Annotation of src/usr.bin/ssh/mux.c, Revision 1.91
1.91 ! djm 1: /* $OpenBSD: mux.c,v 1.90 2021/07/13 23:48:36 djm Exp $ */
1.1 djm 2: /*
3: * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
4: *
5: * Permission to use, copy, modify, and distribute this software for any
6: * purpose with or without fee is hereby granted, provided that the above
7: * copyright notice and this permission notice appear in all copies.
8: *
9: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16: */
17:
18: /* ssh session multiplexing support */
1.2 djm 19:
1.1 djm 20: #include <sys/types.h>
21: #include <sys/queue.h>
22: #include <sys/stat.h>
23: #include <sys/socket.h>
24: #include <sys/un.h>
25:
26: #include <errno.h>
27: #include <fcntl.h>
1.10 djm 28: #include <poll.h>
1.1 djm 29: #include <signal.h>
30: #include <stdarg.h>
31: #include <stddef.h>
32: #include <stdlib.h>
33: #include <stdio.h>
34: #include <string.h>
35: #include <unistd.h>
36: #include <util.h>
37: #include <paths.h>
38:
1.10 djm 39: #include "atomicio.h"
1.1 djm 40: #include "xmalloc.h"
41: #include "log.h"
42: #include "ssh.h"
1.18 markus 43: #include "ssh2.h"
1.1 djm 44: #include "pathnames.h"
45: #include "misc.h"
46: #include "match.h"
1.73 markus 47: #include "sshbuf.h"
1.1 djm 48: #include "channels.h"
49: #include "msg.h"
50: #include "packet.h"
51: #include "monitor_fdpass.h"
52: #include "sshpty.h"
1.74 markus 53: #include "sshkey.h"
1.1 djm 54: #include "readconf.h"
55: #include "clientloop.h"
1.62 markus 56: #include "ssherr.h"
1.78 djm 57:
1.1 djm 58: /* from ssh.c */
59: extern int tty_flag;
60: extern Options options;
61: extern char *host;
1.72 markus 62: extern struct sshbuf *command;
1.10 djm 63: extern volatile sig_atomic_t quit_pending;
1.1 djm 64:
1.2 djm 65: /* Context for session open confirmation callback */
66: struct mux_session_confirm_ctx {
1.10 djm 67: u_int want_tty;
68: u_int want_subsys;
69: u_int want_x_fwd;
70: u_int want_agent_fwd;
1.73 markus 71: struct sshbuf *cmd;
1.2 djm 72: char *term;
73: struct termios tio;
74: char **env;
1.17 djm 75: u_int rid;
1.2 djm 76: };
77:
1.48 djm 78: /* Context for stdio fwd open confirmation callback */
79: struct mux_stdio_confirm_ctx {
80: u_int rid;
81: };
82:
1.18 markus 83: /* Context for global channel callback */
84: struct mux_channel_confirm_ctx {
85: u_int cid; /* channel id */
86: u_int rid; /* request id */
87: int fid; /* forward id */
88: };
89:
1.1 djm 90: /* fd to control socket */
91: int muxserver_sock = -1;
92:
1.10 djm 93: /* client request id */
94: u_int muxclient_request_id = 0;
95:
1.1 djm 96: /* Multiplexing control command */
97: u_int muxclient_command = 0;
98:
99: /* Set when signalled. */
100: static volatile sig_atomic_t muxclient_terminate = 0;
101:
102: /* PID of multiplex server */
103: static u_int muxserver_pid = 0;
104:
1.10 djm 105: static Channel *mux_listener_channel = NULL;
106:
107: struct mux_master_state {
108: int hello_rcvd;
109: };
1.1 djm 110:
1.10 djm 111: /* mux protocol messages */
112: #define MUX_MSG_HELLO 0x00000001
113: #define MUX_C_NEW_SESSION 0x10000002
114: #define MUX_C_ALIVE_CHECK 0x10000004
115: #define MUX_C_TERMINATE 0x10000005
116: #define MUX_C_OPEN_FWD 0x10000006
117: #define MUX_C_CLOSE_FWD 0x10000007
118: #define MUX_C_NEW_STDIO_FWD 0x10000008
1.25 djm 119: #define MUX_C_STOP_LISTENING 0x10000009
1.62 markus 120: #define MUX_C_PROXY 0x1000000f
1.10 djm 121: #define MUX_S_OK 0x80000001
122: #define MUX_S_PERMISSION_DENIED 0x80000002
123: #define MUX_S_FAILURE 0x80000003
124: #define MUX_S_EXIT_MESSAGE 0x80000004
125: #define MUX_S_ALIVE 0x80000005
126: #define MUX_S_SESSION_OPENED 0x80000006
1.18 markus 127: #define MUX_S_REMOTE_PORT 0x80000007
1.28 djm 128: #define MUX_S_TTY_ALLOC_FAIL 0x80000008
1.62 markus 129: #define MUX_S_PROXY 0x8000000f
1.10 djm 130:
131: /* type codes for MUX_C_OPEN_FWD and MUX_C_CLOSE_FWD */
132: #define MUX_FWD_LOCAL 1
133: #define MUX_FWD_REMOTE 2
134: #define MUX_FWD_DYNAMIC 3
135:
1.66 djm 136: static void mux_session_confirm(struct ssh *, int, int, void *);
137: static void mux_stdio_confirm(struct ssh *, int, int, void *);
1.10 djm 138:
1.76 djm 139: static int mux_master_process_hello(struct ssh *, u_int,
1.66 djm 140: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 141: static int mux_master_process_new_session(struct ssh *, u_int,
1.66 djm 142: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 143: static int mux_master_process_alive_check(struct ssh *, u_int,
1.66 djm 144: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 145: static int mux_master_process_terminate(struct ssh *, u_int,
1.66 djm 146: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 147: static int mux_master_process_open_fwd(struct ssh *, u_int,
1.66 djm 148: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 149: static int mux_master_process_close_fwd(struct ssh *, u_int,
1.66 djm 150: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 151: static int mux_master_process_stdio_fwd(struct ssh *, u_int,
1.66 djm 152: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 153: static int mux_master_process_stop_listening(struct ssh *, u_int,
1.66 djm 154: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 155: static int mux_master_process_proxy(struct ssh *, u_int,
1.66 djm 156: Channel *, struct sshbuf *, struct sshbuf *);
1.10 djm 157:
158: static const struct {
159: u_int type;
1.66 djm 160: int (*handler)(struct ssh *, u_int, Channel *,
161: struct sshbuf *, struct sshbuf *);
1.10 djm 162: } mux_master_handlers[] = {
1.76 djm 163: { MUX_MSG_HELLO, mux_master_process_hello },
164: { MUX_C_NEW_SESSION, mux_master_process_new_session },
165: { MUX_C_ALIVE_CHECK, mux_master_process_alive_check },
166: { MUX_C_TERMINATE, mux_master_process_terminate },
167: { MUX_C_OPEN_FWD, mux_master_process_open_fwd },
168: { MUX_C_CLOSE_FWD, mux_master_process_close_fwd },
169: { MUX_C_NEW_STDIO_FWD, mux_master_process_stdio_fwd },
170: { MUX_C_STOP_LISTENING, mux_master_process_stop_listening },
171: { MUX_C_PROXY, mux_master_process_proxy },
1.10 djm 172: { 0, NULL }
173: };
1.1 djm 174:
1.83 djm 175: /* Cleanup callback fired on closure of mux client _session_ channel */
1.10 djm 176: /* ARGSUSED */
1.42 dtucker 177: static void
1.66 djm 178: mux_master_session_cleanup_cb(struct ssh *ssh, int cid, void *unused)
1.1 djm 179: {
1.66 djm 180: Channel *cc, *c = channel_by_id(ssh, cid);
1.1 djm 181:
1.85 djm 182: debug3_f("entering for channel %d", cid);
1.10 djm 183: if (c == NULL)
1.85 djm 184: fatal_f("channel_by_id(%i) == NULL", cid);
1.10 djm 185: if (c->ctl_chan != -1) {
1.66 djm 186: if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 187: fatal_f("channel %d missing control channel %d",
188: c->self, c->ctl_chan);
1.10 djm 189: c->ctl_chan = -1;
1.67 djm 190: cc->remote_id = 0;
191: cc->have_remote_id = 0;
1.66 djm 192: chan_rcvd_oclose(ssh, cc);
1.1 djm 193: }
1.66 djm 194: channel_cancel_cleanup(ssh, c->self);
1.1 djm 195: }
196:
1.83 djm 197: /* Cleanup callback fired on closure of mux client _control_ channel */
1.10 djm 198: /* ARGSUSED */
1.1 djm 199: static void
1.66 djm 200: mux_master_control_cleanup_cb(struct ssh *ssh, int cid, void *unused)
1.1 djm 201: {
1.66 djm 202: Channel *sc, *c = channel_by_id(ssh, cid);
1.1 djm 203:
1.85 djm 204: debug3_f("entering for channel %d", cid);
1.10 djm 205: if (c == NULL)
1.85 djm 206: fatal_f("channel_by_id(%i) == NULL", cid);
1.67 djm 207: if (c->have_remote_id) {
1.66 djm 208: if ((sc = channel_by_id(ssh, c->remote_id)) == NULL)
1.85 djm 209: fatal_f("channel %d missing session channel %u",
210: c->self, c->remote_id);
1.67 djm 211: c->remote_id = 0;
212: c->have_remote_id = 0;
1.10 djm 213: sc->ctl_chan = -1;
1.39 djm 214: if (sc->type != SSH_CHANNEL_OPEN &&
215: sc->type != SSH_CHANNEL_OPENING) {
1.85 djm 216: debug2_f("channel %d: not open", sc->self);
1.66 djm 217: chan_mark_dead(ssh, sc);
1.12 djm 218: } else {
1.14 djm 219: if (sc->istate == CHAN_INPUT_OPEN)
1.66 djm 220: chan_read_failed(ssh, sc);
1.14 djm 221: if (sc->ostate == CHAN_OUTPUT_OPEN)
1.66 djm 222: chan_write_failed(ssh, sc);
1.12 djm 223: }
1.1 djm 224: }
1.66 djm 225: channel_cancel_cleanup(ssh, c->self);
1.1 djm 226: }
227:
1.10 djm 228: /* Check mux client environment variables before passing them to mux master. */
229: static int
230: env_permitted(char *env)
1.1 djm 231: {
1.10 djm 232: int i, ret;
233: char name[1024], *cp;
1.1 djm 234:
1.10 djm 235: if ((cp = strchr(env, '=')) == NULL || cp == env)
1.1 djm 236: return 0;
1.10 djm 237: ret = snprintf(name, sizeof(name), "%.*s", (int)(cp - env), env);
238: if (ret <= 0 || (size_t)ret >= sizeof(name)) {
1.85 djm 239: error_f("name '%.100s...' too long", env);
1.1 djm 240: return 0;
241: }
242:
1.10 djm 243: for (i = 0; i < options.num_send_env; i++)
244: if (match_pattern(name, options.send_env[i]))
245: return 1;
1.1 djm 246:
1.10 djm 247: return 0;
248: }
1.1 djm 249:
1.10 djm 250: /* Mux master protocol message handlers */
1.1 djm 251:
1.10 djm 252: static int
1.76 djm 253: mux_master_process_hello(struct ssh *ssh, u_int rid,
1.73 markus 254: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 255: {
256: u_int ver;
257: struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx;
1.73 markus 258: int r;
1.1 djm 259:
1.10 djm 260: if (state == NULL)
1.85 djm 261: fatal_f("channel %d: c->mux_ctx == NULL", c->self);
1.10 djm 262: if (state->hello_rcvd) {
1.85 djm 263: error_f("HELLO received twice");
1.10 djm 264: return -1;
265: }
1.73 markus 266: if ((r = sshbuf_get_u32(m, &ver)) != 0) {
1.85 djm 267: error_fr(r, "parse");
1.10 djm 268: return -1;
269: }
270: if (ver != SSHMUX_VER) {
1.85 djm 271: error_f("unsupported multiplexing protocol version %u "
272: "(expected %u)", ver, SSHMUX_VER);
1.10 djm 273: return -1;
274: }
1.85 djm 275: debug2_f("channel %d client version %u", c->self, ver);
1.10 djm 276:
277: /* No extensions are presently defined */
1.73 markus 278: while (sshbuf_len(m) > 0) {
279: char *name = NULL;
1.76 djm 280: size_t value_len = 0;
1.73 markus 281:
282: if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 ||
1.76 djm 283: (r = sshbuf_get_string_direct(m, NULL, &value_len)) != 0) {
1.85 djm 284: error_fr(r, "parse extension");
1.73 markus 285: return -1;
1.1 djm 286: }
1.85 djm 287: debug2_f("Unrecognised extension \"%s\" length %zu",
288: name, value_len);
1.41 djm 289: free(name);
1.1 djm 290: }
1.10 djm 291: state->hello_rcvd = 1;
292: return 0;
293: }
294:
1.73 markus 295: /* Enqueue a "ok" response to the reply buffer */
296: static void
297: reply_ok(struct sshbuf *reply, u_int rid)
298: {
299: int r;
300:
301: if ((r = sshbuf_put_u32(reply, MUX_S_OK)) != 0 ||
302: (r = sshbuf_put_u32(reply, rid)) != 0)
1.85 djm 303: fatal_fr(r, "reply");
1.73 markus 304: }
305:
306: /* Enqueue an error response to the reply buffer */
307: static void
308: reply_error(struct sshbuf *reply, u_int type, u_int rid, const char *msg)
309: {
310: int r;
311:
312: if ((r = sshbuf_put_u32(reply, type)) != 0 ||
313: (r = sshbuf_put_u32(reply, rid)) != 0 ||
314: (r = sshbuf_put_cstring(reply, msg)) != 0)
1.85 djm 315: fatal_fr(r, "reply");
1.73 markus 316: }
317:
1.10 djm 318: static int
1.76 djm 319: mux_master_process_new_session(struct ssh *ssh, u_int rid,
1.73 markus 320: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 321: {
322: Channel *nc;
323: struct mux_session_confirm_ctx *cctx;
1.73 markus 324: char *cmd, *cp;
325: u_int i, j, env_len, escape_char, window, packetmax;
326: int r, new_fd[3];
1.1 djm 327:
328: /* Reply for SSHMUX_COMMAND_OPEN */
1.10 djm 329: cctx = xcalloc(1, sizeof(*cctx));
330: cctx->term = NULL;
1.17 djm 331: cctx->rid = rid;
1.73 markus 332: cmd = NULL;
1.36 djm 333: cctx->env = NULL;
334: env_len = 0;
1.73 markus 335: if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */
336: (r = sshbuf_get_u32(m, &cctx->want_tty)) != 0 ||
337: (r = sshbuf_get_u32(m, &cctx->want_x_fwd)) != 0 ||
338: (r = sshbuf_get_u32(m, &cctx->want_agent_fwd)) != 0 ||
339: (r = sshbuf_get_u32(m, &cctx->want_subsys)) != 0 ||
340: (r = sshbuf_get_u32(m, &escape_char)) != 0 ||
341: (r = sshbuf_get_cstring(m, &cctx->term, NULL)) != 0 ||
342: (r = sshbuf_get_cstring(m, &cmd, NULL)) != 0) {
1.10 djm 343: malf:
1.41 djm 344: free(cmd);
1.36 djm 345: for (j = 0; j < env_len; j++)
1.41 djm 346: free(cctx->env[j]);
347: free(cctx->env);
348: free(cctx->term);
349: free(cctx);
1.85 djm 350: error_f("malformed message");
1.10 djm 351: return -1;
1.1 djm 352: }
353:
1.10 djm 354: #define MUX_MAX_ENV_VARS 4096
1.73 markus 355: while (sshbuf_len(m) > 0) {
356: if ((r = sshbuf_get_cstring(m, &cp, NULL)) != 0)
1.10 djm 357: goto malf;
358: if (!env_permitted(cp)) {
1.41 djm 359: free(cp);
1.10 djm 360: continue;
361: }
1.51 deraadt 362: cctx->env = xreallocarray(cctx->env, env_len + 2,
1.10 djm 363: sizeof(*cctx->env));
364: cctx->env[env_len++] = cp;
365: cctx->env[env_len] = NULL;
366: if (env_len > MUX_MAX_ENV_VARS) {
1.85 djm 367: error_f(">%d environment variables received, "
368: "ignoring additional", MUX_MAX_ENV_VARS);
1.10 djm 369: break;
370: }
1.1 djm 371: }
372:
1.85 djm 373: debug2_f("channel %d: request tty %d, X %d, agent %d, subsys %d, "
374: "term \"%s\", cmd \"%s\", env %u", c->self,
1.10 djm 375: cctx->want_tty, cctx->want_x_fwd, cctx->want_agent_fwd,
376: cctx->want_subsys, cctx->term, cmd, env_len);
1.1 djm 377:
1.73 markus 378: if ((cctx->cmd = sshbuf_new()) == NULL)
1.85 djm 379: fatal_f("sshbuf_new");
1.73 markus 380: if ((r = sshbuf_put(cctx->cmd, cmd, strlen(cmd))) != 0)
1.85 djm 381: fatal_fr(r, "sshbuf_put");
1.41 djm 382: free(cmd);
1.11 djm 383: cmd = NULL;
1.1 djm 384:
385: /* Gather fds from client */
386: for(i = 0; i < 3; i++) {
1.10 djm 387: if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) {
1.85 djm 388: error_f("failed to receive fd %d from client", i);
1.1 djm 389: for (j = 0; j < i; j++)
390: close(new_fd[j]);
391: for (j = 0; j < env_len; j++)
1.41 djm 392: free(cctx->env[j]);
393: free(cctx->env);
394: free(cctx->term);
1.73 markus 395: sshbuf_free(cctx->cmd);
1.41 djm 396: free(cctx);
1.73 markus 397: reply_error(reply, MUX_S_FAILURE, rid,
1.10 djm 398: "did not receive file descriptors");
399: return -1;
1.1 djm 400: }
401: }
402:
1.85 djm 403: debug3_f("got fds stdin %d, stdout %d, stderr %d",
1.1 djm 404: new_fd[0], new_fd[1], new_fd[2]);
405:
1.10 djm 406: /* XXX support multiple child sessions in future */
1.67 djm 407: if (c->have_remote_id) {
1.85 djm 408: debug2_f("session already open");
1.73 markus 409: reply_error(reply, MUX_S_FAILURE, rid,
410: "Multiple sessions not supported");
1.10 djm 411: cleanup:
1.1 djm 412: close(new_fd[0]);
413: close(new_fd[1]);
414: close(new_fd[2]);
1.41 djm 415: free(cctx->term);
1.1 djm 416: if (env_len != 0) {
417: for (i = 0; i < env_len; i++)
1.41 djm 418: free(cctx->env[i]);
419: free(cctx->env);
1.1 djm 420: }
1.73 markus 421: sshbuf_free(cctx->cmd);
1.41 djm 422: free(cctx);
1.1 djm 423: return 0;
424: }
1.10 djm 425:
426: if (options.control_master == SSHCTL_MASTER_ASK ||
427: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
428: if (!ask_permission("Allow shared connection to %s? ", host)) {
1.85 djm 429: debug2_f("session refused by user");
1.73 markus 430: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
431: "Permission denied");
1.10 djm 432: goto cleanup;
433: }
434: }
435:
436: /* Try to pick up ttymodes from client before it goes raw */
437: if (cctx->want_tty && tcgetattr(new_fd[0], &cctx->tio) == -1)
1.85 djm 438: error_f("tcgetattr: %s", strerror(errno));
1.1 djm 439:
440: window = CHAN_SES_WINDOW_DEFAULT;
441: packetmax = CHAN_SES_PACKET_DEFAULT;
442: if (cctx->want_tty) {
443: window >>= 1;
444: packetmax >>= 1;
445: }
1.10 djm 446:
1.66 djm 447: nc = channel_new(ssh, "session", SSH_CHANNEL_OPENING,
1.1 djm 448: new_fd[0], new_fd[1], new_fd[2], window, packetmax,
1.88 djm 449: CHAN_EXTENDED_WRITE, "client-session", CHANNEL_NONBLOCK_STDIO);
1.1 djm 450:
1.10 djm 451: nc->ctl_chan = c->self; /* link session -> control channel */
1.86 djm 452: c->remote_id = nc->self; /* link control -> session channel */
1.67 djm 453: c->have_remote_id = 1;
1.10 djm 454:
1.2 djm 455: if (cctx->want_tty && escape_char != 0xffffffff) {
1.66 djm 456: channel_register_filter(ssh, nc->self,
1.2 djm 457: client_simple_escape_filter, NULL,
1.4 djm 458: client_filter_cleanup,
1.2 djm 459: client_new_escape_filter_ctx((int)escape_char));
460: }
1.1 djm 461:
1.85 djm 462: debug2_f("channel_new: %d linked to control channel %d",
463: nc->self, nc->ctl_chan);
1.10 djm 464:
1.66 djm 465: channel_send_open(ssh, nc->self);
466: channel_register_open_confirm(ssh, nc->self, mux_session_confirm, cctx);
1.17 djm 467: c->mux_pause = 1; /* stop handling messages until open_confirm done */
1.66 djm 468: channel_register_cleanup(ssh, nc->self,
469: mux_master_session_cleanup_cb, 1);
1.10 djm 470:
1.17 djm 471: /* reply is deferred, sent by mux_session_confirm */
1.1 djm 472: return 0;
473: }
474:
1.10 djm 475: static int
1.76 djm 476: mux_master_process_alive_check(struct ssh *ssh, u_int rid,
1.73 markus 477: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.1 djm 478: {
1.73 markus 479: int r;
480:
1.85 djm 481: debug2_f("channel %d: alive check", c->self);
1.1 djm 482:
1.10 djm 483: /* prepare reply */
1.73 markus 484: if ((r = sshbuf_put_u32(reply, MUX_S_ALIVE)) != 0 ||
485: (r = sshbuf_put_u32(reply, rid)) != 0 ||
486: (r = sshbuf_put_u32(reply, (u_int)getpid())) != 0)
1.85 djm 487: fatal_fr(r, "reply");
1.1 djm 488:
1.10 djm 489: return 0;
1.1 djm 490: }
491:
492: static int
1.76 djm 493: mux_master_process_terminate(struct ssh *ssh, u_int rid,
1.73 markus 494: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.1 djm 495: {
1.85 djm 496: debug2_f("channel %d: terminate request", c->self);
1.1 djm 497:
1.10 djm 498: if (options.control_master == SSHCTL_MASTER_ASK ||
499: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
500: if (!ask_permission("Terminate shared connection to %s? ",
501: host)) {
1.85 djm 502: debug2_f("termination refused by user");
1.73 markus 503: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
504: "Permission denied");
1.10 djm 505: return 0;
506: }
507: }
1.1 djm 508:
1.10 djm 509: quit_pending = 1;
1.73 markus 510: reply_ok(reply, rid);
1.10 djm 511: /* XXX exit happens too soon - message never makes it to client */
512: return 0;
1.1 djm 513: }
514:
1.10 djm 515: static char *
1.46 millert 516: format_forward(u_int ftype, struct Forward *fwd)
1.1 djm 517: {
1.10 djm 518: char *ret;
1.1 djm 519:
1.10 djm 520: switch (ftype) {
521: case MUX_FWD_LOCAL:
522: xasprintf(&ret, "local forward %.200s:%d -> %.200s:%d",
1.46 millert 523: (fwd->listen_path != NULL) ? fwd->listen_path :
1.10 djm 524: (fwd->listen_host == NULL) ?
1.46 millert 525: (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
1.10 djm 526: fwd->listen_host, fwd->listen_port,
1.46 millert 527: (fwd->connect_path != NULL) ? fwd->connect_path :
1.10 djm 528: fwd->connect_host, fwd->connect_port);
529: break;
530: case MUX_FWD_DYNAMIC:
531: xasprintf(&ret, "dynamic forward %.200s:%d -> *",
532: (fwd->listen_host == NULL) ?
1.46 millert 533: (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
1.87 djm 534: fwd->listen_host, fwd->listen_port);
1.10 djm 535: break;
536: case MUX_FWD_REMOTE:
537: xasprintf(&ret, "remote forward %.200s:%d -> %.200s:%d",
1.46 millert 538: (fwd->listen_path != NULL) ? fwd->listen_path :
1.10 djm 539: (fwd->listen_host == NULL) ?
540: "LOCALHOST" : fwd->listen_host,
541: fwd->listen_port,
1.46 millert 542: (fwd->connect_path != NULL) ? fwd->connect_path :
1.10 djm 543: fwd->connect_host, fwd->connect_port);
1.1 djm 544: break;
545: default:
1.85 djm 546: fatal_f("unknown forward type %u", ftype);
1.1 djm 547: }
1.10 djm 548: return ret;
549: }
1.1 djm 550:
1.10 djm 551: static int
552: compare_host(const char *a, const char *b)
553: {
554: if (a == NULL && b == NULL)
555: return 1;
556: if (a == NULL || b == NULL)
557: return 0;
558: return strcmp(a, b) == 0;
559: }
1.1 djm 560:
1.10 djm 561: static int
1.46 millert 562: compare_forward(struct Forward *a, struct Forward *b)
1.10 djm 563: {
564: if (!compare_host(a->listen_host, b->listen_host))
565: return 0;
1.46 millert 566: if (!compare_host(a->listen_path, b->listen_path))
567: return 0;
1.10 djm 568: if (a->listen_port != b->listen_port)
569: return 0;
570: if (!compare_host(a->connect_host, b->connect_host))
571: return 0;
1.46 millert 572: if (!compare_host(a->connect_path, b->connect_path))
573: return 0;
1.10 djm 574: if (a->connect_port != b->connect_port)
575: return 0;
1.1 djm 576:
1.10 djm 577: return 1;
578: }
1.1 djm 579:
1.18 markus 580: static void
1.66 djm 581: mux_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
1.18 markus 582: {
583: struct mux_channel_confirm_ctx *fctx = ctxt;
584: char *failmsg = NULL;
1.46 millert 585: struct Forward *rfwd;
1.18 markus 586: Channel *c;
1.73 markus 587: struct sshbuf *out;
1.79 djm 588: u_int port;
1.73 markus 589: int r;
1.18 markus 590:
1.66 djm 591: if ((c = channel_by_id(ssh, fctx->cid)) == NULL) {
1.18 markus 592: /* no channel for reply */
1.85 djm 593: error_f("unknown channel");
1.18 markus 594: return;
595: }
1.73 markus 596: if ((out = sshbuf_new()) == NULL)
1.85 djm 597: fatal_f("sshbuf_new");
1.53 djm 598: if (fctx->fid >= options.num_remote_forwards ||
599: (options.remote_forwards[fctx->fid].connect_path == NULL &&
600: options.remote_forwards[fctx->fid].connect_host == NULL)) {
1.18 markus 601: xasprintf(&failmsg, "unknown forwarding id %d", fctx->fid);
602: goto fail;
603: }
604: rfwd = &options.remote_forwards[fctx->fid];
1.85 djm 605: debug_f("%s for: listen %d, connect %s:%d",
1.18 markus 606: type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
1.46 millert 607: rfwd->listen_port, rfwd->connect_path ? rfwd->connect_path :
608: rfwd->connect_host, rfwd->connect_port);
1.18 markus 609: if (type == SSH2_MSG_REQUEST_SUCCESS) {
610: if (rfwd->listen_port == 0) {
1.79 djm 611: if ((r = sshpkt_get_u32(ssh, &port)) != 0)
1.85 djm 612: fatal_fr(r, "parse port");
1.79 djm 613: if (port > 65535) {
614: fatal("Invalid allocated port %u for "
615: "mux remote forward to %s:%d", port,
616: rfwd->connect_host, rfwd->connect_port);
617: }
618: rfwd->allocated_port = (int)port;
1.52 djm 619: debug("Allocated port %u for mux remote forward"
1.18 markus 620: " to %s:%d", rfwd->allocated_port,
621: rfwd->connect_host, rfwd->connect_port);
1.73 markus 622: if ((r = sshbuf_put_u32(out,
623: MUX_S_REMOTE_PORT)) != 0 ||
624: (r = sshbuf_put_u32(out, fctx->rid)) != 0 ||
625: (r = sshbuf_put_u32(out,
626: rfwd->allocated_port)) != 0)
1.85 djm 627: fatal_fr(r, "reply");
1.70 djm 628: channel_update_permission(ssh, rfwd->handle,
1.87 djm 629: rfwd->allocated_port);
1.18 markus 630: } else {
1.73 markus 631: reply_ok(out, fctx->rid);
1.18 markus 632: }
633: goto out;
634: } else {
1.31 markus 635: if (rfwd->listen_port == 0)
1.70 djm 636: channel_update_permission(ssh, rfwd->handle, -1);
1.46 millert 637: if (rfwd->listen_path != NULL)
638: xasprintf(&failmsg, "remote port forwarding failed for "
639: "listen path %s", rfwd->listen_path);
640: else
641: xasprintf(&failmsg, "remote port forwarding failed for "
642: "listen port %d", rfwd->listen_port);
1.53 djm 643:
1.87 djm 644: debug2_f("clearing registered forwarding for listen %d, "
1.85 djm 645: "connect %s:%d", rfwd->listen_port,
1.53 djm 646: rfwd->connect_path ? rfwd->connect_path :
647: rfwd->connect_host, rfwd->connect_port);
648:
649: free(rfwd->listen_host);
650: free(rfwd->listen_path);
651: free(rfwd->connect_host);
652: free(rfwd->connect_path);
653: memset(rfwd, 0, sizeof(*rfwd));
1.18 markus 654: }
655: fail:
1.85 djm 656: error_f("%s", failmsg);
1.73 markus 657: reply_error(out, MUX_S_FAILURE, fctx->rid, failmsg);
1.41 djm 658: free(failmsg);
1.18 markus 659: out:
1.73 markus 660: if ((r = sshbuf_put_stringb(c->output, out)) != 0)
1.85 djm 661: fatal_fr(r, "enqueue");
1.73 markus 662: sshbuf_free(out);
1.18 markus 663: if (c->mux_pause <= 0)
1.85 djm 664: fatal_f("mux_pause %d", c->mux_pause);
1.18 markus 665: c->mux_pause = 0; /* start processing messages again */
666: }
667:
1.10 djm 668: static int
1.76 djm 669: mux_master_process_open_fwd(struct ssh *ssh, u_int rid,
1.73 markus 670: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 671: {
1.46 millert 672: struct Forward fwd;
1.10 djm 673: char *fwd_desc = NULL;
1.46 millert 674: char *listen_addr, *connect_addr;
1.10 djm 675: u_int ftype;
1.44 djm 676: u_int lport, cport;
1.73 markus 677: int r, i, ret = 0, freefwd = 1;
1.10 djm 678:
1.54 djm 679: memset(&fwd, 0, sizeof(fwd));
680:
1.46 millert 681: /* XXX - lport/cport check redundant */
1.73 markus 682: if ((r = sshbuf_get_u32(m, &ftype)) != 0 ||
683: (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 ||
684: (r = sshbuf_get_u32(m, &lport)) != 0 ||
685: (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 ||
686: (r = sshbuf_get_u32(m, &cport)) != 0 ||
1.46 millert 687: (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
688: (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
1.85 djm 689: error_f("malformed message");
1.10 djm 690: ret = -1;
691: goto out;
692: }
1.46 millert 693: if (*listen_addr == '\0') {
694: free(listen_addr);
695: listen_addr = NULL;
696: }
697: if (*connect_addr == '\0') {
698: free(connect_addr);
699: connect_addr = NULL;
700: }
701:
702: memset(&fwd, 0, sizeof(fwd));
1.44 djm 703: fwd.listen_port = lport;
1.46 millert 704: if (fwd.listen_port == PORT_STREAMLOCAL)
705: fwd.listen_path = listen_addr;
706: else
707: fwd.listen_host = listen_addr;
1.44 djm 708: fwd.connect_port = cport;
1.46 millert 709: if (fwd.connect_port == PORT_STREAMLOCAL)
710: fwd.connect_path = connect_addr;
711: else
712: fwd.connect_host = connect_addr;
1.10 djm 713:
1.85 djm 714: debug2_f("channel %d: request %s", c->self,
1.10 djm 715: (fwd_desc = format_forward(ftype, &fwd)));
716:
717: if (ftype != MUX_FWD_LOCAL && ftype != MUX_FWD_REMOTE &&
718: ftype != MUX_FWD_DYNAMIC) {
1.85 djm 719: logit_f("invalid forwarding type %u", ftype);
1.10 djm 720: invalid:
1.46 millert 721: free(listen_addr);
722: free(connect_addr);
1.73 markus 723: reply_error(reply, MUX_S_FAILURE, rid,
724: "Invalid forwarding request");
1.10 djm 725: return 0;
726: }
1.46 millert 727: if (ftype == MUX_FWD_DYNAMIC && fwd.listen_path) {
1.85 djm 728: logit_f("streamlocal and dynamic forwards "
729: "are mutually exclusive");
1.46 millert 730: goto invalid;
731: }
732: if (fwd.listen_port != PORT_STREAMLOCAL && fwd.listen_port >= 65536) {
1.85 djm 733: logit_f("invalid listen port %u", fwd.listen_port);
1.10 djm 734: goto invalid;
735: }
1.66 djm 736: if ((fwd.connect_port != PORT_STREAMLOCAL &&
737: fwd.connect_port >= 65536) ||
738: (ftype != MUX_FWD_DYNAMIC && ftype != MUX_FWD_REMOTE &&
739: fwd.connect_port == 0)) {
1.85 djm 740: logit_f("invalid connect port %u",
1.10 djm 741: fwd.connect_port);
742: goto invalid;
743: }
1.66 djm 744: if (ftype != MUX_FWD_DYNAMIC && fwd.connect_host == NULL &&
745: fwd.connect_path == NULL) {
1.85 djm 746: logit_f("missing connect host");
1.10 djm 747: goto invalid;
748: }
749:
750: /* Skip forwards that have already been requested */
751: switch (ftype) {
752: case MUX_FWD_LOCAL:
753: case MUX_FWD_DYNAMIC:
754: for (i = 0; i < options.num_local_forwards; i++) {
755: if (compare_forward(&fwd,
756: options.local_forwards + i)) {
757: exists:
1.85 djm 758: debug2_f("found existing forwarding");
1.73 markus 759: reply_ok(reply, rid);
1.10 djm 760: goto out;
761: }
762: }
763: break;
764: case MUX_FWD_REMOTE:
765: for (i = 0; i < options.num_remote_forwards; i++) {
1.73 markus 766: if (!compare_forward(&fwd, options.remote_forwards + i))
767: continue;
768: if (fwd.listen_port != 0)
769: goto exists;
1.85 djm 770: debug2_f("found allocated port");
1.73 markus 771: if ((r = sshbuf_put_u32(reply,
772: MUX_S_REMOTE_PORT)) != 0 ||
773: (r = sshbuf_put_u32(reply, rid)) != 0 ||
774: (r = sshbuf_put_u32(reply,
775: options.remote_forwards[i].allocated_port)) != 0)
1.85 djm 776: fatal_fr(r, "reply FWD_REMOTE");
1.73 markus 777: goto out;
1.10 djm 778: }
779: break;
780: }
781:
782: if (options.control_master == SSHCTL_MASTER_ASK ||
783: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
784: if (!ask_permission("Open %s on %s?", fwd_desc, host)) {
1.85 djm 785: debug2_f("forwarding refused by user");
1.73 markus 786: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
787: "Permission denied");
1.10 djm 788: goto out;
789: }
790: }
791:
792: if (ftype == MUX_FWD_LOCAL || ftype == MUX_FWD_DYNAMIC) {
1.66 djm 793: if (!channel_setup_local_fwd_listener(ssh, &fwd,
1.46 millert 794: &options.fwd_opts)) {
1.10 djm 795: fail:
1.85 djm 796: logit_f("requested %s failed", fwd_desc);
1.73 markus 797: reply_error(reply, MUX_S_FAILURE, rid,
798: "Port forwarding failed");
1.10 djm 799: goto out;
800: }
801: add_local_forward(&options, &fwd);
802: freefwd = 0;
803: } else {
1.18 markus 804: struct mux_channel_confirm_ctx *fctx;
805:
1.66 djm 806: fwd.handle = channel_request_remote_forwarding(ssh, &fwd);
1.31 markus 807: if (fwd.handle < 0)
1.10 djm 808: goto fail;
809: add_remote_forward(&options, &fwd);
1.18 markus 810: fctx = xcalloc(1, sizeof(*fctx));
811: fctx->cid = c->self;
812: fctx->rid = rid;
1.20 djm 813: fctx->fid = options.num_remote_forwards - 1;
1.18 markus 814: client_register_global_confirm(mux_confirm_remote_forward,
815: fctx);
1.10 djm 816: freefwd = 0;
1.18 markus 817: c->mux_pause = 1; /* wait for mux_confirm_remote_forward */
818: /* delayed reply in mux_confirm_remote_forward */
819: goto out;
1.10 djm 820: }
1.73 markus 821: reply_ok(reply, rid);
1.10 djm 822: out:
1.41 djm 823: free(fwd_desc);
1.10 djm 824: if (freefwd) {
1.41 djm 825: free(fwd.listen_host);
1.46 millert 826: free(fwd.listen_path);
1.41 djm 827: free(fwd.connect_host);
1.46 millert 828: free(fwd.connect_path);
1.10 djm 829: }
830: return ret;
831: }
832:
833: static int
1.76 djm 834: mux_master_process_close_fwd(struct ssh *ssh, u_int rid,
1.73 markus 835: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 836: {
1.46 millert 837: struct Forward fwd, *found_fwd;
1.10 djm 838: char *fwd_desc = NULL;
1.30 djm 839: const char *error_reason = NULL;
1.46 millert 840: char *listen_addr = NULL, *connect_addr = NULL;
1.10 djm 841: u_int ftype;
1.73 markus 842: int r, i, ret = 0;
1.44 djm 843: u_int lport, cport;
1.54 djm 844:
845: memset(&fwd, 0, sizeof(fwd));
1.10 djm 846:
1.73 markus 847: if ((r = sshbuf_get_u32(m, &ftype)) != 0 ||
848: (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 ||
849: (r = sshbuf_get_u32(m, &lport)) != 0 ||
850: (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 ||
851: (r = sshbuf_get_u32(m, &cport)) != 0 ||
1.46 millert 852: (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
853: (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
1.85 djm 854: error_f("malformed message");
1.10 djm 855: ret = -1;
856: goto out;
857: }
858:
1.46 millert 859: if (*listen_addr == '\0') {
860: free(listen_addr);
861: listen_addr = NULL;
1.10 djm 862: }
1.46 millert 863: if (*connect_addr == '\0') {
864: free(connect_addr);
865: connect_addr = NULL;
1.10 djm 866: }
867:
1.46 millert 868: memset(&fwd, 0, sizeof(fwd));
869: fwd.listen_port = lport;
870: if (fwd.listen_port == PORT_STREAMLOCAL)
871: fwd.listen_path = listen_addr;
872: else
873: fwd.listen_host = listen_addr;
874: fwd.connect_port = cport;
875: if (fwd.connect_port == PORT_STREAMLOCAL)
876: fwd.connect_path = connect_addr;
877: else
878: fwd.connect_host = connect_addr;
879:
1.85 djm 880: debug2_f("channel %d: request cancel %s", c->self,
1.10 djm 881: (fwd_desc = format_forward(ftype, &fwd)));
882:
1.30 djm 883: /* make sure this has been requested */
884: found_fwd = NULL;
885: switch (ftype) {
886: case MUX_FWD_LOCAL:
887: case MUX_FWD_DYNAMIC:
888: for (i = 0; i < options.num_local_forwards; i++) {
889: if (compare_forward(&fwd,
890: options.local_forwards + i)) {
891: found_fwd = options.local_forwards + i;
892: break;
893: }
894: }
895: break;
896: case MUX_FWD_REMOTE:
897: for (i = 0; i < options.num_remote_forwards; i++) {
898: if (compare_forward(&fwd,
899: options.remote_forwards + i)) {
900: found_fwd = options.remote_forwards + i;
901: break;
902: }
903: }
904: break;
905: }
906:
907: if (found_fwd == NULL)
908: error_reason = "port not forwarded";
909: else if (ftype == MUX_FWD_REMOTE) {
910: /*
911: * This shouldn't fail unless we confused the host/port
912: * between options.remote_forwards and permitted_opens.
1.31 markus 913: * However, for dynamic allocated listen ports we need
1.46 millert 914: * to use the actual listen port.
1.30 djm 915: */
1.66 djm 916: if (channel_request_rforward_cancel(ssh, found_fwd) == -1)
1.30 djm 917: error_reason = "port not in permitted opens";
918: } else { /* local and dynamic forwards */
919: /* Ditto */
1.66 djm 920: if (channel_cancel_lport_listener(ssh, &fwd, fwd.connect_port,
1.46 millert 921: &options.fwd_opts) == -1)
1.30 djm 922: error_reason = "port not found";
923: }
924:
1.73 markus 925: if (error_reason != NULL)
926: reply_error(reply, MUX_S_FAILURE, rid, error_reason);
927: else {
928: reply_ok(reply, rid);
1.41 djm 929: free(found_fwd->listen_host);
1.46 millert 930: free(found_fwd->listen_path);
1.41 djm 931: free(found_fwd->connect_host);
1.46 millert 932: free(found_fwd->connect_path);
1.30 djm 933: found_fwd->listen_host = found_fwd->connect_host = NULL;
1.46 millert 934: found_fwd->listen_path = found_fwd->connect_path = NULL;
1.30 djm 935: found_fwd->listen_port = found_fwd->connect_port = 0;
936: }
1.10 djm 937: out:
1.41 djm 938: free(fwd_desc);
1.46 millert 939: free(listen_addr);
940: free(connect_addr);
1.10 djm 941:
942: return ret;
943: }
944:
945: static int
1.76 djm 946: mux_master_process_stdio_fwd(struct ssh *ssh, u_int rid,
1.73 markus 947: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 948: {
949: Channel *nc;
1.73 markus 950: char *chost = NULL;
1.10 djm 951: u_int cport, i, j;
1.73 markus 952: int r, new_fd[2];
1.48 djm 953: struct mux_stdio_confirm_ctx *cctx;
1.10 djm 954:
1.73 markus 955: if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */
956: (r = sshbuf_get_cstring(m, &chost, NULL)) != 0 ||
957: (r = sshbuf_get_u32(m, &cport)) != 0) {
1.41 djm 958: free(chost);
1.85 djm 959: error_f("malformed message");
1.10 djm 960: return -1;
961: }
962:
1.85 djm 963: debug2_f("channel %d: stdio fwd to %s:%u", c->self, chost, cport);
1.10 djm 964:
965: /* Gather fds from client */
966: for(i = 0; i < 2; i++) {
967: if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) {
1.85 djm 968: error_f("failed to receive fd %d from client", i);
1.10 djm 969: for (j = 0; j < i; j++)
970: close(new_fd[j]);
1.41 djm 971: free(chost);
1.10 djm 972:
973: /* prepare reply */
1.73 markus 974: reply_error(reply, MUX_S_FAILURE, rid,
1.10 djm 975: "did not receive file descriptors");
976: return -1;
977: }
978: }
979:
1.85 djm 980: debug3_f("got fds stdin %d, stdout %d", new_fd[0], new_fd[1]);
1.10 djm 981:
982: /* XXX support multiple child sessions in future */
1.67 djm 983: if (c->have_remote_id) {
1.85 djm 984: debug2_f("session already open");
1.73 markus 985: reply_error(reply, MUX_S_FAILURE, rid,
986: "Multiple sessions not supported");
1.10 djm 987: cleanup:
988: close(new_fd[0]);
989: close(new_fd[1]);
1.41 djm 990: free(chost);
1.10 djm 991: return 0;
992: }
993:
994: if (options.control_master == SSHCTL_MASTER_ASK ||
995: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
1.23 dtucker 996: if (!ask_permission("Allow forward to %s:%u? ",
1.10 djm 997: chost, cport)) {
1.85 djm 998: debug2_f("stdio fwd refused by user");
1.73 markus 999: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
1000: "Permission denied");
1.10 djm 1001: goto cleanup;
1002: }
1003: }
1004:
1.88 djm 1005: nc = channel_connect_stdio_fwd(ssh, chost, cport, new_fd[0], new_fd[1],
1006: CHANNEL_NONBLOCK_STDIO);
1.75 djm 1007: free(chost);
1.10 djm 1008:
1009: nc->ctl_chan = c->self; /* link session -> control channel */
1.86 djm 1010: c->remote_id = nc->self; /* link control -> session channel */
1.67 djm 1011: c->have_remote_id = 1;
1.10 djm 1012:
1.85 djm 1013: debug2_f("channel_new: %d control %d", nc->self, nc->ctl_chan);
1.10 djm 1014:
1.66 djm 1015: channel_register_cleanup(ssh, nc->self,
1016: mux_master_session_cleanup_cb, 1);
1.10 djm 1017:
1.48 djm 1018: cctx = xcalloc(1, sizeof(*cctx));
1019: cctx->rid = rid;
1.66 djm 1020: channel_register_open_confirm(ssh, nc->self, mux_stdio_confirm, cctx);
1.48 djm 1021: c->mux_pause = 1; /* stop handling messages until open_confirm done */
1022:
1023: /* reply is deferred, sent by mux_session_confirm */
1024: return 0;
1025: }
1026:
1027: /* Callback on open confirmation in mux master for a mux stdio fwd session. */
1028: static void
1.66 djm 1029: mux_stdio_confirm(struct ssh *ssh, int id, int success, void *arg)
1.48 djm 1030: {
1031: struct mux_stdio_confirm_ctx *cctx = arg;
1032: Channel *c, *cc;
1.73 markus 1033: struct sshbuf *reply;
1034: int r;
1.48 djm 1035:
1036: if (cctx == NULL)
1.85 djm 1037: fatal_f("cctx == NULL");
1.66 djm 1038: if ((c = channel_by_id(ssh, id)) == NULL)
1.85 djm 1039: fatal_f("no channel for id %d", id);
1.66 djm 1040: if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 1041: fatal_f("channel %d lacks control channel %d",
1.48 djm 1042: id, c->ctl_chan);
1.73 markus 1043: if ((reply = sshbuf_new()) == NULL)
1.85 djm 1044: fatal_f("sshbuf_new");
1.48 djm 1045:
1046: if (!success) {
1.85 djm 1047: debug3_f("sending failure reply");
1.73 markus 1048: reply_error(reply, MUX_S_FAILURE, cctx->rid,
1049: "Session open refused by peer");
1.48 djm 1050: /* prepare reply */
1051: goto done;
1052: }
1053:
1.85 djm 1054: debug3_f("sending success reply");
1.10 djm 1055: /* prepare reply */
1.73 markus 1056: if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 ||
1057: (r = sshbuf_put_u32(reply, cctx->rid)) != 0 ||
1058: (r = sshbuf_put_u32(reply, c->self)) != 0)
1.85 djm 1059: fatal_fr(r, "reply");
1.48 djm 1060:
1061: done:
1062: /* Send reply */
1.73 markus 1063: if ((r = sshbuf_put_stringb(cc->output, reply)) != 0)
1.85 djm 1064: fatal_fr(r, "enqueue");
1.73 markus 1065: sshbuf_free(reply);
1.10 djm 1066:
1.48 djm 1067: if (cc->mux_pause <= 0)
1.85 djm 1068: fatal_f("mux_pause %d", cc->mux_pause);
1.48 djm 1069: cc->mux_pause = 0; /* start processing messages again */
1070: c->open_confirm_ctx = NULL;
1071: free(cctx);
1.10 djm 1072: }
1073:
1.25 djm 1074: static int
1.76 djm 1075: mux_master_process_stop_listening(struct ssh *ssh, u_int rid,
1.73 markus 1076: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.25 djm 1077: {
1.85 djm 1078: debug_f("channel %d: stop listening", c->self);
1.25 djm 1079:
1080: if (options.control_master == SSHCTL_MASTER_ASK ||
1081: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
1082: if (!ask_permission("Disable further multiplexing on shared "
1083: "connection to %s? ", host)) {
1.85 djm 1084: debug2_f("stop listen refused by user");
1.73 markus 1085: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
1086: "Permission denied");
1.25 djm 1087: return 0;
1088: }
1089: }
1090:
1091: if (mux_listener_channel != NULL) {
1.66 djm 1092: channel_free(ssh, mux_listener_channel);
1.25 djm 1093: client_stop_mux();
1.41 djm 1094: free(options.control_path);
1.25 djm 1095: options.control_path = NULL;
1096: mux_listener_channel = NULL;
1097: muxserver_sock = -1;
1098: }
1099:
1.73 markus 1100: reply_ok(reply, rid);
1.25 djm 1101: return 0;
1102: }
1103:
1.62 markus 1104: static int
1.76 djm 1105: mux_master_process_proxy(struct ssh *ssh, u_int rid,
1.73 markus 1106: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.62 markus 1107: {
1.73 markus 1108: int r;
1109:
1.85 djm 1110: debug_f("channel %d: proxy request", c->self);
1.62 markus 1111:
1112: c->mux_rcb = channel_proxy_downstream;
1.73 markus 1113: if ((r = sshbuf_put_u32(reply, MUX_S_PROXY)) != 0 ||
1114: (r = sshbuf_put_u32(reply, rid)) != 0)
1.85 djm 1115: fatal_fr(r, "reply");
1.62 markus 1116:
1117: return 0;
1118: }
1119:
1.83 djm 1120: /* Channel callbacks fired on read/write from mux client fd */
1.10 djm 1121: static int
1.66 djm 1122: mux_master_read_cb(struct ssh *ssh, Channel *c)
1.10 djm 1123: {
1124: struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx;
1.73 markus 1125: struct sshbuf *in = NULL, *out = NULL;
1126: u_int type, rid, i;
1127: int r, ret = -1;
1128:
1129: if ((out = sshbuf_new()) == NULL)
1.85 djm 1130: fatal_f("sshbuf_new");
1.10 djm 1131:
1132: /* Setup ctx and */
1133: if (c->mux_ctx == NULL) {
1.19 djm 1134: state = xcalloc(1, sizeof(*state));
1.10 djm 1135: c->mux_ctx = state;
1.66 djm 1136: channel_register_cleanup(ssh, c->self,
1.10 djm 1137: mux_master_control_cleanup_cb, 0);
1138:
1139: /* Send hello */
1.73 markus 1140: if ((r = sshbuf_put_u32(out, MUX_MSG_HELLO)) != 0 ||
1141: (r = sshbuf_put_u32(out, SSHMUX_VER)) != 0)
1.85 djm 1142: fatal_fr(r, "reply");
1.10 djm 1143: /* no extensions */
1.73 markus 1144: if ((r = sshbuf_put_stringb(c->output, out)) != 0)
1.85 djm 1145: fatal_fr(r, "enqueue");
1146: debug3_f("channel %d: hello sent", c->self);
1.73 markus 1147: ret = 0;
1148: goto out;
1.10 djm 1149: }
1150:
1151: /* Channel code ensures that we receive whole packets */
1.73 markus 1152: if ((r = sshbuf_froms(c->input, &in)) != 0) {
1.10 djm 1153: malf:
1.85 djm 1154: error_f("malformed message");
1.10 djm 1155: goto out;
1156: }
1157:
1.73 markus 1158: if ((r = sshbuf_get_u32(in, &type)) != 0)
1.10 djm 1159: goto malf;
1.85 djm 1160: debug3_f("channel %d packet type 0x%08x len %zu", c->self,
1161: type, sshbuf_len(in));
1.10 djm 1162:
1163: if (type == MUX_MSG_HELLO)
1164: rid = 0;
1165: else {
1166: if (!state->hello_rcvd) {
1.85 djm 1167: error_f("expected MUX_MSG_HELLO(0x%08x), "
1168: "received 0x%08x", MUX_MSG_HELLO, type);
1.10 djm 1169: goto out;
1.1 djm 1170: }
1.73 markus 1171: if ((r = sshbuf_get_u32(in, &rid)) != 0)
1.10 djm 1172: goto malf;
1173: }
1174:
1175: for (i = 0; mux_master_handlers[i].handler != NULL; i++) {
1176: if (type == mux_master_handlers[i].type) {
1.66 djm 1177: ret = mux_master_handlers[i].handler(ssh, rid,
1.73 markus 1178: c, in, out);
1.10 djm 1179: break;
1.1 djm 1180: }
1.10 djm 1181: }
1182: if (mux_master_handlers[i].handler == NULL) {
1.85 djm 1183: error_f("unsupported mux message 0x%08x", type);
1.73 markus 1184: reply_error(out, MUX_S_FAILURE, rid, "unsupported request");
1.10 djm 1185: ret = 0;
1186: }
1187: /* Enqueue reply packet */
1.85 djm 1188: if (sshbuf_len(out) != 0 &&
1189: (r = sshbuf_put_stringb(c->output, out)) != 0)
1190: fatal_fr(r, "enqueue");
1.10 djm 1191: out:
1.73 markus 1192: sshbuf_free(in);
1193: sshbuf_free(out);
1.10 djm 1194: return ret;
1195: }
1196:
1197: void
1.66 djm 1198: mux_exit_message(struct ssh *ssh, Channel *c, int exitval)
1.10 djm 1199: {
1.73 markus 1200: struct sshbuf *m;
1.10 djm 1201: Channel *mux_chan;
1.73 markus 1202: int r;
1.10 djm 1203:
1.85 djm 1204: debug3_f("channel %d: exit message, exitval %d", c->self, exitval);
1.10 djm 1205:
1.66 djm 1206: if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 1207: fatal_f("channel %d missing mux %d", c->self, c->ctl_chan);
1.10 djm 1208:
1209: /* Append exit message packet to control socket output queue */
1.73 markus 1210: if ((m = sshbuf_new()) == NULL)
1.85 djm 1211: fatal_f("sshbuf_new");
1.73 markus 1212: if ((r = sshbuf_put_u32(m, MUX_S_EXIT_MESSAGE)) != 0 ||
1213: (r = sshbuf_put_u32(m, c->self)) != 0 ||
1214: (r = sshbuf_put_u32(m, exitval)) != 0 ||
1215: (r = sshbuf_put_stringb(mux_chan->output, m)) != 0)
1.85 djm 1216: fatal_fr(r, "reply");
1.73 markus 1217: sshbuf_free(m);
1.10 djm 1218: }
1219:
1.28 djm 1220: void
1.66 djm 1221: mux_tty_alloc_failed(struct ssh *ssh, Channel *c)
1.28 djm 1222: {
1.73 markus 1223: struct sshbuf *m;
1.28 djm 1224: Channel *mux_chan;
1.73 markus 1225: int r;
1.28 djm 1226:
1.85 djm 1227: debug3_f("channel %d: TTY alloc failed", c->self);
1.28 djm 1228:
1.66 djm 1229: if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 1230: fatal_f("channel %d missing mux %d", c->self, c->ctl_chan);
1.28 djm 1231:
1232: /* Append exit message packet to control socket output queue */
1.73 markus 1233: if ((m = sshbuf_new()) == NULL)
1.85 djm 1234: fatal_f("sshbuf_new");
1.73 markus 1235: if ((r = sshbuf_put_u32(m, MUX_S_TTY_ALLOC_FAIL)) != 0 ||
1236: (r = sshbuf_put_u32(m, c->self)) != 0 ||
1237: (r = sshbuf_put_stringb(mux_chan->output, m)) != 0)
1.85 djm 1238: fatal_fr(r, "reply");
1.73 markus 1239: sshbuf_free(m);
1.28 djm 1240: }
1241:
1.10 djm 1242: /* Prepare a mux master to listen on a Unix domain socket. */
1243: void
1.66 djm 1244: muxserver_listen(struct ssh *ssh)
1.10 djm 1245: {
1246: mode_t old_umask;
1.22 djm 1247: char *orig_control_path = options.control_path;
1248: char rbuf[16+1];
1249: u_int i, r;
1.47 djm 1250: int oerrno;
1.10 djm 1251:
1252: if (options.control_path == NULL ||
1253: options.control_master == SSHCTL_MASTER_NO)
1.1 djm 1254: return;
1.10 djm 1255:
1256: debug("setting up multiplex master socket");
1257:
1.22 djm 1258: /*
1259: * Use a temporary path before listen so we can pseudo-atomically
1260: * establish the listening socket in its final location to avoid
1261: * other processes racing in between bind() and listen() and hitting
1262: * an unready socket.
1263: */
1264: for (i = 0; i < sizeof(rbuf) - 1; i++) {
1265: r = arc4random_uniform(26+26+10);
1266: rbuf[i] = (r < 26) ? 'a' + r :
1267: (r < 26*2) ? 'A' + r - 26 :
1268: '0' + r - 26 - 26;
1269: }
1270: rbuf[sizeof(rbuf) - 1] = '\0';
1271: options.control_path = NULL;
1272: xasprintf(&options.control_path, "%s.%s", orig_control_path, rbuf);
1.85 djm 1273: debug3_f("temporary control path %s", options.control_path);
1.22 djm 1274:
1.10 djm 1275: old_umask = umask(0177);
1.46 millert 1276: muxserver_sock = unix_listener(options.control_path, 64, 0);
1.47 djm 1277: oerrno = errno;
1.46 millert 1278: umask(old_umask);
1279: if (muxserver_sock < 0) {
1.47 djm 1280: if (oerrno == EINVAL || oerrno == EADDRINUSE) {
1.10 djm 1281: error("ControlSocket %s already exists, "
1282: "disabling multiplexing", options.control_path);
1.22 djm 1283: disable_mux_master:
1.26 djm 1284: if (muxserver_sock != -1) {
1285: close(muxserver_sock);
1286: muxserver_sock = -1;
1287: }
1.41 djm 1288: free(orig_control_path);
1289: free(options.control_path);
1.10 djm 1290: options.control_path = NULL;
1291: options.control_master = SSHCTL_MASTER_NO;
1292: return;
1.46 millert 1293: } else {
1294: /* unix_listener() logs the error */
1295: cleanup_exit(255);
1296: }
1.10 djm 1297: }
1298:
1.22 djm 1299: /* Now atomically "move" the mux socket into position */
1300: if (link(options.control_path, orig_control_path) != 0) {
1301: if (errno != EEXIST) {
1.85 djm 1302: fatal_f("link mux listener %s => %s: %s",
1.22 djm 1303: options.control_path, orig_control_path,
1304: strerror(errno));
1305: }
1306: error("ControlSocket %s already exists, disabling multiplexing",
1307: orig_control_path);
1308: unlink(options.control_path);
1309: goto disable_mux_master;
1310: }
1311: unlink(options.control_path);
1.41 djm 1312: free(options.control_path);
1.22 djm 1313: options.control_path = orig_control_path;
1314:
1.10 djm 1315: set_nonblock(muxserver_sock);
1316:
1.66 djm 1317: mux_listener_channel = channel_new(ssh, "mux listener",
1.10 djm 1318: SSH_CHANNEL_MUX_LISTENER, muxserver_sock, muxserver_sock, -1,
1319: CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1.22 djm 1320: 0, options.control_path, 1);
1.10 djm 1321: mux_listener_channel->mux_rcb = mux_master_read_cb;
1.85 djm 1322: debug3_f("mux listener channel %d fd %d",
1.10 djm 1323: mux_listener_channel->self, mux_listener_channel->sock);
1324: }
1325:
1326: /* Callback on open confirmation in mux master for a mux client session. */
1327: static void
1.66 djm 1328: mux_session_confirm(struct ssh *ssh, int id, int success, void *arg)
1.10 djm 1329: {
1330: struct mux_session_confirm_ctx *cctx = arg;
1331: const char *display;
1.17 djm 1332: Channel *c, *cc;
1.73 markus 1333: int i, r;
1334: struct sshbuf *reply;
1.10 djm 1335:
1336: if (cctx == NULL)
1.85 djm 1337: fatal_f("cctx == NULL");
1.66 djm 1338: if ((c = channel_by_id(ssh, id)) == NULL)
1.85 djm 1339: fatal_f("no channel for id %d", id);
1.66 djm 1340: if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 1341: fatal_f("channel %d lacks control channel %d",
1.17 djm 1342: id, c->ctl_chan);
1.73 markus 1343: if ((reply = sshbuf_new()) == NULL)
1.85 djm 1344: fatal_f("sshbuf_new");
1.17 djm 1345:
1346: if (!success) {
1.85 djm 1347: debug3_f("sending failure reply");
1.73 markus 1348: reply_error(reply, MUX_S_FAILURE, cctx->rid,
1349: "Session open refused by peer");
1.17 djm 1350: goto done;
1351: }
1.10 djm 1352:
1353: display = getenv("DISPLAY");
1354: if (cctx->want_x_fwd && options.forward_x11 && display != NULL) {
1355: char *proto, *data;
1.21 djm 1356:
1.10 djm 1357: /* Get reasonable local authentication information. */
1.66 djm 1358: if (client_x11_get_proto(ssh, display, options.xauth_location,
1.21 djm 1359: options.forward_x11_trusted, options.forward_x11_timeout,
1.58 djm 1360: &proto, &data) == 0) {
1361: /* Request forwarding with authentication spoofing. */
1362: debug("Requesting X11 forwarding with authentication "
1363: "spoofing.");
1.66 djm 1364: x11_request_forwarding_with_spoofing(ssh, id,
1365: display, proto, data, 1);
1.58 djm 1366: /* XXX exit_on_forward_failure */
1.66 djm 1367: client_expect_confirm(ssh, id, "X11 forwarding",
1.58 djm 1368: CONFIRM_WARN);
1369: }
1.10 djm 1370: }
1371:
1372: if (cctx->want_agent_fwd && options.forward_agent) {
1373: debug("Requesting authentication agent forwarding.");
1.66 djm 1374: channel_request_start(ssh, id, "auth-agent-req@openssh.com", 0);
1.79 djm 1375: if ((r = sshpkt_send(ssh)) != 0)
1.85 djm 1376: fatal_fr(r, "send");
1.10 djm 1377: }
1378:
1.66 djm 1379: client_session2_setup(ssh, id, cctx->want_tty, cctx->want_subsys,
1.73 markus 1380: cctx->term, &cctx->tio, c->rfd, cctx->cmd, cctx->env);
1.10 djm 1381:
1.85 djm 1382: debug3_f("sending success reply");
1.17 djm 1383: /* prepare reply */
1.73 markus 1384: if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 ||
1385: (r = sshbuf_put_u32(reply, cctx->rid)) != 0 ||
1386: (r = sshbuf_put_u32(reply, c->self)) != 0)
1.85 djm 1387: fatal_fr(r, "reply");
1.17 djm 1388:
1389: done:
1390: /* Send reply */
1.73 markus 1391: if ((r = sshbuf_put_stringb(cc->output, reply)) != 0)
1.85 djm 1392: fatal_fr(r, "enqueue");
1.73 markus 1393: sshbuf_free(reply);
1.17 djm 1394:
1395: if (cc->mux_pause <= 0)
1.85 djm 1396: fatal_f("mux_pause %d", cc->mux_pause);
1.17 djm 1397: cc->mux_pause = 0; /* start processing messages again */
1.10 djm 1398: c->open_confirm_ctx = NULL;
1.73 markus 1399: sshbuf_free(cctx->cmd);
1.41 djm 1400: free(cctx->term);
1.10 djm 1401: if (cctx->env != NULL) {
1402: for (i = 0; cctx->env[i] != NULL; i++)
1.41 djm 1403: free(cctx->env[i]);
1404: free(cctx->env);
1.1 djm 1405: }
1.41 djm 1406: free(cctx);
1.10 djm 1407: }
1408:
1409: /* ** Multiplexing client support */
1410:
1411: /* Exit signal handler */
1412: static void
1413: control_client_sighandler(int signo)
1414: {
1415: muxclient_terminate = signo;
1416: }
1417:
1418: /*
1419: * Relay signal handler - used to pass some signals from mux client to
1420: * mux master.
1421: */
1422: static void
1423: control_client_sigrelay(int signo)
1424: {
1425: int save_errno = errno;
1426:
1427: if (muxserver_pid > 1)
1428: kill(muxserver_pid, signo);
1429:
1430: errno = save_errno;
1431: }
1.1 djm 1432:
1.10 djm 1433: static int
1.73 markus 1434: mux_client_read(int fd, struct sshbuf *b, size_t need)
1.10 djm 1435: {
1.73 markus 1436: size_t have;
1.10 djm 1437: ssize_t len;
1438: u_char *p;
1439: struct pollfd pfd;
1.73 markus 1440: int r;
1.10 djm 1441:
1442: pfd.fd = fd;
1443: pfd.events = POLLIN;
1.73 markus 1444: if ((r = sshbuf_reserve(b, need, &p)) != 0)
1.85 djm 1445: fatal_fr(r, "reserve");
1.10 djm 1446: for (have = 0; have < need; ) {
1447: if (muxclient_terminate) {
1448: errno = EINTR;
1449: return -1;
1450: }
1451: len = read(fd, p + have, need - have);
1.80 deraadt 1452: if (len == -1) {
1.10 djm 1453: switch (errno) {
1454: case EAGAIN:
1455: (void)poll(&pfd, 1, -1);
1456: /* FALLTHROUGH */
1457: case EINTR:
1458: continue;
1459: default:
1460: return -1;
1461: }
1462: }
1463: if (len == 0) {
1464: errno = EPIPE;
1465: return -1;
1466: }
1.73 markus 1467: have += (size_t)len;
1.1 djm 1468: }
1.10 djm 1469: return 0;
1470: }
1.1 djm 1471:
1.10 djm 1472: static int
1.73 markus 1473: mux_client_write_packet(int fd, struct sshbuf *m)
1.10 djm 1474: {
1.73 markus 1475: struct sshbuf *queue;
1.10 djm 1476: u_int have, need;
1.73 markus 1477: int r, oerrno, len;
1478: const u_char *ptr;
1.10 djm 1479: struct pollfd pfd;
1480:
1481: pfd.fd = fd;
1482: pfd.events = POLLOUT;
1.73 markus 1483: if ((queue = sshbuf_new()) == NULL)
1.85 djm 1484: fatal_f("sshbuf_new");
1.73 markus 1485: if ((r = sshbuf_put_stringb(queue, m)) != 0)
1.85 djm 1486: fatal_fr(r, "enqueue");
1.10 djm 1487:
1.73 markus 1488: need = sshbuf_len(queue);
1489: ptr = sshbuf_ptr(queue);
1.10 djm 1490:
1491: for (have = 0; have < need; ) {
1492: if (muxclient_terminate) {
1.73 markus 1493: sshbuf_free(queue);
1.10 djm 1494: errno = EINTR;
1495: return -1;
1496: }
1497: len = write(fd, ptr + have, need - have);
1.80 deraadt 1498: if (len == -1) {
1.10 djm 1499: switch (errno) {
1500: case EAGAIN:
1501: (void)poll(&pfd, 1, -1);
1502: /* FALLTHROUGH */
1503: case EINTR:
1504: continue;
1505: default:
1506: oerrno = errno;
1.73 markus 1507: sshbuf_free(queue);
1.10 djm 1508: errno = oerrno;
1509: return -1;
1510: }
1511: }
1512: if (len == 0) {
1.73 markus 1513: sshbuf_free(queue);
1.10 djm 1514: errno = EPIPE;
1515: return -1;
1516: }
1517: have += (u_int)len;
1518: }
1.73 markus 1519: sshbuf_free(queue);
1.10 djm 1520: return 0;
1521: }
1.1 djm 1522:
1.10 djm 1523: static int
1.73 markus 1524: mux_client_read_packet(int fd, struct sshbuf *m)
1.10 djm 1525: {
1.73 markus 1526: struct sshbuf *queue;
1527: size_t need, have;
1.45 djm 1528: const u_char *ptr;
1.73 markus 1529: int r, oerrno;
1.10 djm 1530:
1.73 markus 1531: if ((queue = sshbuf_new()) == NULL)
1.85 djm 1532: fatal_f("sshbuf_new");
1.73 markus 1533: if (mux_client_read(fd, queue, 4) != 0) {
1.10 djm 1534: if ((oerrno = errno) == EPIPE)
1.85 djm 1535: debug3_f("read header failed: %s",
1.43 dtucker 1536: strerror(errno));
1.73 markus 1537: sshbuf_free(queue);
1.10 djm 1538: errno = oerrno;
1539: return -1;
1540: }
1.73 markus 1541: need = PEEK_U32(sshbuf_ptr(queue));
1542: if (mux_client_read(fd, queue, need) != 0) {
1.10 djm 1543: oerrno = errno;
1.85 djm 1544: debug3_f("read body failed: %s", strerror(errno));
1.73 markus 1545: sshbuf_free(queue);
1.10 djm 1546: errno = oerrno;
1547: return -1;
1548: }
1.73 markus 1549: if ((r = sshbuf_get_string_direct(queue, &ptr, &have)) != 0 ||
1550: (r = sshbuf_put(m, ptr, have)) != 0)
1.85 djm 1551: fatal_fr(r, "dequeue");
1.73 markus 1552: sshbuf_free(queue);
1.10 djm 1553: return 0;
1554: }
1.1 djm 1555:
1.10 djm 1556: static int
1557: mux_client_hello_exchange(int fd)
1558: {
1.73 markus 1559: struct sshbuf *m;
1.10 djm 1560: u_int type, ver;
1.73 markus 1561: int r, ret = -1;
1.1 djm 1562:
1.73 markus 1563: if ((m = sshbuf_new()) == NULL)
1.85 djm 1564: fatal_f("sshbuf_new");
1.73 markus 1565: if ((r = sshbuf_put_u32(m, MUX_MSG_HELLO)) != 0 ||
1566: (r = sshbuf_put_u32(m, SSHMUX_VER)) != 0)
1.85 djm 1567: fatal_fr(r, "assemble hello");
1.10 djm 1568: /* no extensions */
1569:
1.73 markus 1570: if (mux_client_write_packet(fd, m) != 0) {
1.85 djm 1571: debug_f("write packet: %s", strerror(errno));
1.65 djm 1572: goto out;
1573: }
1.1 djm 1574:
1.73 markus 1575: sshbuf_reset(m);
1.10 djm 1576:
1577: /* Read their HELLO */
1.73 markus 1578: if (mux_client_read_packet(fd, m) != 0) {
1.85 djm 1579: debug_f("read packet failed");
1.65 djm 1580: goto out;
1.10 djm 1581: }
1582:
1.73 markus 1583: if ((r = sshbuf_get_u32(m, &type)) != 0)
1.85 djm 1584: fatal_fr(r, "parse type");
1.65 djm 1585: if (type != MUX_MSG_HELLO) {
1.85 djm 1586: error_f("expected HELLO (%u) got %u", MUX_MSG_HELLO, type);
1.65 djm 1587: goto out;
1588: }
1.73 markus 1589: if ((r = sshbuf_get_u32(m, &ver)) != 0)
1.85 djm 1590: fatal_fr(r, "parse version");
1.65 djm 1591: if (ver != SSHMUX_VER) {
1592: error("Unsupported multiplexing protocol version %d "
1.10 djm 1593: "(expected %d)", ver, SSHMUX_VER);
1.65 djm 1594: goto out;
1595: }
1.85 djm 1596: debug2_f("master version %u", ver);
1.10 djm 1597: /* No extensions are presently defined */
1.73 markus 1598: while (sshbuf_len(m) > 0) {
1599: char *name = NULL;
1.10 djm 1600:
1.73 markus 1601: if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 ||
1602: (r = sshbuf_skip_string(m)) != 0) { /* value */
1.85 djm 1603: error_fr(r, "parse extension");
1.73 markus 1604: goto out;
1605: }
1.10 djm 1606: debug2("Unrecognised master extension \"%s\"", name);
1.41 djm 1607: free(name);
1.5 djm 1608: }
1.65 djm 1609: /* success */
1610: ret = 0;
1611: out:
1.73 markus 1612: sshbuf_free(m);
1.65 djm 1613: return ret;
1.10 djm 1614: }
1615:
1616: static u_int
1617: mux_client_request_alive(int fd)
1618: {
1.73 markus 1619: struct sshbuf *m;
1.10 djm 1620: char *e;
1621: u_int pid, type, rid;
1.73 markus 1622: int r;
1.10 djm 1623:
1.85 djm 1624: debug3_f("entering");
1.10 djm 1625:
1.73 markus 1626: if ((m = sshbuf_new()) == NULL)
1.85 djm 1627: fatal_f("sshbuf_new");
1.73 markus 1628: if ((r = sshbuf_put_u32(m, MUX_C_ALIVE_CHECK)) != 0 ||
1629: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1.85 djm 1630: fatal_fr(r, "assemble");
1.10 djm 1631:
1.73 markus 1632: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 1633: fatal_f("write packet: %s", strerror(errno));
1.10 djm 1634:
1.73 markus 1635: sshbuf_reset(m);
1.1 djm 1636:
1.10 djm 1637: /* Read their reply */
1.73 markus 1638: if (mux_client_read_packet(fd, m) != 0) {
1639: sshbuf_free(m);
1.10 djm 1640: return 0;
1641: }
1642:
1.73 markus 1643: if ((r = sshbuf_get_u32(m, &type)) != 0)
1.85 djm 1644: fatal_fr(r, "parse type");
1.10 djm 1645: if (type != MUX_S_ALIVE) {
1.73 markus 1646: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1647: fatal_fr(r, "parse error message");
1648: fatal_f("master returned error: %s", e);
1.5 djm 1649: }
1.10 djm 1650:
1.73 markus 1651: if ((r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 1652: fatal_fr(r, "parse remote ID");
1.73 markus 1653: if (rid != muxclient_request_id)
1.85 djm 1654: fatal_f("out of sequence reply: my id %u theirs %u",
1655: muxclient_request_id, rid);
1.73 markus 1656: if ((r = sshbuf_get_u32(m, &pid)) != 0)
1.85 djm 1657: fatal_fr(r, "parse PID");
1.73 markus 1658: sshbuf_free(m);
1.10 djm 1659:
1.85 djm 1660: debug3_f("done pid = %u", pid);
1.10 djm 1661:
1662: muxclient_request_id++;
1663:
1664: return pid;
1665: }
1666:
1667: static void
1668: mux_client_request_terminate(int fd)
1669: {
1.73 markus 1670: struct sshbuf *m;
1.10 djm 1671: char *e;
1672: u_int type, rid;
1.73 markus 1673: int r;
1.10 djm 1674:
1.85 djm 1675: debug3_f("entering");
1.10 djm 1676:
1.73 markus 1677: if ((m = sshbuf_new()) == NULL)
1.85 djm 1678: fatal_f("sshbuf_new");
1.73 markus 1679: if ((r = sshbuf_put_u32(m, MUX_C_TERMINATE)) != 0 ||
1680: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1.85 djm 1681: fatal_fr(r, "request");
1.10 djm 1682:
1.73 markus 1683: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 1684: fatal_f("write packet: %s", strerror(errno));
1.1 djm 1685:
1.73 markus 1686: sshbuf_reset(m);
1.1 djm 1687:
1.10 djm 1688: /* Read their reply */
1.73 markus 1689: if (mux_client_read_packet(fd, m) != 0) {
1.10 djm 1690: /* Remote end exited already */
1691: if (errno == EPIPE) {
1.73 markus 1692: sshbuf_free(m);
1.10 djm 1693: return;
1.2 djm 1694: }
1.85 djm 1695: fatal_f("read from master failed: %s", strerror(errno));
1.10 djm 1696: }
1697:
1.73 markus 1698: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1699: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 1700: fatal_fr(r, "parse");
1.73 markus 1701: if (rid != muxclient_request_id)
1.85 djm 1702: fatal_f("out of sequence reply: my id %u theirs %u",
1703: muxclient_request_id, rid);
1.10 djm 1704: switch (type) {
1705: case MUX_S_OK:
1706: break;
1707: case MUX_S_PERMISSION_DENIED:
1.73 markus 1708: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1709: fatal_fr(r, "parse error message");
1.10 djm 1710: fatal("Master refused termination request: %s", e);
1711: case MUX_S_FAILURE:
1.73 markus 1712: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1713: fatal_fr(r, "parse error message");
1714: fatal_f("termination request failed: %s", e);
1.10 djm 1715: default:
1.85 djm 1716: fatal_f("unexpected response from master 0x%08x", type);
1.10 djm 1717: }
1.73 markus 1718: sshbuf_free(m);
1.10 djm 1719: muxclient_request_id++;
1720: }
1721:
1722: static int
1.46 millert 1723: mux_client_forward(int fd, int cancel_flag, u_int ftype, struct Forward *fwd)
1.10 djm 1724: {
1.73 markus 1725: struct sshbuf *m;
1.10 djm 1726: char *e, *fwd_desc;
1.73 markus 1727: const char *lhost, *chost;
1.10 djm 1728: u_int type, rid;
1.73 markus 1729: int r;
1.10 djm 1730:
1731: fwd_desc = format_forward(ftype, fwd);
1.30 djm 1732: debug("Requesting %s %s",
1733: cancel_flag ? "cancellation of" : "forwarding of", fwd_desc);
1.41 djm 1734: free(fwd_desc);
1.10 djm 1735:
1.73 markus 1736: type = cancel_flag ? MUX_C_CLOSE_FWD : MUX_C_OPEN_FWD;
1737: if (fwd->listen_path != NULL)
1738: lhost = fwd->listen_path;
1739: else if (fwd->listen_host == NULL)
1740: lhost = "";
1741: else if (*fwd->listen_host == '\0')
1742: lhost = "*";
1743: else
1744: lhost = fwd->listen_host;
1745:
1746: if (fwd->connect_path != NULL)
1747: chost = fwd->connect_path;
1748: else if (fwd->connect_host == NULL)
1749: chost = "";
1750: else
1751: chost = fwd->connect_host;
1752:
1753: if ((m = sshbuf_new()) == NULL)
1.85 djm 1754: fatal_f("sshbuf_new");
1.73 markus 1755: if ((r = sshbuf_put_u32(m, type)) != 0 ||
1756: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
1757: (r = sshbuf_put_u32(m, ftype)) != 0 ||
1758: (r = sshbuf_put_cstring(m, lhost)) != 0 ||
1759: (r = sshbuf_put_u32(m, fwd->listen_port)) != 0 ||
1760: (r = sshbuf_put_cstring(m, chost)) != 0 ||
1761: (r = sshbuf_put_u32(m, fwd->connect_port)) != 0)
1.85 djm 1762: fatal_fr(r, "request");
1.10 djm 1763:
1.73 markus 1764: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 1765: fatal_f("write packet: %s", strerror(errno));
1.10 djm 1766:
1.73 markus 1767: sshbuf_reset(m);
1.10 djm 1768:
1769: /* Read their reply */
1.73 markus 1770: if (mux_client_read_packet(fd, m) != 0) {
1771: sshbuf_free(m);
1.10 djm 1772: return -1;
1773: }
1774:
1.73 markus 1775: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1776: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 1777: fatal_fr(r, "parse");
1.73 markus 1778: if (rid != muxclient_request_id)
1.85 djm 1779: fatal_f("out of sequence reply: my id %u theirs %u",
1780: muxclient_request_id, rid);
1.73 markus 1781:
1.10 djm 1782: switch (type) {
1783: case MUX_S_OK:
1.1 djm 1784: break;
1.18 markus 1785: case MUX_S_REMOTE_PORT:
1.30 djm 1786: if (cancel_flag)
1.85 djm 1787: fatal_f("got MUX_S_REMOTE_PORT for cancel");
1.73 markus 1788: if ((r = sshbuf_get_u32(m, &fwd->allocated_port)) != 0)
1.85 djm 1789: fatal_fr(r, "parse port");
1.52 djm 1790: verbose("Allocated port %u for remote forward to %s:%d",
1.18 markus 1791: fwd->allocated_port,
1792: fwd->connect_host ? fwd->connect_host : "",
1793: fwd->connect_port);
1794: if (muxclient_command == SSHMUX_COMMAND_FORWARD)
1.55 djm 1795: fprintf(stdout, "%i\n", fwd->allocated_port);
1.18 markus 1796: break;
1.10 djm 1797: case MUX_S_PERMISSION_DENIED:
1.73 markus 1798: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1799: fatal_fr(r, "parse error message");
1.73 markus 1800: sshbuf_free(m);
1.10 djm 1801: error("Master refused forwarding request: %s", e);
1802: return -1;
1803: case MUX_S_FAILURE:
1.73 markus 1804: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1805: fatal_fr(r, "parse error message");
1.73 markus 1806: sshbuf_free(m);
1.85 djm 1807: error_f("forwarding request failed: %s", e);
1.10 djm 1808: return -1;
1.1 djm 1809: default:
1.85 djm 1810: fatal_f("unexpected response from master 0x%08x", type);
1.10 djm 1811: }
1.73 markus 1812: sshbuf_free(m);
1.10 djm 1813:
1814: muxclient_request_id++;
1815: return 0;
1816: }
1817:
1818: static int
1.30 djm 1819: mux_client_forwards(int fd, int cancel_flag)
1.10 djm 1820: {
1.30 djm 1821: int i, ret = 0;
1.10 djm 1822:
1.85 djm 1823: debug3_f("%s forwardings: %d local, %d remote",
1.30 djm 1824: cancel_flag ? "cancel" : "request",
1.10 djm 1825: options.num_local_forwards, options.num_remote_forwards);
1826:
1827: /* XXX ExitOnForwardingFailure */
1828: for (i = 0; i < options.num_local_forwards; i++) {
1.30 djm 1829: if (mux_client_forward(fd, cancel_flag,
1.10 djm 1830: options.local_forwards[i].connect_port == 0 ?
1831: MUX_FWD_DYNAMIC : MUX_FWD_LOCAL,
1832: options.local_forwards + i) != 0)
1.30 djm 1833: ret = -1;
1.10 djm 1834: }
1835: for (i = 0; i < options.num_remote_forwards; i++) {
1.30 djm 1836: if (mux_client_forward(fd, cancel_flag, MUX_FWD_REMOTE,
1.10 djm 1837: options.remote_forwards + i) != 0)
1.30 djm 1838: ret = -1;
1.10 djm 1839: }
1.30 djm 1840: return ret;
1.10 djm 1841: }
1842:
1843: static int
1844: mux_client_request_session(int fd)
1845: {
1.73 markus 1846: struct sshbuf *m;
1847: char *e;
1.89 djm 1848: const char *term = NULL;
1.73 markus 1849: u_int echar, rid, sid, esid, exitval, type, exitval_seen;
1.10 djm 1850: extern char **environ;
1.84 djm 1851: int r, i, rawmode;
1.10 djm 1852:
1.85 djm 1853: debug3_f("entering");
1.10 djm 1854:
1855: if ((muxserver_pid = mux_client_request_alive(fd)) == 0) {
1.85 djm 1856: error_f("master alive request failed");
1.10 djm 1857: return -1;
1.1 djm 1858: }
1859:
1.81 dtucker 1860: ssh_signal(SIGPIPE, SIG_IGN);
1.10 djm 1861:
1.91 ! djm 1862: if (options.stdin_null && stdfd_devnull(1, 0, 0) == -1)
1.85 djm 1863: fatal_f("stdfd_devnull failed");
1.1 djm 1864:
1.89 djm 1865: if ((term = lookup_env_in_list("TERM", options.setenv,
1866: options.num_setenv)) == NULL || *term == '\0')
1867: term = getenv("TERM");
1868:
1.73 markus 1869: echar = 0xffffffff;
1870: if (options.escape_char != SSH_ESCAPECHAR_NONE)
1871: echar = (u_int)options.escape_char;
1872:
1873: if ((m = sshbuf_new()) == NULL)
1.85 djm 1874: fatal_f("sshbuf_new");
1.73 markus 1875: if ((r = sshbuf_put_u32(m, MUX_C_NEW_SESSION)) != 0 ||
1876: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
1877: (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */
1878: (r = sshbuf_put_u32(m, tty_flag)) != 0 ||
1879: (r = sshbuf_put_u32(m, options.forward_x11)) != 0 ||
1880: (r = sshbuf_put_u32(m, options.forward_agent)) != 0 ||
1.90 djm 1881: (r = sshbuf_put_u32(m, options.session_type == SESSION_TYPE_SUBSYSTEM)) != 0 ||
1.73 markus 1882: (r = sshbuf_put_u32(m, echar)) != 0 ||
1.89 djm 1883: (r = sshbuf_put_cstring(m, term == NULL ? "" : term)) != 0 ||
1.73 markus 1884: (r = sshbuf_put_stringb(m, command)) != 0)
1.85 djm 1885: fatal_fr(r, "request");
1.10 djm 1886:
1.71 djm 1887: /* Pass environment */
1.10 djm 1888: if (options.num_send_env > 0 && environ != NULL) {
1889: for (i = 0; environ[i] != NULL; i++) {
1.73 markus 1890: if (!env_permitted(environ[i]))
1891: continue;
1892: if ((r = sshbuf_put_cstring(m, environ[i])) != 0)
1.85 djm 1893: fatal_fr(r, "request sendenv");
1.10 djm 1894: }
1.5 djm 1895: }
1.73 markus 1896: for (i = 0; i < options.num_setenv; i++) {
1897: if ((r = sshbuf_put_cstring(m, options.setenv[i])) != 0)
1.85 djm 1898: fatal_fr(r, "request setenv");
1.73 markus 1899: }
1.5 djm 1900:
1.73 markus 1901: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 1902: fatal_f("write packet: %s", strerror(errno));
1.10 djm 1903:
1904: /* Send the stdio file descriptors */
1905: if (mm_send_fd(fd, STDIN_FILENO) == -1 ||
1906: mm_send_fd(fd, STDOUT_FILENO) == -1 ||
1907: mm_send_fd(fd, STDERR_FILENO) == -1)
1.85 djm 1908: fatal_f("send fds failed");
1.10 djm 1909:
1.85 djm 1910: debug3_f("session request sent");
1.1 djm 1911:
1.10 djm 1912: /* Read their reply */
1.73 markus 1913: sshbuf_reset(m);
1914: if (mux_client_read_packet(fd, m) != 0) {
1.85 djm 1915: error_f("read from master failed: %s", strerror(errno));
1.73 markus 1916: sshbuf_free(m);
1.10 djm 1917: return -1;
1918: }
1919:
1.73 markus 1920: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1921: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 1922: fatal_fr(r, "parse");
1.73 markus 1923: if (rid != muxclient_request_id)
1.85 djm 1924: fatal_f("out of sequence reply: my id %u theirs %u",
1925: muxclient_request_id, rid);
1.73 markus 1926:
1.10 djm 1927: switch (type) {
1928: case MUX_S_SESSION_OPENED:
1.73 markus 1929: if ((r = sshbuf_get_u32(m, &sid)) != 0)
1.85 djm 1930: fatal_fr(r, "parse session ID");
1931: debug_f("master session id: %u", sid);
1.10 djm 1932: break;
1933: case MUX_S_PERMISSION_DENIED:
1.73 markus 1934: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1935: fatal_fr(r, "parse error message");
1.24 djm 1936: error("Master refused session request: %s", e);
1.73 markus 1937: sshbuf_free(m);
1.10 djm 1938: return -1;
1939: case MUX_S_FAILURE:
1.73 markus 1940: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1941: fatal_fr(r, "parse error message");
1942: error_f("session request failed: %s", e);
1.73 markus 1943: sshbuf_free(m);
1.10 djm 1944: return -1;
1945: default:
1.73 markus 1946: sshbuf_free(m);
1.85 djm 1947: error_f("unexpected response from master 0x%08x", type);
1.10 djm 1948: return -1;
1949: }
1950: muxclient_request_id++;
1.1 djm 1951:
1.57 semarie 1952: if (pledge("stdio proc tty", NULL) == -1)
1.85 djm 1953: fatal_f("pledge(): %s", strerror(errno));
1.57 semarie 1954:
1.81 dtucker 1955: ssh_signal(SIGHUP, control_client_sighandler);
1956: ssh_signal(SIGINT, control_client_sighandler);
1957: ssh_signal(SIGTERM, control_client_sighandler);
1958: ssh_signal(SIGWINCH, control_client_sigrelay);
1.1 djm 1959:
1.28 djm 1960: rawmode = tty_flag;
1.1 djm 1961: if (tty_flag)
1.27 djm 1962: enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
1.1 djm 1963:
1964: /*
1965: * Stick around until the controlee closes the client_fd.
1.10 djm 1966: * Before it does, it is expected to write an exit message.
1967: * This process must read the value and wait for the closure of
1968: * the client_fd; if this one closes early, the multiplex master will
1969: * terminate early too (possibly losing data).
1.1 djm 1970: */
1.10 djm 1971: for (exitval = 255, exitval_seen = 0;;) {
1.73 markus 1972: sshbuf_reset(m);
1973: if (mux_client_read_packet(fd, m) != 0)
1.1 djm 1974: break;
1.73 markus 1975: if ((r = sshbuf_get_u32(m, &type)) != 0)
1.85 djm 1976: fatal_fr(r, "parse type");
1.28 djm 1977: switch (type) {
1978: case MUX_S_TTY_ALLOC_FAIL:
1.73 markus 1979: if ((r = sshbuf_get_u32(m, &esid)) != 0)
1.85 djm 1980: fatal_fr(r, "parse session ID");
1.73 markus 1981: if (esid != sid)
1.85 djm 1982: fatal_f("tty alloc fail on unknown session: "
1983: "my id %u theirs %u", sid, esid);
1.28 djm 1984: leave_raw_mode(options.request_tty ==
1985: REQUEST_TTY_FORCE);
1986: rawmode = 0;
1987: continue;
1988: case MUX_S_EXIT_MESSAGE:
1.73 markus 1989: if ((r = sshbuf_get_u32(m, &esid)) != 0)
1.85 djm 1990: fatal_fr(r, "parse session ID");
1.73 markus 1991: if (esid != sid)
1.85 djm 1992: fatal_f("exit on unknown session: "
1993: "my id %u theirs %u", sid, esid);
1.28 djm 1994: if (exitval_seen)
1.85 djm 1995: fatal_f("exitval sent twice");
1.73 markus 1996: if ((r = sshbuf_get_u32(m, &exitval)) != 0)
1.85 djm 1997: fatal_fr(r, "parse exitval");
1.28 djm 1998: exitval_seen = 1;
1999: continue;
2000: default:
1.73 markus 2001: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2002: fatal_fr(r, "parse error message");
2003: fatal_f("master returned error: %s", e);
1.1 djm 2004: }
2005: }
2006:
1.10 djm 2007: close(fd);
1.28 djm 2008: if (rawmode)
2009: leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
1.10 djm 2010:
1.1 djm 2011: if (muxclient_terminate) {
1.69 dtucker 2012: debug2("Exiting on signal: %s", strsignal(muxclient_terminate));
1.10 djm 2013: exitval = 255;
2014: } else if (!exitval_seen) {
1.1 djm 2015: debug2("Control master terminated unexpectedly");
1.10 djm 2016: exitval = 255;
1.1 djm 2017: } else
1.10 djm 2018: debug2("Received exit status from master %d", exitval);
1.1 djm 2019:
2020: if (tty_flag && options.log_level != SYSLOG_LEVEL_QUIET)
2021: fprintf(stderr, "Shared connection to %s closed.\r\n", host);
2022:
1.10 djm 2023: exit(exitval);
2024: }
2025:
2026: static int
1.62 markus 2027: mux_client_proxy(int fd)
2028: {
1.73 markus 2029: struct sshbuf *m;
1.62 markus 2030: char *e;
2031: u_int type, rid;
1.73 markus 2032: int r;
1.62 markus 2033:
1.73 markus 2034: if ((m = sshbuf_new()) == NULL)
1.85 djm 2035: fatal_f("sshbuf_new");
1.73 markus 2036: if ((r = sshbuf_put_u32(m, MUX_C_PROXY)) != 0 ||
2037: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1.85 djm 2038: fatal_fr(r, "request");
1.73 markus 2039: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 2040: fatal_f("write packet: %s", strerror(errno));
1.62 markus 2041:
1.73 markus 2042: sshbuf_reset(m);
1.62 markus 2043:
2044: /* Read their reply */
1.73 markus 2045: if (mux_client_read_packet(fd, m) != 0) {
2046: sshbuf_free(m);
1.62 markus 2047: return 0;
2048: }
1.73 markus 2049: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2050: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 2051: fatal_fr(r, "parse");
1.73 markus 2052: if (rid != muxclient_request_id)
1.85 djm 2053: fatal_f("out of sequence reply: my id %u theirs %u",
2054: muxclient_request_id, rid);
1.62 markus 2055: if (type != MUX_S_PROXY) {
1.73 markus 2056: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2057: fatal_fr(r, "parse error message");
2058: fatal_f("master returned error: %s", e);
1.62 markus 2059: }
1.73 markus 2060: sshbuf_free(m);
1.62 markus 2061:
1.85 djm 2062: debug3_f("done");
1.62 markus 2063: muxclient_request_id++;
2064: return 0;
2065: }
2066:
2067: static int
1.10 djm 2068: mux_client_request_stdio_fwd(int fd)
2069: {
1.73 markus 2070: struct sshbuf *m;
1.10 djm 2071: char *e;
2072: u_int type, rid, sid;
1.84 djm 2073: int r;
1.10 djm 2074:
1.85 djm 2075: debug3_f("entering");
1.10 djm 2076:
2077: if ((muxserver_pid = mux_client_request_alive(fd)) == 0) {
1.85 djm 2078: error_f("master alive request failed");
1.10 djm 2079: return -1;
2080: }
2081:
1.81 dtucker 2082: ssh_signal(SIGPIPE, SIG_IGN);
1.10 djm 2083:
1.91 ! djm 2084: if (options.stdin_null && stdfd_devnull(1, 0, 0) == -1)
1.85 djm 2085: fatal_f("stdfd_devnull failed");
1.10 djm 2086:
1.73 markus 2087: if ((m = sshbuf_new()) == NULL)
1.85 djm 2088: fatal_f("sshbuf_new");
1.73 markus 2089: if ((r = sshbuf_put_u32(m, MUX_C_NEW_STDIO_FWD)) != 0 ||
2090: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
2091: (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */
2092: (r = sshbuf_put_cstring(m, options.stdio_forward_host)) != 0 ||
2093: (r = sshbuf_put_u32(m, options.stdio_forward_port)) != 0)
1.85 djm 2094: fatal_fr(r, "request");
1.10 djm 2095:
1.73 markus 2096: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 2097: fatal_f("write packet: %s", strerror(errno));
1.10 djm 2098:
2099: /* Send the stdio file descriptors */
2100: if (mm_send_fd(fd, STDIN_FILENO) == -1 ||
2101: mm_send_fd(fd, STDOUT_FILENO) == -1)
1.85 djm 2102: fatal_f("send fds failed");
1.10 djm 2103:
1.56 semarie 2104: if (pledge("stdio proc tty", NULL) == -1)
1.85 djm 2105: fatal_f("pledge(): %s", strerror(errno));
1.56 semarie 2106:
1.85 djm 2107: debug3_f("stdio forward request sent");
1.10 djm 2108:
2109: /* Read their reply */
1.73 markus 2110: sshbuf_reset(m);
1.10 djm 2111:
1.73 markus 2112: if (mux_client_read_packet(fd, m) != 0) {
1.85 djm 2113: error_f("read from master failed: %s", strerror(errno));
1.73 markus 2114: sshbuf_free(m);
1.10 djm 2115: return -1;
2116: }
2117:
1.73 markus 2118: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2119: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 2120: fatal_fr(r, "parse");
1.73 markus 2121: if (rid != muxclient_request_id)
1.85 djm 2122: fatal_f("out of sequence reply: my id %u theirs %u",
2123: muxclient_request_id, rid);
1.10 djm 2124: switch (type) {
2125: case MUX_S_SESSION_OPENED:
1.73 markus 2126: if ((r = sshbuf_get_u32(m, &sid)) != 0)
1.85 djm 2127: fatal_fr(r, "parse session ID");
2128: debug_f("master session id: %u", sid);
1.10 djm 2129: break;
2130: case MUX_S_PERMISSION_DENIED:
1.73 markus 2131: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2132: fatal_fr(r, "parse error message");
1.73 markus 2133: sshbuf_free(m);
1.24 djm 2134: fatal("Master refused stdio forwarding request: %s", e);
1.10 djm 2135: case MUX_S_FAILURE:
1.73 markus 2136: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2137: fatal_fr(r, "parse error message");
1.73 markus 2138: sshbuf_free(m);
1.48 djm 2139: fatal("Stdio forwarding request failed: %s", e);
1.10 djm 2140: default:
1.73 markus 2141: sshbuf_free(m);
1.85 djm 2142: error_f("unexpected response from master 0x%08x", type);
1.10 djm 2143: return -1;
2144: }
2145: muxclient_request_id++;
2146:
1.81 dtucker 2147: ssh_signal(SIGHUP, control_client_sighandler);
2148: ssh_signal(SIGINT, control_client_sighandler);
2149: ssh_signal(SIGTERM, control_client_sighandler);
2150: ssh_signal(SIGWINCH, control_client_sigrelay);
1.10 djm 2151:
2152: /*
2153: * Stick around until the controlee closes the client_fd.
2154: */
1.73 markus 2155: sshbuf_reset(m);
2156: if (mux_client_read_packet(fd, m) != 0) {
1.10 djm 2157: if (errno == EPIPE ||
2158: (errno == EINTR && muxclient_terminate != 0))
2159: return 0;
1.85 djm 2160: fatal_f("mux_client_read_packet: %s", strerror(errno));
1.10 djm 2161: }
1.85 djm 2162: fatal_f("master returned unexpected message %u", type);
1.10 djm 2163: }
2164:
1.25 djm 2165: static void
2166: mux_client_request_stop_listening(int fd)
2167: {
1.73 markus 2168: struct sshbuf *m;
1.25 djm 2169: char *e;
2170: u_int type, rid;
1.73 markus 2171: int r;
1.25 djm 2172:
1.85 djm 2173: debug3_f("entering");
1.25 djm 2174:
1.73 markus 2175: if ((m = sshbuf_new()) == NULL)
1.85 djm 2176: fatal_f("sshbuf_new");
1.73 markus 2177: if ((r = sshbuf_put_u32(m, MUX_C_STOP_LISTENING)) != 0 ||
2178: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1.85 djm 2179: fatal_fr(r, "request");
1.25 djm 2180:
1.73 markus 2181: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 2182: fatal_f("write packet: %s", strerror(errno));
1.25 djm 2183:
1.73 markus 2184: sshbuf_reset(m);
1.25 djm 2185:
2186: /* Read their reply */
1.73 markus 2187: if (mux_client_read_packet(fd, m) != 0)
1.85 djm 2188: fatal_f("read from master failed: %s", strerror(errno));
1.25 djm 2189:
1.73 markus 2190: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2191: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 2192: fatal_fr(r, "parse");
1.73 markus 2193: if (rid != muxclient_request_id)
1.85 djm 2194: fatal_f("out of sequence reply: my id %u theirs %u",
2195: muxclient_request_id, rid);
1.73 markus 2196:
1.25 djm 2197: switch (type) {
2198: case MUX_S_OK:
2199: break;
2200: case MUX_S_PERMISSION_DENIED:
1.73 markus 2201: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2202: fatal_fr(r, "parse error message");
1.25 djm 2203: fatal("Master refused stop listening request: %s", e);
2204: case MUX_S_FAILURE:
1.73 markus 2205: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2206: fatal_fr(r, "parse error message");
2207: fatal_f("stop listening request failed: %s", e);
1.25 djm 2208: default:
1.85 djm 2209: fatal_f("unexpected response from master 0x%08x", type);
1.25 djm 2210: }
1.73 markus 2211: sshbuf_free(m);
1.25 djm 2212: muxclient_request_id++;
2213: }
2214:
1.10 djm 2215: /* Multiplex client main loop. */
1.62 markus 2216: int
1.10 djm 2217: muxclient(const char *path)
2218: {
2219: struct sockaddr_un addr;
2220: int sock;
2221: u_int pid;
2222:
2223: if (muxclient_command == 0) {
1.60 dtucker 2224: if (options.stdio_forward_host != NULL)
1.10 djm 2225: muxclient_command = SSHMUX_COMMAND_STDIO_FWD;
2226: else
2227: muxclient_command = SSHMUX_COMMAND_OPEN;
2228: }
2229:
2230: switch (options.control_master) {
2231: case SSHCTL_MASTER_AUTO:
2232: case SSHCTL_MASTER_AUTO_ASK:
2233: debug("auto-mux: Trying existing master");
2234: /* FALLTHROUGH */
2235: case SSHCTL_MASTER_NO:
2236: break;
2237: default:
1.62 markus 2238: return -1;
1.10 djm 2239: }
2240:
2241: memset(&addr, '\0', sizeof(addr));
2242: addr.sun_family = AF_UNIX;
2243:
2244: if (strlcpy(addr.sun_path, path,
2245: sizeof(addr.sun_path)) >= sizeof(addr.sun_path))
1.61 dtucker 2246: fatal("ControlPath too long ('%s' >= %u bytes)", path,
1.87 djm 2247: (unsigned int)sizeof(addr.sun_path));
1.10 djm 2248:
1.80 deraadt 2249: if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
1.85 djm 2250: fatal_f("socket(): %s", strerror(errno));
1.10 djm 2251:
1.64 guenther 2252: if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
1.10 djm 2253: switch (muxclient_command) {
2254: case SSHMUX_COMMAND_OPEN:
2255: case SSHMUX_COMMAND_STDIO_FWD:
2256: break;
2257: default:
2258: fatal("Control socket connect(%.100s): %s", path,
2259: strerror(errno));
2260: }
1.22 djm 2261: if (errno == ECONNREFUSED &&
2262: options.control_master != SSHCTL_MASTER_NO) {
2263: debug("Stale control socket %.100s, unlinking", path);
2264: unlink(path);
2265: } else if (errno == ENOENT) {
1.10 djm 2266: debug("Control socket \"%.100s\" does not exist", path);
1.22 djm 2267: } else {
1.10 djm 2268: error("Control socket connect(%.100s): %s", path,
2269: strerror(errno));
2270: }
2271: close(sock);
1.62 markus 2272: return -1;
1.10 djm 2273: }
2274: set_nonblock(sock);
2275:
2276: if (mux_client_hello_exchange(sock) != 0) {
1.85 djm 2277: error_f("master hello exchange failed");
1.10 djm 2278: close(sock);
1.62 markus 2279: return -1;
1.10 djm 2280: }
2281:
2282: switch (muxclient_command) {
2283: case SSHMUX_COMMAND_ALIVE_CHECK:
2284: if ((pid = mux_client_request_alive(sock)) == 0)
1.85 djm 2285: fatal_f("master alive check failed");
1.55 djm 2286: fprintf(stderr, "Master running (pid=%u)\r\n", pid);
1.10 djm 2287: exit(0);
2288: case SSHMUX_COMMAND_TERMINATE:
2289: mux_client_request_terminate(sock);
1.63 dtucker 2290: if (options.log_level != SYSLOG_LEVEL_QUIET)
2291: fprintf(stderr, "Exit request sent.\r\n");
1.18 markus 2292: exit(0);
2293: case SSHMUX_COMMAND_FORWARD:
1.30 djm 2294: if (mux_client_forwards(sock, 0) != 0)
1.85 djm 2295: fatal_f("master forward request failed");
1.10 djm 2296: exit(0);
2297: case SSHMUX_COMMAND_OPEN:
1.30 djm 2298: if (mux_client_forwards(sock, 0) != 0) {
1.85 djm 2299: error_f("master forward request failed");
1.62 markus 2300: return -1;
1.10 djm 2301: }
2302: mux_client_request_session(sock);
1.62 markus 2303: return -1;
1.10 djm 2304: case SSHMUX_COMMAND_STDIO_FWD:
2305: mux_client_request_stdio_fwd(sock);
1.25 djm 2306: exit(0);
2307: case SSHMUX_COMMAND_STOP:
2308: mux_client_request_stop_listening(sock);
1.63 dtucker 2309: if (options.log_level != SYSLOG_LEVEL_QUIET)
2310: fprintf(stderr, "Stop listening request sent.\r\n");
1.30 djm 2311: exit(0);
2312: case SSHMUX_COMMAND_CANCEL_FWD:
2313: if (mux_client_forwards(sock, 1) != 0)
1.85 djm 2314: error_f("master cancel forward request failed");
1.10 djm 2315: exit(0);
1.62 markus 2316: case SSHMUX_COMMAND_PROXY:
2317: mux_client_proxy(sock);
2318: return (sock);
1.10 djm 2319: default:
2320: fatal("unrecognised muxclient_command %d", muxclient_command);
2321: }
1.1 djm 2322: }
![[BACK]](/icons/back.gif){kind=icon}
Return to mux.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh