Annotation of src/usr.bin/ssh/mux.c, Revision 1.96
1.96 ! guenther 1: /* $OpenBSD: mux.c,v 1.95 2023/01/06 02:39:59 djm Exp $ */
1.1 djm 2: /*
3: * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
4: *
5: * Permission to use, copy, modify, and distribute this software for any
6: * purpose with or without fee is hereby granted, provided that the above
7: * copyright notice and this permission notice appear in all copies.
8: *
9: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16: */
17:
18: /* ssh session multiplexing support */
1.2 djm 19:
1.1 djm 20: #include <sys/types.h>
21: #include <sys/queue.h>
22: #include <sys/stat.h>
23: #include <sys/socket.h>
24: #include <sys/un.h>
25:
26: #include <errno.h>
27: #include <fcntl.h>
1.10 djm 28: #include <poll.h>
1.1 djm 29: #include <signal.h>
30: #include <stdarg.h>
31: #include <stddef.h>
32: #include <stdlib.h>
33: #include <stdio.h>
34: #include <string.h>
35: #include <unistd.h>
36: #include <util.h>
37: #include <paths.h>
38:
1.10 djm 39: #include "atomicio.h"
1.1 djm 40: #include "xmalloc.h"
41: #include "log.h"
42: #include "ssh.h"
1.18 markus 43: #include "ssh2.h"
1.1 djm 44: #include "pathnames.h"
45: #include "misc.h"
46: #include "match.h"
1.73 markus 47: #include "sshbuf.h"
1.1 djm 48: #include "channels.h"
49: #include "msg.h"
50: #include "packet.h"
51: #include "monitor_fdpass.h"
52: #include "sshpty.h"
1.74 markus 53: #include "sshkey.h"
1.1 djm 54: #include "readconf.h"
55: #include "clientloop.h"
1.62 markus 56: #include "ssherr.h"
1.78 djm 57:
1.1 djm 58: /* from ssh.c */
59: extern int tty_flag;
60: extern Options options;
61: extern char *host;
1.72 markus 62: extern struct sshbuf *command;
1.10 djm 63: extern volatile sig_atomic_t quit_pending;
1.1 djm 64:
1.2 djm 65: /* Context for session open confirmation callback */
66: struct mux_session_confirm_ctx {
1.10 djm 67: u_int want_tty;
68: u_int want_subsys;
69: u_int want_x_fwd;
70: u_int want_agent_fwd;
1.73 markus 71: struct sshbuf *cmd;
1.2 djm 72: char *term;
73: struct termios tio;
74: char **env;
1.17 djm 75: u_int rid;
1.2 djm 76: };
77:
1.48 djm 78: /* Context for stdio fwd open confirmation callback */
79: struct mux_stdio_confirm_ctx {
80: u_int rid;
81: };
82:
1.18 markus 83: /* Context for global channel callback */
84: struct mux_channel_confirm_ctx {
85: u_int cid; /* channel id */
86: u_int rid; /* request id */
87: int fid; /* forward id */
88: };
89:
1.1 djm 90: /* fd to control socket */
91: int muxserver_sock = -1;
92:
1.10 djm 93: /* client request id */
94: u_int muxclient_request_id = 0;
95:
1.1 djm 96: /* Multiplexing control command */
97: u_int muxclient_command = 0;
98:
99: /* Set when signalled. */
100: static volatile sig_atomic_t muxclient_terminate = 0;
101:
102: /* PID of multiplex server */
103: static u_int muxserver_pid = 0;
104:
1.10 djm 105: static Channel *mux_listener_channel = NULL;
106:
107: struct mux_master_state {
108: int hello_rcvd;
109: };
1.1 djm 110:
1.10 djm 111: /* mux protocol messages */
112: #define MUX_MSG_HELLO 0x00000001
113: #define MUX_C_NEW_SESSION 0x10000002
114: #define MUX_C_ALIVE_CHECK 0x10000004
115: #define MUX_C_TERMINATE 0x10000005
116: #define MUX_C_OPEN_FWD 0x10000006
117: #define MUX_C_CLOSE_FWD 0x10000007
118: #define MUX_C_NEW_STDIO_FWD 0x10000008
1.25 djm 119: #define MUX_C_STOP_LISTENING 0x10000009
1.62 markus 120: #define MUX_C_PROXY 0x1000000f
1.10 djm 121: #define MUX_S_OK 0x80000001
122: #define MUX_S_PERMISSION_DENIED 0x80000002
123: #define MUX_S_FAILURE 0x80000003
124: #define MUX_S_EXIT_MESSAGE 0x80000004
125: #define MUX_S_ALIVE 0x80000005
126: #define MUX_S_SESSION_OPENED 0x80000006
1.18 markus 127: #define MUX_S_REMOTE_PORT 0x80000007
1.28 djm 128: #define MUX_S_TTY_ALLOC_FAIL 0x80000008
1.62 markus 129: #define MUX_S_PROXY 0x8000000f
1.10 djm 130:
131: /* type codes for MUX_C_OPEN_FWD and MUX_C_CLOSE_FWD */
132: #define MUX_FWD_LOCAL 1
133: #define MUX_FWD_REMOTE 2
134: #define MUX_FWD_DYNAMIC 3
135:
1.66 djm 136: static void mux_session_confirm(struct ssh *, int, int, void *);
137: static void mux_stdio_confirm(struct ssh *, int, int, void *);
1.10 djm 138:
1.76 djm 139: static int mux_master_process_hello(struct ssh *, u_int,
1.66 djm 140: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 141: static int mux_master_process_new_session(struct ssh *, u_int,
1.66 djm 142: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 143: static int mux_master_process_alive_check(struct ssh *, u_int,
1.66 djm 144: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 145: static int mux_master_process_terminate(struct ssh *, u_int,
1.66 djm 146: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 147: static int mux_master_process_open_fwd(struct ssh *, u_int,
1.66 djm 148: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 149: static int mux_master_process_close_fwd(struct ssh *, u_int,
1.66 djm 150: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 151: static int mux_master_process_stdio_fwd(struct ssh *, u_int,
1.66 djm 152: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 153: static int mux_master_process_stop_listening(struct ssh *, u_int,
1.66 djm 154: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 155: static int mux_master_process_proxy(struct ssh *, u_int,
1.66 djm 156: Channel *, struct sshbuf *, struct sshbuf *);
1.10 djm 157:
158: static const struct {
159: u_int type;
1.66 djm 160: int (*handler)(struct ssh *, u_int, Channel *,
161: struct sshbuf *, struct sshbuf *);
1.10 djm 162: } mux_master_handlers[] = {
1.76 djm 163: { MUX_MSG_HELLO, mux_master_process_hello },
164: { MUX_C_NEW_SESSION, mux_master_process_new_session },
165: { MUX_C_ALIVE_CHECK, mux_master_process_alive_check },
166: { MUX_C_TERMINATE, mux_master_process_terminate },
167: { MUX_C_OPEN_FWD, mux_master_process_open_fwd },
168: { MUX_C_CLOSE_FWD, mux_master_process_close_fwd },
169: { MUX_C_NEW_STDIO_FWD, mux_master_process_stdio_fwd },
170: { MUX_C_STOP_LISTENING, mux_master_process_stop_listening },
171: { MUX_C_PROXY, mux_master_process_proxy },
1.10 djm 172: { 0, NULL }
173: };
1.1 djm 174:
1.83 djm 175: /* Cleanup callback fired on closure of mux client _session_ channel */
1.42 dtucker 176: static void
1.95 djm 177: mux_master_session_cleanup_cb(struct ssh *ssh, int cid, int force, void *unused)
1.1 djm 178: {
1.66 djm 179: Channel *cc, *c = channel_by_id(ssh, cid);
1.1 djm 180:
1.85 djm 181: debug3_f("entering for channel %d", cid);
1.10 djm 182: if (c == NULL)
1.85 djm 183: fatal_f("channel_by_id(%i) == NULL", cid);
1.10 djm 184: if (c->ctl_chan != -1) {
1.66 djm 185: if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 186: fatal_f("channel %d missing control channel %d",
187: c->self, c->ctl_chan);
1.10 djm 188: c->ctl_chan = -1;
1.67 djm 189: cc->remote_id = 0;
190: cc->have_remote_id = 0;
1.66 djm 191: chan_rcvd_oclose(ssh, cc);
1.1 djm 192: }
1.66 djm 193: channel_cancel_cleanup(ssh, c->self);
1.1 djm 194: }
195:
1.83 djm 196: /* Cleanup callback fired on closure of mux client _control_ channel */
1.1 djm 197: static void
1.95 djm 198: mux_master_control_cleanup_cb(struct ssh *ssh, int cid, int force, void *unused)
1.1 djm 199: {
1.66 djm 200: Channel *sc, *c = channel_by_id(ssh, cid);
1.1 djm 201:
1.85 djm 202: debug3_f("entering for channel %d", cid);
1.10 djm 203: if (c == NULL)
1.85 djm 204: fatal_f("channel_by_id(%i) == NULL", cid);
1.67 djm 205: if (c->have_remote_id) {
1.66 djm 206: if ((sc = channel_by_id(ssh, c->remote_id)) == NULL)
1.85 djm 207: fatal_f("channel %d missing session channel %u",
208: c->self, c->remote_id);
1.67 djm 209: c->remote_id = 0;
210: c->have_remote_id = 0;
1.10 djm 211: sc->ctl_chan = -1;
1.39 djm 212: if (sc->type != SSH_CHANNEL_OPEN &&
213: sc->type != SSH_CHANNEL_OPENING) {
1.85 djm 214: debug2_f("channel %d: not open", sc->self);
1.66 djm 215: chan_mark_dead(ssh, sc);
1.12 djm 216: } else {
1.14 djm 217: if (sc->istate == CHAN_INPUT_OPEN)
1.66 djm 218: chan_read_failed(ssh, sc);
1.14 djm 219: if (sc->ostate == CHAN_OUTPUT_OPEN)
1.66 djm 220: chan_write_failed(ssh, sc);
1.12 djm 221: }
1.1 djm 222: }
1.66 djm 223: channel_cancel_cleanup(ssh, c->self);
1.1 djm 224: }
225:
1.10 djm 226: /* Check mux client environment variables before passing them to mux master. */
227: static int
1.93 djm 228: env_permitted(const char *env)
1.1 djm 229: {
1.94 djm 230: u_int i;
231: int ret;
1.10 djm 232: char name[1024], *cp;
1.1 djm 233:
1.10 djm 234: if ((cp = strchr(env, '=')) == NULL || cp == env)
1.1 djm 235: return 0;
1.10 djm 236: ret = snprintf(name, sizeof(name), "%.*s", (int)(cp - env), env);
237: if (ret <= 0 || (size_t)ret >= sizeof(name)) {
1.85 djm 238: error_f("name '%.100s...' too long", env);
1.1 djm 239: return 0;
240: }
241:
1.10 djm 242: for (i = 0; i < options.num_send_env; i++)
243: if (match_pattern(name, options.send_env[i]))
244: return 1;
1.1 djm 245:
1.10 djm 246: return 0;
247: }
1.1 djm 248:
1.10 djm 249: /* Mux master protocol message handlers */
1.1 djm 250:
1.10 djm 251: static int
1.76 djm 252: mux_master_process_hello(struct ssh *ssh, u_int rid,
1.73 markus 253: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 254: {
255: u_int ver;
256: struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx;
1.73 markus 257: int r;
1.1 djm 258:
1.10 djm 259: if (state == NULL)
1.85 djm 260: fatal_f("channel %d: c->mux_ctx == NULL", c->self);
1.10 djm 261: if (state->hello_rcvd) {
1.85 djm 262: error_f("HELLO received twice");
1.10 djm 263: return -1;
264: }
1.73 markus 265: if ((r = sshbuf_get_u32(m, &ver)) != 0) {
1.85 djm 266: error_fr(r, "parse");
1.10 djm 267: return -1;
268: }
269: if (ver != SSHMUX_VER) {
1.85 djm 270: error_f("unsupported multiplexing protocol version %u "
271: "(expected %u)", ver, SSHMUX_VER);
1.10 djm 272: return -1;
273: }
1.85 djm 274: debug2_f("channel %d client version %u", c->self, ver);
1.10 djm 275:
276: /* No extensions are presently defined */
1.73 markus 277: while (sshbuf_len(m) > 0) {
278: char *name = NULL;
1.76 djm 279: size_t value_len = 0;
1.73 markus 280:
281: if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 ||
1.76 djm 282: (r = sshbuf_get_string_direct(m, NULL, &value_len)) != 0) {
1.85 djm 283: error_fr(r, "parse extension");
1.73 markus 284: return -1;
1.1 djm 285: }
1.85 djm 286: debug2_f("Unrecognised extension \"%s\" length %zu",
287: name, value_len);
1.41 djm 288: free(name);
1.1 djm 289: }
1.10 djm 290: state->hello_rcvd = 1;
291: return 0;
292: }
293:
1.73 markus 294: /* Enqueue a "ok" response to the reply buffer */
295: static void
296: reply_ok(struct sshbuf *reply, u_int rid)
297: {
298: int r;
299:
300: if ((r = sshbuf_put_u32(reply, MUX_S_OK)) != 0 ||
301: (r = sshbuf_put_u32(reply, rid)) != 0)
1.85 djm 302: fatal_fr(r, "reply");
1.73 markus 303: }
304:
305: /* Enqueue an error response to the reply buffer */
306: static void
307: reply_error(struct sshbuf *reply, u_int type, u_int rid, const char *msg)
308: {
309: int r;
310:
311: if ((r = sshbuf_put_u32(reply, type)) != 0 ||
312: (r = sshbuf_put_u32(reply, rid)) != 0 ||
313: (r = sshbuf_put_cstring(reply, msg)) != 0)
1.85 djm 314: fatal_fr(r, "reply");
1.73 markus 315: }
316:
1.10 djm 317: static int
1.76 djm 318: mux_master_process_new_session(struct ssh *ssh, u_int rid,
1.73 markus 319: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 320: {
321: Channel *nc;
322: struct mux_session_confirm_ctx *cctx;
1.73 markus 323: char *cmd, *cp;
324: u_int i, j, env_len, escape_char, window, packetmax;
325: int r, new_fd[3];
1.1 djm 326:
327: /* Reply for SSHMUX_COMMAND_OPEN */
1.10 djm 328: cctx = xcalloc(1, sizeof(*cctx));
329: cctx->term = NULL;
1.17 djm 330: cctx->rid = rid;
1.73 markus 331: cmd = NULL;
1.36 djm 332: cctx->env = NULL;
333: env_len = 0;
1.73 markus 334: if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */
335: (r = sshbuf_get_u32(m, &cctx->want_tty)) != 0 ||
336: (r = sshbuf_get_u32(m, &cctx->want_x_fwd)) != 0 ||
337: (r = sshbuf_get_u32(m, &cctx->want_agent_fwd)) != 0 ||
338: (r = sshbuf_get_u32(m, &cctx->want_subsys)) != 0 ||
339: (r = sshbuf_get_u32(m, &escape_char)) != 0 ||
340: (r = sshbuf_get_cstring(m, &cctx->term, NULL)) != 0 ||
341: (r = sshbuf_get_cstring(m, &cmd, NULL)) != 0) {
1.10 djm 342: malf:
1.41 djm 343: free(cmd);
1.36 djm 344: for (j = 0; j < env_len; j++)
1.41 djm 345: free(cctx->env[j]);
346: free(cctx->env);
347: free(cctx->term);
348: free(cctx);
1.85 djm 349: error_f("malformed message");
1.10 djm 350: return -1;
1.1 djm 351: }
352:
1.10 djm 353: #define MUX_MAX_ENV_VARS 4096
1.73 markus 354: while (sshbuf_len(m) > 0) {
355: if ((r = sshbuf_get_cstring(m, &cp, NULL)) != 0)
1.10 djm 356: goto malf;
357: if (!env_permitted(cp)) {
1.41 djm 358: free(cp);
1.10 djm 359: continue;
360: }
1.51 deraadt 361: cctx->env = xreallocarray(cctx->env, env_len + 2,
1.10 djm 362: sizeof(*cctx->env));
363: cctx->env[env_len++] = cp;
364: cctx->env[env_len] = NULL;
365: if (env_len > MUX_MAX_ENV_VARS) {
1.85 djm 366: error_f(">%d environment variables received, "
367: "ignoring additional", MUX_MAX_ENV_VARS);
1.10 djm 368: break;
369: }
1.1 djm 370: }
371:
1.85 djm 372: debug2_f("channel %d: request tty %d, X %d, agent %d, subsys %d, "
373: "term \"%s\", cmd \"%s\", env %u", c->self,
1.10 djm 374: cctx->want_tty, cctx->want_x_fwd, cctx->want_agent_fwd,
375: cctx->want_subsys, cctx->term, cmd, env_len);
1.1 djm 376:
1.73 markus 377: if ((cctx->cmd = sshbuf_new()) == NULL)
1.85 djm 378: fatal_f("sshbuf_new");
1.73 markus 379: if ((r = sshbuf_put(cctx->cmd, cmd, strlen(cmd))) != 0)
1.85 djm 380: fatal_fr(r, "sshbuf_put");
1.41 djm 381: free(cmd);
1.11 djm 382: cmd = NULL;
1.1 djm 383:
384: /* Gather fds from client */
385: for(i = 0; i < 3; i++) {
1.10 djm 386: if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) {
1.85 djm 387: error_f("failed to receive fd %d from client", i);
1.1 djm 388: for (j = 0; j < i; j++)
389: close(new_fd[j]);
390: for (j = 0; j < env_len; j++)
1.41 djm 391: free(cctx->env[j]);
392: free(cctx->env);
393: free(cctx->term);
1.73 markus 394: sshbuf_free(cctx->cmd);
1.41 djm 395: free(cctx);
1.73 markus 396: reply_error(reply, MUX_S_FAILURE, rid,
1.10 djm 397: "did not receive file descriptors");
398: return -1;
1.1 djm 399: }
400: }
401:
1.85 djm 402: debug3_f("got fds stdin %d, stdout %d, stderr %d",
1.1 djm 403: new_fd[0], new_fd[1], new_fd[2]);
404:
1.10 djm 405: /* XXX support multiple child sessions in future */
1.67 djm 406: if (c->have_remote_id) {
1.85 djm 407: debug2_f("session already open");
1.73 markus 408: reply_error(reply, MUX_S_FAILURE, rid,
409: "Multiple sessions not supported");
1.10 djm 410: cleanup:
1.1 djm 411: close(new_fd[0]);
412: close(new_fd[1]);
413: close(new_fd[2]);
1.41 djm 414: free(cctx->term);
1.1 djm 415: if (env_len != 0) {
416: for (i = 0; i < env_len; i++)
1.41 djm 417: free(cctx->env[i]);
418: free(cctx->env);
1.1 djm 419: }
1.73 markus 420: sshbuf_free(cctx->cmd);
1.41 djm 421: free(cctx);
1.1 djm 422: return 0;
423: }
1.10 djm 424:
425: if (options.control_master == SSHCTL_MASTER_ASK ||
426: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
427: if (!ask_permission("Allow shared connection to %s? ", host)) {
1.85 djm 428: debug2_f("session refused by user");
1.73 markus 429: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
430: "Permission denied");
1.10 djm 431: goto cleanup;
432: }
433: }
434:
435: /* Try to pick up ttymodes from client before it goes raw */
436: if (cctx->want_tty && tcgetattr(new_fd[0], &cctx->tio) == -1)
1.85 djm 437: error_f("tcgetattr: %s", strerror(errno));
1.1 djm 438:
439: window = CHAN_SES_WINDOW_DEFAULT;
440: packetmax = CHAN_SES_PACKET_DEFAULT;
441: if (cctx->want_tty) {
442: window >>= 1;
443: packetmax >>= 1;
444: }
1.10 djm 445:
1.66 djm 446: nc = channel_new(ssh, "session", SSH_CHANNEL_OPENING,
1.1 djm 447: new_fd[0], new_fd[1], new_fd[2], window, packetmax,
1.88 djm 448: CHAN_EXTENDED_WRITE, "client-session", CHANNEL_NONBLOCK_STDIO);
1.1 djm 449:
1.10 djm 450: nc->ctl_chan = c->self; /* link session -> control channel */
1.86 djm 451: c->remote_id = nc->self; /* link control -> session channel */
1.67 djm 452: c->have_remote_id = 1;
1.10 djm 453:
1.2 djm 454: if (cctx->want_tty && escape_char != 0xffffffff) {
1.66 djm 455: channel_register_filter(ssh, nc->self,
1.2 djm 456: client_simple_escape_filter, NULL,
1.4 djm 457: client_filter_cleanup,
1.2 djm 458: client_new_escape_filter_ctx((int)escape_char));
459: }
1.1 djm 460:
1.85 djm 461: debug2_f("channel_new: %d linked to control channel %d",
462: nc->self, nc->ctl_chan);
1.10 djm 463:
1.66 djm 464: channel_send_open(ssh, nc->self);
465: channel_register_open_confirm(ssh, nc->self, mux_session_confirm, cctx);
1.17 djm 466: c->mux_pause = 1; /* stop handling messages until open_confirm done */
1.66 djm 467: channel_register_cleanup(ssh, nc->self,
468: mux_master_session_cleanup_cb, 1);
1.10 djm 469:
1.17 djm 470: /* reply is deferred, sent by mux_session_confirm */
1.1 djm 471: return 0;
472: }
473:
1.10 djm 474: static int
1.76 djm 475: mux_master_process_alive_check(struct ssh *ssh, u_int rid,
1.73 markus 476: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.1 djm 477: {
1.73 markus 478: int r;
479:
1.85 djm 480: debug2_f("channel %d: alive check", c->self);
1.1 djm 481:
1.10 djm 482: /* prepare reply */
1.73 markus 483: if ((r = sshbuf_put_u32(reply, MUX_S_ALIVE)) != 0 ||
484: (r = sshbuf_put_u32(reply, rid)) != 0 ||
485: (r = sshbuf_put_u32(reply, (u_int)getpid())) != 0)
1.85 djm 486: fatal_fr(r, "reply");
1.1 djm 487:
1.10 djm 488: return 0;
1.1 djm 489: }
490:
491: static int
1.76 djm 492: mux_master_process_terminate(struct ssh *ssh, u_int rid,
1.73 markus 493: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.1 djm 494: {
1.85 djm 495: debug2_f("channel %d: terminate request", c->self);
1.1 djm 496:
1.10 djm 497: if (options.control_master == SSHCTL_MASTER_ASK ||
498: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
499: if (!ask_permission("Terminate shared connection to %s? ",
500: host)) {
1.85 djm 501: debug2_f("termination refused by user");
1.73 markus 502: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
503: "Permission denied");
1.10 djm 504: return 0;
505: }
506: }
1.1 djm 507:
1.10 djm 508: quit_pending = 1;
1.73 markus 509: reply_ok(reply, rid);
1.10 djm 510: /* XXX exit happens too soon - message never makes it to client */
511: return 0;
1.1 djm 512: }
513:
1.10 djm 514: static char *
1.46 millert 515: format_forward(u_int ftype, struct Forward *fwd)
1.1 djm 516: {
1.10 djm 517: char *ret;
1.1 djm 518:
1.10 djm 519: switch (ftype) {
520: case MUX_FWD_LOCAL:
521: xasprintf(&ret, "local forward %.200s:%d -> %.200s:%d",
1.46 millert 522: (fwd->listen_path != NULL) ? fwd->listen_path :
1.10 djm 523: (fwd->listen_host == NULL) ?
1.46 millert 524: (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
1.10 djm 525: fwd->listen_host, fwd->listen_port,
1.46 millert 526: (fwd->connect_path != NULL) ? fwd->connect_path :
1.10 djm 527: fwd->connect_host, fwd->connect_port);
528: break;
529: case MUX_FWD_DYNAMIC:
530: xasprintf(&ret, "dynamic forward %.200s:%d -> *",
531: (fwd->listen_host == NULL) ?
1.46 millert 532: (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
1.87 djm 533: fwd->listen_host, fwd->listen_port);
1.10 djm 534: break;
535: case MUX_FWD_REMOTE:
536: xasprintf(&ret, "remote forward %.200s:%d -> %.200s:%d",
1.46 millert 537: (fwd->listen_path != NULL) ? fwd->listen_path :
1.10 djm 538: (fwd->listen_host == NULL) ?
539: "LOCALHOST" : fwd->listen_host,
540: fwd->listen_port,
1.46 millert 541: (fwd->connect_path != NULL) ? fwd->connect_path :
1.10 djm 542: fwd->connect_host, fwd->connect_port);
1.1 djm 543: break;
544: default:
1.85 djm 545: fatal_f("unknown forward type %u", ftype);
1.1 djm 546: }
1.10 djm 547: return ret;
548: }
1.1 djm 549:
1.10 djm 550: static int
551: compare_host(const char *a, const char *b)
552: {
553: if (a == NULL && b == NULL)
554: return 1;
555: if (a == NULL || b == NULL)
556: return 0;
557: return strcmp(a, b) == 0;
558: }
1.1 djm 559:
1.10 djm 560: static int
1.46 millert 561: compare_forward(struct Forward *a, struct Forward *b)
1.10 djm 562: {
563: if (!compare_host(a->listen_host, b->listen_host))
564: return 0;
1.46 millert 565: if (!compare_host(a->listen_path, b->listen_path))
566: return 0;
1.10 djm 567: if (a->listen_port != b->listen_port)
568: return 0;
569: if (!compare_host(a->connect_host, b->connect_host))
570: return 0;
1.46 millert 571: if (!compare_host(a->connect_path, b->connect_path))
572: return 0;
1.10 djm 573: if (a->connect_port != b->connect_port)
574: return 0;
1.1 djm 575:
1.10 djm 576: return 1;
577: }
1.1 djm 578:
1.18 markus 579: static void
1.66 djm 580: mux_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
1.18 markus 581: {
582: struct mux_channel_confirm_ctx *fctx = ctxt;
583: char *failmsg = NULL;
1.46 millert 584: struct Forward *rfwd;
1.18 markus 585: Channel *c;
1.73 markus 586: struct sshbuf *out;
1.79 djm 587: u_int port;
1.73 markus 588: int r;
1.18 markus 589:
1.66 djm 590: if ((c = channel_by_id(ssh, fctx->cid)) == NULL) {
1.18 markus 591: /* no channel for reply */
1.85 djm 592: error_f("unknown channel");
1.18 markus 593: return;
594: }
1.73 markus 595: if ((out = sshbuf_new()) == NULL)
1.85 djm 596: fatal_f("sshbuf_new");
1.53 djm 597: if (fctx->fid >= options.num_remote_forwards ||
598: (options.remote_forwards[fctx->fid].connect_path == NULL &&
599: options.remote_forwards[fctx->fid].connect_host == NULL)) {
1.18 markus 600: xasprintf(&failmsg, "unknown forwarding id %d", fctx->fid);
601: goto fail;
602: }
603: rfwd = &options.remote_forwards[fctx->fid];
1.85 djm 604: debug_f("%s for: listen %d, connect %s:%d",
1.18 markus 605: type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
1.46 millert 606: rfwd->listen_port, rfwd->connect_path ? rfwd->connect_path :
607: rfwd->connect_host, rfwd->connect_port);
1.18 markus 608: if (type == SSH2_MSG_REQUEST_SUCCESS) {
609: if (rfwd->listen_port == 0) {
1.79 djm 610: if ((r = sshpkt_get_u32(ssh, &port)) != 0)
1.85 djm 611: fatal_fr(r, "parse port");
1.79 djm 612: if (port > 65535) {
613: fatal("Invalid allocated port %u for "
614: "mux remote forward to %s:%d", port,
615: rfwd->connect_host, rfwd->connect_port);
616: }
617: rfwd->allocated_port = (int)port;
1.52 djm 618: debug("Allocated port %u for mux remote forward"
1.18 markus 619: " to %s:%d", rfwd->allocated_port,
620: rfwd->connect_host, rfwd->connect_port);
1.73 markus 621: if ((r = sshbuf_put_u32(out,
622: MUX_S_REMOTE_PORT)) != 0 ||
623: (r = sshbuf_put_u32(out, fctx->rid)) != 0 ||
624: (r = sshbuf_put_u32(out,
625: rfwd->allocated_port)) != 0)
1.85 djm 626: fatal_fr(r, "reply");
1.70 djm 627: channel_update_permission(ssh, rfwd->handle,
1.87 djm 628: rfwd->allocated_port);
1.18 markus 629: } else {
1.73 markus 630: reply_ok(out, fctx->rid);
1.18 markus 631: }
632: goto out;
633: } else {
1.31 markus 634: if (rfwd->listen_port == 0)
1.70 djm 635: channel_update_permission(ssh, rfwd->handle, -1);
1.46 millert 636: if (rfwd->listen_path != NULL)
637: xasprintf(&failmsg, "remote port forwarding failed for "
638: "listen path %s", rfwd->listen_path);
639: else
640: xasprintf(&failmsg, "remote port forwarding failed for "
641: "listen port %d", rfwd->listen_port);
1.53 djm 642:
1.87 djm 643: debug2_f("clearing registered forwarding for listen %d, "
1.85 djm 644: "connect %s:%d", rfwd->listen_port,
1.53 djm 645: rfwd->connect_path ? rfwd->connect_path :
646: rfwd->connect_host, rfwd->connect_port);
647:
648: free(rfwd->listen_host);
649: free(rfwd->listen_path);
650: free(rfwd->connect_host);
651: free(rfwd->connect_path);
652: memset(rfwd, 0, sizeof(*rfwd));
1.18 markus 653: }
654: fail:
1.85 djm 655: error_f("%s", failmsg);
1.73 markus 656: reply_error(out, MUX_S_FAILURE, fctx->rid, failmsg);
1.41 djm 657: free(failmsg);
1.18 markus 658: out:
1.73 markus 659: if ((r = sshbuf_put_stringb(c->output, out)) != 0)
1.85 djm 660: fatal_fr(r, "enqueue");
1.73 markus 661: sshbuf_free(out);
1.18 markus 662: if (c->mux_pause <= 0)
1.85 djm 663: fatal_f("mux_pause %d", c->mux_pause);
1.18 markus 664: c->mux_pause = 0; /* start processing messages again */
665: }
666:
1.10 djm 667: static int
1.76 djm 668: mux_master_process_open_fwd(struct ssh *ssh, u_int rid,
1.73 markus 669: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 670: {
1.46 millert 671: struct Forward fwd;
1.10 djm 672: char *fwd_desc = NULL;
1.46 millert 673: char *listen_addr, *connect_addr;
1.10 djm 674: u_int ftype;
1.44 djm 675: u_int lport, cport;
1.73 markus 676: int r, i, ret = 0, freefwd = 1;
1.10 djm 677:
1.54 djm 678: memset(&fwd, 0, sizeof(fwd));
679:
1.46 millert 680: /* XXX - lport/cport check redundant */
1.73 markus 681: if ((r = sshbuf_get_u32(m, &ftype)) != 0 ||
682: (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 ||
683: (r = sshbuf_get_u32(m, &lport)) != 0 ||
684: (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 ||
685: (r = sshbuf_get_u32(m, &cport)) != 0 ||
1.46 millert 686: (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
687: (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
1.85 djm 688: error_f("malformed message");
1.10 djm 689: ret = -1;
690: goto out;
691: }
1.46 millert 692: if (*listen_addr == '\0') {
693: free(listen_addr);
694: listen_addr = NULL;
695: }
696: if (*connect_addr == '\0') {
697: free(connect_addr);
698: connect_addr = NULL;
699: }
700:
701: memset(&fwd, 0, sizeof(fwd));
1.44 djm 702: fwd.listen_port = lport;
1.46 millert 703: if (fwd.listen_port == PORT_STREAMLOCAL)
704: fwd.listen_path = listen_addr;
705: else
706: fwd.listen_host = listen_addr;
1.44 djm 707: fwd.connect_port = cport;
1.46 millert 708: if (fwd.connect_port == PORT_STREAMLOCAL)
709: fwd.connect_path = connect_addr;
710: else
711: fwd.connect_host = connect_addr;
1.10 djm 712:
1.85 djm 713: debug2_f("channel %d: request %s", c->self,
1.10 djm 714: (fwd_desc = format_forward(ftype, &fwd)));
715:
716: if (ftype != MUX_FWD_LOCAL && ftype != MUX_FWD_REMOTE &&
717: ftype != MUX_FWD_DYNAMIC) {
1.85 djm 718: logit_f("invalid forwarding type %u", ftype);
1.10 djm 719: invalid:
1.46 millert 720: free(listen_addr);
721: free(connect_addr);
1.73 markus 722: reply_error(reply, MUX_S_FAILURE, rid,
723: "Invalid forwarding request");
1.10 djm 724: return 0;
725: }
1.46 millert 726: if (ftype == MUX_FWD_DYNAMIC && fwd.listen_path) {
1.85 djm 727: logit_f("streamlocal and dynamic forwards "
728: "are mutually exclusive");
1.46 millert 729: goto invalid;
730: }
731: if (fwd.listen_port != PORT_STREAMLOCAL && fwd.listen_port >= 65536) {
1.85 djm 732: logit_f("invalid listen port %u", fwd.listen_port);
1.10 djm 733: goto invalid;
734: }
1.66 djm 735: if ((fwd.connect_port != PORT_STREAMLOCAL &&
736: fwd.connect_port >= 65536) ||
737: (ftype != MUX_FWD_DYNAMIC && ftype != MUX_FWD_REMOTE &&
738: fwd.connect_port == 0)) {
1.85 djm 739: logit_f("invalid connect port %u",
1.10 djm 740: fwd.connect_port);
741: goto invalid;
742: }
1.66 djm 743: if (ftype != MUX_FWD_DYNAMIC && fwd.connect_host == NULL &&
744: fwd.connect_path == NULL) {
1.85 djm 745: logit_f("missing connect host");
1.10 djm 746: goto invalid;
747: }
748:
749: /* Skip forwards that have already been requested */
750: switch (ftype) {
751: case MUX_FWD_LOCAL:
752: case MUX_FWD_DYNAMIC:
753: for (i = 0; i < options.num_local_forwards; i++) {
754: if (compare_forward(&fwd,
755: options.local_forwards + i)) {
756: exists:
1.85 djm 757: debug2_f("found existing forwarding");
1.73 markus 758: reply_ok(reply, rid);
1.10 djm 759: goto out;
760: }
761: }
762: break;
763: case MUX_FWD_REMOTE:
764: for (i = 0; i < options.num_remote_forwards; i++) {
1.73 markus 765: if (!compare_forward(&fwd, options.remote_forwards + i))
766: continue;
767: if (fwd.listen_port != 0)
768: goto exists;
1.85 djm 769: debug2_f("found allocated port");
1.73 markus 770: if ((r = sshbuf_put_u32(reply,
771: MUX_S_REMOTE_PORT)) != 0 ||
772: (r = sshbuf_put_u32(reply, rid)) != 0 ||
773: (r = sshbuf_put_u32(reply,
774: options.remote_forwards[i].allocated_port)) != 0)
1.85 djm 775: fatal_fr(r, "reply FWD_REMOTE");
1.73 markus 776: goto out;
1.10 djm 777: }
778: break;
779: }
780:
781: if (options.control_master == SSHCTL_MASTER_ASK ||
782: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
783: if (!ask_permission("Open %s on %s?", fwd_desc, host)) {
1.85 djm 784: debug2_f("forwarding refused by user");
1.73 markus 785: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
786: "Permission denied");
1.10 djm 787: goto out;
788: }
789: }
790:
791: if (ftype == MUX_FWD_LOCAL || ftype == MUX_FWD_DYNAMIC) {
1.66 djm 792: if (!channel_setup_local_fwd_listener(ssh, &fwd,
1.46 millert 793: &options.fwd_opts)) {
1.10 djm 794: fail:
1.85 djm 795: logit_f("requested %s failed", fwd_desc);
1.73 markus 796: reply_error(reply, MUX_S_FAILURE, rid,
797: "Port forwarding failed");
1.10 djm 798: goto out;
799: }
800: add_local_forward(&options, &fwd);
801: freefwd = 0;
802: } else {
1.18 markus 803: struct mux_channel_confirm_ctx *fctx;
804:
1.66 djm 805: fwd.handle = channel_request_remote_forwarding(ssh, &fwd);
1.31 markus 806: if (fwd.handle < 0)
1.10 djm 807: goto fail;
808: add_remote_forward(&options, &fwd);
1.18 markus 809: fctx = xcalloc(1, sizeof(*fctx));
810: fctx->cid = c->self;
811: fctx->rid = rid;
1.20 djm 812: fctx->fid = options.num_remote_forwards - 1;
1.18 markus 813: client_register_global_confirm(mux_confirm_remote_forward,
814: fctx);
1.10 djm 815: freefwd = 0;
1.18 markus 816: c->mux_pause = 1; /* wait for mux_confirm_remote_forward */
817: /* delayed reply in mux_confirm_remote_forward */
818: goto out;
1.10 djm 819: }
1.73 markus 820: reply_ok(reply, rid);
1.10 djm 821: out:
1.41 djm 822: free(fwd_desc);
1.10 djm 823: if (freefwd) {
1.41 djm 824: free(fwd.listen_host);
1.46 millert 825: free(fwd.listen_path);
1.41 djm 826: free(fwd.connect_host);
1.46 millert 827: free(fwd.connect_path);
1.10 djm 828: }
829: return ret;
830: }
831:
832: static int
1.76 djm 833: mux_master_process_close_fwd(struct ssh *ssh, u_int rid,
1.73 markus 834: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 835: {
1.46 millert 836: struct Forward fwd, *found_fwd;
1.10 djm 837: char *fwd_desc = NULL;
1.30 djm 838: const char *error_reason = NULL;
1.46 millert 839: char *listen_addr = NULL, *connect_addr = NULL;
1.10 djm 840: u_int ftype;
1.73 markus 841: int r, i, ret = 0;
1.44 djm 842: u_int lport, cport;
1.54 djm 843:
844: memset(&fwd, 0, sizeof(fwd));
1.10 djm 845:
1.73 markus 846: if ((r = sshbuf_get_u32(m, &ftype)) != 0 ||
847: (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 ||
848: (r = sshbuf_get_u32(m, &lport)) != 0 ||
849: (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 ||
850: (r = sshbuf_get_u32(m, &cport)) != 0 ||
1.46 millert 851: (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
852: (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
1.85 djm 853: error_f("malformed message");
1.10 djm 854: ret = -1;
855: goto out;
856: }
857:
1.46 millert 858: if (*listen_addr == '\0') {
859: free(listen_addr);
860: listen_addr = NULL;
1.10 djm 861: }
1.46 millert 862: if (*connect_addr == '\0') {
863: free(connect_addr);
864: connect_addr = NULL;
1.10 djm 865: }
866:
1.46 millert 867: memset(&fwd, 0, sizeof(fwd));
868: fwd.listen_port = lport;
869: if (fwd.listen_port == PORT_STREAMLOCAL)
870: fwd.listen_path = listen_addr;
871: else
872: fwd.listen_host = listen_addr;
873: fwd.connect_port = cport;
874: if (fwd.connect_port == PORT_STREAMLOCAL)
875: fwd.connect_path = connect_addr;
876: else
877: fwd.connect_host = connect_addr;
878:
1.85 djm 879: debug2_f("channel %d: request cancel %s", c->self,
1.10 djm 880: (fwd_desc = format_forward(ftype, &fwd)));
881:
1.30 djm 882: /* make sure this has been requested */
883: found_fwd = NULL;
884: switch (ftype) {
885: case MUX_FWD_LOCAL:
886: case MUX_FWD_DYNAMIC:
887: for (i = 0; i < options.num_local_forwards; i++) {
888: if (compare_forward(&fwd,
889: options.local_forwards + i)) {
890: found_fwd = options.local_forwards + i;
891: break;
892: }
893: }
894: break;
895: case MUX_FWD_REMOTE:
896: for (i = 0; i < options.num_remote_forwards; i++) {
897: if (compare_forward(&fwd,
898: options.remote_forwards + i)) {
899: found_fwd = options.remote_forwards + i;
900: break;
901: }
902: }
903: break;
904: }
905:
906: if (found_fwd == NULL)
907: error_reason = "port not forwarded";
908: else if (ftype == MUX_FWD_REMOTE) {
909: /*
910: * This shouldn't fail unless we confused the host/port
911: * between options.remote_forwards and permitted_opens.
1.31 markus 912: * However, for dynamic allocated listen ports we need
1.46 millert 913: * to use the actual listen port.
1.30 djm 914: */
1.66 djm 915: if (channel_request_rforward_cancel(ssh, found_fwd) == -1)
1.30 djm 916: error_reason = "port not in permitted opens";
917: } else { /* local and dynamic forwards */
918: /* Ditto */
1.66 djm 919: if (channel_cancel_lport_listener(ssh, &fwd, fwd.connect_port,
1.46 millert 920: &options.fwd_opts) == -1)
1.30 djm 921: error_reason = "port not found";
922: }
923:
1.73 markus 924: if (error_reason != NULL)
925: reply_error(reply, MUX_S_FAILURE, rid, error_reason);
926: else {
927: reply_ok(reply, rid);
1.41 djm 928: free(found_fwd->listen_host);
1.46 millert 929: free(found_fwd->listen_path);
1.41 djm 930: free(found_fwd->connect_host);
1.46 millert 931: free(found_fwd->connect_path);
1.30 djm 932: found_fwd->listen_host = found_fwd->connect_host = NULL;
1.46 millert 933: found_fwd->listen_path = found_fwd->connect_path = NULL;
1.30 djm 934: found_fwd->listen_port = found_fwd->connect_port = 0;
935: }
1.10 djm 936: out:
1.41 djm 937: free(fwd_desc);
1.46 millert 938: free(listen_addr);
939: free(connect_addr);
1.10 djm 940:
941: return ret;
942: }
943:
944: static int
1.76 djm 945: mux_master_process_stdio_fwd(struct ssh *ssh, u_int rid,
1.73 markus 946: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 947: {
948: Channel *nc;
1.73 markus 949: char *chost = NULL;
1.10 djm 950: u_int cport, i, j;
1.73 markus 951: int r, new_fd[2];
1.48 djm 952: struct mux_stdio_confirm_ctx *cctx;
1.10 djm 953:
1.73 markus 954: if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */
955: (r = sshbuf_get_cstring(m, &chost, NULL)) != 0 ||
956: (r = sshbuf_get_u32(m, &cport)) != 0) {
1.41 djm 957: free(chost);
1.85 djm 958: error_f("malformed message");
1.10 djm 959: return -1;
960: }
961:
1.85 djm 962: debug2_f("channel %d: stdio fwd to %s:%u", c->self, chost, cport);
1.10 djm 963:
964: /* Gather fds from client */
965: for(i = 0; i < 2; i++) {
966: if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) {
1.85 djm 967: error_f("failed to receive fd %d from client", i);
1.10 djm 968: for (j = 0; j < i; j++)
969: close(new_fd[j]);
1.41 djm 970: free(chost);
1.10 djm 971:
972: /* prepare reply */
1.73 markus 973: reply_error(reply, MUX_S_FAILURE, rid,
1.10 djm 974: "did not receive file descriptors");
975: return -1;
976: }
977: }
978:
1.85 djm 979: debug3_f("got fds stdin %d, stdout %d", new_fd[0], new_fd[1]);
1.10 djm 980:
981: /* XXX support multiple child sessions in future */
1.67 djm 982: if (c->have_remote_id) {
1.85 djm 983: debug2_f("session already open");
1.73 markus 984: reply_error(reply, MUX_S_FAILURE, rid,
985: "Multiple sessions not supported");
1.10 djm 986: cleanup:
987: close(new_fd[0]);
988: close(new_fd[1]);
1.41 djm 989: free(chost);
1.10 djm 990: return 0;
991: }
992:
993: if (options.control_master == SSHCTL_MASTER_ASK ||
994: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
1.23 dtucker 995: if (!ask_permission("Allow forward to %s:%u? ",
1.10 djm 996: chost, cport)) {
1.85 djm 997: debug2_f("stdio fwd refused by user");
1.73 markus 998: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
999: "Permission denied");
1.10 djm 1000: goto cleanup;
1001: }
1002: }
1003:
1.88 djm 1004: nc = channel_connect_stdio_fwd(ssh, chost, cport, new_fd[0], new_fd[1],
1005: CHANNEL_NONBLOCK_STDIO);
1.75 djm 1006: free(chost);
1.10 djm 1007:
1008: nc->ctl_chan = c->self; /* link session -> control channel */
1.86 djm 1009: c->remote_id = nc->self; /* link control -> session channel */
1.67 djm 1010: c->have_remote_id = 1;
1.10 djm 1011:
1.85 djm 1012: debug2_f("channel_new: %d control %d", nc->self, nc->ctl_chan);
1.10 djm 1013:
1.66 djm 1014: channel_register_cleanup(ssh, nc->self,
1015: mux_master_session_cleanup_cb, 1);
1.10 djm 1016:
1.48 djm 1017: cctx = xcalloc(1, sizeof(*cctx));
1018: cctx->rid = rid;
1.66 djm 1019: channel_register_open_confirm(ssh, nc->self, mux_stdio_confirm, cctx);
1.48 djm 1020: c->mux_pause = 1; /* stop handling messages until open_confirm done */
1021:
1022: /* reply is deferred, sent by mux_session_confirm */
1023: return 0;
1024: }
1025:
1026: /* Callback on open confirmation in mux master for a mux stdio fwd session. */
1027: static void
1.66 djm 1028: mux_stdio_confirm(struct ssh *ssh, int id, int success, void *arg)
1.48 djm 1029: {
1030: struct mux_stdio_confirm_ctx *cctx = arg;
1031: Channel *c, *cc;
1.73 markus 1032: struct sshbuf *reply;
1033: int r;
1.48 djm 1034:
1035: if (cctx == NULL)
1.85 djm 1036: fatal_f("cctx == NULL");
1.66 djm 1037: if ((c = channel_by_id(ssh, id)) == NULL)
1.85 djm 1038: fatal_f("no channel for id %d", id);
1.66 djm 1039: if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 1040: fatal_f("channel %d lacks control channel %d",
1.48 djm 1041: id, c->ctl_chan);
1.73 markus 1042: if ((reply = sshbuf_new()) == NULL)
1.85 djm 1043: fatal_f("sshbuf_new");
1.48 djm 1044:
1045: if (!success) {
1.85 djm 1046: debug3_f("sending failure reply");
1.73 markus 1047: reply_error(reply, MUX_S_FAILURE, cctx->rid,
1048: "Session open refused by peer");
1.48 djm 1049: /* prepare reply */
1050: goto done;
1051: }
1052:
1.85 djm 1053: debug3_f("sending success reply");
1.10 djm 1054: /* prepare reply */
1.73 markus 1055: if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 ||
1056: (r = sshbuf_put_u32(reply, cctx->rid)) != 0 ||
1057: (r = sshbuf_put_u32(reply, c->self)) != 0)
1.85 djm 1058: fatal_fr(r, "reply");
1.48 djm 1059:
1060: done:
1061: /* Send reply */
1.73 markus 1062: if ((r = sshbuf_put_stringb(cc->output, reply)) != 0)
1.85 djm 1063: fatal_fr(r, "enqueue");
1.73 markus 1064: sshbuf_free(reply);
1.10 djm 1065:
1.48 djm 1066: if (cc->mux_pause <= 0)
1.85 djm 1067: fatal_f("mux_pause %d", cc->mux_pause);
1.48 djm 1068: cc->mux_pause = 0; /* start processing messages again */
1069: c->open_confirm_ctx = NULL;
1070: free(cctx);
1.10 djm 1071: }
1072:
1.25 djm 1073: static int
1.76 djm 1074: mux_master_process_stop_listening(struct ssh *ssh, u_int rid,
1.73 markus 1075: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.25 djm 1076: {
1.85 djm 1077: debug_f("channel %d: stop listening", c->self);
1.25 djm 1078:
1079: if (options.control_master == SSHCTL_MASTER_ASK ||
1080: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
1081: if (!ask_permission("Disable further multiplexing on shared "
1082: "connection to %s? ", host)) {
1.85 djm 1083: debug2_f("stop listen refused by user");
1.73 markus 1084: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
1085: "Permission denied");
1.25 djm 1086: return 0;
1087: }
1088: }
1089:
1090: if (mux_listener_channel != NULL) {
1.66 djm 1091: channel_free(ssh, mux_listener_channel);
1.25 djm 1092: client_stop_mux();
1.41 djm 1093: free(options.control_path);
1.25 djm 1094: options.control_path = NULL;
1095: mux_listener_channel = NULL;
1096: muxserver_sock = -1;
1097: }
1098:
1.73 markus 1099: reply_ok(reply, rid);
1.25 djm 1100: return 0;
1101: }
1102:
1.62 markus 1103: static int
1.76 djm 1104: mux_master_process_proxy(struct ssh *ssh, u_int rid,
1.73 markus 1105: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.62 markus 1106: {
1.73 markus 1107: int r;
1108:
1.85 djm 1109: debug_f("channel %d: proxy request", c->self);
1.62 markus 1110:
1111: c->mux_rcb = channel_proxy_downstream;
1.73 markus 1112: if ((r = sshbuf_put_u32(reply, MUX_S_PROXY)) != 0 ||
1113: (r = sshbuf_put_u32(reply, rid)) != 0)
1.85 djm 1114: fatal_fr(r, "reply");
1.62 markus 1115:
1116: return 0;
1117: }
1118:
1.83 djm 1119: /* Channel callbacks fired on read/write from mux client fd */
1.10 djm 1120: static int
1.66 djm 1121: mux_master_read_cb(struct ssh *ssh, Channel *c)
1.10 djm 1122: {
1123: struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx;
1.73 markus 1124: struct sshbuf *in = NULL, *out = NULL;
1125: u_int type, rid, i;
1126: int r, ret = -1;
1127:
1128: if ((out = sshbuf_new()) == NULL)
1.85 djm 1129: fatal_f("sshbuf_new");
1.10 djm 1130:
1131: /* Setup ctx and */
1132: if (c->mux_ctx == NULL) {
1.19 djm 1133: state = xcalloc(1, sizeof(*state));
1.10 djm 1134: c->mux_ctx = state;
1.66 djm 1135: channel_register_cleanup(ssh, c->self,
1.10 djm 1136: mux_master_control_cleanup_cb, 0);
1137:
1138: /* Send hello */
1.73 markus 1139: if ((r = sshbuf_put_u32(out, MUX_MSG_HELLO)) != 0 ||
1140: (r = sshbuf_put_u32(out, SSHMUX_VER)) != 0)
1.85 djm 1141: fatal_fr(r, "reply");
1.10 djm 1142: /* no extensions */
1.73 markus 1143: if ((r = sshbuf_put_stringb(c->output, out)) != 0)
1.85 djm 1144: fatal_fr(r, "enqueue");
1145: debug3_f("channel %d: hello sent", c->self);
1.73 markus 1146: ret = 0;
1147: goto out;
1.10 djm 1148: }
1149:
1150: /* Channel code ensures that we receive whole packets */
1.73 markus 1151: if ((r = sshbuf_froms(c->input, &in)) != 0) {
1.10 djm 1152: malf:
1.85 djm 1153: error_f("malformed message");
1.10 djm 1154: goto out;
1155: }
1156:
1.73 markus 1157: if ((r = sshbuf_get_u32(in, &type)) != 0)
1.10 djm 1158: goto malf;
1.85 djm 1159: debug3_f("channel %d packet type 0x%08x len %zu", c->self,
1160: type, sshbuf_len(in));
1.10 djm 1161:
1162: if (type == MUX_MSG_HELLO)
1163: rid = 0;
1164: else {
1165: if (!state->hello_rcvd) {
1.85 djm 1166: error_f("expected MUX_MSG_HELLO(0x%08x), "
1167: "received 0x%08x", MUX_MSG_HELLO, type);
1.10 djm 1168: goto out;
1.1 djm 1169: }
1.73 markus 1170: if ((r = sshbuf_get_u32(in, &rid)) != 0)
1.10 djm 1171: goto malf;
1172: }
1173:
1174: for (i = 0; mux_master_handlers[i].handler != NULL; i++) {
1175: if (type == mux_master_handlers[i].type) {
1.66 djm 1176: ret = mux_master_handlers[i].handler(ssh, rid,
1.73 markus 1177: c, in, out);
1.10 djm 1178: break;
1.1 djm 1179: }
1.10 djm 1180: }
1181: if (mux_master_handlers[i].handler == NULL) {
1.85 djm 1182: error_f("unsupported mux message 0x%08x", type);
1.73 markus 1183: reply_error(out, MUX_S_FAILURE, rid, "unsupported request");
1.10 djm 1184: ret = 0;
1185: }
1186: /* Enqueue reply packet */
1.85 djm 1187: if (sshbuf_len(out) != 0 &&
1188: (r = sshbuf_put_stringb(c->output, out)) != 0)
1189: fatal_fr(r, "enqueue");
1.10 djm 1190: out:
1.73 markus 1191: sshbuf_free(in);
1192: sshbuf_free(out);
1.10 djm 1193: return ret;
1194: }
1195:
1196: void
1.66 djm 1197: mux_exit_message(struct ssh *ssh, Channel *c, int exitval)
1.10 djm 1198: {
1.73 markus 1199: struct sshbuf *m;
1.10 djm 1200: Channel *mux_chan;
1.73 markus 1201: int r;
1.10 djm 1202:
1.85 djm 1203: debug3_f("channel %d: exit message, exitval %d", c->self, exitval);
1.10 djm 1204:
1.66 djm 1205: if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 1206: fatal_f("channel %d missing mux %d", c->self, c->ctl_chan);
1.10 djm 1207:
1208: /* Append exit message packet to control socket output queue */
1.73 markus 1209: if ((m = sshbuf_new()) == NULL)
1.85 djm 1210: fatal_f("sshbuf_new");
1.73 markus 1211: if ((r = sshbuf_put_u32(m, MUX_S_EXIT_MESSAGE)) != 0 ||
1212: (r = sshbuf_put_u32(m, c->self)) != 0 ||
1213: (r = sshbuf_put_u32(m, exitval)) != 0 ||
1214: (r = sshbuf_put_stringb(mux_chan->output, m)) != 0)
1.85 djm 1215: fatal_fr(r, "reply");
1.73 markus 1216: sshbuf_free(m);
1.10 djm 1217: }
1218:
1.28 djm 1219: void
1.66 djm 1220: mux_tty_alloc_failed(struct ssh *ssh, Channel *c)
1.28 djm 1221: {
1.73 markus 1222: struct sshbuf *m;
1.28 djm 1223: Channel *mux_chan;
1.73 markus 1224: int r;
1.28 djm 1225:
1.85 djm 1226: debug3_f("channel %d: TTY alloc failed", c->self);
1.28 djm 1227:
1.66 djm 1228: if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 1229: fatal_f("channel %d missing mux %d", c->self, c->ctl_chan);
1.28 djm 1230:
1231: /* Append exit message packet to control socket output queue */
1.73 markus 1232: if ((m = sshbuf_new()) == NULL)
1.85 djm 1233: fatal_f("sshbuf_new");
1.73 markus 1234: if ((r = sshbuf_put_u32(m, MUX_S_TTY_ALLOC_FAIL)) != 0 ||
1235: (r = sshbuf_put_u32(m, c->self)) != 0 ||
1236: (r = sshbuf_put_stringb(mux_chan->output, m)) != 0)
1.85 djm 1237: fatal_fr(r, "reply");
1.73 markus 1238: sshbuf_free(m);
1.28 djm 1239: }
1240:
1.10 djm 1241: /* Prepare a mux master to listen on a Unix domain socket. */
1242: void
1.66 djm 1243: muxserver_listen(struct ssh *ssh)
1.10 djm 1244: {
1245: mode_t old_umask;
1.22 djm 1246: char *orig_control_path = options.control_path;
1247: char rbuf[16+1];
1248: u_int i, r;
1.47 djm 1249: int oerrno;
1.10 djm 1250:
1251: if (options.control_path == NULL ||
1252: options.control_master == SSHCTL_MASTER_NO)
1.1 djm 1253: return;
1.10 djm 1254:
1255: debug("setting up multiplex master socket");
1256:
1.22 djm 1257: /*
1258: * Use a temporary path before listen so we can pseudo-atomically
1259: * establish the listening socket in its final location to avoid
1260: * other processes racing in between bind() and listen() and hitting
1261: * an unready socket.
1262: */
1263: for (i = 0; i < sizeof(rbuf) - 1; i++) {
1264: r = arc4random_uniform(26+26+10);
1265: rbuf[i] = (r < 26) ? 'a' + r :
1266: (r < 26*2) ? 'A' + r - 26 :
1267: '0' + r - 26 - 26;
1268: }
1269: rbuf[sizeof(rbuf) - 1] = '\0';
1270: options.control_path = NULL;
1271: xasprintf(&options.control_path, "%s.%s", orig_control_path, rbuf);
1.85 djm 1272: debug3_f("temporary control path %s", options.control_path);
1.22 djm 1273:
1.10 djm 1274: old_umask = umask(0177);
1.46 millert 1275: muxserver_sock = unix_listener(options.control_path, 64, 0);
1.47 djm 1276: oerrno = errno;
1.46 millert 1277: umask(old_umask);
1278: if (muxserver_sock < 0) {
1.47 djm 1279: if (oerrno == EINVAL || oerrno == EADDRINUSE) {
1.10 djm 1280: error("ControlSocket %s already exists, "
1281: "disabling multiplexing", options.control_path);
1.22 djm 1282: disable_mux_master:
1.26 djm 1283: if (muxserver_sock != -1) {
1284: close(muxserver_sock);
1285: muxserver_sock = -1;
1286: }
1.41 djm 1287: free(orig_control_path);
1288: free(options.control_path);
1.10 djm 1289: options.control_path = NULL;
1290: options.control_master = SSHCTL_MASTER_NO;
1291: return;
1.46 millert 1292: } else {
1293: /* unix_listener() logs the error */
1294: cleanup_exit(255);
1295: }
1.10 djm 1296: }
1297:
1.22 djm 1298: /* Now atomically "move" the mux socket into position */
1299: if (link(options.control_path, orig_control_path) != 0) {
1300: if (errno != EEXIST) {
1.85 djm 1301: fatal_f("link mux listener %s => %s: %s",
1.22 djm 1302: options.control_path, orig_control_path,
1303: strerror(errno));
1304: }
1305: error("ControlSocket %s already exists, disabling multiplexing",
1306: orig_control_path);
1307: unlink(options.control_path);
1308: goto disable_mux_master;
1309: }
1310: unlink(options.control_path);
1.41 djm 1311: free(options.control_path);
1.22 djm 1312: options.control_path = orig_control_path;
1313:
1.10 djm 1314: set_nonblock(muxserver_sock);
1315:
1.66 djm 1316: mux_listener_channel = channel_new(ssh, "mux listener",
1.10 djm 1317: SSH_CHANNEL_MUX_LISTENER, muxserver_sock, muxserver_sock, -1,
1318: CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1.22 djm 1319: 0, options.control_path, 1);
1.10 djm 1320: mux_listener_channel->mux_rcb = mux_master_read_cb;
1.85 djm 1321: debug3_f("mux listener channel %d fd %d",
1.10 djm 1322: mux_listener_channel->self, mux_listener_channel->sock);
1323: }
1324:
1325: /* Callback on open confirmation in mux master for a mux client session. */
1326: static void
1.66 djm 1327: mux_session_confirm(struct ssh *ssh, int id, int success, void *arg)
1.10 djm 1328: {
1329: struct mux_session_confirm_ctx *cctx = arg;
1330: const char *display;
1.17 djm 1331: Channel *c, *cc;
1.73 markus 1332: int i, r;
1333: struct sshbuf *reply;
1.10 djm 1334:
1335: if (cctx == NULL)
1.85 djm 1336: fatal_f("cctx == NULL");
1.66 djm 1337: if ((c = channel_by_id(ssh, id)) == NULL)
1.85 djm 1338: fatal_f("no channel for id %d", id);
1.66 djm 1339: if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 1340: fatal_f("channel %d lacks control channel %d",
1.17 djm 1341: id, c->ctl_chan);
1.73 markus 1342: if ((reply = sshbuf_new()) == NULL)
1.85 djm 1343: fatal_f("sshbuf_new");
1.17 djm 1344:
1345: if (!success) {
1.85 djm 1346: debug3_f("sending failure reply");
1.73 markus 1347: reply_error(reply, MUX_S_FAILURE, cctx->rid,
1348: "Session open refused by peer");
1.17 djm 1349: goto done;
1350: }
1.10 djm 1351:
1352: display = getenv("DISPLAY");
1353: if (cctx->want_x_fwd && options.forward_x11 && display != NULL) {
1354: char *proto, *data;
1.21 djm 1355:
1.10 djm 1356: /* Get reasonable local authentication information. */
1.66 djm 1357: if (client_x11_get_proto(ssh, display, options.xauth_location,
1.21 djm 1358: options.forward_x11_trusted, options.forward_x11_timeout,
1.58 djm 1359: &proto, &data) == 0) {
1360: /* Request forwarding with authentication spoofing. */
1361: debug("Requesting X11 forwarding with authentication "
1362: "spoofing.");
1.66 djm 1363: x11_request_forwarding_with_spoofing(ssh, id,
1364: display, proto, data, 1);
1.58 djm 1365: /* XXX exit_on_forward_failure */
1.66 djm 1366: client_expect_confirm(ssh, id, "X11 forwarding",
1.58 djm 1367: CONFIRM_WARN);
1368: }
1.10 djm 1369: }
1370:
1371: if (cctx->want_agent_fwd && options.forward_agent) {
1372: debug("Requesting authentication agent forwarding.");
1.66 djm 1373: channel_request_start(ssh, id, "auth-agent-req@openssh.com", 0);
1.79 djm 1374: if ((r = sshpkt_send(ssh)) != 0)
1.85 djm 1375: fatal_fr(r, "send");
1.10 djm 1376: }
1377:
1.66 djm 1378: client_session2_setup(ssh, id, cctx->want_tty, cctx->want_subsys,
1.73 markus 1379: cctx->term, &cctx->tio, c->rfd, cctx->cmd, cctx->env);
1.10 djm 1380:
1.85 djm 1381: debug3_f("sending success reply");
1.17 djm 1382: /* prepare reply */
1.73 markus 1383: if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 ||
1384: (r = sshbuf_put_u32(reply, cctx->rid)) != 0 ||
1385: (r = sshbuf_put_u32(reply, c->self)) != 0)
1.85 djm 1386: fatal_fr(r, "reply");
1.17 djm 1387:
1388: done:
1389: /* Send reply */
1.73 markus 1390: if ((r = sshbuf_put_stringb(cc->output, reply)) != 0)
1.85 djm 1391: fatal_fr(r, "enqueue");
1.73 markus 1392: sshbuf_free(reply);
1.17 djm 1393:
1394: if (cc->mux_pause <= 0)
1.85 djm 1395: fatal_f("mux_pause %d", cc->mux_pause);
1.17 djm 1396: cc->mux_pause = 0; /* start processing messages again */
1.10 djm 1397: c->open_confirm_ctx = NULL;
1.73 markus 1398: sshbuf_free(cctx->cmd);
1.41 djm 1399: free(cctx->term);
1.10 djm 1400: if (cctx->env != NULL) {
1401: for (i = 0; cctx->env[i] != NULL; i++)
1.41 djm 1402: free(cctx->env[i]);
1403: free(cctx->env);
1.1 djm 1404: }
1.41 djm 1405: free(cctx);
1.10 djm 1406: }
1407:
1408: /* ** Multiplexing client support */
1409:
1410: /* Exit signal handler */
1411: static void
1412: control_client_sighandler(int signo)
1413: {
1414: muxclient_terminate = signo;
1415: }
1416:
1417: /*
1418: * Relay signal handler - used to pass some signals from mux client to
1419: * mux master.
1420: */
1421: static void
1422: control_client_sigrelay(int signo)
1423: {
1424: int save_errno = errno;
1425:
1426: if (muxserver_pid > 1)
1427: kill(muxserver_pid, signo);
1428:
1429: errno = save_errno;
1430: }
1.1 djm 1431:
1.10 djm 1432: static int
1.73 markus 1433: mux_client_read(int fd, struct sshbuf *b, size_t need)
1.10 djm 1434: {
1.73 markus 1435: size_t have;
1.10 djm 1436: ssize_t len;
1437: u_char *p;
1438: struct pollfd pfd;
1.73 markus 1439: int r;
1.10 djm 1440:
1441: pfd.fd = fd;
1442: pfd.events = POLLIN;
1.73 markus 1443: if ((r = sshbuf_reserve(b, need, &p)) != 0)
1.85 djm 1444: fatal_fr(r, "reserve");
1.10 djm 1445: for (have = 0; have < need; ) {
1446: if (muxclient_terminate) {
1447: errno = EINTR;
1448: return -1;
1449: }
1450: len = read(fd, p + have, need - have);
1.80 deraadt 1451: if (len == -1) {
1.10 djm 1452: switch (errno) {
1453: case EAGAIN:
1454: (void)poll(&pfd, 1, -1);
1455: /* FALLTHROUGH */
1456: case EINTR:
1457: continue;
1458: default:
1459: return -1;
1460: }
1461: }
1462: if (len == 0) {
1463: errno = EPIPE;
1464: return -1;
1465: }
1.73 markus 1466: have += (size_t)len;
1.1 djm 1467: }
1.10 djm 1468: return 0;
1469: }
1.1 djm 1470:
1.10 djm 1471: static int
1.73 markus 1472: mux_client_write_packet(int fd, struct sshbuf *m)
1.10 djm 1473: {
1.73 markus 1474: struct sshbuf *queue;
1.10 djm 1475: u_int have, need;
1.73 markus 1476: int r, oerrno, len;
1477: const u_char *ptr;
1.10 djm 1478: struct pollfd pfd;
1479:
1480: pfd.fd = fd;
1481: pfd.events = POLLOUT;
1.73 markus 1482: if ((queue = sshbuf_new()) == NULL)
1.85 djm 1483: fatal_f("sshbuf_new");
1.73 markus 1484: if ((r = sshbuf_put_stringb(queue, m)) != 0)
1.85 djm 1485: fatal_fr(r, "enqueue");
1.10 djm 1486:
1.73 markus 1487: need = sshbuf_len(queue);
1488: ptr = sshbuf_ptr(queue);
1.10 djm 1489:
1490: for (have = 0; have < need; ) {
1491: if (muxclient_terminate) {
1.73 markus 1492: sshbuf_free(queue);
1.10 djm 1493: errno = EINTR;
1494: return -1;
1495: }
1496: len = write(fd, ptr + have, need - have);
1.80 deraadt 1497: if (len == -1) {
1.10 djm 1498: switch (errno) {
1499: case EAGAIN:
1500: (void)poll(&pfd, 1, -1);
1501: /* FALLTHROUGH */
1502: case EINTR:
1503: continue;
1504: default:
1505: oerrno = errno;
1.73 markus 1506: sshbuf_free(queue);
1.10 djm 1507: errno = oerrno;
1508: return -1;
1509: }
1510: }
1511: if (len == 0) {
1.73 markus 1512: sshbuf_free(queue);
1.10 djm 1513: errno = EPIPE;
1514: return -1;
1515: }
1516: have += (u_int)len;
1517: }
1.73 markus 1518: sshbuf_free(queue);
1.10 djm 1519: return 0;
1520: }
1.1 djm 1521:
1.10 djm 1522: static int
1.73 markus 1523: mux_client_read_packet(int fd, struct sshbuf *m)
1.10 djm 1524: {
1.73 markus 1525: struct sshbuf *queue;
1526: size_t need, have;
1.45 djm 1527: const u_char *ptr;
1.73 markus 1528: int r, oerrno;
1.10 djm 1529:
1.73 markus 1530: if ((queue = sshbuf_new()) == NULL)
1.85 djm 1531: fatal_f("sshbuf_new");
1.73 markus 1532: if (mux_client_read(fd, queue, 4) != 0) {
1.10 djm 1533: if ((oerrno = errno) == EPIPE)
1.85 djm 1534: debug3_f("read header failed: %s",
1.43 dtucker 1535: strerror(errno));
1.73 markus 1536: sshbuf_free(queue);
1.10 djm 1537: errno = oerrno;
1538: return -1;
1539: }
1.73 markus 1540: need = PEEK_U32(sshbuf_ptr(queue));
1541: if (mux_client_read(fd, queue, need) != 0) {
1.10 djm 1542: oerrno = errno;
1.85 djm 1543: debug3_f("read body failed: %s", strerror(errno));
1.73 markus 1544: sshbuf_free(queue);
1.10 djm 1545: errno = oerrno;
1546: return -1;
1547: }
1.73 markus 1548: if ((r = sshbuf_get_string_direct(queue, &ptr, &have)) != 0 ||
1549: (r = sshbuf_put(m, ptr, have)) != 0)
1.85 djm 1550: fatal_fr(r, "dequeue");
1.73 markus 1551: sshbuf_free(queue);
1.10 djm 1552: return 0;
1553: }
1.1 djm 1554:
1.10 djm 1555: static int
1556: mux_client_hello_exchange(int fd)
1557: {
1.73 markus 1558: struct sshbuf *m;
1.10 djm 1559: u_int type, ver;
1.73 markus 1560: int r, ret = -1;
1.1 djm 1561:
1.73 markus 1562: if ((m = sshbuf_new()) == NULL)
1.85 djm 1563: fatal_f("sshbuf_new");
1.73 markus 1564: if ((r = sshbuf_put_u32(m, MUX_MSG_HELLO)) != 0 ||
1565: (r = sshbuf_put_u32(m, SSHMUX_VER)) != 0)
1.85 djm 1566: fatal_fr(r, "assemble hello");
1.10 djm 1567: /* no extensions */
1568:
1.73 markus 1569: if (mux_client_write_packet(fd, m) != 0) {
1.85 djm 1570: debug_f("write packet: %s", strerror(errno));
1.65 djm 1571: goto out;
1572: }
1.1 djm 1573:
1.73 markus 1574: sshbuf_reset(m);
1.10 djm 1575:
1576: /* Read their HELLO */
1.73 markus 1577: if (mux_client_read_packet(fd, m) != 0) {
1.85 djm 1578: debug_f("read packet failed");
1.65 djm 1579: goto out;
1.10 djm 1580: }
1581:
1.73 markus 1582: if ((r = sshbuf_get_u32(m, &type)) != 0)
1.85 djm 1583: fatal_fr(r, "parse type");
1.65 djm 1584: if (type != MUX_MSG_HELLO) {
1.85 djm 1585: error_f("expected HELLO (%u) got %u", MUX_MSG_HELLO, type);
1.65 djm 1586: goto out;
1587: }
1.73 markus 1588: if ((r = sshbuf_get_u32(m, &ver)) != 0)
1.85 djm 1589: fatal_fr(r, "parse version");
1.65 djm 1590: if (ver != SSHMUX_VER) {
1591: error("Unsupported multiplexing protocol version %d "
1.10 djm 1592: "(expected %d)", ver, SSHMUX_VER);
1.65 djm 1593: goto out;
1594: }
1.85 djm 1595: debug2_f("master version %u", ver);
1.10 djm 1596: /* No extensions are presently defined */
1.73 markus 1597: while (sshbuf_len(m) > 0) {
1598: char *name = NULL;
1.10 djm 1599:
1.73 markus 1600: if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 ||
1601: (r = sshbuf_skip_string(m)) != 0) { /* value */
1.85 djm 1602: error_fr(r, "parse extension");
1.73 markus 1603: goto out;
1604: }
1.10 djm 1605: debug2("Unrecognised master extension \"%s\"", name);
1.41 djm 1606: free(name);
1.5 djm 1607: }
1.65 djm 1608: /* success */
1609: ret = 0;
1610: out:
1.73 markus 1611: sshbuf_free(m);
1.65 djm 1612: return ret;
1.10 djm 1613: }
1614:
1615: static u_int
1616: mux_client_request_alive(int fd)
1617: {
1.73 markus 1618: struct sshbuf *m;
1.10 djm 1619: char *e;
1620: u_int pid, type, rid;
1.73 markus 1621: int r;
1.10 djm 1622:
1.85 djm 1623: debug3_f("entering");
1.10 djm 1624:
1.73 markus 1625: if ((m = sshbuf_new()) == NULL)
1.85 djm 1626: fatal_f("sshbuf_new");
1.73 markus 1627: if ((r = sshbuf_put_u32(m, MUX_C_ALIVE_CHECK)) != 0 ||
1628: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1.85 djm 1629: fatal_fr(r, "assemble");
1.10 djm 1630:
1.73 markus 1631: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 1632: fatal_f("write packet: %s", strerror(errno));
1.10 djm 1633:
1.73 markus 1634: sshbuf_reset(m);
1.1 djm 1635:
1.10 djm 1636: /* Read their reply */
1.73 markus 1637: if (mux_client_read_packet(fd, m) != 0) {
1638: sshbuf_free(m);
1.10 djm 1639: return 0;
1640: }
1641:
1.73 markus 1642: if ((r = sshbuf_get_u32(m, &type)) != 0)
1.85 djm 1643: fatal_fr(r, "parse type");
1.10 djm 1644: if (type != MUX_S_ALIVE) {
1.73 markus 1645: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1646: fatal_fr(r, "parse error message");
1647: fatal_f("master returned error: %s", e);
1.5 djm 1648: }
1.10 djm 1649:
1.73 markus 1650: if ((r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 1651: fatal_fr(r, "parse remote ID");
1.73 markus 1652: if (rid != muxclient_request_id)
1.85 djm 1653: fatal_f("out of sequence reply: my id %u theirs %u",
1654: muxclient_request_id, rid);
1.73 markus 1655: if ((r = sshbuf_get_u32(m, &pid)) != 0)
1.85 djm 1656: fatal_fr(r, "parse PID");
1.73 markus 1657: sshbuf_free(m);
1.10 djm 1658:
1.85 djm 1659: debug3_f("done pid = %u", pid);
1.10 djm 1660:
1661: muxclient_request_id++;
1662:
1663: return pid;
1664: }
1665:
1666: static void
1667: mux_client_request_terminate(int fd)
1668: {
1.73 markus 1669: struct sshbuf *m;
1.10 djm 1670: char *e;
1671: u_int type, rid;
1.73 markus 1672: int r;
1.10 djm 1673:
1.85 djm 1674: debug3_f("entering");
1.10 djm 1675:
1.73 markus 1676: if ((m = sshbuf_new()) == NULL)
1.85 djm 1677: fatal_f("sshbuf_new");
1.73 markus 1678: if ((r = sshbuf_put_u32(m, MUX_C_TERMINATE)) != 0 ||
1679: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1.85 djm 1680: fatal_fr(r, "request");
1.10 djm 1681:
1.73 markus 1682: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 1683: fatal_f("write packet: %s", strerror(errno));
1.1 djm 1684:
1.73 markus 1685: sshbuf_reset(m);
1.1 djm 1686:
1.10 djm 1687: /* Read their reply */
1.73 markus 1688: if (mux_client_read_packet(fd, m) != 0) {
1.10 djm 1689: /* Remote end exited already */
1690: if (errno == EPIPE) {
1.73 markus 1691: sshbuf_free(m);
1.10 djm 1692: return;
1.2 djm 1693: }
1.85 djm 1694: fatal_f("read from master failed: %s", strerror(errno));
1.10 djm 1695: }
1696:
1.73 markus 1697: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1698: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 1699: fatal_fr(r, "parse");
1.73 markus 1700: if (rid != muxclient_request_id)
1.85 djm 1701: fatal_f("out of sequence reply: my id %u theirs %u",
1702: muxclient_request_id, rid);
1.10 djm 1703: switch (type) {
1704: case MUX_S_OK:
1705: break;
1706: case MUX_S_PERMISSION_DENIED:
1.73 markus 1707: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1708: fatal_fr(r, "parse error message");
1.10 djm 1709: fatal("Master refused termination request: %s", e);
1710: case MUX_S_FAILURE:
1.73 markus 1711: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1712: fatal_fr(r, "parse error message");
1713: fatal_f("termination request failed: %s", e);
1.10 djm 1714: default:
1.85 djm 1715: fatal_f("unexpected response from master 0x%08x", type);
1.10 djm 1716: }
1.73 markus 1717: sshbuf_free(m);
1.10 djm 1718: muxclient_request_id++;
1719: }
1720:
1721: static int
1.46 millert 1722: mux_client_forward(int fd, int cancel_flag, u_int ftype, struct Forward *fwd)
1.10 djm 1723: {
1.73 markus 1724: struct sshbuf *m;
1.10 djm 1725: char *e, *fwd_desc;
1.73 markus 1726: const char *lhost, *chost;
1.10 djm 1727: u_int type, rid;
1.73 markus 1728: int r;
1.10 djm 1729:
1730: fwd_desc = format_forward(ftype, fwd);
1.30 djm 1731: debug("Requesting %s %s",
1732: cancel_flag ? "cancellation of" : "forwarding of", fwd_desc);
1.41 djm 1733: free(fwd_desc);
1.10 djm 1734:
1.73 markus 1735: type = cancel_flag ? MUX_C_CLOSE_FWD : MUX_C_OPEN_FWD;
1736: if (fwd->listen_path != NULL)
1737: lhost = fwd->listen_path;
1738: else if (fwd->listen_host == NULL)
1739: lhost = "";
1740: else if (*fwd->listen_host == '\0')
1741: lhost = "*";
1742: else
1743: lhost = fwd->listen_host;
1744:
1745: if (fwd->connect_path != NULL)
1746: chost = fwd->connect_path;
1747: else if (fwd->connect_host == NULL)
1748: chost = "";
1749: else
1750: chost = fwd->connect_host;
1751:
1752: if ((m = sshbuf_new()) == NULL)
1.85 djm 1753: fatal_f("sshbuf_new");
1.73 markus 1754: if ((r = sshbuf_put_u32(m, type)) != 0 ||
1755: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
1756: (r = sshbuf_put_u32(m, ftype)) != 0 ||
1757: (r = sshbuf_put_cstring(m, lhost)) != 0 ||
1758: (r = sshbuf_put_u32(m, fwd->listen_port)) != 0 ||
1759: (r = sshbuf_put_cstring(m, chost)) != 0 ||
1760: (r = sshbuf_put_u32(m, fwd->connect_port)) != 0)
1.85 djm 1761: fatal_fr(r, "request");
1.10 djm 1762:
1.73 markus 1763: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 1764: fatal_f("write packet: %s", strerror(errno));
1.10 djm 1765:
1.73 markus 1766: sshbuf_reset(m);
1.10 djm 1767:
1768: /* Read their reply */
1.73 markus 1769: if (mux_client_read_packet(fd, m) != 0) {
1770: sshbuf_free(m);
1.10 djm 1771: return -1;
1772: }
1773:
1.73 markus 1774: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1775: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 1776: fatal_fr(r, "parse");
1.73 markus 1777: if (rid != muxclient_request_id)
1.85 djm 1778: fatal_f("out of sequence reply: my id %u theirs %u",
1779: muxclient_request_id, rid);
1.73 markus 1780:
1.10 djm 1781: switch (type) {
1782: case MUX_S_OK:
1.1 djm 1783: break;
1.18 markus 1784: case MUX_S_REMOTE_PORT:
1.30 djm 1785: if (cancel_flag)
1.85 djm 1786: fatal_f("got MUX_S_REMOTE_PORT for cancel");
1.73 markus 1787: if ((r = sshbuf_get_u32(m, &fwd->allocated_port)) != 0)
1.85 djm 1788: fatal_fr(r, "parse port");
1.52 djm 1789: verbose("Allocated port %u for remote forward to %s:%d",
1.18 markus 1790: fwd->allocated_port,
1791: fwd->connect_host ? fwd->connect_host : "",
1792: fwd->connect_port);
1793: if (muxclient_command == SSHMUX_COMMAND_FORWARD)
1.55 djm 1794: fprintf(stdout, "%i\n", fwd->allocated_port);
1.18 markus 1795: break;
1.10 djm 1796: case MUX_S_PERMISSION_DENIED:
1.73 markus 1797: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1798: fatal_fr(r, "parse error message");
1.73 markus 1799: sshbuf_free(m);
1.10 djm 1800: error("Master refused forwarding request: %s", e);
1801: return -1;
1802: case MUX_S_FAILURE:
1.73 markus 1803: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1804: fatal_fr(r, "parse error message");
1.73 markus 1805: sshbuf_free(m);
1.85 djm 1806: error_f("forwarding request failed: %s", e);
1.10 djm 1807: return -1;
1.1 djm 1808: default:
1.85 djm 1809: fatal_f("unexpected response from master 0x%08x", type);
1.10 djm 1810: }
1.73 markus 1811: sshbuf_free(m);
1.10 djm 1812:
1813: muxclient_request_id++;
1814: return 0;
1815: }
1816:
1817: static int
1.30 djm 1818: mux_client_forwards(int fd, int cancel_flag)
1.10 djm 1819: {
1.30 djm 1820: int i, ret = 0;
1.10 djm 1821:
1.85 djm 1822: debug3_f("%s forwardings: %d local, %d remote",
1.30 djm 1823: cancel_flag ? "cancel" : "request",
1.10 djm 1824: options.num_local_forwards, options.num_remote_forwards);
1825:
1826: /* XXX ExitOnForwardingFailure */
1827: for (i = 0; i < options.num_local_forwards; i++) {
1.30 djm 1828: if (mux_client_forward(fd, cancel_flag,
1.10 djm 1829: options.local_forwards[i].connect_port == 0 ?
1830: MUX_FWD_DYNAMIC : MUX_FWD_LOCAL,
1831: options.local_forwards + i) != 0)
1.30 djm 1832: ret = -1;
1.10 djm 1833: }
1834: for (i = 0; i < options.num_remote_forwards; i++) {
1.30 djm 1835: if (mux_client_forward(fd, cancel_flag, MUX_FWD_REMOTE,
1.10 djm 1836: options.remote_forwards + i) != 0)
1.30 djm 1837: ret = -1;
1.10 djm 1838: }
1.30 djm 1839: return ret;
1.10 djm 1840: }
1841:
1842: static int
1843: mux_client_request_session(int fd)
1844: {
1.73 markus 1845: struct sshbuf *m;
1846: char *e;
1.89 djm 1847: const char *term = NULL;
1.94 djm 1848: u_int i, echar, rid, sid, esid, exitval, type, exitval_seen;
1.10 djm 1849: extern char **environ;
1.94 djm 1850: int r, rawmode;
1.10 djm 1851:
1.85 djm 1852: debug3_f("entering");
1.10 djm 1853:
1854: if ((muxserver_pid = mux_client_request_alive(fd)) == 0) {
1.85 djm 1855: error_f("master alive request failed");
1.10 djm 1856: return -1;
1.1 djm 1857: }
1858:
1.81 dtucker 1859: ssh_signal(SIGPIPE, SIG_IGN);
1.10 djm 1860:
1.91 djm 1861: if (options.stdin_null && stdfd_devnull(1, 0, 0) == -1)
1.85 djm 1862: fatal_f("stdfd_devnull failed");
1.1 djm 1863:
1.89 djm 1864: if ((term = lookup_env_in_list("TERM", options.setenv,
1865: options.num_setenv)) == NULL || *term == '\0')
1866: term = getenv("TERM");
1867:
1.73 markus 1868: echar = 0xffffffff;
1869: if (options.escape_char != SSH_ESCAPECHAR_NONE)
1870: echar = (u_int)options.escape_char;
1871:
1872: if ((m = sshbuf_new()) == NULL)
1.85 djm 1873: fatal_f("sshbuf_new");
1.73 markus 1874: if ((r = sshbuf_put_u32(m, MUX_C_NEW_SESSION)) != 0 ||
1875: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
1876: (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */
1877: (r = sshbuf_put_u32(m, tty_flag)) != 0 ||
1878: (r = sshbuf_put_u32(m, options.forward_x11)) != 0 ||
1879: (r = sshbuf_put_u32(m, options.forward_agent)) != 0 ||
1.90 djm 1880: (r = sshbuf_put_u32(m, options.session_type == SESSION_TYPE_SUBSYSTEM)) != 0 ||
1.73 markus 1881: (r = sshbuf_put_u32(m, echar)) != 0 ||
1.89 djm 1882: (r = sshbuf_put_cstring(m, term == NULL ? "" : term)) != 0 ||
1.73 markus 1883: (r = sshbuf_put_stringb(m, command)) != 0)
1.85 djm 1884: fatal_fr(r, "request");
1.10 djm 1885:
1.71 djm 1886: /* Pass environment */
1.10 djm 1887: if (options.num_send_env > 0 && environ != NULL) {
1888: for (i = 0; environ[i] != NULL; i++) {
1.73 markus 1889: if (!env_permitted(environ[i]))
1890: continue;
1891: if ((r = sshbuf_put_cstring(m, environ[i])) != 0)
1.85 djm 1892: fatal_fr(r, "request sendenv");
1.10 djm 1893: }
1.5 djm 1894: }
1.73 markus 1895: for (i = 0; i < options.num_setenv; i++) {
1896: if ((r = sshbuf_put_cstring(m, options.setenv[i])) != 0)
1.85 djm 1897: fatal_fr(r, "request setenv");
1.73 markus 1898: }
1.5 djm 1899:
1.73 markus 1900: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 1901: fatal_f("write packet: %s", strerror(errno));
1.10 djm 1902:
1903: /* Send the stdio file descriptors */
1904: if (mm_send_fd(fd, STDIN_FILENO) == -1 ||
1905: mm_send_fd(fd, STDOUT_FILENO) == -1 ||
1906: mm_send_fd(fd, STDERR_FILENO) == -1)
1.85 djm 1907: fatal_f("send fds failed");
1.10 djm 1908:
1.85 djm 1909: debug3_f("session request sent");
1.1 djm 1910:
1.10 djm 1911: /* Read their reply */
1.73 markus 1912: sshbuf_reset(m);
1913: if (mux_client_read_packet(fd, m) != 0) {
1.85 djm 1914: error_f("read from master failed: %s", strerror(errno));
1.73 markus 1915: sshbuf_free(m);
1.10 djm 1916: return -1;
1917: }
1918:
1.73 markus 1919: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1920: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 1921: fatal_fr(r, "parse");
1.73 markus 1922: if (rid != muxclient_request_id)
1.85 djm 1923: fatal_f("out of sequence reply: my id %u theirs %u",
1924: muxclient_request_id, rid);
1.73 markus 1925:
1.10 djm 1926: switch (type) {
1927: case MUX_S_SESSION_OPENED:
1.73 markus 1928: if ((r = sshbuf_get_u32(m, &sid)) != 0)
1.85 djm 1929: fatal_fr(r, "parse session ID");
1930: debug_f("master session id: %u", sid);
1.10 djm 1931: break;
1932: case MUX_S_PERMISSION_DENIED:
1.73 markus 1933: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1934: fatal_fr(r, "parse error message");
1.24 djm 1935: error("Master refused session request: %s", e);
1.73 markus 1936: sshbuf_free(m);
1.10 djm 1937: return -1;
1938: case MUX_S_FAILURE:
1.73 markus 1939: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1940: fatal_fr(r, "parse error message");
1941: error_f("session request failed: %s", e);
1.73 markus 1942: sshbuf_free(m);
1.10 djm 1943: return -1;
1944: default:
1.73 markus 1945: sshbuf_free(m);
1.85 djm 1946: error_f("unexpected response from master 0x%08x", type);
1.10 djm 1947: return -1;
1948: }
1949: muxclient_request_id++;
1.1 djm 1950:
1.57 semarie 1951: if (pledge("stdio proc tty", NULL) == -1)
1.85 djm 1952: fatal_f("pledge(): %s", strerror(errno));
1.57 semarie 1953:
1.81 dtucker 1954: ssh_signal(SIGHUP, control_client_sighandler);
1955: ssh_signal(SIGINT, control_client_sighandler);
1956: ssh_signal(SIGTERM, control_client_sighandler);
1957: ssh_signal(SIGWINCH, control_client_sigrelay);
1.1 djm 1958:
1.28 djm 1959: rawmode = tty_flag;
1.1 djm 1960: if (tty_flag)
1.27 djm 1961: enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
1.1 djm 1962:
1963: /*
1964: * Stick around until the controlee closes the client_fd.
1.10 djm 1965: * Before it does, it is expected to write an exit message.
1966: * This process must read the value and wait for the closure of
1967: * the client_fd; if this one closes early, the multiplex master will
1968: * terminate early too (possibly losing data).
1.1 djm 1969: */
1.10 djm 1970: for (exitval = 255, exitval_seen = 0;;) {
1.73 markus 1971: sshbuf_reset(m);
1972: if (mux_client_read_packet(fd, m) != 0)
1.1 djm 1973: break;
1.73 markus 1974: if ((r = sshbuf_get_u32(m, &type)) != 0)
1.85 djm 1975: fatal_fr(r, "parse type");
1.28 djm 1976: switch (type) {
1977: case MUX_S_TTY_ALLOC_FAIL:
1.73 markus 1978: if ((r = sshbuf_get_u32(m, &esid)) != 0)
1.85 djm 1979: fatal_fr(r, "parse session ID");
1.73 markus 1980: if (esid != sid)
1.85 djm 1981: fatal_f("tty alloc fail on unknown session: "
1982: "my id %u theirs %u", sid, esid);
1.28 djm 1983: leave_raw_mode(options.request_tty ==
1984: REQUEST_TTY_FORCE);
1985: rawmode = 0;
1986: continue;
1987: case MUX_S_EXIT_MESSAGE:
1.73 markus 1988: if ((r = sshbuf_get_u32(m, &esid)) != 0)
1.85 djm 1989: fatal_fr(r, "parse session ID");
1.73 markus 1990: if (esid != sid)
1.85 djm 1991: fatal_f("exit on unknown session: "
1992: "my id %u theirs %u", sid, esid);
1.28 djm 1993: if (exitval_seen)
1.85 djm 1994: fatal_f("exitval sent twice");
1.73 markus 1995: if ((r = sshbuf_get_u32(m, &exitval)) != 0)
1.85 djm 1996: fatal_fr(r, "parse exitval");
1.28 djm 1997: exitval_seen = 1;
1998: continue;
1999: default:
1.73 markus 2000: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2001: fatal_fr(r, "parse error message");
2002: fatal_f("master returned error: %s", e);
1.1 djm 2003: }
2004: }
2005:
1.10 djm 2006: close(fd);
1.28 djm 2007: if (rawmode)
2008: leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
1.10 djm 2009:
1.1 djm 2010: if (muxclient_terminate) {
1.69 dtucker 2011: debug2("Exiting on signal: %s", strsignal(muxclient_terminate));
1.10 djm 2012: exitval = 255;
2013: } else if (!exitval_seen) {
1.1 djm 2014: debug2("Control master terminated unexpectedly");
1.10 djm 2015: exitval = 255;
1.1 djm 2016: } else
1.10 djm 2017: debug2("Received exit status from master %d", exitval);
1.1 djm 2018:
1.92 djm 2019: if (tty_flag && options.log_level >= SYSLOG_LEVEL_INFO)
1.1 djm 2020: fprintf(stderr, "Shared connection to %s closed.\r\n", host);
2021:
1.10 djm 2022: exit(exitval);
2023: }
2024:
2025: static int
1.62 markus 2026: mux_client_proxy(int fd)
2027: {
1.73 markus 2028: struct sshbuf *m;
1.62 markus 2029: char *e;
2030: u_int type, rid;
1.73 markus 2031: int r;
1.62 markus 2032:
1.73 markus 2033: if ((m = sshbuf_new()) == NULL)
1.85 djm 2034: fatal_f("sshbuf_new");
1.73 markus 2035: if ((r = sshbuf_put_u32(m, MUX_C_PROXY)) != 0 ||
2036: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1.85 djm 2037: fatal_fr(r, "request");
1.73 markus 2038: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 2039: fatal_f("write packet: %s", strerror(errno));
1.62 markus 2040:
1.73 markus 2041: sshbuf_reset(m);
1.62 markus 2042:
2043: /* Read their reply */
1.73 markus 2044: if (mux_client_read_packet(fd, m) != 0) {
2045: sshbuf_free(m);
1.62 markus 2046: return 0;
2047: }
1.73 markus 2048: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2049: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 2050: fatal_fr(r, "parse");
1.73 markus 2051: if (rid != muxclient_request_id)
1.85 djm 2052: fatal_f("out of sequence reply: my id %u theirs %u",
2053: muxclient_request_id, rid);
1.62 markus 2054: if (type != MUX_S_PROXY) {
1.73 markus 2055: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2056: fatal_fr(r, "parse error message");
2057: fatal_f("master returned error: %s", e);
1.62 markus 2058: }
1.73 markus 2059: sshbuf_free(m);
1.62 markus 2060:
1.85 djm 2061: debug3_f("done");
1.62 markus 2062: muxclient_request_id++;
2063: return 0;
2064: }
2065:
2066: static int
1.10 djm 2067: mux_client_request_stdio_fwd(int fd)
2068: {
1.73 markus 2069: struct sshbuf *m;
1.10 djm 2070: char *e;
2071: u_int type, rid, sid;
1.84 djm 2072: int r;
1.10 djm 2073:
1.85 djm 2074: debug3_f("entering");
1.10 djm 2075:
2076: if ((muxserver_pid = mux_client_request_alive(fd)) == 0) {
1.85 djm 2077: error_f("master alive request failed");
1.10 djm 2078: return -1;
2079: }
2080:
1.81 dtucker 2081: ssh_signal(SIGPIPE, SIG_IGN);
1.10 djm 2082:
1.91 djm 2083: if (options.stdin_null && stdfd_devnull(1, 0, 0) == -1)
1.85 djm 2084: fatal_f("stdfd_devnull failed");
1.10 djm 2085:
1.73 markus 2086: if ((m = sshbuf_new()) == NULL)
1.85 djm 2087: fatal_f("sshbuf_new");
1.73 markus 2088: if ((r = sshbuf_put_u32(m, MUX_C_NEW_STDIO_FWD)) != 0 ||
2089: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
2090: (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */
2091: (r = sshbuf_put_cstring(m, options.stdio_forward_host)) != 0 ||
2092: (r = sshbuf_put_u32(m, options.stdio_forward_port)) != 0)
1.85 djm 2093: fatal_fr(r, "request");
1.10 djm 2094:
1.73 markus 2095: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 2096: fatal_f("write packet: %s", strerror(errno));
1.10 djm 2097:
2098: /* Send the stdio file descriptors */
2099: if (mm_send_fd(fd, STDIN_FILENO) == -1 ||
2100: mm_send_fd(fd, STDOUT_FILENO) == -1)
1.85 djm 2101: fatal_f("send fds failed");
1.10 djm 2102:
1.56 semarie 2103: if (pledge("stdio proc tty", NULL) == -1)
1.85 djm 2104: fatal_f("pledge(): %s", strerror(errno));
1.56 semarie 2105:
1.85 djm 2106: debug3_f("stdio forward request sent");
1.10 djm 2107:
2108: /* Read their reply */
1.73 markus 2109: sshbuf_reset(m);
1.10 djm 2110:
1.73 markus 2111: if (mux_client_read_packet(fd, m) != 0) {
1.85 djm 2112: error_f("read from master failed: %s", strerror(errno));
1.73 markus 2113: sshbuf_free(m);
1.10 djm 2114: return -1;
2115: }
2116:
1.73 markus 2117: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2118: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 2119: fatal_fr(r, "parse");
1.73 markus 2120: if (rid != muxclient_request_id)
1.85 djm 2121: fatal_f("out of sequence reply: my id %u theirs %u",
2122: muxclient_request_id, rid);
1.10 djm 2123: switch (type) {
2124: case MUX_S_SESSION_OPENED:
1.73 markus 2125: if ((r = sshbuf_get_u32(m, &sid)) != 0)
1.85 djm 2126: fatal_fr(r, "parse session ID");
2127: debug_f("master session id: %u", sid);
1.10 djm 2128: break;
2129: case MUX_S_PERMISSION_DENIED:
1.73 markus 2130: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2131: fatal_fr(r, "parse error message");
1.73 markus 2132: sshbuf_free(m);
1.24 djm 2133: fatal("Master refused stdio forwarding request: %s", e);
1.10 djm 2134: case MUX_S_FAILURE:
1.73 markus 2135: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2136: fatal_fr(r, "parse error message");
1.73 markus 2137: sshbuf_free(m);
1.48 djm 2138: fatal("Stdio forwarding request failed: %s", e);
1.10 djm 2139: default:
1.73 markus 2140: sshbuf_free(m);
1.85 djm 2141: error_f("unexpected response from master 0x%08x", type);
1.10 djm 2142: return -1;
2143: }
2144: muxclient_request_id++;
2145:
1.81 dtucker 2146: ssh_signal(SIGHUP, control_client_sighandler);
2147: ssh_signal(SIGINT, control_client_sighandler);
2148: ssh_signal(SIGTERM, control_client_sighandler);
2149: ssh_signal(SIGWINCH, control_client_sigrelay);
1.10 djm 2150:
2151: /*
2152: * Stick around until the controlee closes the client_fd.
2153: */
1.73 markus 2154: sshbuf_reset(m);
2155: if (mux_client_read_packet(fd, m) != 0) {
1.10 djm 2156: if (errno == EPIPE ||
2157: (errno == EINTR && muxclient_terminate != 0))
2158: return 0;
1.85 djm 2159: fatal_f("mux_client_read_packet: %s", strerror(errno));
1.10 djm 2160: }
1.85 djm 2161: fatal_f("master returned unexpected message %u", type);
1.10 djm 2162: }
2163:
1.25 djm 2164: static void
2165: mux_client_request_stop_listening(int fd)
2166: {
1.73 markus 2167: struct sshbuf *m;
1.25 djm 2168: char *e;
2169: u_int type, rid;
1.73 markus 2170: int r;
1.25 djm 2171:
1.85 djm 2172: debug3_f("entering");
1.25 djm 2173:
1.73 markus 2174: if ((m = sshbuf_new()) == NULL)
1.85 djm 2175: fatal_f("sshbuf_new");
1.73 markus 2176: if ((r = sshbuf_put_u32(m, MUX_C_STOP_LISTENING)) != 0 ||
2177: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1.85 djm 2178: fatal_fr(r, "request");
1.25 djm 2179:
1.73 markus 2180: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 2181: fatal_f("write packet: %s", strerror(errno));
1.25 djm 2182:
1.73 markus 2183: sshbuf_reset(m);
1.25 djm 2184:
2185: /* Read their reply */
1.73 markus 2186: if (mux_client_read_packet(fd, m) != 0)
1.85 djm 2187: fatal_f("read from master failed: %s", strerror(errno));
1.25 djm 2188:
1.73 markus 2189: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2190: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 2191: fatal_fr(r, "parse");
1.73 markus 2192: if (rid != muxclient_request_id)
1.85 djm 2193: fatal_f("out of sequence reply: my id %u theirs %u",
2194: muxclient_request_id, rid);
1.73 markus 2195:
1.25 djm 2196: switch (type) {
2197: case MUX_S_OK:
2198: break;
2199: case MUX_S_PERMISSION_DENIED:
1.73 markus 2200: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2201: fatal_fr(r, "parse error message");
1.25 djm 2202: fatal("Master refused stop listening request: %s", e);
2203: case MUX_S_FAILURE:
1.73 markus 2204: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2205: fatal_fr(r, "parse error message");
2206: fatal_f("stop listening request failed: %s", e);
1.25 djm 2207: default:
1.85 djm 2208: fatal_f("unexpected response from master 0x%08x", type);
1.25 djm 2209: }
1.73 markus 2210: sshbuf_free(m);
1.25 djm 2211: muxclient_request_id++;
2212: }
2213:
1.10 djm 2214: /* Multiplex client main loop. */
1.62 markus 2215: int
1.10 djm 2216: muxclient(const char *path)
2217: {
2218: struct sockaddr_un addr;
2219: int sock;
2220: u_int pid;
2221:
2222: if (muxclient_command == 0) {
1.60 dtucker 2223: if (options.stdio_forward_host != NULL)
1.10 djm 2224: muxclient_command = SSHMUX_COMMAND_STDIO_FWD;
2225: else
2226: muxclient_command = SSHMUX_COMMAND_OPEN;
2227: }
2228:
2229: switch (options.control_master) {
2230: case SSHCTL_MASTER_AUTO:
2231: case SSHCTL_MASTER_AUTO_ASK:
2232: debug("auto-mux: Trying existing master");
2233: /* FALLTHROUGH */
2234: case SSHCTL_MASTER_NO:
2235: break;
2236: default:
1.62 markus 2237: return -1;
1.10 djm 2238: }
2239:
2240: memset(&addr, '\0', sizeof(addr));
2241: addr.sun_family = AF_UNIX;
2242:
2243: if (strlcpy(addr.sun_path, path,
2244: sizeof(addr.sun_path)) >= sizeof(addr.sun_path))
1.61 dtucker 2245: fatal("ControlPath too long ('%s' >= %u bytes)", path,
1.87 djm 2246: (unsigned int)sizeof(addr.sun_path));
1.10 djm 2247:
1.80 deraadt 2248: if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
1.85 djm 2249: fatal_f("socket(): %s", strerror(errno));
1.10 djm 2250:
1.64 guenther 2251: if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
1.10 djm 2252: switch (muxclient_command) {
2253: case SSHMUX_COMMAND_OPEN:
2254: case SSHMUX_COMMAND_STDIO_FWD:
2255: break;
2256: default:
2257: fatal("Control socket connect(%.100s): %s", path,
2258: strerror(errno));
2259: }
1.22 djm 2260: if (errno == ECONNREFUSED &&
2261: options.control_master != SSHCTL_MASTER_NO) {
2262: debug("Stale control socket %.100s, unlinking", path);
2263: unlink(path);
2264: } else if (errno == ENOENT) {
1.10 djm 2265: debug("Control socket \"%.100s\" does not exist", path);
1.22 djm 2266: } else {
1.10 djm 2267: error("Control socket connect(%.100s): %s", path,
2268: strerror(errno));
2269: }
2270: close(sock);
1.62 markus 2271: return -1;
1.10 djm 2272: }
2273: set_nonblock(sock);
2274:
2275: if (mux_client_hello_exchange(sock) != 0) {
1.85 djm 2276: error_f("master hello exchange failed");
1.10 djm 2277: close(sock);
1.62 markus 2278: return -1;
1.10 djm 2279: }
2280:
2281: switch (muxclient_command) {
2282: case SSHMUX_COMMAND_ALIVE_CHECK:
2283: if ((pid = mux_client_request_alive(sock)) == 0)
1.85 djm 2284: fatal_f("master alive check failed");
1.55 djm 2285: fprintf(stderr, "Master running (pid=%u)\r\n", pid);
1.10 djm 2286: exit(0);
2287: case SSHMUX_COMMAND_TERMINATE:
2288: mux_client_request_terminate(sock);
1.63 dtucker 2289: if (options.log_level != SYSLOG_LEVEL_QUIET)
2290: fprintf(stderr, "Exit request sent.\r\n");
1.18 markus 2291: exit(0);
2292: case SSHMUX_COMMAND_FORWARD:
1.30 djm 2293: if (mux_client_forwards(sock, 0) != 0)
1.85 djm 2294: fatal_f("master forward request failed");
1.10 djm 2295: exit(0);
2296: case SSHMUX_COMMAND_OPEN:
1.30 djm 2297: if (mux_client_forwards(sock, 0) != 0) {
1.85 djm 2298: error_f("master forward request failed");
1.62 markus 2299: return -1;
1.10 djm 2300: }
2301: mux_client_request_session(sock);
1.62 markus 2302: return -1;
1.10 djm 2303: case SSHMUX_COMMAND_STDIO_FWD:
2304: mux_client_request_stdio_fwd(sock);
1.25 djm 2305: exit(0);
2306: case SSHMUX_COMMAND_STOP:
2307: mux_client_request_stop_listening(sock);
1.63 dtucker 2308: if (options.log_level != SYSLOG_LEVEL_QUIET)
2309: fprintf(stderr, "Stop listening request sent.\r\n");
1.30 djm 2310: exit(0);
2311: case SSHMUX_COMMAND_CANCEL_FWD:
2312: if (mux_client_forwards(sock, 1) != 0)
1.85 djm 2313: error_f("master cancel forward request failed");
1.10 djm 2314: exit(0);
1.62 markus 2315: case SSHMUX_COMMAND_PROXY:
2316: mux_client_proxy(sock);
2317: return (sock);
1.10 djm 2318: default:
2319: fatal("unrecognised muxclient_command %d", muxclient_command);
2320: }
1.1 djm 2321: }
![[BACK]](/icons/back.gif){kind=icon}
Return to mux.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh