1664f4763Szrj /* $OpenBSD: serverloop.c,v 1.215 2019/03/27 09:29:14 djm Exp $ */ 218de8d7fSPeter Avalos /* 318de8d7fSPeter Avalos * Author: Tatu Ylonen <ylo@cs.hut.fi> 418de8d7fSPeter Avalos * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 518de8d7fSPeter Avalos * All rights reserved 618de8d7fSPeter Avalos * Server main loop for handling the interactive session. 718de8d7fSPeter Avalos * 818de8d7fSPeter Avalos * As far as I am concerned, the code I have written for this software 918de8d7fSPeter Avalos * can be used freely for any purpose. Any derived versions of this 1018de8d7fSPeter Avalos * software must be clearly marked as such, and if the derived work is 1118de8d7fSPeter Avalos * incompatible with the protocol description in the RFC file, it must be 1218de8d7fSPeter Avalos * called by a name other than "ssh" or "Secure Shell". 1318de8d7fSPeter Avalos * 1418de8d7fSPeter Avalos * SSH2 support by Markus Friedl. 1518de8d7fSPeter Avalos * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 1618de8d7fSPeter Avalos * 1718de8d7fSPeter Avalos * Redistribution and use in source and binary forms, with or without 1818de8d7fSPeter Avalos * modification, are permitted provided that the following conditions 1918de8d7fSPeter Avalos * are met: 2018de8d7fSPeter Avalos * 1. Redistributions of source code must retain the above copyright 2118de8d7fSPeter Avalos * notice, this list of conditions and the following disclaimer. 2218de8d7fSPeter Avalos * 2. Redistributions in binary form must reproduce the above copyright 2318de8d7fSPeter Avalos * notice, this list of conditions and the following disclaimer in the 2418de8d7fSPeter Avalos * documentation and/or other materials provided with the distribution. 2518de8d7fSPeter Avalos * 2618de8d7fSPeter Avalos * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 2718de8d7fSPeter Avalos * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 2818de8d7fSPeter Avalos * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 2918de8d7fSPeter Avalos * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 3018de8d7fSPeter Avalos * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 3118de8d7fSPeter Avalos * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 3218de8d7fSPeter Avalos * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 3318de8d7fSPeter Avalos * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 3418de8d7fSPeter Avalos * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 3518de8d7fSPeter Avalos * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 3618de8d7fSPeter Avalos */ 3718de8d7fSPeter Avalos 3818de8d7fSPeter Avalos #include "includes.h" 3918de8d7fSPeter Avalos 4018de8d7fSPeter Avalos #include <sys/types.h> 4118de8d7fSPeter Avalos #include <sys/wait.h> 4218de8d7fSPeter Avalos #include <sys/socket.h> 4318de8d7fSPeter Avalos #ifdef HAVE_SYS_TIME_H 4418de8d7fSPeter Avalos # include <sys/time.h> 4518de8d7fSPeter Avalos #endif 4618de8d7fSPeter Avalos 4718de8d7fSPeter Avalos #include <netinet/in.h> 4818de8d7fSPeter Avalos 4918de8d7fSPeter Avalos #include <errno.h> 5018de8d7fSPeter Avalos #include <fcntl.h> 5118de8d7fSPeter Avalos #include <pwd.h> 52664f4763Szrj #include <limits.h> 5318de8d7fSPeter Avalos #include <signal.h> 5418de8d7fSPeter Avalos #include <string.h> 5518de8d7fSPeter Avalos #include <termios.h> 5618de8d7fSPeter Avalos #include <unistd.h> 5718de8d7fSPeter Avalos #include <stdarg.h> 5818de8d7fSPeter Avalos 5918de8d7fSPeter Avalos #include "openbsd-compat/sys-queue.h" 6018de8d7fSPeter Avalos #include "xmalloc.h" 6118de8d7fSPeter Avalos #include "packet.h" 62664f4763Szrj #include "sshbuf.h" 6318de8d7fSPeter Avalos #include "log.h" 6436e94dc5SPeter Avalos #include "misc.h" 6518de8d7fSPeter Avalos #include "servconf.h" 6618de8d7fSPeter Avalos #include "canohost.h" 6718de8d7fSPeter Avalos #include "sshpty.h" 6818de8d7fSPeter Avalos #include "channels.h" 6918de8d7fSPeter Avalos #include "compat.h" 7018de8d7fSPeter Avalos #include "ssh2.h" 71664f4763Szrj #include "sshkey.h" 7218de8d7fSPeter Avalos #include "cipher.h" 7318de8d7fSPeter Avalos #include "kex.h" 7418de8d7fSPeter Avalos #include "hostfile.h" 7518de8d7fSPeter Avalos #include "auth.h" 7618de8d7fSPeter Avalos #include "session.h" 7718de8d7fSPeter Avalos #include "dispatch.h" 7818de8d7fSPeter Avalos #include "auth-options.h" 7918de8d7fSPeter Avalos #include "serverloop.h" 80e9778795SPeter Avalos #include "ssherr.h" 8118de8d7fSPeter Avalos 8218de8d7fSPeter Avalos extern ServerOptions options; 8318de8d7fSPeter Avalos 8418de8d7fSPeter Avalos /* XXX */ 8518de8d7fSPeter Avalos extern Authctxt *the_authctxt; 86664f4763Szrj extern struct sshauthopt *auth_opts; 8718de8d7fSPeter Avalos extern int use_privsep; 8818de8d7fSPeter Avalos 8918de8d7fSPeter Avalos static int no_more_sessions = 0; /* Disallow further sessions. */ 9018de8d7fSPeter Avalos 9118de8d7fSPeter Avalos /* 9218de8d7fSPeter Avalos * This SIGCHLD kludge is used to detect when the child exits. The server 9318de8d7fSPeter Avalos * will exit after that, as soon as forwarded connections have terminated. 9418de8d7fSPeter Avalos */ 9518de8d7fSPeter Avalos 9618de8d7fSPeter Avalos static volatile sig_atomic_t child_terminated = 0; /* The child has terminated. */ 9718de8d7fSPeter Avalos 9818de8d7fSPeter Avalos /* Cleanup on signals (!use_privsep case only) */ 9918de8d7fSPeter Avalos static volatile sig_atomic_t received_sigterm = 0; 10018de8d7fSPeter Avalos 10118de8d7fSPeter Avalos /* prototypes */ 102664f4763Szrj static void server_init_dispatch(struct ssh *); 103664f4763Szrj 104664f4763Szrj /* requested tunnel forwarding interface(s), shared with session.c */ 105664f4763Szrj char *tun_fwd_ifnames = NULL; 106664f4763Szrj 107664f4763Szrj /* returns 1 if bind to specified port by specified user is permitted */ 108664f4763Szrj static int 109664f4763Szrj bind_permitted(int port, uid_t uid) 110664f4763Szrj { 111664f4763Szrj if (use_privsep) 112664f4763Szrj return 1; /* allow system to decide */ 113664f4763Szrj if (port < IPPORT_RESERVED && uid != 0) 114664f4763Szrj return 0; 115664f4763Szrj return 1; 116664f4763Szrj } 11718de8d7fSPeter Avalos 11818de8d7fSPeter Avalos /* 11918de8d7fSPeter Avalos * we write to this pipe if a SIGCHLD is caught in order to avoid 12018de8d7fSPeter Avalos * the race between select() and child_terminated 12118de8d7fSPeter Avalos */ 12218de8d7fSPeter Avalos static int notify_pipe[2]; 12318de8d7fSPeter Avalos static void 12418de8d7fSPeter Avalos notify_setup(void) 12518de8d7fSPeter Avalos { 12618de8d7fSPeter Avalos if (pipe(notify_pipe) < 0) { 12718de8d7fSPeter Avalos error("pipe(notify_pipe) failed %s", strerror(errno)); 1281c188a7fSPeter Avalos } else if ((fcntl(notify_pipe[0], F_SETFD, FD_CLOEXEC) == -1) || 1291c188a7fSPeter Avalos (fcntl(notify_pipe[1], F_SETFD, FD_CLOEXEC) == -1)) { 13018de8d7fSPeter Avalos error("fcntl(notify_pipe, F_SETFD) failed %s", strerror(errno)); 13118de8d7fSPeter Avalos close(notify_pipe[0]); 13218de8d7fSPeter Avalos close(notify_pipe[1]); 13318de8d7fSPeter Avalos } else { 13418de8d7fSPeter Avalos set_nonblock(notify_pipe[0]); 13518de8d7fSPeter Avalos set_nonblock(notify_pipe[1]); 13618de8d7fSPeter Avalos return; 13718de8d7fSPeter Avalos } 13818de8d7fSPeter Avalos notify_pipe[0] = -1; /* read end */ 13918de8d7fSPeter Avalos notify_pipe[1] = -1; /* write end */ 14018de8d7fSPeter Avalos } 14118de8d7fSPeter Avalos static void 14218de8d7fSPeter Avalos notify_parent(void) 14318de8d7fSPeter Avalos { 14418de8d7fSPeter Avalos if (notify_pipe[1] != -1) 14536e94dc5SPeter Avalos (void)write(notify_pipe[1], "", 1); 14618de8d7fSPeter Avalos } 14718de8d7fSPeter Avalos static void 14818de8d7fSPeter Avalos notify_prepare(fd_set *readset) 14918de8d7fSPeter Avalos { 15018de8d7fSPeter Avalos if (notify_pipe[0] != -1) 15118de8d7fSPeter Avalos FD_SET(notify_pipe[0], readset); 15218de8d7fSPeter Avalos } 15318de8d7fSPeter Avalos static void 15418de8d7fSPeter Avalos notify_done(fd_set *readset) 15518de8d7fSPeter Avalos { 15618de8d7fSPeter Avalos char c; 15718de8d7fSPeter Avalos 15818de8d7fSPeter Avalos if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) 15918de8d7fSPeter Avalos while (read(notify_pipe[0], &c, 1) != -1) 160664f4763Szrj debug2("%s: reading", __func__); 16118de8d7fSPeter Avalos } 16218de8d7fSPeter Avalos 16318de8d7fSPeter Avalos /*ARGSUSED*/ 16418de8d7fSPeter Avalos static void 16518de8d7fSPeter Avalos sigchld_handler(int sig) 16618de8d7fSPeter Avalos { 16718de8d7fSPeter Avalos int save_errno = errno; 16818de8d7fSPeter Avalos child_terminated = 1; 16918de8d7fSPeter Avalos notify_parent(); 17018de8d7fSPeter Avalos errno = save_errno; 17118de8d7fSPeter Avalos } 17218de8d7fSPeter Avalos 17318de8d7fSPeter Avalos /*ARGSUSED*/ 17418de8d7fSPeter Avalos static void 17518de8d7fSPeter Avalos sigterm_handler(int sig) 17618de8d7fSPeter Avalos { 17718de8d7fSPeter Avalos received_sigterm = sig; 17818de8d7fSPeter Avalos } 17918de8d7fSPeter Avalos 18018de8d7fSPeter Avalos static void 181ce74bacaSMatthew Dillon client_alive_check(struct ssh *ssh) 18218de8d7fSPeter Avalos { 183664f4763Szrj char remote_id[512]; 184664f4763Szrj int r, channel_id; 18518de8d7fSPeter Avalos 18618de8d7fSPeter Avalos /* timeout, check to see how many we have had */ 187664f4763Szrj if (ssh_packet_inc_alive_timeouts(ssh) > 188664f4763Szrj options.client_alive_count_max) { 189664f4763Szrj sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id)); 190664f4763Szrj logit("Timeout, client not responding from %s", remote_id); 19118de8d7fSPeter Avalos cleanup_exit(255); 19218de8d7fSPeter Avalos } 19318de8d7fSPeter Avalos 19418de8d7fSPeter Avalos /* 19518de8d7fSPeter Avalos * send a bogus global/channel request with "wantreply", 19618de8d7fSPeter Avalos * we should get back a failure 19718de8d7fSPeter Avalos */ 198ce74bacaSMatthew Dillon if ((channel_id = channel_find_open(ssh)) == -1) { 199664f4763Szrj if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 || 200664f4763Szrj (r = sshpkt_put_cstring(ssh, "keepalive@openssh.com")) 201664f4763Szrj != 0 || 202664f4763Szrj (r = sshpkt_put_u8(ssh, 1)) != 0) /* boolean: want reply */ 203664f4763Szrj fatal("%s: %s", __func__, ssh_err(r)); 20418de8d7fSPeter Avalos } else { 205ce74bacaSMatthew Dillon channel_request_start(ssh, channel_id, 206ce74bacaSMatthew Dillon "keepalive@openssh.com", 1); 20718de8d7fSPeter Avalos } 208664f4763Szrj if ((r = sshpkt_send(ssh)) != 0) 209664f4763Szrj fatal("%s: %s", __func__, ssh_err(r)); 21018de8d7fSPeter Avalos } 21118de8d7fSPeter Avalos 21218de8d7fSPeter Avalos /* 21318de8d7fSPeter Avalos * Sleep in select() until we can do something. This will initialize the 21418de8d7fSPeter Avalos * select masks. Upon return, the masks will indicate which descriptors 21518de8d7fSPeter Avalos * have data or can accept data. Optionally, a maximum time can be specified 21618de8d7fSPeter Avalos * for the duration of the wait (0 = infinite). 21718de8d7fSPeter Avalos */ 21818de8d7fSPeter Avalos static void 219ce74bacaSMatthew Dillon wait_until_can_do_something(struct ssh *ssh, 220ce74bacaSMatthew Dillon int connection_in, int connection_out, 221ce74bacaSMatthew Dillon fd_set **readsetp, fd_set **writesetp, int *maxfdp, 222e9778795SPeter Avalos u_int *nallocp, u_int64_t max_time_ms) 22318de8d7fSPeter Avalos { 22418de8d7fSPeter Avalos struct timeval tv, *tvp; 22518de8d7fSPeter Avalos int ret; 22699e85e0dSPeter Avalos time_t minwait_secs = 0; 22718de8d7fSPeter Avalos int client_alive_scheduled = 0; 228664f4763Szrj /* time we last heard from the client OR sent a keepalive */ 229ce74bacaSMatthew Dillon static time_t last_client_time; 23018de8d7fSPeter Avalos 23199e85e0dSPeter Avalos /* Allocate and update select() masks for channel descriptors. */ 232ce74bacaSMatthew Dillon channel_prepare_select(ssh, readsetp, writesetp, maxfdp, 233ce74bacaSMatthew Dillon nallocp, &minwait_secs); 23499e85e0dSPeter Avalos 235e9778795SPeter Avalos /* XXX need proper deadline system for rekey/client alive */ 23699e85e0dSPeter Avalos if (minwait_secs != 0) 237ce74bacaSMatthew Dillon max_time_ms = MINIMUM(max_time_ms, (u_int)minwait_secs * 1000); 23899e85e0dSPeter Avalos 23918de8d7fSPeter Avalos /* 24018de8d7fSPeter Avalos * if using client_alive, set the max timeout accordingly, 24118de8d7fSPeter Avalos * and indicate that this particular timeout was for client 24218de8d7fSPeter Avalos * alive by setting the client_alive_scheduled flag. 24318de8d7fSPeter Avalos * 24418de8d7fSPeter Avalos * this could be randomized somewhat to make traffic 24518de8d7fSPeter Avalos * analysis more difficult, but we're not doing it yet. 24618de8d7fSPeter Avalos */ 247ce74bacaSMatthew Dillon if (options.client_alive_interval) { 248e9778795SPeter Avalos uint64_t keepalive_ms = 249e9778795SPeter Avalos (uint64_t)options.client_alive_interval * 1000; 250e9778795SPeter Avalos 251664f4763Szrj if (max_time_ms == 0 || max_time_ms > keepalive_ms) { 252e9778795SPeter Avalos max_time_ms = keepalive_ms; 253664f4763Szrj client_alive_scheduled = 1; 254664f4763Szrj } 25518de8d7fSPeter Avalos } 25618de8d7fSPeter Avalos 25718de8d7fSPeter Avalos #if 0 25818de8d7fSPeter Avalos /* wrong: bad condition XXX */ 25918de8d7fSPeter Avalos if (channel_not_very_much_buffered_data()) 26018de8d7fSPeter Avalos #endif 26118de8d7fSPeter Avalos FD_SET(connection_in, *readsetp); 26218de8d7fSPeter Avalos notify_prepare(*readsetp); 26318de8d7fSPeter Avalos 26418de8d7fSPeter Avalos /* 26518de8d7fSPeter Avalos * If we have buffered packet data going to the client, mark that 26618de8d7fSPeter Avalos * descriptor. 26718de8d7fSPeter Avalos */ 268664f4763Szrj if (ssh_packet_have_data_to_write(ssh)) 26918de8d7fSPeter Avalos FD_SET(connection_out, *writesetp); 27018de8d7fSPeter Avalos 27118de8d7fSPeter Avalos /* 27218de8d7fSPeter Avalos * If child has terminated and there is enough buffer space to read 27318de8d7fSPeter Avalos * from it, then read as much as is available and exit. 27418de8d7fSPeter Avalos */ 275664f4763Szrj if (child_terminated && ssh_packet_not_very_much_data_to_write(ssh)) 276e9778795SPeter Avalos if (max_time_ms == 0 || client_alive_scheduled) 277e9778795SPeter Avalos max_time_ms = 100; 27818de8d7fSPeter Avalos 279e9778795SPeter Avalos if (max_time_ms == 0) 28018de8d7fSPeter Avalos tvp = NULL; 28118de8d7fSPeter Avalos else { 282e9778795SPeter Avalos tv.tv_sec = max_time_ms / 1000; 283e9778795SPeter Avalos tv.tv_usec = 1000 * (max_time_ms % 1000); 28418de8d7fSPeter Avalos tvp = &tv; 28518de8d7fSPeter Avalos } 28618de8d7fSPeter Avalos 28718de8d7fSPeter Avalos /* Wait for something to happen, or the timeout to expire. */ 28818de8d7fSPeter Avalos ret = select((*maxfdp)+1, *readsetp, *writesetp, NULL, tvp); 28918de8d7fSPeter Avalos 29018de8d7fSPeter Avalos if (ret == -1) { 29118de8d7fSPeter Avalos memset(*readsetp, 0, *nallocp); 29218de8d7fSPeter Avalos memset(*writesetp, 0, *nallocp); 29318de8d7fSPeter Avalos if (errno != EINTR) 29418de8d7fSPeter Avalos error("select: %.100s", strerror(errno)); 295ce74bacaSMatthew Dillon } else if (client_alive_scheduled) { 296ce74bacaSMatthew Dillon time_t now = monotime(); 297ce74bacaSMatthew Dillon 298664f4763Szrj /* 299664f4763Szrj * If the select timed out, or returned for some other reason 300664f4763Szrj * but we haven't heard from the client in time, send keepalive. 301664f4763Szrj */ 302664f4763Szrj if (ret == 0 || (last_client_time != 0 && last_client_time + 303664f4763Szrj options.client_alive_interval <= now)) { 304ce74bacaSMatthew Dillon client_alive_check(ssh); 305ce74bacaSMatthew Dillon last_client_time = now; 306664f4763Szrj } else if (FD_ISSET(connection_in, *readsetp)) { 307ce74bacaSMatthew Dillon last_client_time = now; 30818de8d7fSPeter Avalos } 30918de8d7fSPeter Avalos } 31018de8d7fSPeter Avalos 31118de8d7fSPeter Avalos notify_done(*readsetp); 31218de8d7fSPeter Avalos } 31318de8d7fSPeter Avalos 31418de8d7fSPeter Avalos /* 31518de8d7fSPeter Avalos * Processes input from the client and the program. Input data is stored 31618de8d7fSPeter Avalos * in buffers and processed later. 31718de8d7fSPeter Avalos */ 318ce74bacaSMatthew Dillon static int 319ce74bacaSMatthew Dillon process_input(struct ssh *ssh, fd_set *readset, int connection_in) 32018de8d7fSPeter Avalos { 321664f4763Szrj int r, len; 32218de8d7fSPeter Avalos char buf[16384]; 32318de8d7fSPeter Avalos 32418de8d7fSPeter Avalos /* Read and buffer any input data from the client. */ 32518de8d7fSPeter Avalos if (FD_ISSET(connection_in, readset)) { 326e9778795SPeter Avalos len = read(connection_in, buf, sizeof(buf)); 32718de8d7fSPeter Avalos if (len == 0) { 328e9778795SPeter Avalos verbose("Connection closed by %.100s port %d", 329e9778795SPeter Avalos ssh_remote_ipaddr(ssh), ssh_remote_port(ssh)); 330ce74bacaSMatthew Dillon return -1; 33118de8d7fSPeter Avalos } else if (len < 0) { 33218de8d7fSPeter Avalos if (errno != EINTR && errno != EAGAIN && 33318de8d7fSPeter Avalos errno != EWOULDBLOCK) { 33418de8d7fSPeter Avalos verbose("Read error from remote host " 335e9778795SPeter Avalos "%.100s port %d: %.100s", 336e9778795SPeter Avalos ssh_remote_ipaddr(ssh), 337e9778795SPeter Avalos ssh_remote_port(ssh), strerror(errno)); 33818de8d7fSPeter Avalos cleanup_exit(255); 33918de8d7fSPeter Avalos } 34018de8d7fSPeter Avalos } else { 34118de8d7fSPeter Avalos /* Buffer any received data. */ 342664f4763Szrj if ((r = ssh_packet_process_incoming(ssh, buf, len)) 343664f4763Szrj != 0) 344664f4763Szrj fatal("%s: ssh_packet_process_incoming: %s", 345664f4763Szrj __func__, ssh_err(r)); 34618de8d7fSPeter Avalos } 34718de8d7fSPeter Avalos } 348ce74bacaSMatthew Dillon return 0; 34918de8d7fSPeter Avalos } 35018de8d7fSPeter Avalos 35118de8d7fSPeter Avalos /* 35218de8d7fSPeter Avalos * Sends data from internal buffers to client program stdin. 35318de8d7fSPeter Avalos */ 35418de8d7fSPeter Avalos static void 355664f4763Szrj process_output(struct ssh *ssh, fd_set *writeset, int connection_out) 35618de8d7fSPeter Avalos { 357664f4763Szrj int r; 358664f4763Szrj 35918de8d7fSPeter Avalos /* Send any buffered packet data to the client. */ 360664f4763Szrj if (FD_ISSET(connection_out, writeset)) { 361664f4763Szrj if ((r = ssh_packet_write_poll(ssh)) != 0) 362664f4763Szrj fatal("%s: ssh_packet_write_poll: %s", 363664f4763Szrj __func__, ssh_err(r)); 364664f4763Szrj } 36518de8d7fSPeter Avalos } 36618de8d7fSPeter Avalos 36718de8d7fSPeter Avalos static void 368ce74bacaSMatthew Dillon process_buffered_input_packets(struct ssh *ssh) 36918de8d7fSPeter Avalos { 370ce74bacaSMatthew Dillon ssh_dispatch_run_fatal(ssh, DISPATCH_NONBLOCK, NULL); 37118de8d7fSPeter Avalos } 37218de8d7fSPeter Avalos 37318de8d7fSPeter Avalos static void 374ce74bacaSMatthew Dillon collect_children(struct ssh *ssh) 37518de8d7fSPeter Avalos { 37618de8d7fSPeter Avalos pid_t pid; 37718de8d7fSPeter Avalos sigset_t oset, nset; 37818de8d7fSPeter Avalos int status; 37918de8d7fSPeter Avalos 38018de8d7fSPeter Avalos /* block SIGCHLD while we check for dead children */ 38118de8d7fSPeter Avalos sigemptyset(&nset); 38218de8d7fSPeter Avalos sigaddset(&nset, SIGCHLD); 38318de8d7fSPeter Avalos sigprocmask(SIG_BLOCK, &nset, &oset); 38418de8d7fSPeter Avalos if (child_terminated) { 38518de8d7fSPeter Avalos debug("Received SIGCHLD."); 38618de8d7fSPeter Avalos while ((pid = waitpid(-1, &status, WNOHANG)) > 0 || 38718de8d7fSPeter Avalos (pid < 0 && errno == EINTR)) 38818de8d7fSPeter Avalos if (pid > 0) 389ce74bacaSMatthew Dillon session_close_by_pid(ssh, pid, status); 39018de8d7fSPeter Avalos child_terminated = 0; 39118de8d7fSPeter Avalos } 39218de8d7fSPeter Avalos sigprocmask(SIG_SETMASK, &oset, NULL); 39318de8d7fSPeter Avalos } 39418de8d7fSPeter Avalos 39518de8d7fSPeter Avalos void 396ce74bacaSMatthew Dillon server_loop2(struct ssh *ssh, Authctxt *authctxt) 39718de8d7fSPeter Avalos { 39818de8d7fSPeter Avalos fd_set *readset = NULL, *writeset = NULL; 399e9778795SPeter Avalos int max_fd; 400ce74bacaSMatthew Dillon u_int nalloc = 0, connection_in, connection_out; 40136e94dc5SPeter Avalos u_int64_t rekey_timeout_ms = 0; 40218de8d7fSPeter Avalos 40318de8d7fSPeter Avalos debug("Entering interactive session for SSH2."); 40418de8d7fSPeter Avalos 405664f4763Szrj signal(SIGCHLD, sigchld_handler); 40618de8d7fSPeter Avalos child_terminated = 0; 407664f4763Szrj connection_in = ssh_packet_get_connection_in(ssh); 408664f4763Szrj connection_out = ssh_packet_get_connection_out(ssh); 40918de8d7fSPeter Avalos 41018de8d7fSPeter Avalos if (!use_privsep) { 41118de8d7fSPeter Avalos signal(SIGTERM, sigterm_handler); 41218de8d7fSPeter Avalos signal(SIGINT, sigterm_handler); 41318de8d7fSPeter Avalos signal(SIGQUIT, sigterm_handler); 41418de8d7fSPeter Avalos } 41518de8d7fSPeter Avalos 41618de8d7fSPeter Avalos notify_setup(); 41718de8d7fSPeter Avalos 418ce74bacaSMatthew Dillon max_fd = MAXIMUM(connection_in, connection_out); 419ce74bacaSMatthew Dillon max_fd = MAXIMUM(max_fd, notify_pipe[0]); 42018de8d7fSPeter Avalos 421664f4763Szrj server_init_dispatch(ssh); 42218de8d7fSPeter Avalos 42318de8d7fSPeter Avalos for (;;) { 424ce74bacaSMatthew Dillon process_buffered_input_packets(ssh); 42518de8d7fSPeter Avalos 426ce74bacaSMatthew Dillon if (!ssh_packet_is_rekeying(ssh) && 427664f4763Szrj ssh_packet_not_very_much_data_to_write(ssh)) 428ce74bacaSMatthew Dillon channel_output_poll(ssh); 429664f4763Szrj if (options.rekey_interval > 0 && 430664f4763Szrj !ssh_packet_is_rekeying(ssh)) { 431664f4763Szrj rekey_timeout_ms = ssh_packet_get_rekey_timeout(ssh) * 432664f4763Szrj 1000; 433664f4763Szrj } else { 43436e94dc5SPeter Avalos rekey_timeout_ms = 0; 435664f4763Szrj } 43636e94dc5SPeter Avalos 437ce74bacaSMatthew Dillon wait_until_can_do_something(ssh, connection_in, connection_out, 438ce74bacaSMatthew Dillon &readset, &writeset, &max_fd, &nalloc, rekey_timeout_ms); 43918de8d7fSPeter Avalos 44018de8d7fSPeter Avalos if (received_sigterm) { 44136e94dc5SPeter Avalos logit("Exiting on signal %d", (int)received_sigterm); 44218de8d7fSPeter Avalos /* Clean up sessions, utmp, etc. */ 44318de8d7fSPeter Avalos cleanup_exit(255); 44418de8d7fSPeter Avalos } 44518de8d7fSPeter Avalos 446ce74bacaSMatthew Dillon collect_children(ssh); 447ce74bacaSMatthew Dillon if (!ssh_packet_is_rekeying(ssh)) 448ce74bacaSMatthew Dillon channel_after_select(ssh, readset, writeset); 449ce74bacaSMatthew Dillon if (process_input(ssh, readset, connection_in) < 0) 45018de8d7fSPeter Avalos break; 451664f4763Szrj process_output(ssh, writeset, connection_out); 45218de8d7fSPeter Avalos } 453ce74bacaSMatthew Dillon collect_children(ssh); 45418de8d7fSPeter Avalos 45536e94dc5SPeter Avalos free(readset); 45636e94dc5SPeter Avalos free(writeset); 45718de8d7fSPeter Avalos 45818de8d7fSPeter Avalos /* free all channels, no more reads and writes */ 459ce74bacaSMatthew Dillon channel_free_all(ssh); 46018de8d7fSPeter Avalos 46118de8d7fSPeter Avalos /* free remaining sessions, e.g. remove wtmp entries */ 462ce74bacaSMatthew Dillon session_destroy_all(ssh, NULL); 46318de8d7fSPeter Avalos } 46418de8d7fSPeter Avalos 465e9778795SPeter Avalos static int 466ce74bacaSMatthew Dillon server_input_keep_alive(int type, u_int32_t seq, struct ssh *ssh) 46718de8d7fSPeter Avalos { 46818de8d7fSPeter Avalos debug("Got %d/%u for keepalive", type, seq); 46918de8d7fSPeter Avalos /* 47018de8d7fSPeter Avalos * reset timeout, since we got a sane answer from the client. 47118de8d7fSPeter Avalos * even if this was generated by something other than 47218de8d7fSPeter Avalos * the bogus CHANNEL_REQUEST we send for keepalives. 47318de8d7fSPeter Avalos */ 474664f4763Szrj ssh_packet_set_alive_timeouts(ssh, 0); 475e9778795SPeter Avalos return 0; 47618de8d7fSPeter Avalos } 47718de8d7fSPeter Avalos 47818de8d7fSPeter Avalos static Channel * 479ce74bacaSMatthew Dillon server_request_direct_tcpip(struct ssh *ssh, int *reason, const char **errmsg) 48018de8d7fSPeter Avalos { 48136e94dc5SPeter Avalos Channel *c = NULL; 482664f4763Szrj char *target = NULL, *originator = NULL; 483664f4763Szrj u_int target_port = 0, originator_port = 0; 484664f4763Szrj int r; 48518de8d7fSPeter Avalos 486664f4763Szrj if ((r = sshpkt_get_cstring(ssh, &target, NULL)) != 0 || 487664f4763Szrj (r = sshpkt_get_u32(ssh, &target_port)) != 0 || 488664f4763Szrj (r = sshpkt_get_cstring(ssh, &originator, NULL)) != 0 || 489664f4763Szrj (r = sshpkt_get_u32(ssh, &originator_port)) != 0 || 490664f4763Szrj (r = sshpkt_get_end(ssh)) != 0) 491664f4763Szrj sshpkt_fatal(ssh, r, "%s: parse packet", __func__); 492664f4763Szrj if (target_port > 0xFFFF) { 493664f4763Szrj error("%s: invalid target port", __func__); 494664f4763Szrj *reason = SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED; 495664f4763Szrj goto out; 496664f4763Szrj } 497664f4763Szrj if (originator_port > 0xFFFF) { 498664f4763Szrj error("%s: invalid originator port", __func__); 499664f4763Szrj *reason = SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED; 500664f4763Szrj goto out; 501664f4763Szrj } 50218de8d7fSPeter Avalos 503664f4763Szrj debug("%s: originator %s port %u, target %s port %u", __func__, 504664f4763Szrj originator, originator_port, target, target_port); 50518de8d7fSPeter Avalos 50636e94dc5SPeter Avalos /* XXX fine grained permissions */ 50736e94dc5SPeter Avalos if ((options.allow_tcp_forwarding & FORWARD_LOCAL) != 0 && 508664f4763Szrj auth_opts->permit_port_forwarding_flag && 509664f4763Szrj !options.disable_forwarding) { 510ce74bacaSMatthew Dillon c = channel_connect_to_port(ssh, target, target_port, 511ce74bacaSMatthew Dillon "direct-tcpip", "direct-tcpip", reason, errmsg); 51236e94dc5SPeter Avalos } else { 51336e94dc5SPeter Avalos logit("refused local port forward: " 51436e94dc5SPeter Avalos "originator %s port %d, target %s port %d", 51536e94dc5SPeter Avalos originator, originator_port, target, target_port); 516ce74bacaSMatthew Dillon if (reason != NULL) 517ce74bacaSMatthew Dillon *reason = SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED; 51836e94dc5SPeter Avalos } 51918de8d7fSPeter Avalos 520664f4763Szrj out: 52136e94dc5SPeter Avalos free(originator); 52236e94dc5SPeter Avalos free(target); 52336e94dc5SPeter Avalos return c; 52436e94dc5SPeter Avalos } 52536e94dc5SPeter Avalos 52636e94dc5SPeter Avalos static Channel * 527ce74bacaSMatthew Dillon server_request_direct_streamlocal(struct ssh *ssh) 52836e94dc5SPeter Avalos { 52936e94dc5SPeter Avalos Channel *c = NULL; 530664f4763Szrj char *target = NULL, *originator = NULL; 531664f4763Szrj u_int originator_port = 0; 532ce74bacaSMatthew Dillon struct passwd *pw = the_authctxt->pw; 533664f4763Szrj int r; 534ce74bacaSMatthew Dillon 535ce74bacaSMatthew Dillon if (pw == NULL || !the_authctxt->valid) 536664f4763Szrj fatal("%s: no/invalid user", __func__); 53736e94dc5SPeter Avalos 538664f4763Szrj if ((r = sshpkt_get_cstring(ssh, &target, NULL)) != 0 || 539664f4763Szrj (r = sshpkt_get_cstring(ssh, &originator, NULL)) != 0 || 540664f4763Szrj (r = sshpkt_get_u32(ssh, &originator_port)) != 0 || 541664f4763Szrj (r = sshpkt_get_end(ssh)) != 0) 542664f4763Szrj sshpkt_fatal(ssh, r, "%s: parse packet", __func__); 543664f4763Szrj if (originator_port > 0xFFFF) { 544664f4763Szrj error("%s: invalid originator port", __func__); 545664f4763Szrj goto out; 546664f4763Szrj } 54736e94dc5SPeter Avalos 548664f4763Szrj debug("%s: originator %s port %d, target %s", __func__, 54936e94dc5SPeter Avalos originator, originator_port, target); 55036e94dc5SPeter Avalos 55136e94dc5SPeter Avalos /* XXX fine grained permissions */ 55236e94dc5SPeter Avalos if ((options.allow_streamlocal_forwarding & FORWARD_LOCAL) != 0 && 553664f4763Szrj auth_opts->permit_port_forwarding_flag && 554664f4763Szrj !options.disable_forwarding && (pw->pw_uid == 0 || use_privsep)) { 555ce74bacaSMatthew Dillon c = channel_connect_to_path(ssh, target, 55636e94dc5SPeter Avalos "direct-streamlocal@openssh.com", "direct-streamlocal"); 55736e94dc5SPeter Avalos } else { 55836e94dc5SPeter Avalos logit("refused streamlocal port forward: " 55936e94dc5SPeter Avalos "originator %s port %d, target %s", 56036e94dc5SPeter Avalos originator, originator_port, target); 56136e94dc5SPeter Avalos } 56236e94dc5SPeter Avalos 563664f4763Szrj out: 56436e94dc5SPeter Avalos free(originator); 56536e94dc5SPeter Avalos free(target); 56618de8d7fSPeter Avalos return c; 56718de8d7fSPeter Avalos } 56818de8d7fSPeter Avalos 56918de8d7fSPeter Avalos static Channel * 570ce74bacaSMatthew Dillon server_request_tun(struct ssh *ssh) 57118de8d7fSPeter Avalos { 57218de8d7fSPeter Avalos Channel *c = NULL; 573664f4763Szrj u_int mode, tun; 574664f4763Szrj int r, sock; 575664f4763Szrj char *tmp, *ifname = NULL; 57618de8d7fSPeter Avalos 577664f4763Szrj if ((r = sshpkt_get_u32(ssh, &mode)) != 0) 578664f4763Szrj sshpkt_fatal(ssh, r, "%s: parse mode", __func__); 57918de8d7fSPeter Avalos switch (mode) { 58018de8d7fSPeter Avalos case SSH_TUNMODE_POINTOPOINT: 58118de8d7fSPeter Avalos case SSH_TUNMODE_ETHERNET: 58218de8d7fSPeter Avalos break; 58318de8d7fSPeter Avalos default: 584664f4763Szrj ssh_packet_send_debug(ssh, "Unsupported tunnel device mode."); 58518de8d7fSPeter Avalos return NULL; 58618de8d7fSPeter Avalos } 58718de8d7fSPeter Avalos if ((options.permit_tun & mode) == 0) { 588664f4763Szrj ssh_packet_send_debug(ssh, "Server has rejected tunnel device " 58918de8d7fSPeter Avalos "forwarding"); 59018de8d7fSPeter Avalos return NULL; 59118de8d7fSPeter Avalos } 59218de8d7fSPeter Avalos 593664f4763Szrj if ((r = sshpkt_get_u32(ssh, &tun)) != 0) 594664f4763Szrj sshpkt_fatal(ssh, r, "%s: parse device", __func__); 595664f4763Szrj if (tun > INT_MAX) { 596664f4763Szrj debug("%s: invalid tun", __func__); 59718de8d7fSPeter Avalos goto done; 59818de8d7fSPeter Avalos } 599664f4763Szrj if (auth_opts->force_tun_device != -1) { 600664f4763Szrj if (tun != SSH_TUNID_ANY && 601664f4763Szrj auth_opts->force_tun_device != (int)tun) 602664f4763Szrj goto done; 603664f4763Szrj tun = auth_opts->force_tun_device; 604664f4763Szrj } 605664f4763Szrj sock = tun_open(tun, mode, &ifname); 60618de8d7fSPeter Avalos if (sock < 0) 60718de8d7fSPeter Avalos goto done; 608664f4763Szrj debug("Tunnel forwarding using interface %s", ifname); 609664f4763Szrj 610ce74bacaSMatthew Dillon c = channel_new(ssh, "tun", SSH_CHANNEL_OPEN, sock, sock, -1, 61118de8d7fSPeter Avalos CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1); 61218de8d7fSPeter Avalos c->datagram = 1; 61318de8d7fSPeter Avalos #if defined(SSH_TUN_FILTER) 61418de8d7fSPeter Avalos if (mode == SSH_TUNMODE_POINTOPOINT) 615ce74bacaSMatthew Dillon channel_register_filter(ssh, c->self, sys_tun_infilter, 61618de8d7fSPeter Avalos sys_tun_outfilter, NULL, NULL); 61718de8d7fSPeter Avalos #endif 61818de8d7fSPeter Avalos 619664f4763Szrj /* 620664f4763Szrj * Update the list of names exposed to the session 621664f4763Szrj * XXX remove these if the tunnels are closed (won't matter 622664f4763Szrj * much if they are already in the environment though) 623664f4763Szrj */ 624664f4763Szrj tmp = tun_fwd_ifnames; 625664f4763Szrj xasprintf(&tun_fwd_ifnames, "%s%s%s", 626664f4763Szrj tun_fwd_ifnames == NULL ? "" : tun_fwd_ifnames, 627664f4763Szrj tun_fwd_ifnames == NULL ? "" : ",", 628664f4763Szrj ifname); 629664f4763Szrj free(tmp); 630664f4763Szrj free(ifname); 631664f4763Szrj 63218de8d7fSPeter Avalos done: 63318de8d7fSPeter Avalos if (c == NULL) 634664f4763Szrj ssh_packet_send_debug(ssh, "Failed to open the tunnel device."); 63518de8d7fSPeter Avalos return c; 63618de8d7fSPeter Avalos } 63718de8d7fSPeter Avalos 63818de8d7fSPeter Avalos static Channel * 639ce74bacaSMatthew Dillon server_request_session(struct ssh *ssh) 64018de8d7fSPeter Avalos { 64118de8d7fSPeter Avalos Channel *c; 642664f4763Szrj int r; 64318de8d7fSPeter Avalos 64418de8d7fSPeter Avalos debug("input_session_request"); 645664f4763Szrj if ((r = sshpkt_get_end(ssh)) != 0) 646664f4763Szrj sshpkt_fatal(ssh, r, "%s: parse packet", __func__); 64718de8d7fSPeter Avalos 64818de8d7fSPeter Avalos if (no_more_sessions) { 649664f4763Szrj ssh_packet_disconnect(ssh, "Possible attack: attempt to open a " 650664f4763Szrj "session after additional sessions disabled"); 65118de8d7fSPeter Avalos } 65218de8d7fSPeter Avalos 65318de8d7fSPeter Avalos /* 65418de8d7fSPeter Avalos * A server session has no fd to read or write until a 65518de8d7fSPeter Avalos * CHANNEL_REQUEST for a shell is made, so we set the type to 65618de8d7fSPeter Avalos * SSH_CHANNEL_LARVAL. Additionally, a callback for handling all 65718de8d7fSPeter Avalos * CHANNEL_REQUEST messages is registered. 65818de8d7fSPeter Avalos */ 659ce74bacaSMatthew Dillon c = channel_new(ssh, "session", SSH_CHANNEL_LARVAL, 66018de8d7fSPeter Avalos -1, -1, -1, /*window size*/0, CHAN_SES_PACKET_DEFAULT, 66118de8d7fSPeter Avalos 0, "server-session", 1); 66218de8d7fSPeter Avalos if (session_open(the_authctxt, c->self) != 1) { 66318de8d7fSPeter Avalos debug("session open failed, free channel %d", c->self); 664ce74bacaSMatthew Dillon channel_free(ssh, c); 66518de8d7fSPeter Avalos return NULL; 66618de8d7fSPeter Avalos } 667ce74bacaSMatthew Dillon channel_register_cleanup(ssh, c->self, session_close_by_channel, 0); 66818de8d7fSPeter Avalos return c; 66918de8d7fSPeter Avalos } 67018de8d7fSPeter Avalos 671e9778795SPeter Avalos static int 672ce74bacaSMatthew Dillon server_input_channel_open(int type, u_int32_t seq, struct ssh *ssh) 67318de8d7fSPeter Avalos { 67418de8d7fSPeter Avalos Channel *c = NULL; 675664f4763Szrj char *ctype = NULL; 676ce74bacaSMatthew Dillon const char *errmsg = NULL; 677664f4763Szrj int r, reason = SSH2_OPEN_CONNECT_FAILED; 678664f4763Szrj u_int rchan = 0, rmaxpack = 0, rwindow = 0; 67918de8d7fSPeter Avalos 680664f4763Szrj if ((r = sshpkt_get_cstring(ssh, &ctype, NULL)) != 0 || 681664f4763Szrj (r = sshpkt_get_u32(ssh, &rchan)) != 0 || 682664f4763Szrj (r = sshpkt_get_u32(ssh, &rwindow)) != 0 || 683664f4763Szrj (r = sshpkt_get_u32(ssh, &rmaxpack)) != 0) 684664f4763Szrj sshpkt_fatal(ssh, r, "%s: parse packet", __func__); 685664f4763Szrj debug("%s: ctype %s rchan %u win %u max %u", __func__, 68618de8d7fSPeter Avalos ctype, rchan, rwindow, rmaxpack); 68718de8d7fSPeter Avalos 688664f4763Szrj if (rchan > INT_MAX) { 689664f4763Szrj error("%s: invalid remote channel ID", __func__); 690664f4763Szrj } else if (strcmp(ctype, "session") == 0) { 691ce74bacaSMatthew Dillon c = server_request_session(ssh); 69218de8d7fSPeter Avalos } else if (strcmp(ctype, "direct-tcpip") == 0) { 693ce74bacaSMatthew Dillon c = server_request_direct_tcpip(ssh, &reason, &errmsg); 69436e94dc5SPeter Avalos } else if (strcmp(ctype, "direct-streamlocal@openssh.com") == 0) { 695ce74bacaSMatthew Dillon c = server_request_direct_streamlocal(ssh); 69618de8d7fSPeter Avalos } else if (strcmp(ctype, "tun@openssh.com") == 0) { 697ce74bacaSMatthew Dillon c = server_request_tun(ssh); 69818de8d7fSPeter Avalos } 69918de8d7fSPeter Avalos if (c != NULL) { 700664f4763Szrj debug("%s: confirm %s", __func__, ctype); 701664f4763Szrj c->remote_id = (int)rchan; 702ce74bacaSMatthew Dillon c->have_remote_id = 1; 70318de8d7fSPeter Avalos c->remote_window = rwindow; 70418de8d7fSPeter Avalos c->remote_maxpacket = rmaxpack; 70518de8d7fSPeter Avalos if (c->type != SSH_CHANNEL_CONNECTING) { 706664f4763Szrj if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_OPEN_CONFIRMATION)) != 0 || 707664f4763Szrj (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 708664f4763Szrj (r = sshpkt_put_u32(ssh, c->self)) != 0 || 709664f4763Szrj (r = sshpkt_put_u32(ssh, c->local_window)) != 0 || 710664f4763Szrj (r = sshpkt_put_u32(ssh, c->local_maxpacket)) != 0 || 711664f4763Szrj (r = sshpkt_send(ssh)) != 0) { 712664f4763Szrj sshpkt_fatal(ssh, r, 713664f4763Szrj "%s: send open confirm", __func__); 714664f4763Szrj } 71518de8d7fSPeter Avalos } 71618de8d7fSPeter Avalos } else { 717664f4763Szrj debug("%s: failure %s", __func__, ctype); 718664f4763Szrj if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_OPEN_FAILURE)) != 0 || 719664f4763Szrj (r = sshpkt_put_u32(ssh, rchan)) != 0 || 720664f4763Szrj (r = sshpkt_put_u32(ssh, reason)) != 0 || 721664f4763Szrj (r = sshpkt_put_cstring(ssh, errmsg ? errmsg : "open failed")) != 0 || 722664f4763Szrj (r = sshpkt_put_cstring(ssh, "")) != 0 || 723664f4763Szrj (r = sshpkt_send(ssh)) != 0) { 724664f4763Szrj sshpkt_fatal(ssh, r, 725664f4763Szrj "%s: send open failure", __func__); 72618de8d7fSPeter Avalos } 72718de8d7fSPeter Avalos } 72836e94dc5SPeter Avalos free(ctype); 729e9778795SPeter Avalos return 0; 73018de8d7fSPeter Avalos } 73118de8d7fSPeter Avalos 732e9778795SPeter Avalos static int 733ce74bacaSMatthew Dillon server_input_hostkeys_prove(struct ssh *ssh, struct sshbuf **respp) 734e9778795SPeter Avalos { 735e9778795SPeter Avalos struct sshbuf *resp = NULL; 736e9778795SPeter Avalos struct sshbuf *sigbuf = NULL; 737e9778795SPeter Avalos struct sshkey *key = NULL, *key_pub = NULL, *key_prv = NULL; 738664f4763Szrj int r, ndx, kexsigtype, use_kexsigtype, success = 0; 739e9778795SPeter Avalos const u_char *blob; 740e9778795SPeter Avalos u_char *sig = 0; 741e9778795SPeter Avalos size_t blen, slen; 742e9778795SPeter Avalos 743e9778795SPeter Avalos if ((resp = sshbuf_new()) == NULL || (sigbuf = sshbuf_new()) == NULL) 744e9778795SPeter Avalos fatal("%s: sshbuf_new", __func__); 745e9778795SPeter Avalos 746664f4763Szrj kexsigtype = sshkey_type_plain( 747664f4763Szrj sshkey_type_from_name(ssh->kex->hostkey_alg)); 748e9778795SPeter Avalos while (ssh_packet_remaining(ssh) > 0) { 749e9778795SPeter Avalos sshkey_free(key); 750e9778795SPeter Avalos key = NULL; 751e9778795SPeter Avalos if ((r = sshpkt_get_string_direct(ssh, &blob, &blen)) != 0 || 752e9778795SPeter Avalos (r = sshkey_from_blob(blob, blen, &key)) != 0) { 753e9778795SPeter Avalos error("%s: couldn't parse key: %s", 754e9778795SPeter Avalos __func__, ssh_err(r)); 755e9778795SPeter Avalos goto out; 756e9778795SPeter Avalos } 757e9778795SPeter Avalos /* 758e9778795SPeter Avalos * Better check that this is actually one of our hostkeys 759e9778795SPeter Avalos * before attempting to sign anything with it. 760e9778795SPeter Avalos */ 761e9778795SPeter Avalos if ((ndx = ssh->kex->host_key_index(key, 1, ssh)) == -1) { 762e9778795SPeter Avalos error("%s: unknown host %s key", 763e9778795SPeter Avalos __func__, sshkey_type(key)); 764e9778795SPeter Avalos goto out; 765e9778795SPeter Avalos } 766e9778795SPeter Avalos /* 767e9778795SPeter Avalos * XXX refactor: make kex->sign just use an index rather 768e9778795SPeter Avalos * than passing in public and private keys 769e9778795SPeter Avalos */ 770e9778795SPeter Avalos if ((key_prv = get_hostkey_by_index(ndx)) == NULL && 771e9778795SPeter Avalos (key_pub = get_hostkey_public_by_index(ndx, ssh)) == NULL) { 772e9778795SPeter Avalos error("%s: can't retrieve hostkey %d", __func__, ndx); 773e9778795SPeter Avalos goto out; 774e9778795SPeter Avalos } 775e9778795SPeter Avalos sshbuf_reset(sigbuf); 776e9778795SPeter Avalos free(sig); 777e9778795SPeter Avalos sig = NULL; 778664f4763Szrj /* 779664f4763Szrj * For RSA keys, prefer to use the signature type negotiated 780664f4763Szrj * during KEX to the default (SHA1). 781664f4763Szrj */ 782664f4763Szrj use_kexsigtype = kexsigtype == KEY_RSA && 783664f4763Szrj sshkey_type_plain(key->type) == KEY_RSA; 784e9778795SPeter Avalos if ((r = sshbuf_put_cstring(sigbuf, 785e9778795SPeter Avalos "hostkeys-prove-00@openssh.com")) != 0 || 786e9778795SPeter Avalos (r = sshbuf_put_string(sigbuf, 787e9778795SPeter Avalos ssh->kex->session_id, ssh->kex->session_id_len)) != 0 || 788e9778795SPeter Avalos (r = sshkey_puts(key, sigbuf)) != 0 || 789664f4763Szrj (r = ssh->kex->sign(ssh, key_prv, key_pub, &sig, &slen, 790664f4763Szrj sshbuf_ptr(sigbuf), sshbuf_len(sigbuf), 791664f4763Szrj use_kexsigtype ? ssh->kex->hostkey_alg : NULL)) != 0 || 792e9778795SPeter Avalos (r = sshbuf_put_string(resp, sig, slen)) != 0) { 793e9778795SPeter Avalos error("%s: couldn't prepare signature: %s", 794e9778795SPeter Avalos __func__, ssh_err(r)); 795e9778795SPeter Avalos goto out; 796e9778795SPeter Avalos } 797e9778795SPeter Avalos } 798e9778795SPeter Avalos /* Success */ 799e9778795SPeter Avalos *respp = resp; 800e9778795SPeter Avalos resp = NULL; /* don't free it */ 801e9778795SPeter Avalos success = 1; 802e9778795SPeter Avalos out: 803e9778795SPeter Avalos free(sig); 804e9778795SPeter Avalos sshbuf_free(resp); 805e9778795SPeter Avalos sshbuf_free(sigbuf); 806e9778795SPeter Avalos sshkey_free(key); 807e9778795SPeter Avalos return success; 808e9778795SPeter Avalos } 809e9778795SPeter Avalos 810e9778795SPeter Avalos static int 811ce74bacaSMatthew Dillon server_input_global_request(int type, u_int32_t seq, struct ssh *ssh) 81218de8d7fSPeter Avalos { 813664f4763Szrj char *rtype = NULL; 814664f4763Szrj u_char want_reply = 0; 815e9778795SPeter Avalos int r, success = 0, allocated_listen_port = 0; 816664f4763Szrj u_int port = 0; 817e9778795SPeter Avalos struct sshbuf *resp = NULL; 818ce74bacaSMatthew Dillon struct passwd *pw = the_authctxt->pw; 81936e94dc5SPeter Avalos struct Forward fwd; 82018de8d7fSPeter Avalos 82136e94dc5SPeter Avalos memset(&fwd, 0, sizeof(fwd)); 822664f4763Szrj if (pw == NULL || !the_authctxt->valid) 823664f4763Szrj fatal("%s: no/invalid user", __func__); 82418de8d7fSPeter Avalos 825664f4763Szrj if ((r = sshpkt_get_cstring(ssh, &rtype, NULL)) != 0 || 826664f4763Szrj (r = sshpkt_get_u8(ssh, &want_reply)) != 0) 827664f4763Szrj sshpkt_fatal(ssh, r, "%s: parse packet", __func__); 828664f4763Szrj debug("%s: rtype %s want_reply %d", __func__, rtype, want_reply); 829664f4763Szrj 830664f4763Szrj /* -R style forwarding */ 831664f4763Szrj if (strcmp(rtype, "tcpip-forward") == 0) { 832664f4763Szrj if ((r = sshpkt_get_cstring(ssh, &fwd.listen_host, NULL)) != 0 || 833664f4763Szrj (r = sshpkt_get_u32(ssh, &port)) != 0) 834664f4763Szrj sshpkt_fatal(ssh, r, "%s: parse tcpip-forward", __func__); 835664f4763Szrj debug("%s: tcpip-forward listen %s port %u", __func__, 836664f4763Szrj fwd.listen_host, port); 837664f4763Szrj if (port <= INT_MAX) 838664f4763Szrj fwd.listen_port = (int)port; 83918de8d7fSPeter Avalos /* check permissions */ 840664f4763Szrj if (port > INT_MAX || 841664f4763Szrj (options.allow_tcp_forwarding & FORWARD_REMOTE) == 0 || 842664f4763Szrj !auth_opts->permit_port_forwarding_flag || 843664f4763Szrj options.disable_forwarding || 844e9778795SPeter Avalos (!want_reply && fwd.listen_port == 0) || 845ce74bacaSMatthew Dillon (fwd.listen_port != 0 && 846ce74bacaSMatthew Dillon !bind_permitted(fwd.listen_port, pw->pw_uid))) { 84718de8d7fSPeter Avalos success = 0; 848664f4763Szrj ssh_packet_send_debug(ssh, "Server has disabled port forwarding."); 84918de8d7fSPeter Avalos } else { 85018de8d7fSPeter Avalos /* Start listening on the port */ 851ce74bacaSMatthew Dillon success = channel_setup_remote_fwd_listener(ssh, &fwd, 85236e94dc5SPeter Avalos &allocated_listen_port, &options.fwd_opts); 85318de8d7fSPeter Avalos } 854e9778795SPeter Avalos if ((resp = sshbuf_new()) == NULL) 855e9778795SPeter Avalos fatal("%s: sshbuf_new", __func__); 856e9778795SPeter Avalos if (allocated_listen_port != 0 && 857e9778795SPeter Avalos (r = sshbuf_put_u32(resp, allocated_listen_port)) != 0) 858e9778795SPeter Avalos fatal("%s: sshbuf_put_u32: %s", __func__, ssh_err(r)); 85918de8d7fSPeter Avalos } else if (strcmp(rtype, "cancel-tcpip-forward") == 0) { 860664f4763Szrj if ((r = sshpkt_get_cstring(ssh, &fwd.listen_host, NULL)) != 0 || 861664f4763Szrj (r = sshpkt_get_u32(ssh, &port)) != 0) 862664f4763Szrj sshpkt_fatal(ssh, r, "%s: parse cancel-tcpip-forward", __func__); 86318de8d7fSPeter Avalos 86418de8d7fSPeter Avalos debug("%s: cancel-tcpip-forward addr %s port %d", __func__, 865664f4763Szrj fwd.listen_host, port); 866664f4763Szrj if (port <= INT_MAX) { 867664f4763Szrj fwd.listen_port = (int)port; 868ce74bacaSMatthew Dillon success = channel_cancel_rport_listener(ssh, &fwd); 869664f4763Szrj } 87036e94dc5SPeter Avalos } else if (strcmp(rtype, "streamlocal-forward@openssh.com") == 0) { 871664f4763Szrj if ((r = sshpkt_get_cstring(ssh, &fwd.listen_path, NULL)) != 0) 872664f4763Szrj sshpkt_fatal(ssh, r, "%s: parse streamlocal-forward@openssh.com", __func__); 873664f4763Szrj debug("%s: streamlocal-forward listen path %s", __func__, 87436e94dc5SPeter Avalos fwd.listen_path); 87536e94dc5SPeter Avalos 87636e94dc5SPeter Avalos /* check permissions */ 87736e94dc5SPeter Avalos if ((options.allow_streamlocal_forwarding & FORWARD_REMOTE) == 0 878664f4763Szrj || !auth_opts->permit_port_forwarding_flag || 879664f4763Szrj options.disable_forwarding || 880ce74bacaSMatthew Dillon (pw->pw_uid != 0 && !use_privsep)) { 88136e94dc5SPeter Avalos success = 0; 882664f4763Szrj ssh_packet_send_debug(ssh, "Server has disabled " 883ce74bacaSMatthew Dillon "streamlocal forwarding."); 88436e94dc5SPeter Avalos } else { 88536e94dc5SPeter Avalos /* Start listening on the socket */ 886ce74bacaSMatthew Dillon success = channel_setup_remote_fwd_listener(ssh, 88736e94dc5SPeter Avalos &fwd, NULL, &options.fwd_opts); 88836e94dc5SPeter Avalos } 88936e94dc5SPeter Avalos } else if (strcmp(rtype, "cancel-streamlocal-forward@openssh.com") == 0) { 890664f4763Szrj if ((r = sshpkt_get_cstring(ssh, &fwd.listen_path, NULL)) != 0) 891664f4763Szrj sshpkt_fatal(ssh, r, "%s: parse cancel-streamlocal-forward@openssh.com", __func__); 89236e94dc5SPeter Avalos debug("%s: cancel-streamlocal-forward path %s", __func__, 89336e94dc5SPeter Avalos fwd.listen_path); 89436e94dc5SPeter Avalos 895ce74bacaSMatthew Dillon success = channel_cancel_rport_listener(ssh, &fwd); 89618de8d7fSPeter Avalos } else if (strcmp(rtype, "no-more-sessions@openssh.com") == 0) { 89718de8d7fSPeter Avalos no_more_sessions = 1; 89818de8d7fSPeter Avalos success = 1; 899e9778795SPeter Avalos } else if (strcmp(rtype, "hostkeys-prove-00@openssh.com") == 0) { 900ce74bacaSMatthew Dillon success = server_input_hostkeys_prove(ssh, &resp); 90118de8d7fSPeter Avalos } 902664f4763Szrj /* XXX sshpkt_get_end() */ 90318de8d7fSPeter Avalos if (want_reply) { 904664f4763Szrj if ((r = sshpkt_start(ssh, success ? 905664f4763Szrj SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE)) != 0 || 906664f4763Szrj (success && resp != NULL && (r = sshpkt_putb(ssh, resp)) != 0) || 907664f4763Szrj (r = sshpkt_send(ssh)) != 0 || 908664f4763Szrj (r = ssh_packet_write_wait(ssh)) != 0) 909664f4763Szrj sshpkt_fatal(ssh, r, "%s: send reply", __func__); 91018de8d7fSPeter Avalos } 911664f4763Szrj free(fwd.listen_host); 912664f4763Szrj free(fwd.listen_path); 91336e94dc5SPeter Avalos free(rtype); 914e9778795SPeter Avalos sshbuf_free(resp); 915e9778795SPeter Avalos return 0; 91618de8d7fSPeter Avalos } 91718de8d7fSPeter Avalos 918e9778795SPeter Avalos static int 919ce74bacaSMatthew Dillon server_input_channel_req(int type, u_int32_t seq, struct ssh *ssh) 92018de8d7fSPeter Avalos { 92118de8d7fSPeter Avalos Channel *c; 922664f4763Szrj int r, success = 0; 923664f4763Szrj char *rtype = NULL; 924664f4763Szrj u_char want_reply = 0; 925664f4763Szrj u_int id = 0; 92618de8d7fSPeter Avalos 927664f4763Szrj if ((r = sshpkt_get_u32(ssh, &id)) != 0 || 928664f4763Szrj (r = sshpkt_get_cstring(ssh, &rtype, NULL)) != 0 || 929664f4763Szrj (r = sshpkt_get_u8(ssh, &want_reply)) != 0) 930664f4763Szrj sshpkt_fatal(ssh, r, "%s: parse packet", __func__); 93118de8d7fSPeter Avalos 932664f4763Szrj debug("server_input_channel_req: channel %u request %s reply %d", 933664f4763Szrj id, rtype, want_reply); 93418de8d7fSPeter Avalos 935664f4763Szrj if (id >= INT_MAX || (c = channel_lookup(ssh, (int)id)) == NULL) { 936664f4763Szrj ssh_packet_disconnect(ssh, "%s: unknown channel %d", 937664f4763Szrj __func__, id); 938664f4763Szrj } 93918de8d7fSPeter Avalos if (!strcmp(rtype, "eow@openssh.com")) { 940664f4763Szrj if ((r = sshpkt_get_end(ssh)) != 0) 941664f4763Szrj sshpkt_fatal(ssh, r, "%s: parse packet", __func__); 942ce74bacaSMatthew Dillon chan_rcvd_eow(ssh, c); 94318de8d7fSPeter Avalos } else if ((c->type == SSH_CHANNEL_LARVAL || 94418de8d7fSPeter Avalos c->type == SSH_CHANNEL_OPEN) && strcmp(c->ctype, "session") == 0) 945ce74bacaSMatthew Dillon success = session_input_channel_req(ssh, c, rtype); 946664f4763Szrj if (want_reply && !(c->flags & CHAN_CLOSE_SENT)) { 947ce74bacaSMatthew Dillon if (!c->have_remote_id) 948ce74bacaSMatthew Dillon fatal("%s: channel %d: no remote_id", 949ce74bacaSMatthew Dillon __func__, c->self); 950664f4763Szrj if ((r = sshpkt_start(ssh, success ? 951664f4763Szrj SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE)) != 0 || 952664f4763Szrj (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 953664f4763Szrj (r = sshpkt_send(ssh)) != 0) 954664f4763Szrj sshpkt_fatal(ssh, r, "%s: send reply", __func__); 95518de8d7fSPeter Avalos } 95636e94dc5SPeter Avalos free(rtype); 957e9778795SPeter Avalos return 0; 95818de8d7fSPeter Avalos } 95918de8d7fSPeter Avalos 96018de8d7fSPeter Avalos static void 961664f4763Szrj server_init_dispatch(struct ssh *ssh) 96218de8d7fSPeter Avalos { 963ce74bacaSMatthew Dillon debug("server_init_dispatch"); 964664f4763Szrj ssh_dispatch_init(ssh, &dispatch_protocol_error); 965664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_CLOSE, &channel_input_oclose); 966664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_DATA, &channel_input_data); 967664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_EOF, &channel_input_ieof); 968664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_EXTENDED_DATA, &channel_input_extended_data); 969664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_OPEN, &server_input_channel_open); 970664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation); 971664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure); 972664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_REQUEST, &server_input_channel_req); 973664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust); 974664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_GLOBAL_REQUEST, &server_input_global_request); 97518de8d7fSPeter Avalos /* client_alive */ 976664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_SUCCESS, &server_input_keep_alive); 977664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_CHANNEL_FAILURE, &server_input_keep_alive); 978664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_REQUEST_SUCCESS, &server_input_keep_alive); 979664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_REQUEST_FAILURE, &server_input_keep_alive); 98018de8d7fSPeter Avalos /* rekeying */ 981664f4763Szrj ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_input_kexinit); 98218de8d7fSPeter Avalos } 983