", e);
1839: return -1;
1840: case MUX_S_FAILURE:
1.73 markus 1841: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1842: fatal("%s: decode error: %s", __func__, ssh_err(r));
1843: sshbuf_free(m);
1.24 djm 1844: error("%s: forwarding request failed: %s", __func__, e);
1.10 djm 1845: return -1;
1.1 djm 1846: default:
1.10 djm 1847: fatal("%s: unexpected response from master 0x%08x",
1848: __func__, type);
1849: }
1.73 markus 1850: sshbuf_free(m);
1.10 djm 1851:
1852: muxclient_request_id++;
1853: return 0;
1854: }
1855:
1856: static int
1.30 djm 1857: mux_client_forwards(int fd, int cancel_flag)
1.10 djm 1858: {
1.30 djm 1859: int i, ret = 0;
1.10 djm 1860:
1.30 djm 1861: debug3("%s: %s forwardings: %d local, %d remote", __func__,
1862: cancel_flag ? "cancel" : "request",
1.10 djm 1863: options.num_local_forwards, options.num_remote_forwards);
1864:
1865: /* XXX ExitOnForwardingFailure */
1866: for (i = 0; i < options.num_local_forwards; i++) {
1.30 djm 1867: if (mux_client_forward(fd, cancel_flag,
1.10 djm 1868: options.local_forwards[i].connect_port == 0 ?
1869: MUX_FWD_DYNAMIC : MUX_FWD_LOCAL,
1870: options.local_forwards + i) != 0)
1.30 djm 1871: ret = -1;
1.10 djm 1872: }
1873: for (i = 0; i < options.num_remote_forwards; i++) {
1.30 djm 1874: if (mux_client_forward(fd, cancel_flag, MUX_FWD_REMOTE,
1.10 djm 1875: options.remote_forwards + i) != 0)
1.30 djm 1876: ret = -1;
1.10 djm 1877: }
1.30 djm 1878: return ret;
1.10 djm 1879: }
1880:
1881: static int
1882: mux_client_request_session(int fd)
1883: {
1.73 markus 1884: struct sshbuf *m;
1885: char *e;
1886: const char *term;
1887: u_int echar, rid, sid, esid, exitval, type, exitval_seen;
1.10 djm 1888: extern char **environ;
1.73 markus 1889: int r, i, devnull, rawmode;
1.10 djm 1890:
1891: debug3("%s: entering", __func__);
1892:
1893: if ((muxserver_pid = mux_client_request_alive(fd)) == 0) {
1894: error("%s: master alive request failed", __func__);
1895: return -1;
1.1 djm 1896: }
1897:
1.10 djm 1898: signal(SIGPIPE, SIG_IGN);
1899:
1900: if (stdin_null_flag) {
1901: if ((devnull = open(_PATH_DEVNULL, O_RDONLY)) == -1)
1902: fatal("open(/dev/null): %s", strerror(errno));
1903: if (dup2(devnull, STDIN_FILENO) == -1)
1904: fatal("dup2: %s", strerror(errno));
1905: if (devnull > STDERR_FILENO)
1906: close(devnull);
1.5 djm 1907: }
1.1 djm 1908:
1.73 markus 1909: if ((term = getenv("TERM")) == NULL)
1910: term = "";
1911: echar = 0xffffffff;
1912: if (options.escape_char != SSH_ESCAPECHAR_NONE)
1913: echar = (u_int)options.escape_char;
1914:
1915: if ((m = sshbuf_new()) == NULL)
1916: fatal("%s: sshbuf_new", __func__);
1917: if ((r = sshbuf_put_u32(m, MUX_C_NEW_SESSION)) != 0 ||
1918: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
1919: (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */
1920: (r = sshbuf_put_u32(m, tty_flag)) != 0 ||
1921: (r = sshbuf_put_u32(m, options.forward_x11)) != 0 ||
1922: (r = sshbuf_put_u32(m, options.forward_agent)) != 0 ||
1923: (r = sshbuf_put_u32(m, subsystem_flag)) != 0 ||
1924: (r = sshbuf_put_u32(m, echar)) != 0 ||
1925: (r = sshbuf_put_cstring(m, term)) != 0 ||
1926: (r = sshbuf_put_stringb(m, command)) != 0)
1927: fatal("%s: request: %s", __func__, ssh_err(r));
1.10 djm 1928:
1.71 djm 1929: /* Pass environment */
1.10 djm 1930: if (options.num_send_env > 0 && environ != NULL) {
1931: for (i = 0; environ[i] != NULL; i++) {
1.73 markus 1932: if (!env_permitted(environ[i]))
1933: continue;
1934: if ((r = sshbuf_put_cstring(m, environ[i])) != 0)
1935: fatal("%s: request: %s", __func__, ssh_err(r));
1.10 djm 1936: }
1.5 djm 1937: }
1.73 markus 1938: for (i = 0; i < options.num_setenv; i++) {
1939: if ((r = sshbuf_put_cstring(m, options.setenv[i])) != 0)
1940: fatal("%s: request: %s", __func__, ssh_err(r));
1941: }
1.5 djm 1942:
1.73 markus 1943: if (mux_client_write_packet(fd, m) != 0)
1.10 djm 1944: fatal("%s: write packet: %s", __func__, strerror(errno));
1945:
1946: /* Send the stdio file descriptors */
1947: if (mm_send_fd(fd, STDIN_FILENO) == -1 ||
1948: mm_send_fd(fd, STDOUT_FILENO) == -1 ||
1949: mm_send_fd(fd, STDERR_FILENO) == -1)
1950: fatal("%s: send fds failed", __func__);
1951:
1952: debug3("%s: session request sent", __func__);
1.1 djm 1953:
1.10 djm 1954: /* Read their reply */
1.73 markus 1955: sshbuf_reset(m);
1956: if (mux_client_read_packet(fd, m) != 0) {
1.10 djm 1957: error("%s: read from master failed: %s",
1958: __func__, strerror(errno));
1.73 markus 1959: sshbuf_free(m);
1.10 djm 1960: return -1;
1961: }
1962:
1.73 markus 1963: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1964: (r = sshbuf_get_u32(m, &rid)) != 0)
1965: fatal("%s: decode: %s", __func__, ssh_err(r));
1966: if (rid != muxclient_request_id)
1.10 djm 1967: fatal("%s: out of sequence reply: my id %u theirs %u",
1968: __func__, muxclient_request_id, rid);
1.73 markus 1969:
1.10 djm 1970: switch (type) {
1971: case MUX_S_SESSION_OPENED:
1.73 markus 1972: if ((r = sshbuf_get_u32(m, &sid)) != 0)
1973: fatal("%s: decode ID: %s", __func__, ssh_err(r));
1.10 djm 1974: break;
1975: case MUX_S_PERMISSION_DENIED:
1.73 markus 1976: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1977: fatal("%s: decode error: %s", __func__, ssh_err(r));
1.24 djm 1978: error("Master refused session request: %s", e);
1.73 markus 1979: sshbuf_free(m);
1.10 djm 1980: return -1;
1981: case MUX_S_FAILURE:
1.73 markus 1982: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1983: fatal("%s: decode error: %s", __func__, ssh_err(r));
1.24 djm 1984: error("%s: session request failed: %s", __func__, e);
1.73 markus 1985: sshbuf_free(m);
1.10 djm 1986: return -1;
1987: default:
1.73 markus 1988: sshbuf_free(m);
1.10 djm 1989: error("%s: unexpected response from master 0x%08x",
1990: __func__, type);
1991: return -1;
1992: }
1993: muxclient_request_id++;
1.1 djm 1994:
1.57 semarie 1995: if (pledge("stdio proc tty", NULL) == -1)
1996: fatal("%s pledge(): %s", __func__, strerror(errno));
1997:
1.1 djm 1998: signal(SIGHUP, control_client_sighandler);
1999: signal(SIGINT, control_client_sighandler);
2000: signal(SIGTERM, control_client_sighandler);
2001: signal(SIGWINCH, control_client_sigrelay);
2002:
1.28 djm 2003: rawmode = tty_flag;
1.1 djm 2004: if (tty_flag)
1.27 djm 2005: enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
1.1 djm 2006:
2007: /*
2008: * Stick around until the controlee closes the client_fd.
1.10 djm 2009: * Before it does, it is expected to write an exit message.
2010: * This process must read the value and wait for the closure of
2011: * the client_fd; if this one closes early, the multiplex master will
2012: * terminate early too (possibly losing data).
1.1 djm 2013: */
1.10 djm 2014: for (exitval = 255, exitval_seen = 0;;) {
1.73 markus 2015: sshbuf_reset(m);
2016: if (mux_client_read_packet(fd, m) != 0)
1.1 djm 2017: break;
1.73 markus 2018: if ((r = sshbuf_get_u32(m, &type)) != 0)
2019: fatal("%s: decode type: %s", __func__, ssh_err(r));
1.28 djm 2020: switch (type) {
2021: case MUX_S_TTY_ALLOC_FAIL:
1.73 markus 2022: if ((r = sshbuf_get_u32(m, &esid)) != 0)
2023: fatal("%s: decode ID: %s",
2024: __func__, ssh_err(r));
2025: if (esid != sid)
1.28 djm 2026: fatal("%s: tty alloc fail on unknown session: "
2027: "my id %u theirs %u",
2028: __func__, sid, esid);
2029: leave_raw_mode(options.request_tty ==
2030: REQUEST_TTY_FORCE);
2031: rawmode = 0;
2032: continue;
2033: case MUX_S_EXIT_MESSAGE:
1.73 markus 2034: if ((r = sshbuf_get_u32(m, &esid)) != 0)
2035: fatal("%s: decode ID: %s",
2036: __func__, ssh_err(r));
2037: if (esid != sid)
1.28 djm 2038: fatal("%s: exit on unknown session: "
2039: "my id %u theirs %u",
2040: __func__, sid, esid);
2041: if (exitval_seen)
2042: fatal("%s: exitval sent twice", __func__);
1.73 markus 2043: if ((r = sshbuf_get_u32(m, &exitval)) != 0)
2044: fatal("%s: decode exit value: %s",
2045: __func__, ssh_err(r));
1.28 djm 2046: exitval_seen = 1;
2047: continue;
2048: default:
1.73 markus 2049: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2050: fatal("%s: decode error: %s",
2051: __func__, ssh_err(r));
1.10 djm 2052: fatal("%s: master returned error: %s", __func__, e);
1.1 djm 2053: }
2054: }
2055:
1.10 djm 2056: close(fd);
1.28 djm 2057: if (rawmode)
2058: leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
1.10 djm 2059:
1.1 djm 2060: if (muxclient_terminate) {
1.69 dtucker 2061: debug2("Exiting on signal: %s", strsignal(muxclient_terminate));
1.10 djm 2062: exitval = 255;
2063: } else if (!exitval_seen) {
1.1 djm 2064: debug2("Control master terminated unexpectedly");
1.10 djm 2065: exitval = 255;
1.1 djm 2066: } else
1.10 djm 2067: debug2("Received exit status from master %d", exitval);
1.1 djm 2068:
2069: if (tty_flag && options.log_level != SYSLOG_LEVEL_QUIET)
2070: fprintf(stderr, "Shared connection to %s closed.\r\n", host);
2071:
1.10 djm 2072: exit(exitval);
2073: }
2074:
2075: static int
1.62 markus 2076: mux_client_proxy(int fd)
2077: {
1.73 markus 2078: struct sshbuf *m;
1.62 markus 2079: char *e;
2080: u_int type, rid;
1.73 markus 2081: int r;
1.62 markus 2082:
1.73 markus 2083: if ((m = sshbuf_new()) == NULL)
2084: fatal("%s: sshbuf_new", __func__);
2085: if ((r = sshbuf_put_u32(m, MUX_C_PROXY)) != 0 ||
2086: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
2087: fatal("%s: request: %s", __func__, ssh_err(r));
2088: if (mux_client_write_packet(fd, m) != 0)
1.62 markus 2089: fatal("%s: write packet: %s", __func__, strerror(errno));
2090:
1.73 markus 2091: sshbuf_reset(m);
1.62 markus 2092:
2093: /* Read their reply */
1.73 markus 2094: if (mux_client_read_packet(fd, m) != 0) {
2095: sshbuf_free(m);
1.62 markus 2096: return 0;
2097: }
1.73 markus 2098: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2099: (r = sshbuf_get_u32(m, &rid)) != 0)
2100: fatal("%s: decode: %s", __func__, ssh_err(r));
2101: if (rid != muxclient_request_id)
2102: fatal("%s: out of sequence reply: my id %u theirs %u",
2103: __func__, muxclient_request_id, rid);
1.62 markus 2104: if (type != MUX_S_PROXY) {
1.73 markus 2105: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2106: fatal("%s: decode error: %s", __func__, ssh_err(r));
1.62 markus 2107: fatal("%s: master returned error: %s", __func__, e);
2108: }
1.73 markus 2109: sshbuf_free(m);
1.62 markus 2110:
2111: debug3("%s: done", __func__);
2112: muxclient_request_id++;
2113: return 0;
2114: }
2115:
2116: static int
1.10 djm 2117: mux_client_request_stdio_fwd(int fd)
2118: {
1.73 markus 2119: struct sshbuf *m;
1.10 djm 2120: char *e;
2121: u_int type, rid, sid;
1.73 markus 2122: int r, devnull;
1.10 djm 2123:
2124: debug3("%s: entering", __func__);
2125:
2126: if ((muxserver_pid = mux_client_request_alive(fd)) == 0) {
2127: error("%s: master alive request failed", __func__);
2128: return -1;
2129: }
2130:
2131: signal(SIGPIPE, SIG_IGN);
2132:
2133: if (stdin_null_flag) {
2134: if ((devnull = open(_PATH_DEVNULL, O_RDONLY)) == -1)
2135: fatal("open(/dev/null): %s", strerror(errno));
2136: if (dup2(devnull, STDIN_FILENO) == -1)
2137: fatal("dup2: %s", strerror(errno));
2138: if (devnull > STDERR_FILENO)
2139: close(devnull);
2140: }
2141:
1.73 markus 2142: if ((m = sshbuf_new()) == NULL)
2143: fatal("%s: sshbuf_new", __func__);
2144: if ((r = sshbuf_put_u32(m, MUX_C_NEW_STDIO_FWD)) != 0 ||
2145: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
2146: (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */
2147: (r = sshbuf_put_cstring(m, options.stdio_forward_host)) != 0 ||
2148: (r = sshbuf_put_u32(m, options.stdio_forward_port)) != 0)
2149: fatal("%s: request: %s", __func__, ssh_err(r));
1.10 djm 2150:
1.73 markus 2151: if (mux_client_write_packet(fd, m) != 0)
1.10 djm 2152: fatal("%s: write packet: %s", __func__, strerror(errno));
2153:
2154: /* Send the stdio file descriptors */
2155: if (mm_send_fd(fd, STDIN_FILENO) == -1 ||
2156: mm_send_fd(fd, STDOUT_FILENO) == -1)
2157: fatal("%s: send fds failed", __func__);
2158:
1.56 semarie 2159: if (pledge("stdio proc tty", NULL) == -1)
2160: fatal("%s pledge(): %s", __func__, strerror(errno));
2161:
1.10 djm 2162: debug3("%s: stdio forward request sent", __func__);
2163:
2164: /* Read their reply */
1.73 markus 2165: sshbuf_reset(m);
1.10 djm 2166:
1.73 markus 2167: if (mux_client_read_packet(fd, m) != 0) {
1.10 djm 2168: error("%s: read from master failed: %s",
2169: __func__, strerror(errno));
1.73 markus 2170: sshbuf_free(m);
1.10 djm 2171: return -1;
2172: }
2173:
1.73 markus 2174: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2175: (r = sshbuf_get_u32(m, &rid)) != 0)
2176: fatal("%s: decode: %s", __func__, ssh_err(r));
2177: if (rid != muxclient_request_id)
1.10 djm 2178: fatal("%s: out of sequence reply: my id %u theirs %u",
2179: __func__, muxclient_request_id, rid);
2180: switch (type) {
2181: case MUX_S_SESSION_OPENED:
1.73 markus 2182: if ((r = sshbuf_get_u32(m, &sid)) != 0)
2183: fatal("%s: decode ID: %s", __func__, ssh_err(r));
1.10 djm 2184: debug("%s: master session id: %u", __func__, sid);
2185: break;
2186: case MUX_S_PERMISSION_DENIED:
1.73 markus 2187: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2188: fatal("%s: decode error: %s", __func__, ssh_err(r));
2189: sshbuf_free(m);
1.24 djm 2190: fatal("Master refused stdio forwarding request: %s", e);
1.10 djm 2191: case MUX_S_FAILURE:
1.73 markus 2192: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2193: fatal("%s: decode error: %s", __func__, ssh_err(r));
2194: sshbuf_free(m);
1.48 djm 2195: fatal("Stdio forwarding request failed: %s", e);
1.10 djm 2196: default:
1.73 markus 2197: sshbuf_free(m);
1.10 djm 2198: error("%s: unexpected response from master 0x%08x",
2199: __func__, type);
2200: return -1;
2201: }
2202: muxclient_request_id++;
2203:
2204: signal(SIGHUP, control_client_sighandler);
2205: signal(SIGINT, control_client_sighandler);
2206: signal(SIGTERM, control_client_sighandler);
2207: signal(SIGWINCH, control_client_sigrelay);
2208:
2209: /*
2210: * Stick around until the controlee closes the client_fd.
2211: */
1.73 markus 2212: sshbuf_reset(m);
2213: if (mux_client_read_packet(fd, m) != 0) {
1.10 djm 2214: if (errno == EPIPE ||
2215: (errno == EINTR && muxclient_terminate != 0))
2216: return 0;
2217: fatal("%s: mux_client_read_packet: %s",
2218: __func__, strerror(errno));
2219: }
2220: fatal("%s: master returned unexpected message %u", __func__, type);
2221: }
2222:
1.25 djm 2223: static void
2224: mux_client_request_stop_listening(int fd)
2225: {
1.73 markus 2226: struct sshbuf *m;
1.25 djm 2227: char *e;
2228: u_int type, rid;
1.73 markus 2229: int r;
1.25 djm 2230:
2231: debug3("%s: entering", __func__);
2232:
1.73 markus 2233: if ((m = sshbuf_new()) == NULL)
2234: fatal("%s: sshbuf_new", __func__);
2235: if ((r = sshbuf_put_u32(m, MUX_C_STOP_LISTENING)) != 0 ||
2236: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
2237: fatal("%s: request: %s", __func__, ssh_err(r));
1.25 djm 2238:
1.73 markus 2239: if (mux_client_write_packet(fd, m) != 0)
1.25 djm 2240: fatal("%s: write packet: %s", __func__, strerror(errno));
2241:
1.73 markus 2242: sshbuf_reset(m);
1.25 djm 2243:
2244: /* Read their reply */
1.73 markus 2245: if (mux_client_read_packet(fd, m) != 0)
1.25 djm 2246: fatal("%s: read from master failed: %s",
2247: __func__, strerror(errno));
2248:
1.73 markus 2249: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2250: (r = sshbuf_get_u32(m, &rid)) != 0)
2251: fatal("%s: decode: %s", __func__, ssh_err(r));
2252: if (rid != muxclient_request_id)
1.25 djm 2253: fatal("%s: out of sequence reply: my id %u theirs %u",
2254: __func__, muxclient_request_id, rid);
1.73 markus 2255:
1.25 djm 2256: switch (type) {
2257: case MUX_S_OK:
2258: break;
2259: case MUX_S_PERMISSION_DENIED:
1.73 markus 2260: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2261: fatal("%s: decode error: %s", __func__, ssh_err(r));
1.25 djm 2262: fatal("Master refused stop listening request: %s", e);
2263: case MUX_S_FAILURE:
1.73 markus 2264: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2265: fatal("%s: decode error: %s", __func__, ssh_err(r));
1.25 djm 2266: fatal("%s: stop listening request failed: %s", __func__, e);
2267: default:
2268: fatal("%s: unexpected response from master 0x%08x",
2269: __func__, type);
2270: }
1.73 markus 2271: sshbuf_free(m);
1.25 djm 2272: muxclient_request_id++;
2273: }
2274:
1.10 djm 2275: /* Multiplex client main loop. */
1.62 markus 2276: int
1.10 djm 2277: muxclient(const char *path)
2278: {
2279: struct sockaddr_un addr;
2280: int sock;
2281: u_int pid;
2282:
2283: if (muxclient_command == 0) {
1.60 dtucker 2284: if (options.stdio_forward_host != NULL)
1.10 djm 2285: muxclient_command = SSHMUX_COMMAND_STDIO_FWD;
2286: else
2287: muxclient_command = SSHMUX_COMMAND_OPEN;
2288: }
2289:
2290: switch (options.control_master) {
2291: case SSHCTL_MASTER_AUTO:
2292: case SSHCTL_MASTER_AUTO_ASK:
2293: debug("auto-mux: Trying existing master");
2294: /* FALLTHROUGH */
2295: case SSHCTL_MASTER_NO:
2296: break;
2297: default:
1.62 markus 2298: return -1;
1.10 djm 2299: }
2300:
2301: memset(&addr, '\0', sizeof(addr));
2302: addr.sun_family = AF_UNIX;
2303:
2304: if (strlcpy(addr.sun_path, path,
2305: sizeof(addr.sun_path)) >= sizeof(addr.sun_path))
1.61 dtucker 2306: fatal("ControlPath too long ('%s' >= %u bytes)", path,
2307: (unsigned int)sizeof(addr.sun_path));
1.10 djm 2308:
2309: if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
2310: fatal("%s socket(): %s", __func__, strerror(errno));
2311:
1.64 guenther 2312: if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
1.10 djm 2313: switch (muxclient_command) {
2314: case SSHMUX_COMMAND_OPEN:
2315: case SSHMUX_COMMAND_STDIO_FWD:
2316: break;
2317: default:
2318: fatal("Control socket connect(%.100s): %s", path,
2319: strerror(errno));
2320: }
1.22 djm 2321: if (errno == ECONNREFUSED &&
2322: options.control_master != SSHCTL_MASTER_NO) {
2323: debug("Stale control socket %.100s, unlinking", path);
2324: unlink(path);
2325: } else if (errno == ENOENT) {
1.10 djm 2326: debug("Control socket \"%.100s\" does not exist", path);
1.22 djm 2327: } else {
1.10 djm 2328: error("Control socket connect(%.100s): %s", path,
2329: strerror(errno));
2330: }
2331: close(sock);
1.62 markus 2332: return -1;
1.10 djm 2333: }
2334: set_nonblock(sock);
2335:
2336: if (mux_client_hello_exchange(sock) != 0) {
2337: error("%s: master hello exchange failed", __func__);
2338: close(sock);
1.62 markus 2339: return -1;
1.10 djm 2340: }
2341:
2342: switch (muxclient_command) {
2343: case SSHMUX_COMMAND_ALIVE_CHECK:
2344: if ((pid = mux_client_request_alive(sock)) == 0)
2345: fatal("%s: master alive check failed", __func__);
1.55 djm 2346: fprintf(stderr, "Master running (pid=%u)\r\n", pid);
1.10 djm 2347: exit(0);
2348: case SSHMUX_COMMAND_TERMINATE:
2349: mux_client_request_terminate(sock);
1.63 dtucker 2350: if (options.log_level != SYSLOG_LEVEL_QUIET)
2351: fprintf(stderr, "Exit request sent.\r\n");
1.18 markus 2352: exit(0);
2353: case SSHMUX_COMMAND_FORWARD:
1.30 djm 2354: if (mux_client_forwards(sock, 0) != 0)
1.18 markus 2355: fatal("%s: master forward request failed", __func__);
1.10 djm 2356: exit(0);
2357: case SSHMUX_COMMAND_OPEN:
1.30 djm 2358: if (mux_client_forwards(sock, 0) != 0) {
1.10 djm 2359: error("%s: master forward request failed", __func__);
1.62 markus 2360: return -1;
1.10 djm 2361: }
2362: mux_client_request_session(sock);
1.62 markus 2363: return -1;
1.10 djm 2364: case SSHMUX_COMMAND_STDIO_FWD:
2365: mux_client_request_stdio_fwd(sock);
1.25 djm 2366: exit(0);
2367: case SSHMUX_COMMAND_STOP:
2368: mux_client_request_stop_listening(sock);
1.63 dtucker 2369: if (options.log_level != SYSLOG_LEVEL_QUIET)
2370: fprintf(stderr, "Stop listening request sent.\r\n");
1.30 djm 2371: exit(0);
2372: case SSHMUX_COMMAND_CANCEL_FWD:
2373: if (mux_client_forwards(sock, 1) != 0)
2374: error("%s: master cancel forward request failed",
2375: __func__);
1.10 djm 2376: exit(0);
1.62 markus 2377: case SSHMUX_COMMAND_PROXY:
2378: mux_client_proxy(sock);
2379: return (sock);
1.10 djm 2380: default:
2381: fatal("unrecognised muxclient_command %d", muxclient_command);
2382: }
1.1 djm 2383: }
![[BACK]](/icons/back.gif){kind=icon}
Return to mux.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh