Annotation of src/usr.bin/ssh/mux.c, Revision 1.97
1.97 ! djm 1: /* $OpenBSD: mux.c,v 1.96 2023/03/08 04:43:12 guenther Exp $ */
1.1 djm 2: /*
3: * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
4: *
5: * Permission to use, copy, modify, and distribute this software for any
6: * purpose with or without fee is hereby granted, provided that the above
7: * copyright notice and this permission notice appear in all copies.
8: *
9: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16: */
17:
18: /* ssh session multiplexing support */
1.2 djm 19:
1.1 djm 20: #include <sys/types.h>
21: #include <sys/queue.h>
22: #include <sys/stat.h>
23: #include <sys/socket.h>
24: #include <sys/un.h>
25:
26: #include <errno.h>
27: #include <fcntl.h>
1.10 djm 28: #include <poll.h>
1.97 ! djm 29: #include <limits.h>
1.1 djm 30: #include <signal.h>
31: #include <stdarg.h>
32: #include <stddef.h>
33: #include <stdlib.h>
34: #include <stdio.h>
35: #include <string.h>
36: #include <unistd.h>
37: #include <util.h>
38: #include <paths.h>
39:
1.10 djm 40: #include "atomicio.h"
1.1 djm 41: #include "xmalloc.h"
42: #include "log.h"
43: #include "ssh.h"
1.18 markus 44: #include "ssh2.h"
1.1 djm 45: #include "pathnames.h"
46: #include "misc.h"
47: #include "match.h"
1.73 markus 48: #include "sshbuf.h"
1.1 djm 49: #include "channels.h"
50: #include "msg.h"
51: #include "packet.h"
52: #include "monitor_fdpass.h"
53: #include "sshpty.h"
1.74 markus 54: #include "sshkey.h"
1.1 djm 55: #include "readconf.h"
56: #include "clientloop.h"
1.62 markus 57: #include "ssherr.h"
1.78 djm 58:
1.1 djm 59: /* from ssh.c */
60: extern int tty_flag;
61: extern Options options;
62: extern char *host;
1.72 markus 63: extern struct sshbuf *command;
1.10 djm 64: extern volatile sig_atomic_t quit_pending;
1.1 djm 65:
1.2 djm 66: /* Context for session open confirmation callback */
67: struct mux_session_confirm_ctx {
1.10 djm 68: u_int want_tty;
69: u_int want_subsys;
70: u_int want_x_fwd;
71: u_int want_agent_fwd;
1.73 markus 72: struct sshbuf *cmd;
1.2 djm 73: char *term;
74: struct termios tio;
75: char **env;
1.17 djm 76: u_int rid;
1.2 djm 77: };
78:
1.48 djm 79: /* Context for stdio fwd open confirmation callback */
80: struct mux_stdio_confirm_ctx {
81: u_int rid;
82: };
83:
1.18 markus 84: /* Context for global channel callback */
85: struct mux_channel_confirm_ctx {
86: u_int cid; /* channel id */
87: u_int rid; /* request id */
88: int fid; /* forward id */
89: };
90:
1.1 djm 91: /* fd to control socket */
92: int muxserver_sock = -1;
93:
1.10 djm 94: /* client request id */
95: u_int muxclient_request_id = 0;
96:
1.1 djm 97: /* Multiplexing control command */
98: u_int muxclient_command = 0;
99:
100: /* Set when signalled. */
101: static volatile sig_atomic_t muxclient_terminate = 0;
102:
103: /* PID of multiplex server */
104: static u_int muxserver_pid = 0;
105:
1.10 djm 106: static Channel *mux_listener_channel = NULL;
107:
108: struct mux_master_state {
109: int hello_rcvd;
110: };
1.1 djm 111:
1.10 djm 112: /* mux protocol messages */
113: #define MUX_MSG_HELLO 0x00000001
114: #define MUX_C_NEW_SESSION 0x10000002
115: #define MUX_C_ALIVE_CHECK 0x10000004
116: #define MUX_C_TERMINATE 0x10000005
117: #define MUX_C_OPEN_FWD 0x10000006
118: #define MUX_C_CLOSE_FWD 0x10000007
119: #define MUX_C_NEW_STDIO_FWD 0x10000008
1.25 djm 120: #define MUX_C_STOP_LISTENING 0x10000009
1.62 markus 121: #define MUX_C_PROXY 0x1000000f
1.10 djm 122: #define MUX_S_OK 0x80000001
123: #define MUX_S_PERMISSION_DENIED 0x80000002
124: #define MUX_S_FAILURE 0x80000003
125: #define MUX_S_EXIT_MESSAGE 0x80000004
126: #define MUX_S_ALIVE 0x80000005
127: #define MUX_S_SESSION_OPENED 0x80000006
1.18 markus 128: #define MUX_S_REMOTE_PORT 0x80000007
1.28 djm 129: #define MUX_S_TTY_ALLOC_FAIL 0x80000008
1.62 markus 130: #define MUX_S_PROXY 0x8000000f
1.10 djm 131:
132: /* type codes for MUX_C_OPEN_FWD and MUX_C_CLOSE_FWD */
133: #define MUX_FWD_LOCAL 1
134: #define MUX_FWD_REMOTE 2
135: #define MUX_FWD_DYNAMIC 3
136:
1.66 djm 137: static void mux_session_confirm(struct ssh *, int, int, void *);
138: static void mux_stdio_confirm(struct ssh *, int, int, void *);
1.10 djm 139:
1.76 djm 140: static int mux_master_process_hello(struct ssh *, u_int,
1.66 djm 141: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 142: static int mux_master_process_new_session(struct ssh *, u_int,
1.66 djm 143: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 144: static int mux_master_process_alive_check(struct ssh *, u_int,
1.66 djm 145: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 146: static int mux_master_process_terminate(struct ssh *, u_int,
1.66 djm 147: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 148: static int mux_master_process_open_fwd(struct ssh *, u_int,
1.66 djm 149: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 150: static int mux_master_process_close_fwd(struct ssh *, u_int,
1.66 djm 151: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 152: static int mux_master_process_stdio_fwd(struct ssh *, u_int,
1.66 djm 153: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 154: static int mux_master_process_stop_listening(struct ssh *, u_int,
1.66 djm 155: Channel *, struct sshbuf *, struct sshbuf *);
1.76 djm 156: static int mux_master_process_proxy(struct ssh *, u_int,
1.66 djm 157: Channel *, struct sshbuf *, struct sshbuf *);
1.10 djm 158:
159: static const struct {
160: u_int type;
1.66 djm 161: int (*handler)(struct ssh *, u_int, Channel *,
162: struct sshbuf *, struct sshbuf *);
1.10 djm 163: } mux_master_handlers[] = {
1.76 djm 164: { MUX_MSG_HELLO, mux_master_process_hello },
165: { MUX_C_NEW_SESSION, mux_master_process_new_session },
166: { MUX_C_ALIVE_CHECK, mux_master_process_alive_check },
167: { MUX_C_TERMINATE, mux_master_process_terminate },
168: { MUX_C_OPEN_FWD, mux_master_process_open_fwd },
169: { MUX_C_CLOSE_FWD, mux_master_process_close_fwd },
170: { MUX_C_NEW_STDIO_FWD, mux_master_process_stdio_fwd },
171: { MUX_C_STOP_LISTENING, mux_master_process_stop_listening },
172: { MUX_C_PROXY, mux_master_process_proxy },
1.10 djm 173: { 0, NULL }
174: };
1.1 djm 175:
1.83 djm 176: /* Cleanup callback fired on closure of mux client _session_ channel */
1.42 dtucker 177: static void
1.95 djm 178: mux_master_session_cleanup_cb(struct ssh *ssh, int cid, int force, void *unused)
1.1 djm 179: {
1.66 djm 180: Channel *cc, *c = channel_by_id(ssh, cid);
1.1 djm 181:
1.85 djm 182: debug3_f("entering for channel %d", cid);
1.10 djm 183: if (c == NULL)
1.85 djm 184: fatal_f("channel_by_id(%i) == NULL", cid);
1.10 djm 185: if (c->ctl_chan != -1) {
1.66 djm 186: if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 187: fatal_f("channel %d missing control channel %d",
188: c->self, c->ctl_chan);
1.10 djm 189: c->ctl_chan = -1;
1.67 djm 190: cc->remote_id = 0;
191: cc->have_remote_id = 0;
1.66 djm 192: chan_rcvd_oclose(ssh, cc);
1.1 djm 193: }
1.66 djm 194: channel_cancel_cleanup(ssh, c->self);
1.1 djm 195: }
196:
1.83 djm 197: /* Cleanup callback fired on closure of mux client _control_ channel */
1.1 djm 198: static void
1.95 djm 199: mux_master_control_cleanup_cb(struct ssh *ssh, int cid, int force, void *unused)
1.1 djm 200: {
1.66 djm 201: Channel *sc, *c = channel_by_id(ssh, cid);
1.1 djm 202:
1.85 djm 203: debug3_f("entering for channel %d", cid);
1.10 djm 204: if (c == NULL)
1.85 djm 205: fatal_f("channel_by_id(%i) == NULL", cid);
1.67 djm 206: if (c->have_remote_id) {
1.66 djm 207: if ((sc = channel_by_id(ssh, c->remote_id)) == NULL)
1.85 djm 208: fatal_f("channel %d missing session channel %u",
209: c->self, c->remote_id);
1.67 djm 210: c->remote_id = 0;
211: c->have_remote_id = 0;
1.10 djm 212: sc->ctl_chan = -1;
1.39 djm 213: if (sc->type != SSH_CHANNEL_OPEN &&
214: sc->type != SSH_CHANNEL_OPENING) {
1.85 djm 215: debug2_f("channel %d: not open", sc->self);
1.66 djm 216: chan_mark_dead(ssh, sc);
1.12 djm 217: } else {
1.14 djm 218: if (sc->istate == CHAN_INPUT_OPEN)
1.66 djm 219: chan_read_failed(ssh, sc);
1.14 djm 220: if (sc->ostate == CHAN_OUTPUT_OPEN)
1.66 djm 221: chan_write_failed(ssh, sc);
1.12 djm 222: }
1.1 djm 223: }
1.66 djm 224: channel_cancel_cleanup(ssh, c->self);
1.1 djm 225: }
226:
1.10 djm 227: /* Check mux client environment variables before passing them to mux master. */
228: static int
1.93 djm 229: env_permitted(const char *env)
1.1 djm 230: {
1.94 djm 231: u_int i;
232: int ret;
1.10 djm 233: char name[1024], *cp;
1.1 djm 234:
1.10 djm 235: if ((cp = strchr(env, '=')) == NULL || cp == env)
1.1 djm 236: return 0;
1.10 djm 237: ret = snprintf(name, sizeof(name), "%.*s", (int)(cp - env), env);
238: if (ret <= 0 || (size_t)ret >= sizeof(name)) {
1.85 djm 239: error_f("name '%.100s...' too long", env);
1.1 djm 240: return 0;
241: }
242:
1.10 djm 243: for (i = 0; i < options.num_send_env; i++)
244: if (match_pattern(name, options.send_env[i]))
245: return 1;
1.1 djm 246:
1.10 djm 247: return 0;
248: }
1.1 djm 249:
1.10 djm 250: /* Mux master protocol message handlers */
1.1 djm 251:
1.10 djm 252: static int
1.76 djm 253: mux_master_process_hello(struct ssh *ssh, u_int rid,
1.73 markus 254: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 255: {
256: u_int ver;
257: struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx;
1.73 markus 258: int r;
1.1 djm 259:
1.10 djm 260: if (state == NULL)
1.85 djm 261: fatal_f("channel %d: c->mux_ctx == NULL", c->self);
1.10 djm 262: if (state->hello_rcvd) {
1.85 djm 263: error_f("HELLO received twice");
1.10 djm 264: return -1;
265: }
1.73 markus 266: if ((r = sshbuf_get_u32(m, &ver)) != 0) {
1.85 djm 267: error_fr(r, "parse");
1.10 djm 268: return -1;
269: }
270: if (ver != SSHMUX_VER) {
1.85 djm 271: error_f("unsupported multiplexing protocol version %u "
272: "(expected %u)", ver, SSHMUX_VER);
1.10 djm 273: return -1;
274: }
1.85 djm 275: debug2_f("channel %d client version %u", c->self, ver);
1.10 djm 276:
277: /* No extensions are presently defined */
1.73 markus 278: while (sshbuf_len(m) > 0) {
279: char *name = NULL;
1.76 djm 280: size_t value_len = 0;
1.73 markus 281:
282: if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 ||
1.76 djm 283: (r = sshbuf_get_string_direct(m, NULL, &value_len)) != 0) {
1.85 djm 284: error_fr(r, "parse extension");
1.73 markus 285: return -1;
1.1 djm 286: }
1.85 djm 287: debug2_f("Unrecognised extension \"%s\" length %zu",
288: name, value_len);
1.41 djm 289: free(name);
1.1 djm 290: }
1.10 djm 291: state->hello_rcvd = 1;
292: return 0;
293: }
294:
1.73 markus 295: /* Enqueue a "ok" response to the reply buffer */
296: static void
297: reply_ok(struct sshbuf *reply, u_int rid)
298: {
299: int r;
300:
301: if ((r = sshbuf_put_u32(reply, MUX_S_OK)) != 0 ||
302: (r = sshbuf_put_u32(reply, rid)) != 0)
1.85 djm 303: fatal_fr(r, "reply");
1.73 markus 304: }
305:
306: /* Enqueue an error response to the reply buffer */
307: static void
308: reply_error(struct sshbuf *reply, u_int type, u_int rid, const char *msg)
309: {
310: int r;
311:
312: if ((r = sshbuf_put_u32(reply, type)) != 0 ||
313: (r = sshbuf_put_u32(reply, rid)) != 0 ||
314: (r = sshbuf_put_cstring(reply, msg)) != 0)
1.85 djm 315: fatal_fr(r, "reply");
1.73 markus 316: }
317:
1.10 djm 318: static int
1.76 djm 319: mux_master_process_new_session(struct ssh *ssh, u_int rid,
1.73 markus 320: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 321: {
322: Channel *nc;
323: struct mux_session_confirm_ctx *cctx;
1.73 markus 324: char *cmd, *cp;
325: u_int i, j, env_len, escape_char, window, packetmax;
326: int r, new_fd[3];
1.1 djm 327:
328: /* Reply for SSHMUX_COMMAND_OPEN */
1.10 djm 329: cctx = xcalloc(1, sizeof(*cctx));
330: cctx->term = NULL;
1.17 djm 331: cctx->rid = rid;
1.73 markus 332: cmd = NULL;
1.36 djm 333: cctx->env = NULL;
334: env_len = 0;
1.73 markus 335: if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */
336: (r = sshbuf_get_u32(m, &cctx->want_tty)) != 0 ||
337: (r = sshbuf_get_u32(m, &cctx->want_x_fwd)) != 0 ||
338: (r = sshbuf_get_u32(m, &cctx->want_agent_fwd)) != 0 ||
339: (r = sshbuf_get_u32(m, &cctx->want_subsys)) != 0 ||
340: (r = sshbuf_get_u32(m, &escape_char)) != 0 ||
341: (r = sshbuf_get_cstring(m, &cctx->term, NULL)) != 0 ||
342: (r = sshbuf_get_cstring(m, &cmd, NULL)) != 0) {
1.10 djm 343: malf:
1.41 djm 344: free(cmd);
1.36 djm 345: for (j = 0; j < env_len; j++)
1.41 djm 346: free(cctx->env[j]);
347: free(cctx->env);
348: free(cctx->term);
349: free(cctx);
1.85 djm 350: error_f("malformed message");
1.10 djm 351: return -1;
1.1 djm 352: }
353:
1.10 djm 354: #define MUX_MAX_ENV_VARS 4096
1.73 markus 355: while (sshbuf_len(m) > 0) {
356: if ((r = sshbuf_get_cstring(m, &cp, NULL)) != 0)
1.10 djm 357: goto malf;
358: if (!env_permitted(cp)) {
1.41 djm 359: free(cp);
1.10 djm 360: continue;
361: }
1.51 deraadt 362: cctx->env = xreallocarray(cctx->env, env_len + 2,
1.10 djm 363: sizeof(*cctx->env));
364: cctx->env[env_len++] = cp;
365: cctx->env[env_len] = NULL;
366: if (env_len > MUX_MAX_ENV_VARS) {
1.85 djm 367: error_f(">%d environment variables received, "
368: "ignoring additional", MUX_MAX_ENV_VARS);
1.10 djm 369: break;
370: }
1.1 djm 371: }
372:
1.85 djm 373: debug2_f("channel %d: request tty %d, X %d, agent %d, subsys %d, "
374: "term \"%s\", cmd \"%s\", env %u", c->self,
1.10 djm 375: cctx->want_tty, cctx->want_x_fwd, cctx->want_agent_fwd,
376: cctx->want_subsys, cctx->term, cmd, env_len);
1.1 djm 377:
1.73 markus 378: if ((cctx->cmd = sshbuf_new()) == NULL)
1.85 djm 379: fatal_f("sshbuf_new");
1.73 markus 380: if ((r = sshbuf_put(cctx->cmd, cmd, strlen(cmd))) != 0)
1.85 djm 381: fatal_fr(r, "sshbuf_put");
1.41 djm 382: free(cmd);
1.11 djm 383: cmd = NULL;
1.1 djm 384:
385: /* Gather fds from client */
386: for(i = 0; i < 3; i++) {
1.10 djm 387: if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) {
1.85 djm 388: error_f("failed to receive fd %d from client", i);
1.1 djm 389: for (j = 0; j < i; j++)
390: close(new_fd[j]);
391: for (j = 0; j < env_len; j++)
1.41 djm 392: free(cctx->env[j]);
393: free(cctx->env);
394: free(cctx->term);
1.73 markus 395: sshbuf_free(cctx->cmd);
1.41 djm 396: free(cctx);
1.73 markus 397: reply_error(reply, MUX_S_FAILURE, rid,
1.10 djm 398: "did not receive file descriptors");
399: return -1;
1.1 djm 400: }
401: }
402:
1.85 djm 403: debug3_f("got fds stdin %d, stdout %d, stderr %d",
1.1 djm 404: new_fd[0], new_fd[1], new_fd[2]);
405:
1.10 djm 406: /* XXX support multiple child sessions in future */
1.67 djm 407: if (c->have_remote_id) {
1.85 djm 408: debug2_f("session already open");
1.73 markus 409: reply_error(reply, MUX_S_FAILURE, rid,
410: "Multiple sessions not supported");
1.10 djm 411: cleanup:
1.1 djm 412: close(new_fd[0]);
413: close(new_fd[1]);
414: close(new_fd[2]);
1.41 djm 415: free(cctx->term);
1.1 djm 416: if (env_len != 0) {
417: for (i = 0; i < env_len; i++)
1.41 djm 418: free(cctx->env[i]);
419: free(cctx->env);
1.1 djm 420: }
1.73 markus 421: sshbuf_free(cctx->cmd);
1.41 djm 422: free(cctx);
1.1 djm 423: return 0;
424: }
1.10 djm 425:
426: if (options.control_master == SSHCTL_MASTER_ASK ||
427: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
428: if (!ask_permission("Allow shared connection to %s? ", host)) {
1.85 djm 429: debug2_f("session refused by user");
1.73 markus 430: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
431: "Permission denied");
1.10 djm 432: goto cleanup;
433: }
434: }
435:
436: /* Try to pick up ttymodes from client before it goes raw */
437: if (cctx->want_tty && tcgetattr(new_fd[0], &cctx->tio) == -1)
1.85 djm 438: error_f("tcgetattr: %s", strerror(errno));
1.1 djm 439:
440: window = CHAN_SES_WINDOW_DEFAULT;
441: packetmax = CHAN_SES_PACKET_DEFAULT;
442: if (cctx->want_tty) {
443: window >>= 1;
444: packetmax >>= 1;
445: }
1.10 djm 446:
1.66 djm 447: nc = channel_new(ssh, "session", SSH_CHANNEL_OPENING,
1.1 djm 448: new_fd[0], new_fd[1], new_fd[2], window, packetmax,
1.88 djm 449: CHAN_EXTENDED_WRITE, "client-session", CHANNEL_NONBLOCK_STDIO);
1.1 djm 450:
1.10 djm 451: nc->ctl_chan = c->self; /* link session -> control channel */
1.86 djm 452: c->remote_id = nc->self; /* link control -> session channel */
1.67 djm 453: c->have_remote_id = 1;
1.10 djm 454:
1.2 djm 455: if (cctx->want_tty && escape_char != 0xffffffff) {
1.66 djm 456: channel_register_filter(ssh, nc->self,
1.2 djm 457: client_simple_escape_filter, NULL,
1.4 djm 458: client_filter_cleanup,
1.2 djm 459: client_new_escape_filter_ctx((int)escape_char));
460: }
1.1 djm 461:
1.85 djm 462: debug2_f("channel_new: %d linked to control channel %d",
463: nc->self, nc->ctl_chan);
1.10 djm 464:
1.66 djm 465: channel_send_open(ssh, nc->self);
466: channel_register_open_confirm(ssh, nc->self, mux_session_confirm, cctx);
1.17 djm 467: c->mux_pause = 1; /* stop handling messages until open_confirm done */
1.66 djm 468: channel_register_cleanup(ssh, nc->self,
469: mux_master_session_cleanup_cb, 1);
1.10 djm 470:
1.17 djm 471: /* reply is deferred, sent by mux_session_confirm */
1.1 djm 472: return 0;
473: }
474:
1.10 djm 475: static int
1.76 djm 476: mux_master_process_alive_check(struct ssh *ssh, u_int rid,
1.73 markus 477: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.1 djm 478: {
1.73 markus 479: int r;
480:
1.85 djm 481: debug2_f("channel %d: alive check", c->self);
1.1 djm 482:
1.10 djm 483: /* prepare reply */
1.73 markus 484: if ((r = sshbuf_put_u32(reply, MUX_S_ALIVE)) != 0 ||
485: (r = sshbuf_put_u32(reply, rid)) != 0 ||
486: (r = sshbuf_put_u32(reply, (u_int)getpid())) != 0)
1.85 djm 487: fatal_fr(r, "reply");
1.1 djm 488:
1.10 djm 489: return 0;
1.1 djm 490: }
491:
492: static int
1.76 djm 493: mux_master_process_terminate(struct ssh *ssh, u_int rid,
1.73 markus 494: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.1 djm 495: {
1.85 djm 496: debug2_f("channel %d: terminate request", c->self);
1.1 djm 497:
1.10 djm 498: if (options.control_master == SSHCTL_MASTER_ASK ||
499: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
500: if (!ask_permission("Terminate shared connection to %s? ",
501: host)) {
1.85 djm 502: debug2_f("termination refused by user");
1.73 markus 503: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
504: "Permission denied");
1.10 djm 505: return 0;
506: }
507: }
1.1 djm 508:
1.10 djm 509: quit_pending = 1;
1.73 markus 510: reply_ok(reply, rid);
1.10 djm 511: /* XXX exit happens too soon - message never makes it to client */
512: return 0;
1.1 djm 513: }
514:
1.10 djm 515: static char *
1.46 millert 516: format_forward(u_int ftype, struct Forward *fwd)
1.1 djm 517: {
1.10 djm 518: char *ret;
1.1 djm 519:
1.10 djm 520: switch (ftype) {
521: case MUX_FWD_LOCAL:
522: xasprintf(&ret, "local forward %.200s:%d -> %.200s:%d",
1.46 millert 523: (fwd->listen_path != NULL) ? fwd->listen_path :
1.10 djm 524: (fwd->listen_host == NULL) ?
1.46 millert 525: (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
1.10 djm 526: fwd->listen_host, fwd->listen_port,
1.46 millert 527: (fwd->connect_path != NULL) ? fwd->connect_path :
1.10 djm 528: fwd->connect_host, fwd->connect_port);
529: break;
530: case MUX_FWD_DYNAMIC:
531: xasprintf(&ret, "dynamic forward %.200s:%d -> *",
532: (fwd->listen_host == NULL) ?
1.46 millert 533: (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
1.87 djm 534: fwd->listen_host, fwd->listen_port);
1.10 djm 535: break;
536: case MUX_FWD_REMOTE:
537: xasprintf(&ret, "remote forward %.200s:%d -> %.200s:%d",
1.46 millert 538: (fwd->listen_path != NULL) ? fwd->listen_path :
1.10 djm 539: (fwd->listen_host == NULL) ?
540: "LOCALHOST" : fwd->listen_host,
541: fwd->listen_port,
1.46 millert 542: (fwd->connect_path != NULL) ? fwd->connect_path :
1.10 djm 543: fwd->connect_host, fwd->connect_port);
1.1 djm 544: break;
545: default:
1.85 djm 546: fatal_f("unknown forward type %u", ftype);
1.1 djm 547: }
1.10 djm 548: return ret;
549: }
1.1 djm 550:
1.10 djm 551: static int
552: compare_host(const char *a, const char *b)
553: {
554: if (a == NULL && b == NULL)
555: return 1;
556: if (a == NULL || b == NULL)
557: return 0;
558: return strcmp(a, b) == 0;
559: }
1.1 djm 560:
1.10 djm 561: static int
1.46 millert 562: compare_forward(struct Forward *a, struct Forward *b)
1.10 djm 563: {
564: if (!compare_host(a->listen_host, b->listen_host))
565: return 0;
1.46 millert 566: if (!compare_host(a->listen_path, b->listen_path))
567: return 0;
1.10 djm 568: if (a->listen_port != b->listen_port)
569: return 0;
570: if (!compare_host(a->connect_host, b->connect_host))
571: return 0;
1.46 millert 572: if (!compare_host(a->connect_path, b->connect_path))
573: return 0;
1.10 djm 574: if (a->connect_port != b->connect_port)
575: return 0;
1.1 djm 576:
1.10 djm 577: return 1;
578: }
1.1 djm 579:
1.18 markus 580: static void
1.66 djm 581: mux_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
1.18 markus 582: {
583: struct mux_channel_confirm_ctx *fctx = ctxt;
584: char *failmsg = NULL;
1.46 millert 585: struct Forward *rfwd;
1.18 markus 586: Channel *c;
1.73 markus 587: struct sshbuf *out;
1.79 djm 588: u_int port;
1.73 markus 589: int r;
1.18 markus 590:
1.66 djm 591: if ((c = channel_by_id(ssh, fctx->cid)) == NULL) {
1.18 markus 592: /* no channel for reply */
1.85 djm 593: error_f("unknown channel");
1.18 markus 594: return;
595: }
1.73 markus 596: if ((out = sshbuf_new()) == NULL)
1.85 djm 597: fatal_f("sshbuf_new");
1.53 djm 598: if (fctx->fid >= options.num_remote_forwards ||
599: (options.remote_forwards[fctx->fid].connect_path == NULL &&
600: options.remote_forwards[fctx->fid].connect_host == NULL)) {
1.18 markus 601: xasprintf(&failmsg, "unknown forwarding id %d", fctx->fid);
602: goto fail;
603: }
604: rfwd = &options.remote_forwards[fctx->fid];
1.85 djm 605: debug_f("%s for: listen %d, connect %s:%d",
1.18 markus 606: type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
1.46 millert 607: rfwd->listen_port, rfwd->connect_path ? rfwd->connect_path :
608: rfwd->connect_host, rfwd->connect_port);
1.18 markus 609: if (type == SSH2_MSG_REQUEST_SUCCESS) {
610: if (rfwd->listen_port == 0) {
1.79 djm 611: if ((r = sshpkt_get_u32(ssh, &port)) != 0)
1.85 djm 612: fatal_fr(r, "parse port");
1.79 djm 613: if (port > 65535) {
614: fatal("Invalid allocated port %u for "
615: "mux remote forward to %s:%d", port,
616: rfwd->connect_host, rfwd->connect_port);
617: }
618: rfwd->allocated_port = (int)port;
1.52 djm 619: debug("Allocated port %u for mux remote forward"
1.18 markus 620: " to %s:%d", rfwd->allocated_port,
621: rfwd->connect_host, rfwd->connect_port);
1.73 markus 622: if ((r = sshbuf_put_u32(out,
623: MUX_S_REMOTE_PORT)) != 0 ||
624: (r = sshbuf_put_u32(out, fctx->rid)) != 0 ||
625: (r = sshbuf_put_u32(out,
626: rfwd->allocated_port)) != 0)
1.85 djm 627: fatal_fr(r, "reply");
1.70 djm 628: channel_update_permission(ssh, rfwd->handle,
1.87 djm 629: rfwd->allocated_port);
1.18 markus 630: } else {
1.73 markus 631: reply_ok(out, fctx->rid);
1.18 markus 632: }
633: goto out;
634: } else {
1.31 markus 635: if (rfwd->listen_port == 0)
1.70 djm 636: channel_update_permission(ssh, rfwd->handle, -1);
1.46 millert 637: if (rfwd->listen_path != NULL)
638: xasprintf(&failmsg, "remote port forwarding failed for "
639: "listen path %s", rfwd->listen_path);
640: else
641: xasprintf(&failmsg, "remote port forwarding failed for "
642: "listen port %d", rfwd->listen_port);
1.53 djm 643:
1.87 djm 644: debug2_f("clearing registered forwarding for listen %d, "
1.85 djm 645: "connect %s:%d", rfwd->listen_port,
1.53 djm 646: rfwd->connect_path ? rfwd->connect_path :
647: rfwd->connect_host, rfwd->connect_port);
648:
649: free(rfwd->listen_host);
650: free(rfwd->listen_path);
651: free(rfwd->connect_host);
652: free(rfwd->connect_path);
653: memset(rfwd, 0, sizeof(*rfwd));
1.18 markus 654: }
655: fail:
1.85 djm 656: error_f("%s", failmsg);
1.73 markus 657: reply_error(out, MUX_S_FAILURE, fctx->rid, failmsg);
1.41 djm 658: free(failmsg);
1.18 markus 659: out:
1.73 markus 660: if ((r = sshbuf_put_stringb(c->output, out)) != 0)
1.85 djm 661: fatal_fr(r, "enqueue");
1.73 markus 662: sshbuf_free(out);
1.18 markus 663: if (c->mux_pause <= 0)
1.85 djm 664: fatal_f("mux_pause %d", c->mux_pause);
1.18 markus 665: c->mux_pause = 0; /* start processing messages again */
666: }
667:
1.10 djm 668: static int
1.76 djm 669: mux_master_process_open_fwd(struct ssh *ssh, u_int rid,
1.73 markus 670: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 671: {
1.46 millert 672: struct Forward fwd;
1.10 djm 673: char *fwd_desc = NULL;
1.46 millert 674: char *listen_addr, *connect_addr;
1.10 djm 675: u_int ftype;
1.44 djm 676: u_int lport, cport;
1.73 markus 677: int r, i, ret = 0, freefwd = 1;
1.10 djm 678:
1.54 djm 679: memset(&fwd, 0, sizeof(fwd));
680:
1.46 millert 681: /* XXX - lport/cport check redundant */
1.73 markus 682: if ((r = sshbuf_get_u32(m, &ftype)) != 0 ||
683: (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 ||
684: (r = sshbuf_get_u32(m, &lport)) != 0 ||
685: (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 ||
686: (r = sshbuf_get_u32(m, &cport)) != 0 ||
1.46 millert 687: (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
688: (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
1.85 djm 689: error_f("malformed message");
1.10 djm 690: ret = -1;
691: goto out;
692: }
1.46 millert 693: if (*listen_addr == '\0') {
694: free(listen_addr);
695: listen_addr = NULL;
696: }
697: if (*connect_addr == '\0') {
698: free(connect_addr);
699: connect_addr = NULL;
700: }
701:
702: memset(&fwd, 0, sizeof(fwd));
1.44 djm 703: fwd.listen_port = lport;
1.46 millert 704: if (fwd.listen_port == PORT_STREAMLOCAL)
705: fwd.listen_path = listen_addr;
706: else
707: fwd.listen_host = listen_addr;
1.44 djm 708: fwd.connect_port = cport;
1.46 millert 709: if (fwd.connect_port == PORT_STREAMLOCAL)
710: fwd.connect_path = connect_addr;
711: else
712: fwd.connect_host = connect_addr;
1.10 djm 713:
1.85 djm 714: debug2_f("channel %d: request %s", c->self,
1.10 djm 715: (fwd_desc = format_forward(ftype, &fwd)));
716:
717: if (ftype != MUX_FWD_LOCAL && ftype != MUX_FWD_REMOTE &&
718: ftype != MUX_FWD_DYNAMIC) {
1.85 djm 719: logit_f("invalid forwarding type %u", ftype);
1.10 djm 720: invalid:
1.46 millert 721: free(listen_addr);
722: free(connect_addr);
1.73 markus 723: reply_error(reply, MUX_S_FAILURE, rid,
724: "Invalid forwarding request");
1.10 djm 725: return 0;
726: }
1.46 millert 727: if (ftype == MUX_FWD_DYNAMIC && fwd.listen_path) {
1.85 djm 728: logit_f("streamlocal and dynamic forwards "
729: "are mutually exclusive");
1.46 millert 730: goto invalid;
731: }
732: if (fwd.listen_port != PORT_STREAMLOCAL && fwd.listen_port >= 65536) {
1.85 djm 733: logit_f("invalid listen port %u", fwd.listen_port);
1.10 djm 734: goto invalid;
735: }
1.66 djm 736: if ((fwd.connect_port != PORT_STREAMLOCAL &&
737: fwd.connect_port >= 65536) ||
738: (ftype != MUX_FWD_DYNAMIC && ftype != MUX_FWD_REMOTE &&
739: fwd.connect_port == 0)) {
1.85 djm 740: logit_f("invalid connect port %u",
1.10 djm 741: fwd.connect_port);
742: goto invalid;
743: }
1.66 djm 744: if (ftype != MUX_FWD_DYNAMIC && fwd.connect_host == NULL &&
745: fwd.connect_path == NULL) {
1.85 djm 746: logit_f("missing connect host");
1.10 djm 747: goto invalid;
748: }
749:
750: /* Skip forwards that have already been requested */
751: switch (ftype) {
752: case MUX_FWD_LOCAL:
753: case MUX_FWD_DYNAMIC:
754: for (i = 0; i < options.num_local_forwards; i++) {
755: if (compare_forward(&fwd,
756: options.local_forwards + i)) {
757: exists:
1.85 djm 758: debug2_f("found existing forwarding");
1.73 markus 759: reply_ok(reply, rid);
1.10 djm 760: goto out;
761: }
762: }
763: break;
764: case MUX_FWD_REMOTE:
765: for (i = 0; i < options.num_remote_forwards; i++) {
1.73 markus 766: if (!compare_forward(&fwd, options.remote_forwards + i))
767: continue;
768: if (fwd.listen_port != 0)
769: goto exists;
1.85 djm 770: debug2_f("found allocated port");
1.73 markus 771: if ((r = sshbuf_put_u32(reply,
772: MUX_S_REMOTE_PORT)) != 0 ||
773: (r = sshbuf_put_u32(reply, rid)) != 0 ||
774: (r = sshbuf_put_u32(reply,
775: options.remote_forwards[i].allocated_port)) != 0)
1.85 djm 776: fatal_fr(r, "reply FWD_REMOTE");
1.73 markus 777: goto out;
1.10 djm 778: }
779: break;
780: }
781:
782: if (options.control_master == SSHCTL_MASTER_ASK ||
783: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
784: if (!ask_permission("Open %s on %s?", fwd_desc, host)) {
1.85 djm 785: debug2_f("forwarding refused by user");
1.73 markus 786: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
787: "Permission denied");
1.10 djm 788: goto out;
789: }
790: }
791:
792: if (ftype == MUX_FWD_LOCAL || ftype == MUX_FWD_DYNAMIC) {
1.66 djm 793: if (!channel_setup_local_fwd_listener(ssh, &fwd,
1.46 millert 794: &options.fwd_opts)) {
1.10 djm 795: fail:
1.85 djm 796: logit_f("requested %s failed", fwd_desc);
1.73 markus 797: reply_error(reply, MUX_S_FAILURE, rid,
798: "Port forwarding failed");
1.10 djm 799: goto out;
800: }
801: add_local_forward(&options, &fwd);
802: freefwd = 0;
803: } else {
1.18 markus 804: struct mux_channel_confirm_ctx *fctx;
805:
1.66 djm 806: fwd.handle = channel_request_remote_forwarding(ssh, &fwd);
1.31 markus 807: if (fwd.handle < 0)
1.10 djm 808: goto fail;
809: add_remote_forward(&options, &fwd);
1.18 markus 810: fctx = xcalloc(1, sizeof(*fctx));
811: fctx->cid = c->self;
812: fctx->rid = rid;
1.20 djm 813: fctx->fid = options.num_remote_forwards - 1;
1.18 markus 814: client_register_global_confirm(mux_confirm_remote_forward,
815: fctx);
1.10 djm 816: freefwd = 0;
1.18 markus 817: c->mux_pause = 1; /* wait for mux_confirm_remote_forward */
818: /* delayed reply in mux_confirm_remote_forward */
819: goto out;
1.10 djm 820: }
1.73 markus 821: reply_ok(reply, rid);
1.10 djm 822: out:
1.41 djm 823: free(fwd_desc);
1.10 djm 824: if (freefwd) {
1.41 djm 825: free(fwd.listen_host);
1.46 millert 826: free(fwd.listen_path);
1.41 djm 827: free(fwd.connect_host);
1.46 millert 828: free(fwd.connect_path);
1.10 djm 829: }
830: return ret;
831: }
832:
833: static int
1.76 djm 834: mux_master_process_close_fwd(struct ssh *ssh, u_int rid,
1.73 markus 835: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 836: {
1.46 millert 837: struct Forward fwd, *found_fwd;
1.10 djm 838: char *fwd_desc = NULL;
1.30 djm 839: const char *error_reason = NULL;
1.46 millert 840: char *listen_addr = NULL, *connect_addr = NULL;
1.10 djm 841: u_int ftype;
1.73 markus 842: int r, i, ret = 0;
1.44 djm 843: u_int lport, cport;
1.54 djm 844:
845: memset(&fwd, 0, sizeof(fwd));
1.10 djm 846:
1.73 markus 847: if ((r = sshbuf_get_u32(m, &ftype)) != 0 ||
848: (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 ||
849: (r = sshbuf_get_u32(m, &lport)) != 0 ||
850: (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 ||
851: (r = sshbuf_get_u32(m, &cport)) != 0 ||
1.46 millert 852: (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
853: (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
1.85 djm 854: error_f("malformed message");
1.10 djm 855: ret = -1;
856: goto out;
857: }
858:
1.46 millert 859: if (*listen_addr == '\0') {
860: free(listen_addr);
861: listen_addr = NULL;
1.10 djm 862: }
1.46 millert 863: if (*connect_addr == '\0') {
864: free(connect_addr);
865: connect_addr = NULL;
1.10 djm 866: }
867:
1.46 millert 868: memset(&fwd, 0, sizeof(fwd));
869: fwd.listen_port = lport;
870: if (fwd.listen_port == PORT_STREAMLOCAL)
871: fwd.listen_path = listen_addr;
872: else
873: fwd.listen_host = listen_addr;
874: fwd.connect_port = cport;
875: if (fwd.connect_port == PORT_STREAMLOCAL)
876: fwd.connect_path = connect_addr;
877: else
878: fwd.connect_host = connect_addr;
879:
1.85 djm 880: debug2_f("channel %d: request cancel %s", c->self,
1.10 djm 881: (fwd_desc = format_forward(ftype, &fwd)));
882:
1.30 djm 883: /* make sure this has been requested */
884: found_fwd = NULL;
885: switch (ftype) {
886: case MUX_FWD_LOCAL:
887: case MUX_FWD_DYNAMIC:
888: for (i = 0; i < options.num_local_forwards; i++) {
889: if (compare_forward(&fwd,
890: options.local_forwards + i)) {
891: found_fwd = options.local_forwards + i;
892: break;
893: }
894: }
895: break;
896: case MUX_FWD_REMOTE:
897: for (i = 0; i < options.num_remote_forwards; i++) {
898: if (compare_forward(&fwd,
899: options.remote_forwards + i)) {
900: found_fwd = options.remote_forwards + i;
901: break;
902: }
903: }
904: break;
905: }
906:
907: if (found_fwd == NULL)
908: error_reason = "port not forwarded";
909: else if (ftype == MUX_FWD_REMOTE) {
910: /*
911: * This shouldn't fail unless we confused the host/port
912: * between options.remote_forwards and permitted_opens.
1.31 markus 913: * However, for dynamic allocated listen ports we need
1.46 millert 914: * to use the actual listen port.
1.30 djm 915: */
1.66 djm 916: if (channel_request_rforward_cancel(ssh, found_fwd) == -1)
1.30 djm 917: error_reason = "port not in permitted opens";
918: } else { /* local and dynamic forwards */
919: /* Ditto */
1.66 djm 920: if (channel_cancel_lport_listener(ssh, &fwd, fwd.connect_port,
1.46 millert 921: &options.fwd_opts) == -1)
1.30 djm 922: error_reason = "port not found";
923: }
924:
1.73 markus 925: if (error_reason != NULL)
926: reply_error(reply, MUX_S_FAILURE, rid, error_reason);
927: else {
928: reply_ok(reply, rid);
1.41 djm 929: free(found_fwd->listen_host);
1.46 millert 930: free(found_fwd->listen_path);
1.41 djm 931: free(found_fwd->connect_host);
1.46 millert 932: free(found_fwd->connect_path);
1.30 djm 933: found_fwd->listen_host = found_fwd->connect_host = NULL;
1.46 millert 934: found_fwd->listen_path = found_fwd->connect_path = NULL;
1.30 djm 935: found_fwd->listen_port = found_fwd->connect_port = 0;
936: }
1.10 djm 937: out:
1.41 djm 938: free(fwd_desc);
1.46 millert 939: free(listen_addr);
940: free(connect_addr);
1.10 djm 941:
942: return ret;
943: }
944:
945: static int
1.76 djm 946: mux_master_process_stdio_fwd(struct ssh *ssh, u_int rid,
1.73 markus 947: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.10 djm 948: {
949: Channel *nc;
1.73 markus 950: char *chost = NULL;
1.97 ! djm 951: u_int _cport, i, j;
! 952: int ok = 0, cport, r, new_fd[2];
1.48 djm 953: struct mux_stdio_confirm_ctx *cctx;
1.10 djm 954:
1.73 markus 955: if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */
956: (r = sshbuf_get_cstring(m, &chost, NULL)) != 0 ||
1.97 ! djm 957: (r = sshbuf_get_u32(m, &_cport)) != 0) {
1.41 djm 958: free(chost);
1.85 djm 959: error_f("malformed message");
1.10 djm 960: return -1;
961: }
1.97 ! djm 962: if (_cport == (u_int)PORT_STREAMLOCAL)
! 963: cport = PORT_STREAMLOCAL;
! 964: else if (_cport <= INT_MAX)
! 965: cport = (int)_cport;
! 966: else {
! 967: free(chost);
! 968: error_f("invalid port 0x%x", _cport);
! 969: return -1;
! 970: }
1.10 djm 971:
1.97 ! djm 972: debug2_f("channel %d: stdio fwd to %s:%d", c->self, chost, cport);
1.10 djm 973:
974: /* Gather fds from client */
975: for(i = 0; i < 2; i++) {
976: if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) {
1.85 djm 977: error_f("failed to receive fd %d from client", i);
1.10 djm 978: for (j = 0; j < i; j++)
979: close(new_fd[j]);
1.41 djm 980: free(chost);
1.10 djm 981:
982: /* prepare reply */
1.73 markus 983: reply_error(reply, MUX_S_FAILURE, rid,
1.10 djm 984: "did not receive file descriptors");
985: return -1;
986: }
987: }
988:
1.85 djm 989: debug3_f("got fds stdin %d, stdout %d", new_fd[0], new_fd[1]);
1.10 djm 990:
991: /* XXX support multiple child sessions in future */
1.67 djm 992: if (c->have_remote_id) {
1.85 djm 993: debug2_f("session already open");
1.73 markus 994: reply_error(reply, MUX_S_FAILURE, rid,
995: "Multiple sessions not supported");
1.10 djm 996: cleanup:
997: close(new_fd[0]);
998: close(new_fd[1]);
1.41 djm 999: free(chost);
1.10 djm 1000: return 0;
1001: }
1002:
1003: if (options.control_master == SSHCTL_MASTER_ASK ||
1004: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
1.97 ! djm 1005: if (cport == PORT_STREAMLOCAL) {
! 1006: ok = ask_permission("Allow forward to path %s", chost);
! 1007: } else {
! 1008: ok = ask_permission("Allow forward to [%s]:%d? ",
! 1009: chost, cport);
! 1010: }
! 1011: if (!ok) {
1.85 djm 1012: debug2_f("stdio fwd refused by user");
1.73 markus 1013: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
1014: "Permission denied");
1.10 djm 1015: goto cleanup;
1016: }
1017: }
1018:
1.88 djm 1019: nc = channel_connect_stdio_fwd(ssh, chost, cport, new_fd[0], new_fd[1],
1020: CHANNEL_NONBLOCK_STDIO);
1.75 djm 1021: free(chost);
1.10 djm 1022:
1023: nc->ctl_chan = c->self; /* link session -> control channel */
1.86 djm 1024: c->remote_id = nc->self; /* link control -> session channel */
1.67 djm 1025: c->have_remote_id = 1;
1.10 djm 1026:
1.85 djm 1027: debug2_f("channel_new: %d control %d", nc->self, nc->ctl_chan);
1.10 djm 1028:
1.66 djm 1029: channel_register_cleanup(ssh, nc->self,
1030: mux_master_session_cleanup_cb, 1);
1.10 djm 1031:
1.48 djm 1032: cctx = xcalloc(1, sizeof(*cctx));
1033: cctx->rid = rid;
1.66 djm 1034: channel_register_open_confirm(ssh, nc->self, mux_stdio_confirm, cctx);
1.48 djm 1035: c->mux_pause = 1; /* stop handling messages until open_confirm done */
1036:
1037: /* reply is deferred, sent by mux_session_confirm */
1038: return 0;
1039: }
1040:
1041: /* Callback on open confirmation in mux master for a mux stdio fwd session. */
1042: static void
1.66 djm 1043: mux_stdio_confirm(struct ssh *ssh, int id, int success, void *arg)
1.48 djm 1044: {
1045: struct mux_stdio_confirm_ctx *cctx = arg;
1046: Channel *c, *cc;
1.73 markus 1047: struct sshbuf *reply;
1048: int r;
1.48 djm 1049:
1050: if (cctx == NULL)
1.85 djm 1051: fatal_f("cctx == NULL");
1.66 djm 1052: if ((c = channel_by_id(ssh, id)) == NULL)
1.85 djm 1053: fatal_f("no channel for id %d", id);
1.66 djm 1054: if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 1055: fatal_f("channel %d lacks control channel %d",
1.48 djm 1056: id, c->ctl_chan);
1.73 markus 1057: if ((reply = sshbuf_new()) == NULL)
1.85 djm 1058: fatal_f("sshbuf_new");
1.48 djm 1059:
1060: if (!success) {
1.85 djm 1061: debug3_f("sending failure reply");
1.73 markus 1062: reply_error(reply, MUX_S_FAILURE, cctx->rid,
1063: "Session open refused by peer");
1.48 djm 1064: /* prepare reply */
1065: goto done;
1066: }
1067:
1.85 djm 1068: debug3_f("sending success reply");
1.10 djm 1069: /* prepare reply */
1.73 markus 1070: if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 ||
1071: (r = sshbuf_put_u32(reply, cctx->rid)) != 0 ||
1072: (r = sshbuf_put_u32(reply, c->self)) != 0)
1.85 djm 1073: fatal_fr(r, "reply");
1.48 djm 1074:
1075: done:
1076: /* Send reply */
1.73 markus 1077: if ((r = sshbuf_put_stringb(cc->output, reply)) != 0)
1.85 djm 1078: fatal_fr(r, "enqueue");
1.73 markus 1079: sshbuf_free(reply);
1.10 djm 1080:
1.48 djm 1081: if (cc->mux_pause <= 0)
1.85 djm 1082: fatal_f("mux_pause %d", cc->mux_pause);
1.48 djm 1083: cc->mux_pause = 0; /* start processing messages again */
1084: c->open_confirm_ctx = NULL;
1085: free(cctx);
1.10 djm 1086: }
1087:
1.25 djm 1088: static int
1.76 djm 1089: mux_master_process_stop_listening(struct ssh *ssh, u_int rid,
1.73 markus 1090: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.25 djm 1091: {
1.85 djm 1092: debug_f("channel %d: stop listening", c->self);
1.25 djm 1093:
1094: if (options.control_master == SSHCTL_MASTER_ASK ||
1095: options.control_master == SSHCTL_MASTER_AUTO_ASK) {
1096: if (!ask_permission("Disable further multiplexing on shared "
1097: "connection to %s? ", host)) {
1.85 djm 1098: debug2_f("stop listen refused by user");
1.73 markus 1099: reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
1100: "Permission denied");
1.25 djm 1101: return 0;
1102: }
1103: }
1104:
1105: if (mux_listener_channel != NULL) {
1.66 djm 1106: channel_free(ssh, mux_listener_channel);
1.25 djm 1107: client_stop_mux();
1.41 djm 1108: free(options.control_path);
1.25 djm 1109: options.control_path = NULL;
1110: mux_listener_channel = NULL;
1111: muxserver_sock = -1;
1112: }
1113:
1.73 markus 1114: reply_ok(reply, rid);
1.25 djm 1115: return 0;
1116: }
1117:
1.62 markus 1118: static int
1.76 djm 1119: mux_master_process_proxy(struct ssh *ssh, u_int rid,
1.73 markus 1120: Channel *c, struct sshbuf *m, struct sshbuf *reply)
1.62 markus 1121: {
1.73 markus 1122: int r;
1123:
1.85 djm 1124: debug_f("channel %d: proxy request", c->self);
1.62 markus 1125:
1126: c->mux_rcb = channel_proxy_downstream;
1.73 markus 1127: if ((r = sshbuf_put_u32(reply, MUX_S_PROXY)) != 0 ||
1128: (r = sshbuf_put_u32(reply, rid)) != 0)
1.85 djm 1129: fatal_fr(r, "reply");
1.62 markus 1130:
1131: return 0;
1132: }
1133:
1.83 djm 1134: /* Channel callbacks fired on read/write from mux client fd */
1.10 djm 1135: static int
1.66 djm 1136: mux_master_read_cb(struct ssh *ssh, Channel *c)
1.10 djm 1137: {
1138: struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx;
1.73 markus 1139: struct sshbuf *in = NULL, *out = NULL;
1140: u_int type, rid, i;
1141: int r, ret = -1;
1142:
1143: if ((out = sshbuf_new()) == NULL)
1.85 djm 1144: fatal_f("sshbuf_new");
1.10 djm 1145:
1146: /* Setup ctx and */
1147: if (c->mux_ctx == NULL) {
1.19 djm 1148: state = xcalloc(1, sizeof(*state));
1.10 djm 1149: c->mux_ctx = state;
1.66 djm 1150: channel_register_cleanup(ssh, c->self,
1.10 djm 1151: mux_master_control_cleanup_cb, 0);
1152:
1153: /* Send hello */
1.73 markus 1154: if ((r = sshbuf_put_u32(out, MUX_MSG_HELLO)) != 0 ||
1155: (r = sshbuf_put_u32(out, SSHMUX_VER)) != 0)
1.85 djm 1156: fatal_fr(r, "reply");
1.10 djm 1157: /* no extensions */
1.73 markus 1158: if ((r = sshbuf_put_stringb(c->output, out)) != 0)
1.85 djm 1159: fatal_fr(r, "enqueue");
1160: debug3_f("channel %d: hello sent", c->self);
1.73 markus 1161: ret = 0;
1162: goto out;
1.10 djm 1163: }
1164:
1165: /* Channel code ensures that we receive whole packets */
1.73 markus 1166: if ((r = sshbuf_froms(c->input, &in)) != 0) {
1.10 djm 1167: malf:
1.85 djm 1168: error_f("malformed message");
1.10 djm 1169: goto out;
1170: }
1171:
1.73 markus 1172: if ((r = sshbuf_get_u32(in, &type)) != 0)
1.10 djm 1173: goto malf;
1.85 djm 1174: debug3_f("channel %d packet type 0x%08x len %zu", c->self,
1175: type, sshbuf_len(in));
1.10 djm 1176:
1177: if (type == MUX_MSG_HELLO)
1178: rid = 0;
1179: else {
1180: if (!state->hello_rcvd) {
1.85 djm 1181: error_f("expected MUX_MSG_HELLO(0x%08x), "
1182: "received 0x%08x", MUX_MSG_HELLO, type);
1.10 djm 1183: goto out;
1.1 djm 1184: }
1.73 markus 1185: if ((r = sshbuf_get_u32(in, &rid)) != 0)
1.10 djm 1186: goto malf;
1187: }
1188:
1189: for (i = 0; mux_master_handlers[i].handler != NULL; i++) {
1190: if (type == mux_master_handlers[i].type) {
1.66 djm 1191: ret = mux_master_handlers[i].handler(ssh, rid,
1.73 markus 1192: c, in, out);
1.10 djm 1193: break;
1.1 djm 1194: }
1.10 djm 1195: }
1196: if (mux_master_handlers[i].handler == NULL) {
1.85 djm 1197: error_f("unsupported mux message 0x%08x", type);
1.73 markus 1198: reply_error(out, MUX_S_FAILURE, rid, "unsupported request");
1.10 djm 1199: ret = 0;
1200: }
1201: /* Enqueue reply packet */
1.85 djm 1202: if (sshbuf_len(out) != 0 &&
1203: (r = sshbuf_put_stringb(c->output, out)) != 0)
1204: fatal_fr(r, "enqueue");
1.10 djm 1205: out:
1.73 markus 1206: sshbuf_free(in);
1207: sshbuf_free(out);
1.10 djm 1208: return ret;
1209: }
1210:
1211: void
1.66 djm 1212: mux_exit_message(struct ssh *ssh, Channel *c, int exitval)
1.10 djm 1213: {
1.73 markus 1214: struct sshbuf *m;
1.10 djm 1215: Channel *mux_chan;
1.73 markus 1216: int r;
1.10 djm 1217:
1.85 djm 1218: debug3_f("channel %d: exit message, exitval %d", c->self, exitval);
1.10 djm 1219:
1.66 djm 1220: if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 1221: fatal_f("channel %d missing mux %d", c->self, c->ctl_chan);
1.10 djm 1222:
1223: /* Append exit message packet to control socket output queue */
1.73 markus 1224: if ((m = sshbuf_new()) == NULL)
1.85 djm 1225: fatal_f("sshbuf_new");
1.73 markus 1226: if ((r = sshbuf_put_u32(m, MUX_S_EXIT_MESSAGE)) != 0 ||
1227: (r = sshbuf_put_u32(m, c->self)) != 0 ||
1228: (r = sshbuf_put_u32(m, exitval)) != 0 ||
1229: (r = sshbuf_put_stringb(mux_chan->output, m)) != 0)
1.85 djm 1230: fatal_fr(r, "reply");
1.73 markus 1231: sshbuf_free(m);
1.10 djm 1232: }
1233:
1.28 djm 1234: void
1.66 djm 1235: mux_tty_alloc_failed(struct ssh *ssh, Channel *c)
1.28 djm 1236: {
1.73 markus 1237: struct sshbuf *m;
1.28 djm 1238: Channel *mux_chan;
1.73 markus 1239: int r;
1.28 djm 1240:
1.85 djm 1241: debug3_f("channel %d: TTY alloc failed", c->self);
1.28 djm 1242:
1.66 djm 1243: if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 1244: fatal_f("channel %d missing mux %d", c->self, c->ctl_chan);
1.28 djm 1245:
1246: /* Append exit message packet to control socket output queue */
1.73 markus 1247: if ((m = sshbuf_new()) == NULL)
1.85 djm 1248: fatal_f("sshbuf_new");
1.73 markus 1249: if ((r = sshbuf_put_u32(m, MUX_S_TTY_ALLOC_FAIL)) != 0 ||
1250: (r = sshbuf_put_u32(m, c->self)) != 0 ||
1251: (r = sshbuf_put_stringb(mux_chan->output, m)) != 0)
1.85 djm 1252: fatal_fr(r, "reply");
1.73 markus 1253: sshbuf_free(m);
1.28 djm 1254: }
1255:
1.10 djm 1256: /* Prepare a mux master to listen on a Unix domain socket. */
1257: void
1.66 djm 1258: muxserver_listen(struct ssh *ssh)
1.10 djm 1259: {
1260: mode_t old_umask;
1.22 djm 1261: char *orig_control_path = options.control_path;
1262: char rbuf[16+1];
1263: u_int i, r;
1.47 djm 1264: int oerrno;
1.10 djm 1265:
1266: if (options.control_path == NULL ||
1267: options.control_master == SSHCTL_MASTER_NO)
1.1 djm 1268: return;
1.10 djm 1269:
1270: debug("setting up multiplex master socket");
1271:
1.22 djm 1272: /*
1273: * Use a temporary path before listen so we can pseudo-atomically
1274: * establish the listening socket in its final location to avoid
1275: * other processes racing in between bind() and listen() and hitting
1276: * an unready socket.
1277: */
1278: for (i = 0; i < sizeof(rbuf) - 1; i++) {
1279: r = arc4random_uniform(26+26+10);
1280: rbuf[i] = (r < 26) ? 'a' + r :
1281: (r < 26*2) ? 'A' + r - 26 :
1282: '0' + r - 26 - 26;
1283: }
1284: rbuf[sizeof(rbuf) - 1] = '\0';
1285: options.control_path = NULL;
1286: xasprintf(&options.control_path, "%s.%s", orig_control_path, rbuf);
1.85 djm 1287: debug3_f("temporary control path %s", options.control_path);
1.22 djm 1288:
1.10 djm 1289: old_umask = umask(0177);
1.46 millert 1290: muxserver_sock = unix_listener(options.control_path, 64, 0);
1.47 djm 1291: oerrno = errno;
1.46 millert 1292: umask(old_umask);
1293: if (muxserver_sock < 0) {
1.47 djm 1294: if (oerrno == EINVAL || oerrno == EADDRINUSE) {
1.10 djm 1295: error("ControlSocket %s already exists, "
1296: "disabling multiplexing", options.control_path);
1.22 djm 1297: disable_mux_master:
1.26 djm 1298: if (muxserver_sock != -1) {
1299: close(muxserver_sock);
1300: muxserver_sock = -1;
1301: }
1.41 djm 1302: free(orig_control_path);
1303: free(options.control_path);
1.10 djm 1304: options.control_path = NULL;
1305: options.control_master = SSHCTL_MASTER_NO;
1306: return;
1.46 millert 1307: } else {
1308: /* unix_listener() logs the error */
1309: cleanup_exit(255);
1310: }
1.10 djm 1311: }
1312:
1.22 djm 1313: /* Now atomically "move" the mux socket into position */
1314: if (link(options.control_path, orig_control_path) != 0) {
1315: if (errno != EEXIST) {
1.85 djm 1316: fatal_f("link mux listener %s => %s: %s",
1.22 djm 1317: options.control_path, orig_control_path,
1318: strerror(errno));
1319: }
1320: error("ControlSocket %s already exists, disabling multiplexing",
1321: orig_control_path);
1322: unlink(options.control_path);
1323: goto disable_mux_master;
1324: }
1325: unlink(options.control_path);
1.41 djm 1326: free(options.control_path);
1.22 djm 1327: options.control_path = orig_control_path;
1328:
1.10 djm 1329: set_nonblock(muxserver_sock);
1330:
1.66 djm 1331: mux_listener_channel = channel_new(ssh, "mux listener",
1.10 djm 1332: SSH_CHANNEL_MUX_LISTENER, muxserver_sock, muxserver_sock, -1,
1333: CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1.22 djm 1334: 0, options.control_path, 1);
1.10 djm 1335: mux_listener_channel->mux_rcb = mux_master_read_cb;
1.85 djm 1336: debug3_f("mux listener channel %d fd %d",
1.10 djm 1337: mux_listener_channel->self, mux_listener_channel->sock);
1338: }
1339:
1340: /* Callback on open confirmation in mux master for a mux client session. */
1341: static void
1.66 djm 1342: mux_session_confirm(struct ssh *ssh, int id, int success, void *arg)
1.10 djm 1343: {
1344: struct mux_session_confirm_ctx *cctx = arg;
1345: const char *display;
1.17 djm 1346: Channel *c, *cc;
1.73 markus 1347: int i, r;
1348: struct sshbuf *reply;
1.10 djm 1349:
1350: if (cctx == NULL)
1.85 djm 1351: fatal_f("cctx == NULL");
1.66 djm 1352: if ((c = channel_by_id(ssh, id)) == NULL)
1.85 djm 1353: fatal_f("no channel for id %d", id);
1.66 djm 1354: if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1.85 djm 1355: fatal_f("channel %d lacks control channel %d",
1.17 djm 1356: id, c->ctl_chan);
1.73 markus 1357: if ((reply = sshbuf_new()) == NULL)
1.85 djm 1358: fatal_f("sshbuf_new");
1.17 djm 1359:
1360: if (!success) {
1.85 djm 1361: debug3_f("sending failure reply");
1.73 markus 1362: reply_error(reply, MUX_S_FAILURE, cctx->rid,
1363: "Session open refused by peer");
1.17 djm 1364: goto done;
1365: }
1.10 djm 1366:
1367: display = getenv("DISPLAY");
1368: if (cctx->want_x_fwd && options.forward_x11 && display != NULL) {
1369: char *proto, *data;
1.21 djm 1370:
1.10 djm 1371: /* Get reasonable local authentication information. */
1.66 djm 1372: if (client_x11_get_proto(ssh, display, options.xauth_location,
1.21 djm 1373: options.forward_x11_trusted, options.forward_x11_timeout,
1.58 djm 1374: &proto, &data) == 0) {
1375: /* Request forwarding with authentication spoofing. */
1376: debug("Requesting X11 forwarding with authentication "
1377: "spoofing.");
1.66 djm 1378: x11_request_forwarding_with_spoofing(ssh, id,
1379: display, proto, data, 1);
1.58 djm 1380: /* XXX exit_on_forward_failure */
1.66 djm 1381: client_expect_confirm(ssh, id, "X11 forwarding",
1.58 djm 1382: CONFIRM_WARN);
1383: }
1.10 djm 1384: }
1385:
1386: if (cctx->want_agent_fwd && options.forward_agent) {
1387: debug("Requesting authentication agent forwarding.");
1.66 djm 1388: channel_request_start(ssh, id, "auth-agent-req@openssh.com", 0);
1.79 djm 1389: if ((r = sshpkt_send(ssh)) != 0)
1.85 djm 1390: fatal_fr(r, "send");
1.10 djm 1391: }
1392:
1.66 djm 1393: client_session2_setup(ssh, id, cctx->want_tty, cctx->want_subsys,
1.73 markus 1394: cctx->term, &cctx->tio, c->rfd, cctx->cmd, cctx->env);
1.10 djm 1395:
1.85 djm 1396: debug3_f("sending success reply");
1.17 djm 1397: /* prepare reply */
1.73 markus 1398: if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 ||
1399: (r = sshbuf_put_u32(reply, cctx->rid)) != 0 ||
1400: (r = sshbuf_put_u32(reply, c->self)) != 0)
1.85 djm 1401: fatal_fr(r, "reply");
1.17 djm 1402:
1403: done:
1404: /* Send reply */
1.73 markus 1405: if ((r = sshbuf_put_stringb(cc->output, reply)) != 0)
1.85 djm 1406: fatal_fr(r, "enqueue");
1.73 markus 1407: sshbuf_free(reply);
1.17 djm 1408:
1409: if (cc->mux_pause <= 0)
1.85 djm 1410: fatal_f("mux_pause %d", cc->mux_pause);
1.17 djm 1411: cc->mux_pause = 0; /* start processing messages again */
1.10 djm 1412: c->open_confirm_ctx = NULL;
1.73 markus 1413: sshbuf_free(cctx->cmd);
1.41 djm 1414: free(cctx->term);
1.10 djm 1415: if (cctx->env != NULL) {
1416: for (i = 0; cctx->env[i] != NULL; i++)
1.41 djm 1417: free(cctx->env[i]);
1418: free(cctx->env);
1.1 djm 1419: }
1.41 djm 1420: free(cctx);
1.10 djm 1421: }
1422:
1423: /* ** Multiplexing client support */
1424:
1425: /* Exit signal handler */
1426: static void
1427: control_client_sighandler(int signo)
1428: {
1429: muxclient_terminate = signo;
1430: }
1431:
1432: /*
1433: * Relay signal handler - used to pass some signals from mux client to
1434: * mux master.
1435: */
1436: static void
1437: control_client_sigrelay(int signo)
1438: {
1439: int save_errno = errno;
1440:
1441: if (muxserver_pid > 1)
1442: kill(muxserver_pid, signo);
1443:
1444: errno = save_errno;
1445: }
1.1 djm 1446:
1.10 djm 1447: static int
1.73 markus 1448: mux_client_read(int fd, struct sshbuf *b, size_t need)
1.10 djm 1449: {
1.73 markus 1450: size_t have;
1.10 djm 1451: ssize_t len;
1452: u_char *p;
1453: struct pollfd pfd;
1.73 markus 1454: int r;
1.10 djm 1455:
1456: pfd.fd = fd;
1457: pfd.events = POLLIN;
1.73 markus 1458: if ((r = sshbuf_reserve(b, need, &p)) != 0)
1.85 djm 1459: fatal_fr(r, "reserve");
1.10 djm 1460: for (have = 0; have < need; ) {
1461: if (muxclient_terminate) {
1462: errno = EINTR;
1463: return -1;
1464: }
1465: len = read(fd, p + have, need - have);
1.80 deraadt 1466: if (len == -1) {
1.10 djm 1467: switch (errno) {
1468: case EAGAIN:
1469: (void)poll(&pfd, 1, -1);
1470: /* FALLTHROUGH */
1471: case EINTR:
1472: continue;
1473: default:
1474: return -1;
1475: }
1476: }
1477: if (len == 0) {
1478: errno = EPIPE;
1479: return -1;
1480: }
1.73 markus 1481: have += (size_t)len;
1.1 djm 1482: }
1.10 djm 1483: return 0;
1484: }
1.1 djm 1485:
1.10 djm 1486: static int
1.73 markus 1487: mux_client_write_packet(int fd, struct sshbuf *m)
1.10 djm 1488: {
1.73 markus 1489: struct sshbuf *queue;
1.10 djm 1490: u_int have, need;
1.73 markus 1491: int r, oerrno, len;
1492: const u_char *ptr;
1.10 djm 1493: struct pollfd pfd;
1494:
1495: pfd.fd = fd;
1496: pfd.events = POLLOUT;
1.73 markus 1497: if ((queue = sshbuf_new()) == NULL)
1.85 djm 1498: fatal_f("sshbuf_new");
1.73 markus 1499: if ((r = sshbuf_put_stringb(queue, m)) != 0)
1.85 djm 1500: fatal_fr(r, "enqueue");
1.10 djm 1501:
1.73 markus 1502: need = sshbuf_len(queue);
1503: ptr = sshbuf_ptr(queue);
1.10 djm 1504:
1505: for (have = 0; have < need; ) {
1506: if (muxclient_terminate) {
1.73 markus 1507: sshbuf_free(queue);
1.10 djm 1508: errno = EINTR;
1509: return -1;
1510: }
1511: len = write(fd, ptr + have, need - have);
1.80 deraadt 1512: if (len == -1) {
1.10 djm 1513: switch (errno) {
1514: case EAGAIN:
1515: (void)poll(&pfd, 1, -1);
1516: /* FALLTHROUGH */
1517: case EINTR:
1518: continue;
1519: default:
1520: oerrno = errno;
1.73 markus 1521: sshbuf_free(queue);
1.10 djm 1522: errno = oerrno;
1523: return -1;
1524: }
1525: }
1526: if (len == 0) {
1.73 markus 1527: sshbuf_free(queue);
1.10 djm 1528: errno = EPIPE;
1529: return -1;
1530: }
1531: have += (u_int)len;
1532: }
1.73 markus 1533: sshbuf_free(queue);
1.10 djm 1534: return 0;
1535: }
1.1 djm 1536:
1.10 djm 1537: static int
1.73 markus 1538: mux_client_read_packet(int fd, struct sshbuf *m)
1.10 djm 1539: {
1.73 markus 1540: struct sshbuf *queue;
1541: size_t need, have;
1.45 djm 1542: const u_char *ptr;
1.73 markus 1543: int r, oerrno;
1.10 djm 1544:
1.73 markus 1545: if ((queue = sshbuf_new()) == NULL)
1.85 djm 1546: fatal_f("sshbuf_new");
1.73 markus 1547: if (mux_client_read(fd, queue, 4) != 0) {
1.10 djm 1548: if ((oerrno = errno) == EPIPE)
1.85 djm 1549: debug3_f("read header failed: %s",
1.43 dtucker 1550: strerror(errno));
1.73 markus 1551: sshbuf_free(queue);
1.10 djm 1552: errno = oerrno;
1553: return -1;
1554: }
1.73 markus 1555: need = PEEK_U32(sshbuf_ptr(queue));
1556: if (mux_client_read(fd, queue, need) != 0) {
1.10 djm 1557: oerrno = errno;
1.85 djm 1558: debug3_f("read body failed: %s", strerror(errno));
1.73 markus 1559: sshbuf_free(queue);
1.10 djm 1560: errno = oerrno;
1561: return -1;
1562: }
1.73 markus 1563: if ((r = sshbuf_get_string_direct(queue, &ptr, &have)) != 0 ||
1564: (r = sshbuf_put(m, ptr, have)) != 0)
1.85 djm 1565: fatal_fr(r, "dequeue");
1.73 markus 1566: sshbuf_free(queue);
1.10 djm 1567: return 0;
1568: }
1.1 djm 1569:
1.10 djm 1570: static int
1571: mux_client_hello_exchange(int fd)
1572: {
1.73 markus 1573: struct sshbuf *m;
1.10 djm 1574: u_int type, ver;
1.73 markus 1575: int r, ret = -1;
1.1 djm 1576:
1.73 markus 1577: if ((m = sshbuf_new()) == NULL)
1.85 djm 1578: fatal_f("sshbuf_new");
1.73 markus 1579: if ((r = sshbuf_put_u32(m, MUX_MSG_HELLO)) != 0 ||
1580: (r = sshbuf_put_u32(m, SSHMUX_VER)) != 0)
1.85 djm 1581: fatal_fr(r, "assemble hello");
1.10 djm 1582: /* no extensions */
1583:
1.73 markus 1584: if (mux_client_write_packet(fd, m) != 0) {
1.85 djm 1585: debug_f("write packet: %s", strerror(errno));
1.65 djm 1586: goto out;
1587: }
1.1 djm 1588:
1.73 markus 1589: sshbuf_reset(m);
1.10 djm 1590:
1591: /* Read their HELLO */
1.73 markus 1592: if (mux_client_read_packet(fd, m) != 0) {
1.85 djm 1593: debug_f("read packet failed");
1.65 djm 1594: goto out;
1.10 djm 1595: }
1596:
1.73 markus 1597: if ((r = sshbuf_get_u32(m, &type)) != 0)
1.85 djm 1598: fatal_fr(r, "parse type");
1.65 djm 1599: if (type != MUX_MSG_HELLO) {
1.85 djm 1600: error_f("expected HELLO (%u) got %u", MUX_MSG_HELLO, type);
1.65 djm 1601: goto out;
1602: }
1.73 markus 1603: if ((r = sshbuf_get_u32(m, &ver)) != 0)
1.85 djm 1604: fatal_fr(r, "parse version");
1.65 djm 1605: if (ver != SSHMUX_VER) {
1606: error("Unsupported multiplexing protocol version %d "
1.10 djm 1607: "(expected %d)", ver, SSHMUX_VER);
1.65 djm 1608: goto out;
1609: }
1.85 djm 1610: debug2_f("master version %u", ver);
1.10 djm 1611: /* No extensions are presently defined */
1.73 markus 1612: while (sshbuf_len(m) > 0) {
1613: char *name = NULL;
1.10 djm 1614:
1.73 markus 1615: if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 ||
1616: (r = sshbuf_skip_string(m)) != 0) { /* value */
1.85 djm 1617: error_fr(r, "parse extension");
1.73 markus 1618: goto out;
1619: }
1.10 djm 1620: debug2("Unrecognised master extension \"%s\"", name);
1.41 djm 1621: free(name);
1.5 djm 1622: }
1.65 djm 1623: /* success */
1624: ret = 0;
1625: out:
1.73 markus 1626: sshbuf_free(m);
1.65 djm 1627: return ret;
1.10 djm 1628: }
1629:
1630: static u_int
1631: mux_client_request_alive(int fd)
1632: {
1.73 markus 1633: struct sshbuf *m;
1.10 djm 1634: char *e;
1635: u_int pid, type, rid;
1.73 markus 1636: int r;
1.10 djm 1637:
1.85 djm 1638: debug3_f("entering");
1.10 djm 1639:
1.73 markus 1640: if ((m = sshbuf_new()) == NULL)
1.85 djm 1641: fatal_f("sshbuf_new");
1.73 markus 1642: if ((r = sshbuf_put_u32(m, MUX_C_ALIVE_CHECK)) != 0 ||
1643: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1.85 djm 1644: fatal_fr(r, "assemble");
1.10 djm 1645:
1.73 markus 1646: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 1647: fatal_f("write packet: %s", strerror(errno));
1.10 djm 1648:
1.73 markus 1649: sshbuf_reset(m);
1.1 djm 1650:
1.10 djm 1651: /* Read their reply */
1.73 markus 1652: if (mux_client_read_packet(fd, m) != 0) {
1653: sshbuf_free(m);
1.10 djm 1654: return 0;
1655: }
1656:
1.73 markus 1657: if ((r = sshbuf_get_u32(m, &type)) != 0)
1.85 djm 1658: fatal_fr(r, "parse type");
1.10 djm 1659: if (type != MUX_S_ALIVE) {
1.73 markus 1660: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1661: fatal_fr(r, "parse error message");
1662: fatal_f("master returned error: %s", e);
1.5 djm 1663: }
1.10 djm 1664:
1.73 markus 1665: if ((r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 1666: fatal_fr(r, "parse remote ID");
1.73 markus 1667: if (rid != muxclient_request_id)
1.85 djm 1668: fatal_f("out of sequence reply: my id %u theirs %u",
1669: muxclient_request_id, rid);
1.73 markus 1670: if ((r = sshbuf_get_u32(m, &pid)) != 0)
1.85 djm 1671: fatal_fr(r, "parse PID");
1.73 markus 1672: sshbuf_free(m);
1.10 djm 1673:
1.85 djm 1674: debug3_f("done pid = %u", pid);
1.10 djm 1675:
1676: muxclient_request_id++;
1677:
1678: return pid;
1679: }
1680:
1681: static void
1682: mux_client_request_terminate(int fd)
1683: {
1.73 markus 1684: struct sshbuf *m;
1.10 djm 1685: char *e;
1686: u_int type, rid;
1.73 markus 1687: int r;
1.10 djm 1688:
1.85 djm 1689: debug3_f("entering");
1.10 djm 1690:
1.73 markus 1691: if ((m = sshbuf_new()) == NULL)
1.85 djm 1692: fatal_f("sshbuf_new");
1.73 markus 1693: if ((r = sshbuf_put_u32(m, MUX_C_TERMINATE)) != 0 ||
1694: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1.85 djm 1695: fatal_fr(r, "request");
1.10 djm 1696:
1.73 markus 1697: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 1698: fatal_f("write packet: %s", strerror(errno));
1.1 djm 1699:
1.73 markus 1700: sshbuf_reset(m);
1.1 djm 1701:
1.10 djm 1702: /* Read their reply */
1.73 markus 1703: if (mux_client_read_packet(fd, m) != 0) {
1.10 djm 1704: /* Remote end exited already */
1705: if (errno == EPIPE) {
1.73 markus 1706: sshbuf_free(m);
1.10 djm 1707: return;
1.2 djm 1708: }
1.85 djm 1709: fatal_f("read from master failed: %s", strerror(errno));
1.10 djm 1710: }
1711:
1.73 markus 1712: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1713: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 1714: fatal_fr(r, "parse");
1.73 markus 1715: if (rid != muxclient_request_id)
1.85 djm 1716: fatal_f("out of sequence reply: my id %u theirs %u",
1717: muxclient_request_id, rid);
1.10 djm 1718: switch (type) {
1719: case MUX_S_OK:
1720: break;
1721: case MUX_S_PERMISSION_DENIED:
1.73 markus 1722: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1723: fatal_fr(r, "parse error message");
1.10 djm 1724: fatal("Master refused termination request: %s", e);
1725: case MUX_S_FAILURE:
1.73 markus 1726: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1727: fatal_fr(r, "parse error message");
1728: fatal_f("termination request failed: %s", e);
1.10 djm 1729: default:
1.85 djm 1730: fatal_f("unexpected response from master 0x%08x", type);
1.10 djm 1731: }
1.73 markus 1732: sshbuf_free(m);
1.10 djm 1733: muxclient_request_id++;
1734: }
1735:
1736: static int
1.46 millert 1737: mux_client_forward(int fd, int cancel_flag, u_int ftype, struct Forward *fwd)
1.10 djm 1738: {
1.73 markus 1739: struct sshbuf *m;
1.10 djm 1740: char *e, *fwd_desc;
1.73 markus 1741: const char *lhost, *chost;
1.10 djm 1742: u_int type, rid;
1.73 markus 1743: int r;
1.10 djm 1744:
1745: fwd_desc = format_forward(ftype, fwd);
1.30 djm 1746: debug("Requesting %s %s",
1747: cancel_flag ? "cancellation of" : "forwarding of", fwd_desc);
1.41 djm 1748: free(fwd_desc);
1.10 djm 1749:
1.73 markus 1750: type = cancel_flag ? MUX_C_CLOSE_FWD : MUX_C_OPEN_FWD;
1751: if (fwd->listen_path != NULL)
1752: lhost = fwd->listen_path;
1753: else if (fwd->listen_host == NULL)
1754: lhost = "";
1755: else if (*fwd->listen_host == '\0')
1756: lhost = "*";
1757: else
1758: lhost = fwd->listen_host;
1759:
1760: if (fwd->connect_path != NULL)
1761: chost = fwd->connect_path;
1762: else if (fwd->connect_host == NULL)
1763: chost = "";
1764: else
1765: chost = fwd->connect_host;
1766:
1767: if ((m = sshbuf_new()) == NULL)
1.85 djm 1768: fatal_f("sshbuf_new");
1.73 markus 1769: if ((r = sshbuf_put_u32(m, type)) != 0 ||
1770: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
1771: (r = sshbuf_put_u32(m, ftype)) != 0 ||
1772: (r = sshbuf_put_cstring(m, lhost)) != 0 ||
1773: (r = sshbuf_put_u32(m, fwd->listen_port)) != 0 ||
1774: (r = sshbuf_put_cstring(m, chost)) != 0 ||
1775: (r = sshbuf_put_u32(m, fwd->connect_port)) != 0)
1.85 djm 1776: fatal_fr(r, "request");
1.10 djm 1777:
1.73 markus 1778: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 1779: fatal_f("write packet: %s", strerror(errno));
1.10 djm 1780:
1.73 markus 1781: sshbuf_reset(m);
1.10 djm 1782:
1783: /* Read their reply */
1.73 markus 1784: if (mux_client_read_packet(fd, m) != 0) {
1785: sshbuf_free(m);
1.10 djm 1786: return -1;
1787: }
1788:
1.73 markus 1789: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1790: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 1791: fatal_fr(r, "parse");
1.73 markus 1792: if (rid != muxclient_request_id)
1.85 djm 1793: fatal_f("out of sequence reply: my id %u theirs %u",
1794: muxclient_request_id, rid);
1.73 markus 1795:
1.10 djm 1796: switch (type) {
1797: case MUX_S_OK:
1.1 djm 1798: break;
1.18 markus 1799: case MUX_S_REMOTE_PORT:
1.30 djm 1800: if (cancel_flag)
1.85 djm 1801: fatal_f("got MUX_S_REMOTE_PORT for cancel");
1.73 markus 1802: if ((r = sshbuf_get_u32(m, &fwd->allocated_port)) != 0)
1.85 djm 1803: fatal_fr(r, "parse port");
1.52 djm 1804: verbose("Allocated port %u for remote forward to %s:%d",
1.18 markus 1805: fwd->allocated_port,
1806: fwd->connect_host ? fwd->connect_host : "",
1807: fwd->connect_port);
1808: if (muxclient_command == SSHMUX_COMMAND_FORWARD)
1.55 djm 1809: fprintf(stdout, "%i\n", fwd->allocated_port);
1.18 markus 1810: break;
1.10 djm 1811: case MUX_S_PERMISSION_DENIED:
1.73 markus 1812: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1813: fatal_fr(r, "parse error message");
1.73 markus 1814: sshbuf_free(m);
1.10 djm 1815: error("Master refused forwarding request: %s", e);
1816: return -1;
1817: case MUX_S_FAILURE:
1.73 markus 1818: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1819: fatal_fr(r, "parse error message");
1.73 markus 1820: sshbuf_free(m);
1.85 djm 1821: error_f("forwarding request failed: %s", e);
1.10 djm 1822: return -1;
1.1 djm 1823: default:
1.85 djm 1824: fatal_f("unexpected response from master 0x%08x", type);
1.10 djm 1825: }
1.73 markus 1826: sshbuf_free(m);
1.10 djm 1827:
1828: muxclient_request_id++;
1829: return 0;
1830: }
1831:
1832: static int
1.30 djm 1833: mux_client_forwards(int fd, int cancel_flag)
1.10 djm 1834: {
1.30 djm 1835: int i, ret = 0;
1.10 djm 1836:
1.85 djm 1837: debug3_f("%s forwardings: %d local, %d remote",
1.30 djm 1838: cancel_flag ? "cancel" : "request",
1.10 djm 1839: options.num_local_forwards, options.num_remote_forwards);
1840:
1841: /* XXX ExitOnForwardingFailure */
1842: for (i = 0; i < options.num_local_forwards; i++) {
1.30 djm 1843: if (mux_client_forward(fd, cancel_flag,
1.10 djm 1844: options.local_forwards[i].connect_port == 0 ?
1845: MUX_FWD_DYNAMIC : MUX_FWD_LOCAL,
1846: options.local_forwards + i) != 0)
1.30 djm 1847: ret = -1;
1.10 djm 1848: }
1849: for (i = 0; i < options.num_remote_forwards; i++) {
1.30 djm 1850: if (mux_client_forward(fd, cancel_flag, MUX_FWD_REMOTE,
1.10 djm 1851: options.remote_forwards + i) != 0)
1.30 djm 1852: ret = -1;
1.10 djm 1853: }
1.30 djm 1854: return ret;
1.10 djm 1855: }
1856:
1857: static int
1858: mux_client_request_session(int fd)
1859: {
1.73 markus 1860: struct sshbuf *m;
1861: char *e;
1.89 djm 1862: const char *term = NULL;
1.94 djm 1863: u_int i, echar, rid, sid, esid, exitval, type, exitval_seen;
1.10 djm 1864: extern char **environ;
1.94 djm 1865: int r, rawmode;
1.10 djm 1866:
1.85 djm 1867: debug3_f("entering");
1.10 djm 1868:
1869: if ((muxserver_pid = mux_client_request_alive(fd)) == 0) {
1.85 djm 1870: error_f("master alive request failed");
1.10 djm 1871: return -1;
1.1 djm 1872: }
1873:
1.81 dtucker 1874: ssh_signal(SIGPIPE, SIG_IGN);
1.10 djm 1875:
1.91 djm 1876: if (options.stdin_null && stdfd_devnull(1, 0, 0) == -1)
1.85 djm 1877: fatal_f("stdfd_devnull failed");
1.1 djm 1878:
1.89 djm 1879: if ((term = lookup_env_in_list("TERM", options.setenv,
1880: options.num_setenv)) == NULL || *term == '\0')
1881: term = getenv("TERM");
1882:
1.73 markus 1883: echar = 0xffffffff;
1884: if (options.escape_char != SSH_ESCAPECHAR_NONE)
1885: echar = (u_int)options.escape_char;
1886:
1887: if ((m = sshbuf_new()) == NULL)
1.85 djm 1888: fatal_f("sshbuf_new");
1.73 markus 1889: if ((r = sshbuf_put_u32(m, MUX_C_NEW_SESSION)) != 0 ||
1890: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
1891: (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */
1892: (r = sshbuf_put_u32(m, tty_flag)) != 0 ||
1893: (r = sshbuf_put_u32(m, options.forward_x11)) != 0 ||
1894: (r = sshbuf_put_u32(m, options.forward_agent)) != 0 ||
1.90 djm 1895: (r = sshbuf_put_u32(m, options.session_type == SESSION_TYPE_SUBSYSTEM)) != 0 ||
1.73 markus 1896: (r = sshbuf_put_u32(m, echar)) != 0 ||
1.89 djm 1897: (r = sshbuf_put_cstring(m, term == NULL ? "" : term)) != 0 ||
1.73 markus 1898: (r = sshbuf_put_stringb(m, command)) != 0)
1.85 djm 1899: fatal_fr(r, "request");
1.10 djm 1900:
1.71 djm 1901: /* Pass environment */
1.10 djm 1902: if (options.num_send_env > 0 && environ != NULL) {
1903: for (i = 0; environ[i] != NULL; i++) {
1.73 markus 1904: if (!env_permitted(environ[i]))
1905: continue;
1906: if ((r = sshbuf_put_cstring(m, environ[i])) != 0)
1.85 djm 1907: fatal_fr(r, "request sendenv");
1.10 djm 1908: }
1.5 djm 1909: }
1.73 markus 1910: for (i = 0; i < options.num_setenv; i++) {
1911: if ((r = sshbuf_put_cstring(m, options.setenv[i])) != 0)
1.85 djm 1912: fatal_fr(r, "request setenv");
1.73 markus 1913: }
1.5 djm 1914:
1.73 markus 1915: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 1916: fatal_f("write packet: %s", strerror(errno));
1.10 djm 1917:
1918: /* Send the stdio file descriptors */
1919: if (mm_send_fd(fd, STDIN_FILENO) == -1 ||
1920: mm_send_fd(fd, STDOUT_FILENO) == -1 ||
1921: mm_send_fd(fd, STDERR_FILENO) == -1)
1.85 djm 1922: fatal_f("send fds failed");
1.10 djm 1923:
1.85 djm 1924: debug3_f("session request sent");
1.1 djm 1925:
1.10 djm 1926: /* Read their reply */
1.73 markus 1927: sshbuf_reset(m);
1928: if (mux_client_read_packet(fd, m) != 0) {
1.85 djm 1929: error_f("read from master failed: %s", strerror(errno));
1.73 markus 1930: sshbuf_free(m);
1.10 djm 1931: return -1;
1932: }
1933:
1.73 markus 1934: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1935: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 1936: fatal_fr(r, "parse");
1.73 markus 1937: if (rid != muxclient_request_id)
1.85 djm 1938: fatal_f("out of sequence reply: my id %u theirs %u",
1939: muxclient_request_id, rid);
1.73 markus 1940:
1.10 djm 1941: switch (type) {
1942: case MUX_S_SESSION_OPENED:
1.73 markus 1943: if ((r = sshbuf_get_u32(m, &sid)) != 0)
1.85 djm 1944: fatal_fr(r, "parse session ID");
1945: debug_f("master session id: %u", sid);
1.10 djm 1946: break;
1947: case MUX_S_PERMISSION_DENIED:
1.73 markus 1948: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1949: fatal_fr(r, "parse error message");
1.24 djm 1950: error("Master refused session request: %s", e);
1.73 markus 1951: sshbuf_free(m);
1.10 djm 1952: return -1;
1953: case MUX_S_FAILURE:
1.73 markus 1954: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 1955: fatal_fr(r, "parse error message");
1956: error_f("session request failed: %s", e);
1.73 markus 1957: sshbuf_free(m);
1.10 djm 1958: return -1;
1959: default:
1.73 markus 1960: sshbuf_free(m);
1.85 djm 1961: error_f("unexpected response from master 0x%08x", type);
1.10 djm 1962: return -1;
1963: }
1964: muxclient_request_id++;
1.1 djm 1965:
1.57 semarie 1966: if (pledge("stdio proc tty", NULL) == -1)
1.85 djm 1967: fatal_f("pledge(): %s", strerror(errno));
1.57 semarie 1968:
1.81 dtucker 1969: ssh_signal(SIGHUP, control_client_sighandler);
1970: ssh_signal(SIGINT, control_client_sighandler);
1971: ssh_signal(SIGTERM, control_client_sighandler);
1972: ssh_signal(SIGWINCH, control_client_sigrelay);
1.1 djm 1973:
1.28 djm 1974: rawmode = tty_flag;
1.1 djm 1975: if (tty_flag)
1.27 djm 1976: enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
1.1 djm 1977:
1978: /*
1979: * Stick around until the controlee closes the client_fd.
1.10 djm 1980: * Before it does, it is expected to write an exit message.
1981: * This process must read the value and wait for the closure of
1982: * the client_fd; if this one closes early, the multiplex master will
1983: * terminate early too (possibly losing data).
1.1 djm 1984: */
1.10 djm 1985: for (exitval = 255, exitval_seen = 0;;) {
1.73 markus 1986: sshbuf_reset(m);
1987: if (mux_client_read_packet(fd, m) != 0)
1.1 djm 1988: break;
1.73 markus 1989: if ((r = sshbuf_get_u32(m, &type)) != 0)
1.85 djm 1990: fatal_fr(r, "parse type");
1.28 djm 1991: switch (type) {
1992: case MUX_S_TTY_ALLOC_FAIL:
1.73 markus 1993: if ((r = sshbuf_get_u32(m, &esid)) != 0)
1.85 djm 1994: fatal_fr(r, "parse session ID");
1.73 markus 1995: if (esid != sid)
1.85 djm 1996: fatal_f("tty alloc fail on unknown session: "
1997: "my id %u theirs %u", sid, esid);
1.28 djm 1998: leave_raw_mode(options.request_tty ==
1999: REQUEST_TTY_FORCE);
2000: rawmode = 0;
2001: continue;
2002: case MUX_S_EXIT_MESSAGE:
1.73 markus 2003: if ((r = sshbuf_get_u32(m, &esid)) != 0)
1.85 djm 2004: fatal_fr(r, "parse session ID");
1.73 markus 2005: if (esid != sid)
1.85 djm 2006: fatal_f("exit on unknown session: "
2007: "my id %u theirs %u", sid, esid);
1.28 djm 2008: if (exitval_seen)
1.85 djm 2009: fatal_f("exitval sent twice");
1.73 markus 2010: if ((r = sshbuf_get_u32(m, &exitval)) != 0)
1.85 djm 2011: fatal_fr(r, "parse exitval");
1.28 djm 2012: exitval_seen = 1;
2013: continue;
2014: default:
1.73 markus 2015: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2016: fatal_fr(r, "parse error message");
2017: fatal_f("master returned error: %s", e);
1.1 djm 2018: }
2019: }
2020:
1.10 djm 2021: close(fd);
1.28 djm 2022: if (rawmode)
2023: leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
1.10 djm 2024:
1.1 djm 2025: if (muxclient_terminate) {
1.69 dtucker 2026: debug2("Exiting on signal: %s", strsignal(muxclient_terminate));
1.10 djm 2027: exitval = 255;
2028: } else if (!exitval_seen) {
1.1 djm 2029: debug2("Control master terminated unexpectedly");
1.10 djm 2030: exitval = 255;
1.1 djm 2031: } else
1.10 djm 2032: debug2("Received exit status from master %d", exitval);
1.1 djm 2033:
1.92 djm 2034: if (tty_flag && options.log_level >= SYSLOG_LEVEL_INFO)
1.1 djm 2035: fprintf(stderr, "Shared connection to %s closed.\r\n", host);
2036:
1.10 djm 2037: exit(exitval);
2038: }
2039:
2040: static int
1.62 markus 2041: mux_client_proxy(int fd)
2042: {
1.73 markus 2043: struct sshbuf *m;
1.62 markus 2044: char *e;
2045: u_int type, rid;
1.73 markus 2046: int r;
1.62 markus 2047:
1.73 markus 2048: if ((m = sshbuf_new()) == NULL)
1.85 djm 2049: fatal_f("sshbuf_new");
1.73 markus 2050: if ((r = sshbuf_put_u32(m, MUX_C_PROXY)) != 0 ||
2051: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1.85 djm 2052: fatal_fr(r, "request");
1.73 markus 2053: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 2054: fatal_f("write packet: %s", strerror(errno));
1.62 markus 2055:
1.73 markus 2056: sshbuf_reset(m);
1.62 markus 2057:
2058: /* Read their reply */
1.73 markus 2059: if (mux_client_read_packet(fd, m) != 0) {
2060: sshbuf_free(m);
1.62 markus 2061: return 0;
2062: }
1.73 markus 2063: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2064: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 2065: fatal_fr(r, "parse");
1.73 markus 2066: if (rid != muxclient_request_id)
1.85 djm 2067: fatal_f("out of sequence reply: my id %u theirs %u",
2068: muxclient_request_id, rid);
1.62 markus 2069: if (type != MUX_S_PROXY) {
1.73 markus 2070: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2071: fatal_fr(r, "parse error message");
2072: fatal_f("master returned error: %s", e);
1.62 markus 2073: }
1.73 markus 2074: sshbuf_free(m);
1.62 markus 2075:
1.85 djm 2076: debug3_f("done");
1.62 markus 2077: muxclient_request_id++;
2078: return 0;
2079: }
2080:
2081: static int
1.10 djm 2082: mux_client_request_stdio_fwd(int fd)
2083: {
1.73 markus 2084: struct sshbuf *m;
1.10 djm 2085: char *e;
2086: u_int type, rid, sid;
1.84 djm 2087: int r;
1.10 djm 2088:
1.85 djm 2089: debug3_f("entering");
1.10 djm 2090:
2091: if ((muxserver_pid = mux_client_request_alive(fd)) == 0) {
1.85 djm 2092: error_f("master alive request failed");
1.10 djm 2093: return -1;
2094: }
2095:
1.81 dtucker 2096: ssh_signal(SIGPIPE, SIG_IGN);
1.10 djm 2097:
1.91 djm 2098: if (options.stdin_null && stdfd_devnull(1, 0, 0) == -1)
1.85 djm 2099: fatal_f("stdfd_devnull failed");
1.10 djm 2100:
1.73 markus 2101: if ((m = sshbuf_new()) == NULL)
1.85 djm 2102: fatal_f("sshbuf_new");
1.73 markus 2103: if ((r = sshbuf_put_u32(m, MUX_C_NEW_STDIO_FWD)) != 0 ||
2104: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
2105: (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */
2106: (r = sshbuf_put_cstring(m, options.stdio_forward_host)) != 0 ||
2107: (r = sshbuf_put_u32(m, options.stdio_forward_port)) != 0)
1.85 djm 2108: fatal_fr(r, "request");
1.10 djm 2109:
1.73 markus 2110: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 2111: fatal_f("write packet: %s", strerror(errno));
1.10 djm 2112:
2113: /* Send the stdio file descriptors */
2114: if (mm_send_fd(fd, STDIN_FILENO) == -1 ||
2115: mm_send_fd(fd, STDOUT_FILENO) == -1)
1.85 djm 2116: fatal_f("send fds failed");
1.10 djm 2117:
1.56 semarie 2118: if (pledge("stdio proc tty", NULL) == -1)
1.85 djm 2119: fatal_f("pledge(): %s", strerror(errno));
1.56 semarie 2120:
1.85 djm 2121: debug3_f("stdio forward request sent");
1.10 djm 2122:
2123: /* Read their reply */
1.73 markus 2124: sshbuf_reset(m);
1.10 djm 2125:
1.73 markus 2126: if (mux_client_read_packet(fd, m) != 0) {
1.85 djm 2127: error_f("read from master failed: %s", strerror(errno));
1.73 markus 2128: sshbuf_free(m);
1.10 djm 2129: return -1;
2130: }
2131:
1.73 markus 2132: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2133: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 2134: fatal_fr(r, "parse");
1.73 markus 2135: if (rid != muxclient_request_id)
1.85 djm 2136: fatal_f("out of sequence reply: my id %u theirs %u",
2137: muxclient_request_id, rid);
1.10 djm 2138: switch (type) {
2139: case MUX_S_SESSION_OPENED:
1.73 markus 2140: if ((r = sshbuf_get_u32(m, &sid)) != 0)
1.85 djm 2141: fatal_fr(r, "parse session ID");
2142: debug_f("master session id: %u", sid);
1.10 djm 2143: break;
2144: case MUX_S_PERMISSION_DENIED:
1.73 markus 2145: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2146: fatal_fr(r, "parse error message");
1.73 markus 2147: sshbuf_free(m);
1.24 djm 2148: fatal("Master refused stdio forwarding request: %s", e);
1.10 djm 2149: case MUX_S_FAILURE:
1.73 markus 2150: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2151: fatal_fr(r, "parse error message");
1.73 markus 2152: sshbuf_free(m);
1.48 djm 2153: fatal("Stdio forwarding request failed: %s", e);
1.10 djm 2154: default:
1.73 markus 2155: sshbuf_free(m);
1.85 djm 2156: error_f("unexpected response from master 0x%08x", type);
1.10 djm 2157: return -1;
2158: }
2159: muxclient_request_id++;
2160:
1.81 dtucker 2161: ssh_signal(SIGHUP, control_client_sighandler);
2162: ssh_signal(SIGINT, control_client_sighandler);
2163: ssh_signal(SIGTERM, control_client_sighandler);
2164: ssh_signal(SIGWINCH, control_client_sigrelay);
1.10 djm 2165:
2166: /*
2167: * Stick around until the controlee closes the client_fd.
2168: */
1.73 markus 2169: sshbuf_reset(m);
2170: if (mux_client_read_packet(fd, m) != 0) {
1.10 djm 2171: if (errno == EPIPE ||
2172: (errno == EINTR && muxclient_terminate != 0))
2173: return 0;
1.85 djm 2174: fatal_f("mux_client_read_packet: %s", strerror(errno));
1.10 djm 2175: }
1.85 djm 2176: fatal_f("master returned unexpected message %u", type);
1.10 djm 2177: }
2178:
1.25 djm 2179: static void
2180: mux_client_request_stop_listening(int fd)
2181: {
1.73 markus 2182: struct sshbuf *m;
1.25 djm 2183: char *e;
2184: u_int type, rid;
1.73 markus 2185: int r;
1.25 djm 2186:
1.85 djm 2187: debug3_f("entering");
1.25 djm 2188:
1.73 markus 2189: if ((m = sshbuf_new()) == NULL)
1.85 djm 2190: fatal_f("sshbuf_new");
1.73 markus 2191: if ((r = sshbuf_put_u32(m, MUX_C_STOP_LISTENING)) != 0 ||
2192: (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1.85 djm 2193: fatal_fr(r, "request");
1.25 djm 2194:
1.73 markus 2195: if (mux_client_write_packet(fd, m) != 0)
1.85 djm 2196: fatal_f("write packet: %s", strerror(errno));
1.25 djm 2197:
1.73 markus 2198: sshbuf_reset(m);
1.25 djm 2199:
2200: /* Read their reply */
1.73 markus 2201: if (mux_client_read_packet(fd, m) != 0)
1.85 djm 2202: fatal_f("read from master failed: %s", strerror(errno));
1.25 djm 2203:
1.73 markus 2204: if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2205: (r = sshbuf_get_u32(m, &rid)) != 0)
1.85 djm 2206: fatal_fr(r, "parse");
1.73 markus 2207: if (rid != muxclient_request_id)
1.85 djm 2208: fatal_f("out of sequence reply: my id %u theirs %u",
2209: muxclient_request_id, rid);
1.73 markus 2210:
1.25 djm 2211: switch (type) {
2212: case MUX_S_OK:
2213: break;
2214: case MUX_S_PERMISSION_DENIED:
1.73 markus 2215: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2216: fatal_fr(r, "parse error message");
1.25 djm 2217: fatal("Master refused stop listening request: %s", e);
2218: case MUX_S_FAILURE:
1.73 markus 2219: if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1.85 djm 2220: fatal_fr(r, "parse error message");
2221: fatal_f("stop listening request failed: %s", e);
1.25 djm 2222: default:
1.85 djm 2223: fatal_f("unexpected response from master 0x%08x", type);
1.25 djm 2224: }
1.73 markus 2225: sshbuf_free(m);
1.25 djm 2226: muxclient_request_id++;
2227: }
2228:
1.10 djm 2229: /* Multiplex client main loop. */
1.62 markus 2230: int
1.10 djm 2231: muxclient(const char *path)
2232: {
2233: struct sockaddr_un addr;
2234: int sock;
2235: u_int pid;
2236:
2237: if (muxclient_command == 0) {
1.60 dtucker 2238: if (options.stdio_forward_host != NULL)
1.10 djm 2239: muxclient_command = SSHMUX_COMMAND_STDIO_FWD;
2240: else
2241: muxclient_command = SSHMUX_COMMAND_OPEN;
2242: }
2243:
2244: switch (options.control_master) {
2245: case SSHCTL_MASTER_AUTO:
2246: case SSHCTL_MASTER_AUTO_ASK:
2247: debug("auto-mux: Trying existing master");
2248: /* FALLTHROUGH */
2249: case SSHCTL_MASTER_NO:
2250: break;
2251: default:
1.62 markus 2252: return -1;
1.10 djm 2253: }
2254:
2255: memset(&addr, '\0', sizeof(addr));
2256: addr.sun_family = AF_UNIX;
2257:
2258: if (strlcpy(addr.sun_path, path,
2259: sizeof(addr.sun_path)) >= sizeof(addr.sun_path))
1.61 dtucker 2260: fatal("ControlPath too long ('%s' >= %u bytes)", path,
1.87 djm 2261: (unsigned int)sizeof(addr.sun_path));
1.10 djm 2262:
1.80 deraadt 2263: if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
1.85 djm 2264: fatal_f("socket(): %s", strerror(errno));
1.10 djm 2265:
1.64 guenther 2266: if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
1.10 djm 2267: switch (muxclient_command) {
2268: case SSHMUX_COMMAND_OPEN:
2269: case SSHMUX_COMMAND_STDIO_FWD:
2270: break;
2271: default:
2272: fatal("Control socket connect(%.100s): %s", path,
2273: strerror(errno));
2274: }
1.22 djm 2275: if (errno == ECONNREFUSED &&
2276: options.control_master != SSHCTL_MASTER_NO) {
2277: debug("Stale control socket %.100s, unlinking", path);
2278: unlink(path);
2279: } else if (errno == ENOENT) {
1.10 djm 2280: debug("Control socket \"%.100s\" does not exist", path);
1.22 djm 2281: } else {
1.10 djm 2282: error("Control socket connect(%.100s): %s", path,
2283: strerror(errno));
2284: }
2285: close(sock);
1.62 markus 2286: return -1;
1.10 djm 2287: }
2288: set_nonblock(sock);
2289:
2290: if (mux_client_hello_exchange(sock) != 0) {
1.85 djm 2291: error_f("master hello exchange failed");
1.10 djm 2292: close(sock);
1.62 markus 2293: return -1;
1.10 djm 2294: }
2295:
2296: switch (muxclient_command) {
2297: case SSHMUX_COMMAND_ALIVE_CHECK:
2298: if ((pid = mux_client_request_alive(sock)) == 0)
1.85 djm 2299: fatal_f("master alive check failed");
1.55 djm 2300: fprintf(stderr, "Master running (pid=%u)\r\n", pid);
1.10 djm 2301: exit(0);
2302: case SSHMUX_COMMAND_TERMINATE:
2303: mux_client_request_terminate(sock);
1.63 dtucker 2304: if (options.log_level != SYSLOG_LEVEL_QUIET)
2305: fprintf(stderr, "Exit request sent.\r\n");
1.18 markus 2306: exit(0);
2307: case SSHMUX_COMMAND_FORWARD:
1.30 djm 2308: if (mux_client_forwards(sock, 0) != 0)
1.85 djm 2309: fatal_f("master forward request failed");
1.10 djm 2310: exit(0);
2311: case SSHMUX_COMMAND_OPEN:
1.30 djm 2312: if (mux_client_forwards(sock, 0) != 0) {
1.85 djm 2313: error_f("master forward request failed");
1.62 markus 2314: return -1;
1.10 djm 2315: }
2316: mux_client_request_session(sock);
1.62 markus 2317: return -1;
1.10 djm 2318: case SSHMUX_COMMAND_STDIO_FWD:
2319: mux_client_request_stdio_fwd(sock);
1.25 djm 2320: exit(0);
2321: case SSHMUX_COMMAND_STOP:
2322: mux_client_request_stop_listening(sock);
1.63 dtucker 2323: if (options.log_level != SYSLOG_LEVEL_QUIET)
2324: fprintf(stderr, "Stop listening request sent.\r\n");
1.30 djm 2325: exit(0);
2326: case SSHMUX_COMMAND_CANCEL_FWD:
2327: if (mux_client_forwards(sock, 1) != 0)
1.85 djm 2328: error_f("master cancel forward request failed");
1.10 djm 2329: exit(0);
1.62 markus 2330: case SSHMUX_COMMAND_PROXY:
2331: mux_client_proxy(sock);
2332: return (sock);
1.10 djm 2333: default:
2334: fatal("unrecognised muxclient_command %d", muxclient_command);
2335: }
1.1 djm 2336: }
![[BACK]](/icons/back.gif){kind=icon}
Return to mux.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh