xref: /dragonfly/crypto/openssh/sftp-client.c (revision fcf53d9b)
1 /* $OpenBSD: sftp-client.c,v 1.94 2010/12/04 00:18:01 djm Exp $ */
2 /*
3  * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 /* XXX: memleaks */
19 /* XXX: signed vs unsigned */
20 /* XXX: remove all logging, only return status codes */
21 /* XXX: copy between two remote sites */
22 
23 #include "includes.h"
24 
25 #include <sys/types.h>
26 #include <sys/param.h>
27 #ifdef HAVE_SYS_STATVFS_H
28 #include <sys/statvfs.h>
29 #endif
30 #include "openbsd-compat/sys-queue.h"
31 #ifdef HAVE_SYS_STAT_H
32 # include <sys/stat.h>
33 #endif
34 #ifdef HAVE_SYS_TIME_H
35 # include <sys/time.h>
36 #endif
37 #include <sys/uio.h>
38 
39 #include <dirent.h>
40 #include <errno.h>
41 #include <fcntl.h>
42 #include <signal.h>
43 #include <stdarg.h>
44 #include <stdio.h>
45 #include <string.h>
46 #include <unistd.h>
47 
48 #include "xmalloc.h"
49 #include "buffer.h"
50 #include "log.h"
51 #include "atomicio.h"
52 #include "progressmeter.h"
53 #include "misc.h"
54 
55 #include "sftp.h"
56 #include "sftp-common.h"
57 #include "sftp-client.h"
58 
59 extern volatile sig_atomic_t interrupted;
60 extern int showprogress;
61 
62 /* Minimum amount of data to read at a time */
63 #define MIN_READ_SIZE	512
64 
65 /* Maximum depth to descend in directory trees */
66 #define MAX_DIR_DEPTH 64
67 
68 struct sftp_conn {
69 	int fd_in;
70 	int fd_out;
71 	u_int transfer_buflen;
72 	u_int num_requests;
73 	u_int version;
74 	u_int msg_id;
75 #define SFTP_EXT_POSIX_RENAME	0x00000001
76 #define SFTP_EXT_STATVFS	0x00000002
77 #define SFTP_EXT_FSTATVFS	0x00000004
78 #define SFTP_EXT_HARDLINK	0x00000008
79 	u_int exts;
80 	u_int64_t limit_kbps;
81 	struct bwlimit bwlimit_in, bwlimit_out;
82 };
83 
84 static char *
85 get_handle(struct sftp_conn *conn, u_int expected_id, u_int *len,
86     const char *errfmt, ...) __attribute__((format(printf, 4, 5)));
87 
88 /* ARGSUSED */
89 static int
90 sftpio(void *_bwlimit, size_t amount)
91 {
92 	struct bwlimit *bwlimit = (struct bwlimit *)_bwlimit;
93 
94 	bandwidth_limit(bwlimit, amount);
95 	return 0;
96 }
97 
98 static void
99 send_msg(struct sftp_conn *conn, Buffer *m)
100 {
101 	u_char mlen[4];
102 	struct iovec iov[2];
103 
104 	if (buffer_len(m) > SFTP_MAX_MSG_LENGTH)
105 		fatal("Outbound message too long %u", buffer_len(m));
106 
107 	/* Send length first */
108 	put_u32(mlen, buffer_len(m));
109 	iov[0].iov_base = mlen;
110 	iov[0].iov_len = sizeof(mlen);
111 	iov[1].iov_base = buffer_ptr(m);
112 	iov[1].iov_len = buffer_len(m);
113 
114 	if (atomiciov6(writev, conn->fd_out, iov, 2,
115 	    conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_out) !=
116 	    buffer_len(m) + sizeof(mlen))
117 		fatal("Couldn't send packet: %s", strerror(errno));
118 
119 	buffer_clear(m);
120 }
121 
122 static void
123 get_msg(struct sftp_conn *conn, Buffer *m)
124 {
125 	u_int msg_len;
126 
127 	buffer_append_space(m, 4);
128 	if (atomicio6(read, conn->fd_in, buffer_ptr(m), 4,
129 	    conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in) != 4) {
130 		if (errno == EPIPE)
131 			fatal("Connection closed");
132 		else
133 			fatal("Couldn't read packet: %s", strerror(errno));
134 	}
135 
136 	msg_len = buffer_get_int(m);
137 	if (msg_len > SFTP_MAX_MSG_LENGTH)
138 		fatal("Received message too long %u", msg_len);
139 
140 	buffer_append_space(m, msg_len);
141 	if (atomicio6(read, conn->fd_in, buffer_ptr(m), msg_len,
142 	    conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in)
143 	    != msg_len) {
144 		if (errno == EPIPE)
145 			fatal("Connection closed");
146 		else
147 			fatal("Read packet: %s", strerror(errno));
148 	}
149 }
150 
151 static void
152 send_string_request(struct sftp_conn *conn, u_int id, u_int code, char *s,
153     u_int len)
154 {
155 	Buffer msg;
156 
157 	buffer_init(&msg);
158 	buffer_put_char(&msg, code);
159 	buffer_put_int(&msg, id);
160 	buffer_put_string(&msg, s, len);
161 	send_msg(conn, &msg);
162 	debug3("Sent message fd %d T:%u I:%u", conn->fd_out, code, id);
163 	buffer_free(&msg);
164 }
165 
166 static void
167 send_string_attrs_request(struct sftp_conn *conn, u_int id, u_int code,
168     char *s, u_int len, Attrib *a)
169 {
170 	Buffer msg;
171 
172 	buffer_init(&msg);
173 	buffer_put_char(&msg, code);
174 	buffer_put_int(&msg, id);
175 	buffer_put_string(&msg, s, len);
176 	encode_attrib(&msg, a);
177 	send_msg(conn, &msg);
178 	debug3("Sent message fd %d T:%u I:%u", conn->fd_out, code, id);
179 	buffer_free(&msg);
180 }
181 
182 static u_int
183 get_status(struct sftp_conn *conn, u_int expected_id)
184 {
185 	Buffer msg;
186 	u_int type, id, status;
187 
188 	buffer_init(&msg);
189 	get_msg(conn, &msg);
190 	type = buffer_get_char(&msg);
191 	id = buffer_get_int(&msg);
192 
193 	if (id != expected_id)
194 		fatal("ID mismatch (%u != %u)", id, expected_id);
195 	if (type != SSH2_FXP_STATUS)
196 		fatal("Expected SSH2_FXP_STATUS(%u) packet, got %u",
197 		    SSH2_FXP_STATUS, type);
198 
199 	status = buffer_get_int(&msg);
200 	buffer_free(&msg);
201 
202 	debug3("SSH2_FXP_STATUS %u", status);
203 
204 	return status;
205 }
206 
207 static char *
208 get_handle(struct sftp_conn *conn, u_int expected_id, u_int *len,
209     const char *errfmt, ...)
210 {
211 	Buffer msg;
212 	u_int type, id;
213 	char *handle, errmsg[256];
214 	va_list args;
215 	int status;
216 
217 	va_start(args, errfmt);
218 	if (errfmt != NULL)
219 		vsnprintf(errmsg, sizeof(errmsg), errfmt, args);
220 	va_end(args);
221 
222 	buffer_init(&msg);
223 	get_msg(conn, &msg);
224 	type = buffer_get_char(&msg);
225 	id = buffer_get_int(&msg);
226 
227 	if (id != expected_id)
228 		fatal("%s: ID mismatch (%u != %u)",
229 		    errfmt == NULL ? __func__ : errmsg, id, expected_id);
230 	if (type == SSH2_FXP_STATUS) {
231 		status = buffer_get_int(&msg);
232 		if (errfmt != NULL)
233 			error("%s: %s", errmsg, fx2txt(status));
234 		buffer_free(&msg);
235 		return(NULL);
236 	} else if (type != SSH2_FXP_HANDLE)
237 		fatal("%s: Expected SSH2_FXP_HANDLE(%u) packet, got %u",
238 		    errfmt == NULL ? __func__ : errmsg, SSH2_FXP_HANDLE, type);
239 
240 	handle = buffer_get_string(&msg, len);
241 	buffer_free(&msg);
242 
243 	return(handle);
244 }
245 
246 static Attrib *
247 get_decode_stat(struct sftp_conn *conn, u_int expected_id, int quiet)
248 {
249 	Buffer msg;
250 	u_int type, id;
251 	Attrib *a;
252 
253 	buffer_init(&msg);
254 	get_msg(conn, &msg);
255 
256 	type = buffer_get_char(&msg);
257 	id = buffer_get_int(&msg);
258 
259 	debug3("Received stat reply T:%u I:%u", type, id);
260 	if (id != expected_id)
261 		fatal("ID mismatch (%u != %u)", id, expected_id);
262 	if (type == SSH2_FXP_STATUS) {
263 		int status = buffer_get_int(&msg);
264 
265 		if (quiet)
266 			debug("Couldn't stat remote file: %s", fx2txt(status));
267 		else
268 			error("Couldn't stat remote file: %s", fx2txt(status));
269 		buffer_free(&msg);
270 		return(NULL);
271 	} else if (type != SSH2_FXP_ATTRS) {
272 		fatal("Expected SSH2_FXP_ATTRS(%u) packet, got %u",
273 		    SSH2_FXP_ATTRS, type);
274 	}
275 	a = decode_attrib(&msg);
276 	buffer_free(&msg);
277 
278 	return(a);
279 }
280 
281 static int
282 get_decode_statvfs(struct sftp_conn *conn, struct sftp_statvfs *st,
283     u_int expected_id, int quiet)
284 {
285 	Buffer msg;
286 	u_int type, id, flag;
287 
288 	buffer_init(&msg);
289 	get_msg(conn, &msg);
290 
291 	type = buffer_get_char(&msg);
292 	id = buffer_get_int(&msg);
293 
294 	debug3("Received statvfs reply T:%u I:%u", type, id);
295 	if (id != expected_id)
296 		fatal("ID mismatch (%u != %u)", id, expected_id);
297 	if (type == SSH2_FXP_STATUS) {
298 		int status = buffer_get_int(&msg);
299 
300 		if (quiet)
301 			debug("Couldn't statvfs: %s", fx2txt(status));
302 		else
303 			error("Couldn't statvfs: %s", fx2txt(status));
304 		buffer_free(&msg);
305 		return -1;
306 	} else if (type != SSH2_FXP_EXTENDED_REPLY) {
307 		fatal("Expected SSH2_FXP_EXTENDED_REPLY(%u) packet, got %u",
308 		    SSH2_FXP_EXTENDED_REPLY, type);
309 	}
310 
311 	bzero(st, sizeof(*st));
312 	st->f_bsize = buffer_get_int64(&msg);
313 	st->f_frsize = buffer_get_int64(&msg);
314 	st->f_blocks = buffer_get_int64(&msg);
315 	st->f_bfree = buffer_get_int64(&msg);
316 	st->f_bavail = buffer_get_int64(&msg);
317 	st->f_files = buffer_get_int64(&msg);
318 	st->f_ffree = buffer_get_int64(&msg);
319 	st->f_favail = buffer_get_int64(&msg);
320 	st->f_fsid = buffer_get_int64(&msg);
321 	flag = buffer_get_int64(&msg);
322 	st->f_namemax = buffer_get_int64(&msg);
323 
324 	st->f_flag = (flag & SSH2_FXE_STATVFS_ST_RDONLY) ? ST_RDONLY : 0;
325 	st->f_flag |= (flag & SSH2_FXE_STATVFS_ST_NOSUID) ? ST_NOSUID : 0;
326 
327 	buffer_free(&msg);
328 
329 	return 0;
330 }
331 
332 struct sftp_conn *
333 do_init(int fd_in, int fd_out, u_int transfer_buflen, u_int num_requests,
334     u_int64_t limit_kbps)
335 {
336 	u_int type;
337 	Buffer msg;
338 	struct sftp_conn *ret;
339 
340 	ret = xmalloc(sizeof(*ret));
341 	ret->fd_in = fd_in;
342 	ret->fd_out = fd_out;
343 	ret->transfer_buflen = transfer_buflen;
344 	ret->num_requests = num_requests;
345 	ret->exts = 0;
346 	ret->limit_kbps = 0;
347 
348 	buffer_init(&msg);
349 	buffer_put_char(&msg, SSH2_FXP_INIT);
350 	buffer_put_int(&msg, SSH2_FILEXFER_VERSION);
351 	send_msg(ret, &msg);
352 
353 	buffer_clear(&msg);
354 
355 	get_msg(ret, &msg);
356 
357 	/* Expecting a VERSION reply */
358 	if ((type = buffer_get_char(&msg)) != SSH2_FXP_VERSION) {
359 		error("Invalid packet back from SSH2_FXP_INIT (type %u)",
360 		    type);
361 		buffer_free(&msg);
362 		return(NULL);
363 	}
364 	ret->version = buffer_get_int(&msg);
365 
366 	debug2("Remote version: %u", ret->version);
367 
368 	/* Check for extensions */
369 	while (buffer_len(&msg) > 0) {
370 		char *name = buffer_get_string(&msg, NULL);
371 		char *value = buffer_get_string(&msg, NULL);
372 		int known = 0;
373 
374 		if (strcmp(name, "posix-rename@openssh.com") == 0 &&
375 		    strcmp(value, "1") == 0) {
376 			ret->exts |= SFTP_EXT_POSIX_RENAME;
377 			known = 1;
378 		} else if (strcmp(name, "statvfs@openssh.com") == 0 &&
379 		    strcmp(value, "2") == 0) {
380 			ret->exts |= SFTP_EXT_STATVFS;
381 			known = 1;
382 		} else if (strcmp(name, "fstatvfs@openssh.com") == 0 &&
383 		    strcmp(value, "2") == 0) {
384 			ret->exts |= SFTP_EXT_FSTATVFS;
385 			known = 1;
386 		} else if (strcmp(name, "hardlink@openssh.com") == 0 &&
387 		    strcmp(value, "1") == 0) {
388 			ret->exts |= SFTP_EXT_HARDLINK;
389 			known = 1;
390 		}
391 		if (known) {
392 			debug2("Server supports extension \"%s\" revision %s",
393 			    name, value);
394 		} else {
395 			debug2("Unrecognised server extension \"%s\"", name);
396 		}
397 		xfree(name);
398 		xfree(value);
399 	}
400 
401 	buffer_free(&msg);
402 
403 	/* Some filexfer v.0 servers don't support large packets */
404 	if (ret->version == 0)
405 		ret->transfer_buflen = MIN(ret->transfer_buflen, 20480);
406 
407 	ret->limit_kbps = limit_kbps;
408 	if (ret->limit_kbps > 0) {
409 		bandwidth_limit_init(&ret->bwlimit_in, ret->limit_kbps,
410 		    ret->transfer_buflen);
411 		bandwidth_limit_init(&ret->bwlimit_out, ret->limit_kbps,
412 		    ret->transfer_buflen);
413 	}
414 
415 	return ret;
416 }
417 
418 u_int
419 sftp_proto_version(struct sftp_conn *conn)
420 {
421 	return conn->version;
422 }
423 
424 int
425 do_close(struct sftp_conn *conn, char *handle, u_int handle_len)
426 {
427 	u_int id, status;
428 	Buffer msg;
429 
430 	buffer_init(&msg);
431 
432 	id = conn->msg_id++;
433 	buffer_put_char(&msg, SSH2_FXP_CLOSE);
434 	buffer_put_int(&msg, id);
435 	buffer_put_string(&msg, handle, handle_len);
436 	send_msg(conn, &msg);
437 	debug3("Sent message SSH2_FXP_CLOSE I:%u", id);
438 
439 	status = get_status(conn, id);
440 	if (status != SSH2_FX_OK)
441 		error("Couldn't close file: %s", fx2txt(status));
442 
443 	buffer_free(&msg);
444 
445 	return status;
446 }
447 
448 
449 static int
450 do_lsreaddir(struct sftp_conn *conn, char *path, int printflag,
451     SFTP_DIRENT ***dir)
452 {
453 	Buffer msg;
454 	u_int count, type, id, handle_len, i, expected_id, ents = 0;
455 	char *handle;
456 
457 	id = conn->msg_id++;
458 
459 	buffer_init(&msg);
460 	buffer_put_char(&msg, SSH2_FXP_OPENDIR);
461 	buffer_put_int(&msg, id);
462 	buffer_put_cstring(&msg, path);
463 	send_msg(conn, &msg);
464 
465 	buffer_clear(&msg);
466 
467 	handle = get_handle(conn, id, &handle_len,
468 	    "remote readdir(\"%s\")", path);
469 	if (handle == NULL)
470 		return -1;
471 
472 	if (dir) {
473 		ents = 0;
474 		*dir = xmalloc(sizeof(**dir));
475 		(*dir)[0] = NULL;
476 	}
477 
478 	for (; !interrupted;) {
479 		id = expected_id = conn->msg_id++;
480 
481 		debug3("Sending SSH2_FXP_READDIR I:%u", id);
482 
483 		buffer_clear(&msg);
484 		buffer_put_char(&msg, SSH2_FXP_READDIR);
485 		buffer_put_int(&msg, id);
486 		buffer_put_string(&msg, handle, handle_len);
487 		send_msg(conn, &msg);
488 
489 		buffer_clear(&msg);
490 
491 		get_msg(conn, &msg);
492 
493 		type = buffer_get_char(&msg);
494 		id = buffer_get_int(&msg);
495 
496 		debug3("Received reply T:%u I:%u", type, id);
497 
498 		if (id != expected_id)
499 			fatal("ID mismatch (%u != %u)", id, expected_id);
500 
501 		if (type == SSH2_FXP_STATUS) {
502 			int status = buffer_get_int(&msg);
503 
504 			debug3("Received SSH2_FXP_STATUS %d", status);
505 
506 			if (status == SSH2_FX_EOF) {
507 				break;
508 			} else {
509 				error("Couldn't read directory: %s",
510 				    fx2txt(status));
511 				do_close(conn, handle, handle_len);
512 				xfree(handle);
513 				return(status);
514 			}
515 		} else if (type != SSH2_FXP_NAME)
516 			fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
517 			    SSH2_FXP_NAME, type);
518 
519 		count = buffer_get_int(&msg);
520 		if (count == 0)
521 			break;
522 		debug3("Received %d SSH2_FXP_NAME responses", count);
523 		for (i = 0; i < count; i++) {
524 			char *filename, *longname;
525 			Attrib *a;
526 
527 			filename = buffer_get_string(&msg, NULL);
528 			longname = buffer_get_string(&msg, NULL);
529 			a = decode_attrib(&msg);
530 
531 			if (printflag)
532 				printf("%s\n", longname);
533 
534 			/*
535 			 * Directory entries should never contain '/'
536 			 * These can be used to attack recursive ops
537 			 * (e.g. send '../../../../etc/passwd')
538 			 */
539 			if (strchr(filename, '/') != NULL) {
540 				error("Server sent suspect path \"%s\" "
541 				    "during readdir of \"%s\"", filename, path);
542 				goto next;
543 			}
544 
545 			if (dir) {
546 				*dir = xrealloc(*dir, ents + 2, sizeof(**dir));
547 				(*dir)[ents] = xmalloc(sizeof(***dir));
548 				(*dir)[ents]->filename = xstrdup(filename);
549 				(*dir)[ents]->longname = xstrdup(longname);
550 				memcpy(&(*dir)[ents]->a, a, sizeof(*a));
551 				(*dir)[++ents] = NULL;
552 			}
553  next:
554 			xfree(filename);
555 			xfree(longname);
556 		}
557 	}
558 
559 	buffer_free(&msg);
560 	do_close(conn, handle, handle_len);
561 	xfree(handle);
562 
563 	/* Don't return partial matches on interrupt */
564 	if (interrupted && dir != NULL && *dir != NULL) {
565 		free_sftp_dirents(*dir);
566 		*dir = xmalloc(sizeof(**dir));
567 		**dir = NULL;
568 	}
569 
570 	return 0;
571 }
572 
573 int
574 do_readdir(struct sftp_conn *conn, char *path, SFTP_DIRENT ***dir)
575 {
576 	return(do_lsreaddir(conn, path, 0, dir));
577 }
578 
579 void free_sftp_dirents(SFTP_DIRENT **s)
580 {
581 	int i;
582 
583 	for (i = 0; s[i]; i++) {
584 		xfree(s[i]->filename);
585 		xfree(s[i]->longname);
586 		xfree(s[i]);
587 	}
588 	xfree(s);
589 }
590 
591 int
592 do_rm(struct sftp_conn *conn, char *path)
593 {
594 	u_int status, id;
595 
596 	debug2("Sending SSH2_FXP_REMOVE \"%s\"", path);
597 
598 	id = conn->msg_id++;
599 	send_string_request(conn, id, SSH2_FXP_REMOVE, path, strlen(path));
600 	status = get_status(conn, id);
601 	if (status != SSH2_FX_OK)
602 		error("Couldn't delete file: %s", fx2txt(status));
603 	return(status);
604 }
605 
606 int
607 do_mkdir(struct sftp_conn *conn, char *path, Attrib *a, int printflag)
608 {
609 	u_int status, id;
610 
611 	id = conn->msg_id++;
612 	send_string_attrs_request(conn, id, SSH2_FXP_MKDIR, path,
613 	    strlen(path), a);
614 
615 	status = get_status(conn, id);
616 	if (status != SSH2_FX_OK && printflag)
617 		error("Couldn't create directory: %s", fx2txt(status));
618 
619 	return(status);
620 }
621 
622 int
623 do_rmdir(struct sftp_conn *conn, char *path)
624 {
625 	u_int status, id;
626 
627 	id = conn->msg_id++;
628 	send_string_request(conn, id, SSH2_FXP_RMDIR, path,
629 	    strlen(path));
630 
631 	status = get_status(conn, id);
632 	if (status != SSH2_FX_OK)
633 		error("Couldn't remove directory: %s", fx2txt(status));
634 
635 	return(status);
636 }
637 
638 Attrib *
639 do_stat(struct sftp_conn *conn, char *path, int quiet)
640 {
641 	u_int id;
642 
643 	id = conn->msg_id++;
644 
645 	send_string_request(conn, id,
646 	    conn->version == 0 ? SSH2_FXP_STAT_VERSION_0 : SSH2_FXP_STAT,
647 	    path, strlen(path));
648 
649 	return(get_decode_stat(conn, id, quiet));
650 }
651 
652 Attrib *
653 do_lstat(struct sftp_conn *conn, char *path, int quiet)
654 {
655 	u_int id;
656 
657 	if (conn->version == 0) {
658 		if (quiet)
659 			debug("Server version does not support lstat operation");
660 		else
661 			logit("Server version does not support lstat operation");
662 		return(do_stat(conn, path, quiet));
663 	}
664 
665 	id = conn->msg_id++;
666 	send_string_request(conn, id, SSH2_FXP_LSTAT, path,
667 	    strlen(path));
668 
669 	return(get_decode_stat(conn, id, quiet));
670 }
671 
672 #ifdef notyet
673 Attrib *
674 do_fstat(struct sftp_conn *conn, char *handle, u_int handle_len, int quiet)
675 {
676 	u_int id;
677 
678 	id = conn->msg_id++;
679 	send_string_request(conn, id, SSH2_FXP_FSTAT, handle,
680 	    handle_len);
681 
682 	return(get_decode_stat(conn, id, quiet));
683 }
684 #endif
685 
686 int
687 do_setstat(struct sftp_conn *conn, char *path, Attrib *a)
688 {
689 	u_int status, id;
690 
691 	id = conn->msg_id++;
692 	send_string_attrs_request(conn, id, SSH2_FXP_SETSTAT, path,
693 	    strlen(path), a);
694 
695 	status = get_status(conn, id);
696 	if (status != SSH2_FX_OK)
697 		error("Couldn't setstat on \"%s\": %s", path,
698 		    fx2txt(status));
699 
700 	return(status);
701 }
702 
703 int
704 do_fsetstat(struct sftp_conn *conn, char *handle, u_int handle_len,
705     Attrib *a)
706 {
707 	u_int status, id;
708 
709 	id = conn->msg_id++;
710 	send_string_attrs_request(conn, id, SSH2_FXP_FSETSTAT, handle,
711 	    handle_len, a);
712 
713 	status = get_status(conn, id);
714 	if (status != SSH2_FX_OK)
715 		error("Couldn't fsetstat: %s", fx2txt(status));
716 
717 	return(status);
718 }
719 
720 char *
721 do_realpath(struct sftp_conn *conn, char *path)
722 {
723 	Buffer msg;
724 	u_int type, expected_id, count, id;
725 	char *filename, *longname;
726 	Attrib *a;
727 
728 	expected_id = id = conn->msg_id++;
729 	send_string_request(conn, id, SSH2_FXP_REALPATH, path,
730 	    strlen(path));
731 
732 	buffer_init(&msg);
733 
734 	get_msg(conn, &msg);
735 	type = buffer_get_char(&msg);
736 	id = buffer_get_int(&msg);
737 
738 	if (id != expected_id)
739 		fatal("ID mismatch (%u != %u)", id, expected_id);
740 
741 	if (type == SSH2_FXP_STATUS) {
742 		u_int status = buffer_get_int(&msg);
743 
744 		error("Couldn't canonicalise: %s", fx2txt(status));
745 		buffer_free(&msg);
746 		return NULL;
747 	} else if (type != SSH2_FXP_NAME)
748 		fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
749 		    SSH2_FXP_NAME, type);
750 
751 	count = buffer_get_int(&msg);
752 	if (count != 1)
753 		fatal("Got multiple names (%d) from SSH_FXP_REALPATH", count);
754 
755 	filename = buffer_get_string(&msg, NULL);
756 	longname = buffer_get_string(&msg, NULL);
757 	a = decode_attrib(&msg);
758 
759 	debug3("SSH_FXP_REALPATH %s -> %s", path, filename);
760 
761 	xfree(longname);
762 
763 	buffer_free(&msg);
764 
765 	return(filename);
766 }
767 
768 int
769 do_rename(struct sftp_conn *conn, char *oldpath, char *newpath)
770 {
771 	Buffer msg;
772 	u_int status, id;
773 
774 	buffer_init(&msg);
775 
776 	/* Send rename request */
777 	id = conn->msg_id++;
778 	if ((conn->exts & SFTP_EXT_POSIX_RENAME)) {
779 		buffer_put_char(&msg, SSH2_FXP_EXTENDED);
780 		buffer_put_int(&msg, id);
781 		buffer_put_cstring(&msg, "posix-rename@openssh.com");
782 	} else {
783 		buffer_put_char(&msg, SSH2_FXP_RENAME);
784 		buffer_put_int(&msg, id);
785 	}
786 	buffer_put_cstring(&msg, oldpath);
787 	buffer_put_cstring(&msg, newpath);
788 	send_msg(conn, &msg);
789 	debug3("Sent message %s \"%s\" -> \"%s\"",
790 	    (conn->exts & SFTP_EXT_POSIX_RENAME) ? "posix-rename@openssh.com" :
791 	    "SSH2_FXP_RENAME", oldpath, newpath);
792 	buffer_free(&msg);
793 
794 	status = get_status(conn, id);
795 	if (status != SSH2_FX_OK)
796 		error("Couldn't rename file \"%s\" to \"%s\": %s", oldpath,
797 		    newpath, fx2txt(status));
798 
799 	return(status);
800 }
801 
802 int
803 do_hardlink(struct sftp_conn *conn, char *oldpath, char *newpath)
804 {
805 	Buffer msg;
806 	u_int status, id;
807 
808 	buffer_init(&msg);
809 
810 	/* Send link request */
811 	id = conn->msg_id++;
812 	if ((conn->exts & SFTP_EXT_HARDLINK) == 0) {
813 		error("Server does not support hardlink@openssh.com extension");
814 		return -1;
815 	}
816 
817 	buffer_put_char(&msg, SSH2_FXP_EXTENDED);
818 	buffer_put_int(&msg, id);
819 	buffer_put_cstring(&msg, "hardlink@openssh.com");
820 	buffer_put_cstring(&msg, oldpath);
821 	buffer_put_cstring(&msg, newpath);
822 	send_msg(conn, &msg);
823 	debug3("Sent message hardlink@openssh.com \"%s\" -> \"%s\"",
824 	       oldpath, newpath);
825 	buffer_free(&msg);
826 
827 	status = get_status(conn, id);
828 	if (status != SSH2_FX_OK)
829 		error("Couldn't link file \"%s\" to \"%s\": %s", oldpath,
830 		    newpath, fx2txt(status));
831 
832 	return(status);
833 }
834 
835 int
836 do_symlink(struct sftp_conn *conn, char *oldpath, char *newpath)
837 {
838 	Buffer msg;
839 	u_int status, id;
840 
841 	if (conn->version < 3) {
842 		error("This server does not support the symlink operation");
843 		return(SSH2_FX_OP_UNSUPPORTED);
844 	}
845 
846 	buffer_init(&msg);
847 
848 	/* Send symlink request */
849 	id = conn->msg_id++;
850 	buffer_put_char(&msg, SSH2_FXP_SYMLINK);
851 	buffer_put_int(&msg, id);
852 	buffer_put_cstring(&msg, oldpath);
853 	buffer_put_cstring(&msg, newpath);
854 	send_msg(conn, &msg);
855 	debug3("Sent message SSH2_FXP_SYMLINK \"%s\" -> \"%s\"", oldpath,
856 	    newpath);
857 	buffer_free(&msg);
858 
859 	status = get_status(conn, id);
860 	if (status != SSH2_FX_OK)
861 		error("Couldn't symlink file \"%s\" to \"%s\": %s", oldpath,
862 		    newpath, fx2txt(status));
863 
864 	return(status);
865 }
866 
867 #ifdef notyet
868 char *
869 do_readlink(struct sftp_conn *conn, char *path)
870 {
871 	Buffer msg;
872 	u_int type, expected_id, count, id;
873 	char *filename, *longname;
874 	Attrib *a;
875 
876 	expected_id = id = conn->msg_id++;
877 	send_string_request(conn, id, SSH2_FXP_READLINK, path, strlen(path));
878 
879 	buffer_init(&msg);
880 
881 	get_msg(conn, &msg);
882 	type = buffer_get_char(&msg);
883 	id = buffer_get_int(&msg);
884 
885 	if (id != expected_id)
886 		fatal("ID mismatch (%u != %u)", id, expected_id);
887 
888 	if (type == SSH2_FXP_STATUS) {
889 		u_int status = buffer_get_int(&msg);
890 
891 		error("Couldn't readlink: %s", fx2txt(status));
892 		return(NULL);
893 	} else if (type != SSH2_FXP_NAME)
894 		fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
895 		    SSH2_FXP_NAME, type);
896 
897 	count = buffer_get_int(&msg);
898 	if (count != 1)
899 		fatal("Got multiple names (%d) from SSH_FXP_READLINK", count);
900 
901 	filename = buffer_get_string(&msg, NULL);
902 	longname = buffer_get_string(&msg, NULL);
903 	a = decode_attrib(&msg);
904 
905 	debug3("SSH_FXP_READLINK %s -> %s", path, filename);
906 
907 	xfree(longname);
908 
909 	buffer_free(&msg);
910 
911 	return(filename);
912 }
913 #endif
914 
915 int
916 do_statvfs(struct sftp_conn *conn, const char *path, struct sftp_statvfs *st,
917     int quiet)
918 {
919 	Buffer msg;
920 	u_int id;
921 
922 	if ((conn->exts & SFTP_EXT_STATVFS) == 0) {
923 		error("Server does not support statvfs@openssh.com extension");
924 		return -1;
925 	}
926 
927 	id = conn->msg_id++;
928 
929 	buffer_init(&msg);
930 	buffer_clear(&msg);
931 	buffer_put_char(&msg, SSH2_FXP_EXTENDED);
932 	buffer_put_int(&msg, id);
933 	buffer_put_cstring(&msg, "statvfs@openssh.com");
934 	buffer_put_cstring(&msg, path);
935 	send_msg(conn, &msg);
936 	buffer_free(&msg);
937 
938 	return get_decode_statvfs(conn, st, id, quiet);
939 }
940 
941 #ifdef notyet
942 int
943 do_fstatvfs(struct sftp_conn *conn, const char *handle, u_int handle_len,
944     struct sftp_statvfs *st, int quiet)
945 {
946 	Buffer msg;
947 	u_int id;
948 
949 	if ((conn->exts & SFTP_EXT_FSTATVFS) == 0) {
950 		error("Server does not support fstatvfs@openssh.com extension");
951 		return -1;
952 	}
953 
954 	id = conn->msg_id++;
955 
956 	buffer_init(&msg);
957 	buffer_clear(&msg);
958 	buffer_put_char(&msg, SSH2_FXP_EXTENDED);
959 	buffer_put_int(&msg, id);
960 	buffer_put_cstring(&msg, "fstatvfs@openssh.com");
961 	buffer_put_string(&msg, handle, handle_len);
962 	send_msg(conn, &msg);
963 	buffer_free(&msg);
964 
965 	return get_decode_statvfs(conn, st, id, quiet);
966 }
967 #endif
968 
969 static void
970 send_read_request(struct sftp_conn *conn, u_int id, u_int64_t offset,
971     u_int len, char *handle, u_int handle_len)
972 {
973 	Buffer msg;
974 
975 	buffer_init(&msg);
976 	buffer_clear(&msg);
977 	buffer_put_char(&msg, SSH2_FXP_READ);
978 	buffer_put_int(&msg, id);
979 	buffer_put_string(&msg, handle, handle_len);
980 	buffer_put_int64(&msg, offset);
981 	buffer_put_int(&msg, len);
982 	send_msg(conn, &msg);
983 	buffer_free(&msg);
984 }
985 
986 int
987 do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
988     Attrib *a, int pflag)
989 {
990 	Attrib junk;
991 	Buffer msg;
992 	char *handle;
993 	int local_fd, status = 0, write_error;
994 	int read_error, write_errno;
995 	u_int64_t offset, size;
996 	u_int handle_len, mode, type, id, buflen, num_req, max_req;
997 	off_t progress_counter;
998 	struct request {
999 		u_int id;
1000 		u_int len;
1001 		u_int64_t offset;
1002 		TAILQ_ENTRY(request) tq;
1003 	};
1004 	TAILQ_HEAD(reqhead, request) requests;
1005 	struct request *req;
1006 
1007 	TAILQ_INIT(&requests);
1008 
1009 	if (a == NULL && (a = do_stat(conn, remote_path, 0)) == NULL)
1010 		return -1;
1011 
1012 	/* Do not preserve set[ug]id here, as we do not preserve ownership */
1013 	if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS)
1014 		mode = a->perm & 0777;
1015 	else
1016 		mode = 0666;
1017 
1018 	if ((a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) &&
1019 	    (!S_ISREG(a->perm))) {
1020 		error("Cannot download non-regular file: %s", remote_path);
1021 		return(-1);
1022 	}
1023 
1024 	if (a->flags & SSH2_FILEXFER_ATTR_SIZE)
1025 		size = a->size;
1026 	else
1027 		size = 0;
1028 
1029 	buflen = conn->transfer_buflen;
1030 	buffer_init(&msg);
1031 
1032 	/* Send open request */
1033 	id = conn->msg_id++;
1034 	buffer_put_char(&msg, SSH2_FXP_OPEN);
1035 	buffer_put_int(&msg, id);
1036 	buffer_put_cstring(&msg, remote_path);
1037 	buffer_put_int(&msg, SSH2_FXF_READ);
1038 	attrib_clear(&junk); /* Send empty attributes */
1039 	encode_attrib(&msg, &junk);
1040 	send_msg(conn, &msg);
1041 	debug3("Sent message SSH2_FXP_OPEN I:%u P:%s", id, remote_path);
1042 
1043 	handle = get_handle(conn, id, &handle_len,
1044 	    "remote open(\"%s\")", remote_path);
1045 	if (handle == NULL) {
1046 		buffer_free(&msg);
1047 		return(-1);
1048 	}
1049 
1050 	local_fd = open(local_path, O_WRONLY | O_CREAT | O_TRUNC,
1051 	    mode | S_IWRITE);
1052 	if (local_fd == -1) {
1053 		error("Couldn't open local file \"%s\" for writing: %s",
1054 		    local_path, strerror(errno));
1055 		do_close(conn, handle, handle_len);
1056 		buffer_free(&msg);
1057 		xfree(handle);
1058 		return(-1);
1059 	}
1060 
1061 	/* Read from remote and write to local */
1062 	write_error = read_error = write_errno = num_req = offset = 0;
1063 	max_req = 1;
1064 	progress_counter = 0;
1065 
1066 	if (showprogress && size != 0)
1067 		start_progress_meter(remote_path, size, &progress_counter);
1068 
1069 	while (num_req > 0 || max_req > 0) {
1070 		char *data;
1071 		u_int len;
1072 
1073 		/*
1074 		 * Simulate EOF on interrupt: stop sending new requests and
1075 		 * allow outstanding requests to drain gracefully
1076 		 */
1077 		if (interrupted) {
1078 			if (num_req == 0) /* If we haven't started yet... */
1079 				break;
1080 			max_req = 0;
1081 		}
1082 
1083 		/* Send some more requests */
1084 		while (num_req < max_req) {
1085 			debug3("Request range %llu -> %llu (%d/%d)",
1086 			    (unsigned long long)offset,
1087 			    (unsigned long long)offset + buflen - 1,
1088 			    num_req, max_req);
1089 			req = xmalloc(sizeof(*req));
1090 			req->id = conn->msg_id++;
1091 			req->len = buflen;
1092 			req->offset = offset;
1093 			offset += buflen;
1094 			num_req++;
1095 			TAILQ_INSERT_TAIL(&requests, req, tq);
1096 			send_read_request(conn, req->id, req->offset,
1097 			    req->len, handle, handle_len);
1098 		}
1099 
1100 		buffer_clear(&msg);
1101 		get_msg(conn, &msg);
1102 		type = buffer_get_char(&msg);
1103 		id = buffer_get_int(&msg);
1104 		debug3("Received reply T:%u I:%u R:%d", type, id, max_req);
1105 
1106 		/* Find the request in our queue */
1107 		for (req = TAILQ_FIRST(&requests);
1108 		    req != NULL && req->id != id;
1109 		    req = TAILQ_NEXT(req, tq))
1110 			;
1111 		if (req == NULL)
1112 			fatal("Unexpected reply %u", id);
1113 
1114 		switch (type) {
1115 		case SSH2_FXP_STATUS:
1116 			status = buffer_get_int(&msg);
1117 			if (status != SSH2_FX_EOF)
1118 				read_error = 1;
1119 			max_req = 0;
1120 			TAILQ_REMOVE(&requests, req, tq);
1121 			xfree(req);
1122 			num_req--;
1123 			break;
1124 		case SSH2_FXP_DATA:
1125 			data = buffer_get_string(&msg, &len);
1126 			debug3("Received data %llu -> %llu",
1127 			    (unsigned long long)req->offset,
1128 			    (unsigned long long)req->offset + len - 1);
1129 			if (len > req->len)
1130 				fatal("Received more data than asked for "
1131 				    "%u > %u", len, req->len);
1132 			if ((lseek(local_fd, req->offset, SEEK_SET) == -1 ||
1133 			    atomicio(vwrite, local_fd, data, len) != len) &&
1134 			    !write_error) {
1135 				write_errno = errno;
1136 				write_error = 1;
1137 				max_req = 0;
1138 			}
1139 			progress_counter += len;
1140 			xfree(data);
1141 
1142 			if (len == req->len) {
1143 				TAILQ_REMOVE(&requests, req, tq);
1144 				xfree(req);
1145 				num_req--;
1146 			} else {
1147 				/* Resend the request for the missing data */
1148 				debug3("Short data block, re-requesting "
1149 				    "%llu -> %llu (%2d)",
1150 				    (unsigned long long)req->offset + len,
1151 				    (unsigned long long)req->offset +
1152 				    req->len - 1, num_req);
1153 				req->id = conn->msg_id++;
1154 				req->len -= len;
1155 				req->offset += len;
1156 				send_read_request(conn, req->id,
1157 				    req->offset, req->len, handle, handle_len);
1158 				/* Reduce the request size */
1159 				if (len < buflen)
1160 					buflen = MAX(MIN_READ_SIZE, len);
1161 			}
1162 			if (max_req > 0) { /* max_req = 0 iff EOF received */
1163 				if (size > 0 && offset > size) {
1164 					/* Only one request at a time
1165 					 * after the expected EOF */
1166 					debug3("Finish at %llu (%2d)",
1167 					    (unsigned long long)offset,
1168 					    num_req);
1169 					max_req = 1;
1170 				} else if (max_req <= conn->num_requests) {
1171 					++max_req;
1172 				}
1173 			}
1174 			break;
1175 		default:
1176 			fatal("Expected SSH2_FXP_DATA(%u) packet, got %u",
1177 			    SSH2_FXP_DATA, type);
1178 		}
1179 	}
1180 
1181 	if (showprogress && size)
1182 		stop_progress_meter();
1183 
1184 	/* Sanity check */
1185 	if (TAILQ_FIRST(&requests) != NULL)
1186 		fatal("Transfer complete, but requests still in queue");
1187 
1188 	if (read_error) {
1189 		error("Couldn't read from remote file \"%s\" : %s",
1190 		    remote_path, fx2txt(status));
1191 		do_close(conn, handle, handle_len);
1192 	} else if (write_error) {
1193 		error("Couldn't write to \"%s\": %s", local_path,
1194 		    strerror(write_errno));
1195 		status = -1;
1196 		do_close(conn, handle, handle_len);
1197 	} else {
1198 		status = do_close(conn, handle, handle_len);
1199 
1200 		/* Override umask and utimes if asked */
1201 #ifdef HAVE_FCHMOD
1202 		if (pflag && fchmod(local_fd, mode) == -1)
1203 #else
1204 		if (pflag && chmod(local_path, mode) == -1)
1205 #endif /* HAVE_FCHMOD */
1206 			error("Couldn't set mode on \"%s\": %s", local_path,
1207 			    strerror(errno));
1208 		if (pflag && (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME)) {
1209 			struct timeval tv[2];
1210 			tv[0].tv_sec = a->atime;
1211 			tv[1].tv_sec = a->mtime;
1212 			tv[0].tv_usec = tv[1].tv_usec = 0;
1213 			if (utimes(local_path, tv) == -1)
1214 				error("Can't set times on \"%s\": %s",
1215 				    local_path, strerror(errno));
1216 		}
1217 	}
1218 	close(local_fd);
1219 	buffer_free(&msg);
1220 	xfree(handle);
1221 
1222 	return(status);
1223 }
1224 
1225 static int
1226 download_dir_internal(struct sftp_conn *conn, char *src, char *dst,
1227     Attrib *dirattrib, int pflag, int printflag, int depth)
1228 {
1229 	int i, ret = 0;
1230 	SFTP_DIRENT **dir_entries;
1231 	char *filename, *new_src, *new_dst;
1232 	mode_t mode = 0777;
1233 
1234 	if (depth >= MAX_DIR_DEPTH) {
1235 		error("Maximum directory depth exceeded: %d levels", depth);
1236 		return -1;
1237 	}
1238 
1239 	if (dirattrib == NULL &&
1240 	    (dirattrib = do_stat(conn, src, 1)) == NULL) {
1241 		error("Unable to stat remote directory \"%s\"", src);
1242 		return -1;
1243 	}
1244 	if (!S_ISDIR(dirattrib->perm)) {
1245 		error("\"%s\" is not a directory", src);
1246 		return -1;
1247 	}
1248 	if (printflag)
1249 		printf("Retrieving %s\n", src);
1250 
1251 	if (dirattrib->flags & SSH2_FILEXFER_ATTR_PERMISSIONS)
1252 		mode = dirattrib->perm & 01777;
1253 	else {
1254 		debug("Server did not send permissions for "
1255 		    "directory \"%s\"", dst);
1256 	}
1257 
1258 	if (mkdir(dst, mode) == -1 && errno != EEXIST) {
1259 		error("mkdir %s: %s", dst, strerror(errno));
1260 		return -1;
1261 	}
1262 
1263 	if (do_readdir(conn, src, &dir_entries) == -1) {
1264 		error("%s: Failed to get directory contents", src);
1265 		return -1;
1266 	}
1267 
1268 	for (i = 0; dir_entries[i] != NULL && !interrupted; i++) {
1269 		filename = dir_entries[i]->filename;
1270 
1271 		new_dst = path_append(dst, filename);
1272 		new_src = path_append(src, filename);
1273 
1274 		if (S_ISDIR(dir_entries[i]->a.perm)) {
1275 			if (strcmp(filename, ".") == 0 ||
1276 			    strcmp(filename, "..") == 0)
1277 				continue;
1278 			if (download_dir_internal(conn, new_src, new_dst,
1279 			    &(dir_entries[i]->a), pflag, printflag,
1280 			    depth + 1) == -1)
1281 				ret = -1;
1282 		} else if (S_ISREG(dir_entries[i]->a.perm) ) {
1283 			if (do_download(conn, new_src, new_dst,
1284 			    &(dir_entries[i]->a), pflag) == -1) {
1285 				error("Download of file %s to %s failed",
1286 				    new_src, new_dst);
1287 				ret = -1;
1288 			}
1289 		} else
1290 			logit("%s: not a regular file\n", new_src);
1291 
1292 		xfree(new_dst);
1293 		xfree(new_src);
1294 	}
1295 
1296 	if (pflag) {
1297 		if (dirattrib->flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
1298 			struct timeval tv[2];
1299 			tv[0].tv_sec = dirattrib->atime;
1300 			tv[1].tv_sec = dirattrib->mtime;
1301 			tv[0].tv_usec = tv[1].tv_usec = 0;
1302 			if (utimes(dst, tv) == -1)
1303 				error("Can't set times on \"%s\": %s",
1304 				    dst, strerror(errno));
1305 		} else
1306 			debug("Server did not send times for directory "
1307 			    "\"%s\"", dst);
1308 	}
1309 
1310 	free_sftp_dirents(dir_entries);
1311 
1312 	return ret;
1313 }
1314 
1315 int
1316 download_dir(struct sftp_conn *conn, char *src, char *dst,
1317     Attrib *dirattrib, int pflag, int printflag)
1318 {
1319 	char *src_canon;
1320 	int ret;
1321 
1322 	if ((src_canon = do_realpath(conn, src)) == NULL) {
1323 		error("Unable to canonicalise path \"%s\"", src);
1324 		return -1;
1325 	}
1326 
1327 	ret = download_dir_internal(conn, src_canon, dst,
1328 	    dirattrib, pflag, printflag, 0);
1329 	xfree(src_canon);
1330 	return ret;
1331 }
1332 
1333 int
1334 do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
1335     int pflag)
1336 {
1337 	int local_fd;
1338 	int status = SSH2_FX_OK;
1339 	u_int handle_len, id, type;
1340 	off_t offset;
1341 	char *handle, *data;
1342 	Buffer msg;
1343 	struct stat sb;
1344 	Attrib a;
1345 	u_int32_t startid;
1346 	u_int32_t ackid;
1347 	struct outstanding_ack {
1348 		u_int id;
1349 		u_int len;
1350 		off_t offset;
1351 		TAILQ_ENTRY(outstanding_ack) tq;
1352 	};
1353 	TAILQ_HEAD(ackhead, outstanding_ack) acks;
1354 	struct outstanding_ack *ack = NULL;
1355 
1356 	TAILQ_INIT(&acks);
1357 
1358 	if ((local_fd = open(local_path, O_RDONLY, 0)) == -1) {
1359 		error("Couldn't open local file \"%s\" for reading: %s",
1360 		    local_path, strerror(errno));
1361 		return(-1);
1362 	}
1363 	if (fstat(local_fd, &sb) == -1) {
1364 		error("Couldn't fstat local file \"%s\": %s",
1365 		    local_path, strerror(errno));
1366 		close(local_fd);
1367 		return(-1);
1368 	}
1369 	if (!S_ISREG(sb.st_mode)) {
1370 		error("%s is not a regular file", local_path);
1371 		close(local_fd);
1372 		return(-1);
1373 	}
1374 	stat_to_attrib(&sb, &a);
1375 
1376 	a.flags &= ~SSH2_FILEXFER_ATTR_SIZE;
1377 	a.flags &= ~SSH2_FILEXFER_ATTR_UIDGID;
1378 	a.perm &= 0777;
1379 	if (!pflag)
1380 		a.flags &= ~SSH2_FILEXFER_ATTR_ACMODTIME;
1381 
1382 	buffer_init(&msg);
1383 
1384 	/* Send open request */
1385 	id = conn->msg_id++;
1386 	buffer_put_char(&msg, SSH2_FXP_OPEN);
1387 	buffer_put_int(&msg, id);
1388 	buffer_put_cstring(&msg, remote_path);
1389 	buffer_put_int(&msg, SSH2_FXF_WRITE|SSH2_FXF_CREAT|SSH2_FXF_TRUNC);
1390 	encode_attrib(&msg, &a);
1391 	send_msg(conn, &msg);
1392 	debug3("Sent message SSH2_FXP_OPEN I:%u P:%s", id, remote_path);
1393 
1394 	buffer_clear(&msg);
1395 
1396 	handle = get_handle(conn, id, &handle_len,
1397 	    "remote open(\"%s\")", remote_path);
1398 	if (handle == NULL) {
1399 		close(local_fd);
1400 		buffer_free(&msg);
1401 		return -1;
1402 	}
1403 
1404 	startid = ackid = id + 1;
1405 	data = xmalloc(conn->transfer_buflen);
1406 
1407 	/* Read from local and write to remote */
1408 	offset = 0;
1409 	if (showprogress)
1410 		start_progress_meter(local_path, sb.st_size, &offset);
1411 
1412 	for (;;) {
1413 		int len;
1414 
1415 		/*
1416 		 * Can't use atomicio here because it returns 0 on EOF,
1417 		 * thus losing the last block of the file.
1418 		 * Simulate an EOF on interrupt, allowing ACKs from the
1419 		 * server to drain.
1420 		 */
1421 		if (interrupted || status != SSH2_FX_OK)
1422 			len = 0;
1423 		else do
1424 			len = read(local_fd, data, conn->transfer_buflen);
1425 		while ((len == -1) &&
1426 		    (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK));
1427 
1428 		if (len == -1)
1429 			fatal("Couldn't read from \"%s\": %s", local_path,
1430 			    strerror(errno));
1431 
1432 		if (len != 0) {
1433 			ack = xmalloc(sizeof(*ack));
1434 			ack->id = ++id;
1435 			ack->offset = offset;
1436 			ack->len = len;
1437 			TAILQ_INSERT_TAIL(&acks, ack, tq);
1438 
1439 			buffer_clear(&msg);
1440 			buffer_put_char(&msg, SSH2_FXP_WRITE);
1441 			buffer_put_int(&msg, ack->id);
1442 			buffer_put_string(&msg, handle, handle_len);
1443 			buffer_put_int64(&msg, offset);
1444 			buffer_put_string(&msg, data, len);
1445 			send_msg(conn, &msg);
1446 			debug3("Sent message SSH2_FXP_WRITE I:%u O:%llu S:%u",
1447 			    id, (unsigned long long)offset, len);
1448 		} else if (TAILQ_FIRST(&acks) == NULL)
1449 			break;
1450 
1451 		if (ack == NULL)
1452 			fatal("Unexpected ACK %u", id);
1453 
1454 		if (id == startid || len == 0 ||
1455 		    id - ackid >= conn->num_requests) {
1456 			u_int r_id;
1457 
1458 			buffer_clear(&msg);
1459 			get_msg(conn, &msg);
1460 			type = buffer_get_char(&msg);
1461 			r_id = buffer_get_int(&msg);
1462 
1463 			if (type != SSH2_FXP_STATUS)
1464 				fatal("Expected SSH2_FXP_STATUS(%d) packet, "
1465 				    "got %d", SSH2_FXP_STATUS, type);
1466 
1467 			status = buffer_get_int(&msg);
1468 			debug3("SSH2_FXP_STATUS %d", status);
1469 
1470 			/* Find the request in our queue */
1471 			for (ack = TAILQ_FIRST(&acks);
1472 			    ack != NULL && ack->id != r_id;
1473 			    ack = TAILQ_NEXT(ack, tq))
1474 				;
1475 			if (ack == NULL)
1476 				fatal("Can't find request for ID %u", r_id);
1477 			TAILQ_REMOVE(&acks, ack, tq);
1478 			debug3("In write loop, ack for %u %u bytes at %lld",
1479 			    ack->id, ack->len, (long long)ack->offset);
1480 			++ackid;
1481 			xfree(ack);
1482 		}
1483 		offset += len;
1484 		if (offset < 0)
1485 			fatal("%s: offset < 0", __func__);
1486 	}
1487 	buffer_free(&msg);
1488 
1489 	if (showprogress)
1490 		stop_progress_meter();
1491 	xfree(data);
1492 
1493 	if (status != SSH2_FX_OK) {
1494 		error("Couldn't write to remote file \"%s\": %s",
1495 		    remote_path, fx2txt(status));
1496 		status = -1;
1497 	}
1498 
1499 	if (close(local_fd) == -1) {
1500 		error("Couldn't close local file \"%s\": %s", local_path,
1501 		    strerror(errno));
1502 		status = -1;
1503 	}
1504 
1505 	/* Override umask and utimes if asked */
1506 	if (pflag)
1507 		do_fsetstat(conn, handle, handle_len, &a);
1508 
1509 	if (do_close(conn, handle, handle_len) != SSH2_FX_OK)
1510 		status = -1;
1511 	xfree(handle);
1512 
1513 	return status;
1514 }
1515 
1516 static int
1517 upload_dir_internal(struct sftp_conn *conn, char *src, char *dst,
1518     int pflag, int printflag, int depth)
1519 {
1520 	int ret = 0, status;
1521 	DIR *dirp;
1522 	struct dirent *dp;
1523 	char *filename, *new_src, *new_dst;
1524 	struct stat sb;
1525 	Attrib a;
1526 
1527 	if (depth >= MAX_DIR_DEPTH) {
1528 		error("Maximum directory depth exceeded: %d levels", depth);
1529 		return -1;
1530 	}
1531 
1532 	if (stat(src, &sb) == -1) {
1533 		error("Couldn't stat directory \"%s\": %s",
1534 		    src, strerror(errno));
1535 		return -1;
1536 	}
1537 	if (!S_ISDIR(sb.st_mode)) {
1538 		error("\"%s\" is not a directory", src);
1539 		return -1;
1540 	}
1541 	if (printflag)
1542 		printf("Entering %s\n", src);
1543 
1544 	attrib_clear(&a);
1545 	stat_to_attrib(&sb, &a);
1546 	a.flags &= ~SSH2_FILEXFER_ATTR_SIZE;
1547 	a.flags &= ~SSH2_FILEXFER_ATTR_UIDGID;
1548 	a.perm &= 01777;
1549 	if (!pflag)
1550 		a.flags &= ~SSH2_FILEXFER_ATTR_ACMODTIME;
1551 
1552 	status = do_mkdir(conn, dst, &a, 0);
1553 	/*
1554 	 * we lack a portable status for errno EEXIST,
1555 	 * so if we get a SSH2_FX_FAILURE back we must check
1556 	 * if it was created successfully.
1557 	 */
1558 	if (status != SSH2_FX_OK) {
1559 		if (status != SSH2_FX_FAILURE)
1560 			return -1;
1561 		if (do_stat(conn, dst, 0) == NULL)
1562 			return -1;
1563 	}
1564 
1565 	if ((dirp = opendir(src)) == NULL) {
1566 		error("Failed to open dir \"%s\": %s", src, strerror(errno));
1567 		return -1;
1568 	}
1569 
1570 	while (((dp = readdir(dirp)) != NULL) && !interrupted) {
1571 		if (dp->d_ino == 0)
1572 			continue;
1573 		filename = dp->d_name;
1574 		new_dst = path_append(dst, filename);
1575 		new_src = path_append(src, filename);
1576 
1577 		if (lstat(new_src, &sb) == -1) {
1578 			logit("%s: lstat failed: %s", filename,
1579 			    strerror(errno));
1580 			ret = -1;
1581 		} else if (S_ISDIR(sb.st_mode)) {
1582 			if (strcmp(filename, ".") == 0 ||
1583 			    strcmp(filename, "..") == 0)
1584 				continue;
1585 
1586 			if (upload_dir_internal(conn, new_src, new_dst,
1587 			    pflag, printflag, depth + 1) == -1)
1588 				ret = -1;
1589 		} else if (S_ISREG(sb.st_mode)) {
1590 			if (do_upload(conn, new_src, new_dst, pflag) == -1) {
1591 				error("Uploading of file %s to %s failed!",
1592 				    new_src, new_dst);
1593 				ret = -1;
1594 			}
1595 		} else
1596 			logit("%s: not a regular file\n", filename);
1597 		xfree(new_dst);
1598 		xfree(new_src);
1599 	}
1600 
1601 	do_setstat(conn, dst, &a);
1602 
1603 	(void) closedir(dirp);
1604 	return ret;
1605 }
1606 
1607 int
1608 upload_dir(struct sftp_conn *conn, char *src, char *dst, int printflag,
1609     int pflag)
1610 {
1611 	char *dst_canon;
1612 	int ret;
1613 
1614 	if ((dst_canon = do_realpath(conn, dst)) == NULL) {
1615 		error("Unable to canonicalise path \"%s\"", dst);
1616 		return -1;
1617 	}
1618 
1619 	ret = upload_dir_internal(conn, src, dst_canon, pflag, printflag, 0);
1620 	xfree(dst_canon);
1621 	return ret;
1622 }
1623 
1624 char *
1625 path_append(char *p1, char *p2)
1626 {
1627 	char *ret;
1628 	size_t len = strlen(p1) + strlen(p2) + 2;
1629 
1630 	ret = xmalloc(len);
1631 	strlcpy(ret, p1, len);
1632 	if (p1[0] != '\0' && p1[strlen(p1) - 1] != '/')
1633 		strlcat(ret, "/", len);
1634 	strlcat(ret, p2, len);
1635 
1636 	return(ret);
1637 }
1638 
1639