1 /* $OpenBSD: mux.c,v 1.79 2019/01/19 21:35:25 djm Exp $ */ 2 /* 3 * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 /* ssh session multiplexing support */ 19 20 #include "includes.h" 21 22 #include <sys/types.h> 23 #include <sys/stat.h> 24 #include <sys/socket.h> 25 #include <sys/un.h> 26 27 #include <errno.h> 28 #include <fcntl.h> 29 #include <signal.h> 30 #include <stdarg.h> 31 #include <stddef.h> 32 #include <stdlib.h> 33 #include <stdio.h> 34 #include <string.h> 35 #include <unistd.h> 36 #ifdef HAVE_PATHS_H 37 #include <paths.h> 38 #endif 39 40 #ifdef HAVE_POLL_H 41 #include <poll.h> 42 #else 43 # ifdef HAVE_SYS_POLL_H 44 # include <sys/poll.h> 45 # endif 46 #endif 47 48 #ifdef HAVE_UTIL_H 49 # include <util.h> 50 #endif 51 52 #include "openbsd-compat/sys-queue.h" 53 #include "xmalloc.h" 54 #include "log.h" 55 #include "ssh.h" 56 #include "ssh2.h" 57 #include "pathnames.h" 58 #include "misc.h" 59 #include "match.h" 60 #include "sshbuf.h" 61 #include "channels.h" 62 #include "msg.h" 63 #include "packet.h" 64 #include "monitor_fdpass.h" 65 #include "sshpty.h" 66 #include "sshkey.h" 67 #include "readconf.h" 68 #include "clientloop.h" 69 #include "ssherr.h" 70 71 /* from ssh.c */ 72 extern int tty_flag; 73 extern Options options; 74 extern int stdin_null_flag; 75 extern char *host; 76 extern int subsystem_flag; 77 extern struct sshbuf *command; 78 extern volatile sig_atomic_t quit_pending; 79 80 /* Context for session open confirmation callback */ 81 struct mux_session_confirm_ctx { 82 u_int want_tty; 83 u_int want_subsys; 84 u_int want_x_fwd; 85 u_int want_agent_fwd; 86 struct sshbuf *cmd; 87 char *term; 88 struct termios tio; 89 char **env; 90 u_int rid; 91 }; 92 93 /* Context for stdio fwd open confirmation callback */ 94 struct mux_stdio_confirm_ctx { 95 u_int rid; 96 }; 97 98 /* Context for global channel callback */ 99 struct mux_channel_confirm_ctx { 100 u_int cid; /* channel id */ 101 u_int rid; /* request id */ 102 int fid; /* forward id */ 103 }; 104 105 /* fd to control socket */ 106 int muxserver_sock = -1; 107 108 /* client request id */ 109 u_int muxclient_request_id = 0; 110 111 /* Multiplexing control command */ 112 u_int muxclient_command = 0; 113 114 /* Set when signalled. */ 115 static volatile sig_atomic_t muxclient_terminate = 0; 116 117 /* PID of multiplex server */ 118 static u_int muxserver_pid = 0; 119 120 static Channel *mux_listener_channel = NULL; 121 122 struct mux_master_state { 123 int hello_rcvd; 124 }; 125 126 /* mux protocol messages */ 127 #define MUX_MSG_HELLO 0x00000001 128 #define MUX_C_NEW_SESSION 0x10000002 129 #define MUX_C_ALIVE_CHECK 0x10000004 130 #define MUX_C_TERMINATE 0x10000005 131 #define MUX_C_OPEN_FWD 0x10000006 132 #define MUX_C_CLOSE_FWD 0x10000007 133 #define MUX_C_NEW_STDIO_FWD 0x10000008 134 #define MUX_C_STOP_LISTENING 0x10000009 135 #define MUX_C_PROXY 0x1000000f 136 #define MUX_S_OK 0x80000001 137 #define MUX_S_PERMISSION_DENIED 0x80000002 138 #define MUX_S_FAILURE 0x80000003 139 #define MUX_S_EXIT_MESSAGE 0x80000004 140 #define MUX_S_ALIVE 0x80000005 141 #define MUX_S_SESSION_OPENED 0x80000006 142 #define MUX_S_REMOTE_PORT 0x80000007 143 #define MUX_S_TTY_ALLOC_FAIL 0x80000008 144 #define MUX_S_PROXY 0x8000000f 145 146 /* type codes for MUX_C_OPEN_FWD and MUX_C_CLOSE_FWD */ 147 #define MUX_FWD_LOCAL 1 148 #define MUX_FWD_REMOTE 2 149 #define MUX_FWD_DYNAMIC 3 150 151 static void mux_session_confirm(struct ssh *, int, int, void *); 152 static void mux_stdio_confirm(struct ssh *, int, int, void *); 153 154 static int mux_master_process_hello(struct ssh *, u_int, 155 Channel *, struct sshbuf *, struct sshbuf *); 156 static int mux_master_process_new_session(struct ssh *, u_int, 157 Channel *, struct sshbuf *, struct sshbuf *); 158 static int mux_master_process_alive_check(struct ssh *, u_int, 159 Channel *, struct sshbuf *, struct sshbuf *); 160 static int mux_master_process_terminate(struct ssh *, u_int, 161 Channel *, struct sshbuf *, struct sshbuf *); 162 static int mux_master_process_open_fwd(struct ssh *, u_int, 163 Channel *, struct sshbuf *, struct sshbuf *); 164 static int mux_master_process_close_fwd(struct ssh *, u_int, 165 Channel *, struct sshbuf *, struct sshbuf *); 166 static int mux_master_process_stdio_fwd(struct ssh *, u_int, 167 Channel *, struct sshbuf *, struct sshbuf *); 168 static int mux_master_process_stop_listening(struct ssh *, u_int, 169 Channel *, struct sshbuf *, struct sshbuf *); 170 static int mux_master_process_proxy(struct ssh *, u_int, 171 Channel *, struct sshbuf *, struct sshbuf *); 172 173 static const struct { 174 u_int type; 175 int (*handler)(struct ssh *, u_int, Channel *, 176 struct sshbuf *, struct sshbuf *); 177 } mux_master_handlers[] = { 178 { MUX_MSG_HELLO, mux_master_process_hello }, 179 { MUX_C_NEW_SESSION, mux_master_process_new_session }, 180 { MUX_C_ALIVE_CHECK, mux_master_process_alive_check }, 181 { MUX_C_TERMINATE, mux_master_process_terminate }, 182 { MUX_C_OPEN_FWD, mux_master_process_open_fwd }, 183 { MUX_C_CLOSE_FWD, mux_master_process_close_fwd }, 184 { MUX_C_NEW_STDIO_FWD, mux_master_process_stdio_fwd }, 185 { MUX_C_STOP_LISTENING, mux_master_process_stop_listening }, 186 { MUX_C_PROXY, mux_master_process_proxy }, 187 { 0, NULL } 188 }; 189 190 /* Cleanup callback fired on closure of mux slave _session_ channel */ 191 /* ARGSUSED */ 192 static void 193 mux_master_session_cleanup_cb(struct ssh *ssh, int cid, void *unused) 194 { 195 Channel *cc, *c = channel_by_id(ssh, cid); 196 197 debug3("%s: entering for channel %d", __func__, cid); 198 if (c == NULL) 199 fatal("%s: channel_by_id(%i) == NULL", __func__, cid); 200 if (c->ctl_chan != -1) { 201 if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL) 202 fatal("%s: channel %d missing control channel %d", 203 __func__, c->self, c->ctl_chan); 204 c->ctl_chan = -1; 205 cc->remote_id = 0; 206 cc->have_remote_id = 0; 207 chan_rcvd_oclose(ssh, cc); 208 } 209 channel_cancel_cleanup(ssh, c->self); 210 } 211 212 /* Cleanup callback fired on closure of mux slave _control_ channel */ 213 /* ARGSUSED */ 214 static void 215 mux_master_control_cleanup_cb(struct ssh *ssh, int cid, void *unused) 216 { 217 Channel *sc, *c = channel_by_id(ssh, cid); 218 219 debug3("%s: entering for channel %d", __func__, cid); 220 if (c == NULL) 221 fatal("%s: channel_by_id(%i) == NULL", __func__, cid); 222 if (c->have_remote_id) { 223 if ((sc = channel_by_id(ssh, c->remote_id)) == NULL) 224 fatal("%s: channel %d missing session channel %u", 225 __func__, c->self, c->remote_id); 226 c->remote_id = 0; 227 c->have_remote_id = 0; 228 sc->ctl_chan = -1; 229 if (sc->type != SSH_CHANNEL_OPEN && 230 sc->type != SSH_CHANNEL_OPENING) { 231 debug2("%s: channel %d: not open", __func__, sc->self); 232 chan_mark_dead(ssh, sc); 233 } else { 234 if (sc->istate == CHAN_INPUT_OPEN) 235 chan_read_failed(ssh, sc); 236 if (sc->ostate == CHAN_OUTPUT_OPEN) 237 chan_write_failed(ssh, sc); 238 } 239 } 240 channel_cancel_cleanup(ssh, c->self); 241 } 242 243 /* Check mux client environment variables before passing them to mux master. */ 244 static int 245 env_permitted(char *env) 246 { 247 int i, ret; 248 char name[1024], *cp; 249 250 if ((cp = strchr(env, '=')) == NULL || cp == env) 251 return 0; 252 ret = snprintf(name, sizeof(name), "%.*s", (int)(cp - env), env); 253 if (ret <= 0 || (size_t)ret >= sizeof(name)) { 254 error("%s: name '%.100s...' too long", __func__, env); 255 return 0; 256 } 257 258 for (i = 0; i < options.num_send_env; i++) 259 if (match_pattern(name, options.send_env[i])) 260 return 1; 261 262 return 0; 263 } 264 265 /* Mux master protocol message handlers */ 266 267 static int 268 mux_master_process_hello(struct ssh *ssh, u_int rid, 269 Channel *c, struct sshbuf *m, struct sshbuf *reply) 270 { 271 u_int ver; 272 struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx; 273 int r; 274 275 if (state == NULL) 276 fatal("%s: channel %d: c->mux_ctx == NULL", __func__, c->self); 277 if (state->hello_rcvd) { 278 error("%s: HELLO received twice", __func__); 279 return -1; 280 } 281 if ((r = sshbuf_get_u32(m, &ver)) != 0) { 282 error("%s: malformed message: %s", __func__, ssh_err(r)); 283 return -1; 284 } 285 if (ver != SSHMUX_VER) { 286 error("%s: unsupported multiplexing protocol version %u " 287 "(expected %u)", __func__, ver, SSHMUX_VER); 288 return -1; 289 } 290 debug2("%s: channel %d slave version %u", __func__, c->self, ver); 291 292 /* No extensions are presently defined */ 293 while (sshbuf_len(m) > 0) { 294 char *name = NULL; 295 size_t value_len = 0; 296 297 if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 || 298 (r = sshbuf_get_string_direct(m, NULL, &value_len)) != 0) { 299 error("%s: malformed extension: %s", 300 __func__, ssh_err(r)); 301 return -1; 302 } 303 debug2("%s: Unrecognised extension \"%s\" length %zu", 304 __func__, name, value_len); 305 free(name); 306 } 307 state->hello_rcvd = 1; 308 return 0; 309 } 310 311 /* Enqueue a "ok" response to the reply buffer */ 312 static void 313 reply_ok(struct sshbuf *reply, u_int rid) 314 { 315 int r; 316 317 if ((r = sshbuf_put_u32(reply, MUX_S_OK)) != 0 || 318 (r = sshbuf_put_u32(reply, rid)) != 0) 319 fatal("%s: reply: %s", __func__, ssh_err(r)); 320 } 321 322 /* Enqueue an error response to the reply buffer */ 323 static void 324 reply_error(struct sshbuf *reply, u_int type, u_int rid, const char *msg) 325 { 326 int r; 327 328 if ((r = sshbuf_put_u32(reply, type)) != 0 || 329 (r = sshbuf_put_u32(reply, rid)) != 0 || 330 (r = sshbuf_put_cstring(reply, msg)) != 0) 331 fatal("%s: reply: %s", __func__, ssh_err(r)); 332 } 333 334 static int 335 mux_master_process_new_session(struct ssh *ssh, u_int rid, 336 Channel *c, struct sshbuf *m, struct sshbuf *reply) 337 { 338 Channel *nc; 339 struct mux_session_confirm_ctx *cctx; 340 char *cmd, *cp; 341 u_int i, j, env_len, escape_char, window, packetmax; 342 int r, new_fd[3]; 343 344 /* Reply for SSHMUX_COMMAND_OPEN */ 345 cctx = xcalloc(1, sizeof(*cctx)); 346 cctx->term = NULL; 347 cctx->rid = rid; 348 cmd = NULL; 349 cctx->env = NULL; 350 env_len = 0; 351 if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */ 352 (r = sshbuf_get_u32(m, &cctx->want_tty)) != 0 || 353 (r = sshbuf_get_u32(m, &cctx->want_x_fwd)) != 0 || 354 (r = sshbuf_get_u32(m, &cctx->want_agent_fwd)) != 0 || 355 (r = sshbuf_get_u32(m, &cctx->want_subsys)) != 0 || 356 (r = sshbuf_get_u32(m, &escape_char)) != 0 || 357 (r = sshbuf_get_cstring(m, &cctx->term, NULL)) != 0 || 358 (r = sshbuf_get_cstring(m, &cmd, NULL)) != 0) { 359 malf: 360 free(cmd); 361 for (j = 0; j < env_len; j++) 362 free(cctx->env[j]); 363 free(cctx->env); 364 free(cctx->term); 365 free(cctx); 366 error("%s: malformed message", __func__); 367 return -1; 368 } 369 370 #define MUX_MAX_ENV_VARS 4096 371 while (sshbuf_len(m) > 0) { 372 if ((r = sshbuf_get_cstring(m, &cp, NULL)) != 0) 373 goto malf; 374 if (!env_permitted(cp)) { 375 free(cp); 376 continue; 377 } 378 cctx->env = xreallocarray(cctx->env, env_len + 2, 379 sizeof(*cctx->env)); 380 cctx->env[env_len++] = cp; 381 cctx->env[env_len] = NULL; 382 if (env_len > MUX_MAX_ENV_VARS) { 383 error("%s: >%d environment variables received, " 384 "ignoring additional", __func__, MUX_MAX_ENV_VARS); 385 break; 386 } 387 } 388 389 debug2("%s: channel %d: request tty %d, X %d, agent %d, subsys %d, " 390 "term \"%s\", cmd \"%s\", env %u", __func__, c->self, 391 cctx->want_tty, cctx->want_x_fwd, cctx->want_agent_fwd, 392 cctx->want_subsys, cctx->term, cmd, env_len); 393 394 if ((cctx->cmd = sshbuf_new()) == NULL) 395 fatal("%s: sshbuf_new", __func__); 396 if ((r = sshbuf_put(cctx->cmd, cmd, strlen(cmd))) != 0) 397 fatal("%s: sshbuf_put: %s", __func__, ssh_err(r)); 398 free(cmd); 399 cmd = NULL; 400 401 /* Gather fds from client */ 402 for(i = 0; i < 3; i++) { 403 if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) { 404 error("%s: failed to receive fd %d from slave", 405 __func__, i); 406 for (j = 0; j < i; j++) 407 close(new_fd[j]); 408 for (j = 0; j < env_len; j++) 409 free(cctx->env[j]); 410 free(cctx->env); 411 free(cctx->term); 412 sshbuf_free(cctx->cmd); 413 free(cctx); 414 reply_error(reply, MUX_S_FAILURE, rid, 415 "did not receive file descriptors"); 416 return -1; 417 } 418 } 419 420 debug3("%s: got fds stdin %d, stdout %d, stderr %d", __func__, 421 new_fd[0], new_fd[1], new_fd[2]); 422 423 /* XXX support multiple child sessions in future */ 424 if (c->have_remote_id) { 425 debug2("%s: session already open", __func__); 426 reply_error(reply, MUX_S_FAILURE, rid, 427 "Multiple sessions not supported"); 428 cleanup: 429 close(new_fd[0]); 430 close(new_fd[1]); 431 close(new_fd[2]); 432 free(cctx->term); 433 if (env_len != 0) { 434 for (i = 0; i < env_len; i++) 435 free(cctx->env[i]); 436 free(cctx->env); 437 } 438 sshbuf_free(cctx->cmd); 439 free(cctx); 440 return 0; 441 } 442 443 if (options.control_master == SSHCTL_MASTER_ASK || 444 options.control_master == SSHCTL_MASTER_AUTO_ASK) { 445 if (!ask_permission("Allow shared connection to %s? ", host)) { 446 debug2("%s: session refused by user", __func__); 447 reply_error(reply, MUX_S_PERMISSION_DENIED, rid, 448 "Permission denied"); 449 goto cleanup; 450 } 451 } 452 453 /* Try to pick up ttymodes from client before it goes raw */ 454 if (cctx->want_tty && tcgetattr(new_fd[0], &cctx->tio) == -1) 455 error("%s: tcgetattr: %s", __func__, strerror(errno)); 456 457 /* enable nonblocking unless tty */ 458 if (!isatty(new_fd[0])) 459 set_nonblock(new_fd[0]); 460 if (!isatty(new_fd[1])) 461 set_nonblock(new_fd[1]); 462 if (!isatty(new_fd[2])) 463 set_nonblock(new_fd[2]); 464 465 window = CHAN_SES_WINDOW_DEFAULT; 466 packetmax = CHAN_SES_PACKET_DEFAULT; 467 if (cctx->want_tty) { 468 window >>= 1; 469 packetmax >>= 1; 470 } 471 472 nc = channel_new(ssh, "session", SSH_CHANNEL_OPENING, 473 new_fd[0], new_fd[1], new_fd[2], window, packetmax, 474 CHAN_EXTENDED_WRITE, "client-session", /*nonblock*/0); 475 476 nc->ctl_chan = c->self; /* link session -> control channel */ 477 c->remote_id = nc->self; /* link control -> session channel */ 478 c->have_remote_id = 1; 479 480 if (cctx->want_tty && escape_char != 0xffffffff) { 481 channel_register_filter(ssh, nc->self, 482 client_simple_escape_filter, NULL, 483 client_filter_cleanup, 484 client_new_escape_filter_ctx((int)escape_char)); 485 } 486 487 debug2("%s: channel_new: %d linked to control channel %d", 488 __func__, nc->self, nc->ctl_chan); 489 490 channel_send_open(ssh, nc->self); 491 channel_register_open_confirm(ssh, nc->self, mux_session_confirm, cctx); 492 c->mux_pause = 1; /* stop handling messages until open_confirm done */ 493 channel_register_cleanup(ssh, nc->self, 494 mux_master_session_cleanup_cb, 1); 495 496 /* reply is deferred, sent by mux_session_confirm */ 497 return 0; 498 } 499 500 static int 501 mux_master_process_alive_check(struct ssh *ssh, u_int rid, 502 Channel *c, struct sshbuf *m, struct sshbuf *reply) 503 { 504 int r; 505 506 debug2("%s: channel %d: alive check", __func__, c->self); 507 508 /* prepare reply */ 509 if ((r = sshbuf_put_u32(reply, MUX_S_ALIVE)) != 0 || 510 (r = sshbuf_put_u32(reply, rid)) != 0 || 511 (r = sshbuf_put_u32(reply, (u_int)getpid())) != 0) 512 fatal("%s: reply: %s", __func__, ssh_err(r)); 513 514 return 0; 515 } 516 517 static int 518 mux_master_process_terminate(struct ssh *ssh, u_int rid, 519 Channel *c, struct sshbuf *m, struct sshbuf *reply) 520 { 521 debug2("%s: channel %d: terminate request", __func__, c->self); 522 523 if (options.control_master == SSHCTL_MASTER_ASK || 524 options.control_master == SSHCTL_MASTER_AUTO_ASK) { 525 if (!ask_permission("Terminate shared connection to %s? ", 526 host)) { 527 debug2("%s: termination refused by user", __func__); 528 reply_error(reply, MUX_S_PERMISSION_DENIED, rid, 529 "Permission denied"); 530 return 0; 531 } 532 } 533 534 quit_pending = 1; 535 reply_ok(reply, rid); 536 /* XXX exit happens too soon - message never makes it to client */ 537 return 0; 538 } 539 540 static char * 541 format_forward(u_int ftype, struct Forward *fwd) 542 { 543 char *ret; 544 545 switch (ftype) { 546 case MUX_FWD_LOCAL: 547 xasprintf(&ret, "local forward %.200s:%d -> %.200s:%d", 548 (fwd->listen_path != NULL) ? fwd->listen_path : 549 (fwd->listen_host == NULL) ? 550 (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") : 551 fwd->listen_host, fwd->listen_port, 552 (fwd->connect_path != NULL) ? fwd->connect_path : 553 fwd->connect_host, fwd->connect_port); 554 break; 555 case MUX_FWD_DYNAMIC: 556 xasprintf(&ret, "dynamic forward %.200s:%d -> *", 557 (fwd->listen_host == NULL) ? 558 (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") : 559 fwd->listen_host, fwd->listen_port); 560 break; 561 case MUX_FWD_REMOTE: 562 xasprintf(&ret, "remote forward %.200s:%d -> %.200s:%d", 563 (fwd->listen_path != NULL) ? fwd->listen_path : 564 (fwd->listen_host == NULL) ? 565 "LOCALHOST" : fwd->listen_host, 566 fwd->listen_port, 567 (fwd->connect_path != NULL) ? fwd->connect_path : 568 fwd->connect_host, fwd->connect_port); 569 break; 570 default: 571 fatal("%s: unknown forward type %u", __func__, ftype); 572 } 573 return ret; 574 } 575 576 static int 577 compare_host(const char *a, const char *b) 578 { 579 if (a == NULL && b == NULL) 580 return 1; 581 if (a == NULL || b == NULL) 582 return 0; 583 return strcmp(a, b) == 0; 584 } 585 586 static int 587 compare_forward(struct Forward *a, struct Forward *b) 588 { 589 if (!compare_host(a->listen_host, b->listen_host)) 590 return 0; 591 if (!compare_host(a->listen_path, b->listen_path)) 592 return 0; 593 if (a->listen_port != b->listen_port) 594 return 0; 595 if (!compare_host(a->connect_host, b->connect_host)) 596 return 0; 597 if (!compare_host(a->connect_path, b->connect_path)) 598 return 0; 599 if (a->connect_port != b->connect_port) 600 return 0; 601 602 return 1; 603 } 604 605 static void 606 mux_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt) 607 { 608 struct mux_channel_confirm_ctx *fctx = ctxt; 609 char *failmsg = NULL; 610 struct Forward *rfwd; 611 Channel *c; 612 struct sshbuf *out; 613 u_int port; 614 int r; 615 616 if ((c = channel_by_id(ssh, fctx->cid)) == NULL) { 617 /* no channel for reply */ 618 error("%s: unknown channel", __func__); 619 return; 620 } 621 if ((out = sshbuf_new()) == NULL) 622 fatal("%s: sshbuf_new", __func__); 623 if (fctx->fid >= options.num_remote_forwards || 624 (options.remote_forwards[fctx->fid].connect_path == NULL && 625 options.remote_forwards[fctx->fid].connect_host == NULL)) { 626 xasprintf(&failmsg, "unknown forwarding id %d", fctx->fid); 627 goto fail; 628 } 629 rfwd = &options.remote_forwards[fctx->fid]; 630 debug("%s: %s for: listen %d, connect %s:%d", __func__, 631 type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure", 632 rfwd->listen_port, rfwd->connect_path ? rfwd->connect_path : 633 rfwd->connect_host, rfwd->connect_port); 634 if (type == SSH2_MSG_REQUEST_SUCCESS) { 635 if (rfwd->listen_port == 0) { 636 if ((r = sshpkt_get_u32(ssh, &port)) != 0) 637 fatal("%s: packet error: %s", 638 __func__, ssh_err(r)); 639 if (port > 65535) { 640 fatal("Invalid allocated port %u for " 641 "mux remote forward to %s:%d", port, 642 rfwd->connect_host, rfwd->connect_port); 643 } 644 rfwd->allocated_port = (int)port; 645 debug("Allocated port %u for mux remote forward" 646 " to %s:%d", rfwd->allocated_port, 647 rfwd->connect_host, rfwd->connect_port); 648 if ((r = sshbuf_put_u32(out, 649 MUX_S_REMOTE_PORT)) != 0 || 650 (r = sshbuf_put_u32(out, fctx->rid)) != 0 || 651 (r = sshbuf_put_u32(out, 652 rfwd->allocated_port)) != 0) 653 fatal("%s: reply: %s", __func__, ssh_err(r)); 654 channel_update_permission(ssh, rfwd->handle, 655 rfwd->allocated_port); 656 } else { 657 reply_ok(out, fctx->rid); 658 } 659 goto out; 660 } else { 661 if (rfwd->listen_port == 0) 662 channel_update_permission(ssh, rfwd->handle, -1); 663 if (rfwd->listen_path != NULL) 664 xasprintf(&failmsg, "remote port forwarding failed for " 665 "listen path %s", rfwd->listen_path); 666 else 667 xasprintf(&failmsg, "remote port forwarding failed for " 668 "listen port %d", rfwd->listen_port); 669 670 debug2("%s: clearing registered forwarding for listen %d, " 671 "connect %s:%d", __func__, rfwd->listen_port, 672 rfwd->connect_path ? rfwd->connect_path : 673 rfwd->connect_host, rfwd->connect_port); 674 675 free(rfwd->listen_host); 676 free(rfwd->listen_path); 677 free(rfwd->connect_host); 678 free(rfwd->connect_path); 679 memset(rfwd, 0, sizeof(*rfwd)); 680 } 681 fail: 682 error("%s: %s", __func__, failmsg); 683 reply_error(out, MUX_S_FAILURE, fctx->rid, failmsg); 684 free(failmsg); 685 out: 686 if ((r = sshbuf_put_stringb(c->output, out)) != 0) 687 fatal("%s: sshbuf_put_stringb: %s", __func__, ssh_err(r)); 688 sshbuf_free(out); 689 if (c->mux_pause <= 0) 690 fatal("%s: mux_pause %d", __func__, c->mux_pause); 691 c->mux_pause = 0; /* start processing messages again */ 692 } 693 694 static int 695 mux_master_process_open_fwd(struct ssh *ssh, u_int rid, 696 Channel *c, struct sshbuf *m, struct sshbuf *reply) 697 { 698 struct Forward fwd; 699 char *fwd_desc = NULL; 700 char *listen_addr, *connect_addr; 701 u_int ftype; 702 u_int lport, cport; 703 int r, i, ret = 0, freefwd = 1; 704 705 memset(&fwd, 0, sizeof(fwd)); 706 707 /* XXX - lport/cport check redundant */ 708 if ((r = sshbuf_get_u32(m, &ftype)) != 0 || 709 (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 || 710 (r = sshbuf_get_u32(m, &lport)) != 0 || 711 (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 || 712 (r = sshbuf_get_u32(m, &cport)) != 0 || 713 (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) || 714 (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) { 715 error("%s: malformed message", __func__); 716 ret = -1; 717 goto out; 718 } 719 if (*listen_addr == '\0') { 720 free(listen_addr); 721 listen_addr = NULL; 722 } 723 if (*connect_addr == '\0') { 724 free(connect_addr); 725 connect_addr = NULL; 726 } 727 728 memset(&fwd, 0, sizeof(fwd)); 729 fwd.listen_port = lport; 730 if (fwd.listen_port == PORT_STREAMLOCAL) 731 fwd.listen_path = listen_addr; 732 else 733 fwd.listen_host = listen_addr; 734 fwd.connect_port = cport; 735 if (fwd.connect_port == PORT_STREAMLOCAL) 736 fwd.connect_path = connect_addr; 737 else 738 fwd.connect_host = connect_addr; 739 740 debug2("%s: channel %d: request %s", __func__, c->self, 741 (fwd_desc = format_forward(ftype, &fwd))); 742 743 if (ftype != MUX_FWD_LOCAL && ftype != MUX_FWD_REMOTE && 744 ftype != MUX_FWD_DYNAMIC) { 745 logit("%s: invalid forwarding type %u", __func__, ftype); 746 invalid: 747 free(listen_addr); 748 free(connect_addr); 749 reply_error(reply, MUX_S_FAILURE, rid, 750 "Invalid forwarding request"); 751 return 0; 752 } 753 if (ftype == MUX_FWD_DYNAMIC && fwd.listen_path) { 754 logit("%s: streamlocal and dynamic forwards " 755 "are mutually exclusive", __func__); 756 goto invalid; 757 } 758 if (fwd.listen_port != PORT_STREAMLOCAL && fwd.listen_port >= 65536) { 759 logit("%s: invalid listen port %u", __func__, 760 fwd.listen_port); 761 goto invalid; 762 } 763 if ((fwd.connect_port != PORT_STREAMLOCAL && 764 fwd.connect_port >= 65536) || 765 (ftype != MUX_FWD_DYNAMIC && ftype != MUX_FWD_REMOTE && 766 fwd.connect_port == 0)) { 767 logit("%s: invalid connect port %u", __func__, 768 fwd.connect_port); 769 goto invalid; 770 } 771 if (ftype != MUX_FWD_DYNAMIC && fwd.connect_host == NULL && 772 fwd.connect_path == NULL) { 773 logit("%s: missing connect host", __func__); 774 goto invalid; 775 } 776 777 /* Skip forwards that have already been requested */ 778 switch (ftype) { 779 case MUX_FWD_LOCAL: 780 case MUX_FWD_DYNAMIC: 781 for (i = 0; i < options.num_local_forwards; i++) { 782 if (compare_forward(&fwd, 783 options.local_forwards + i)) { 784 exists: 785 debug2("%s: found existing forwarding", 786 __func__); 787 reply_ok(reply, rid); 788 goto out; 789 } 790 } 791 break; 792 case MUX_FWD_REMOTE: 793 for (i = 0; i < options.num_remote_forwards; i++) { 794 if (!compare_forward(&fwd, options.remote_forwards + i)) 795 continue; 796 if (fwd.listen_port != 0) 797 goto exists; 798 debug2("%s: found allocated port", __func__); 799 if ((r = sshbuf_put_u32(reply, 800 MUX_S_REMOTE_PORT)) != 0 || 801 (r = sshbuf_put_u32(reply, rid)) != 0 || 802 (r = sshbuf_put_u32(reply, 803 options.remote_forwards[i].allocated_port)) != 0) 804 fatal("%s: reply: %s", __func__, ssh_err(r)); 805 goto out; 806 } 807 break; 808 } 809 810 if (options.control_master == SSHCTL_MASTER_ASK || 811 options.control_master == SSHCTL_MASTER_AUTO_ASK) { 812 if (!ask_permission("Open %s on %s?", fwd_desc, host)) { 813 debug2("%s: forwarding refused by user", __func__); 814 reply_error(reply, MUX_S_PERMISSION_DENIED, rid, 815 "Permission denied"); 816 goto out; 817 } 818 } 819 820 if (ftype == MUX_FWD_LOCAL || ftype == MUX_FWD_DYNAMIC) { 821 if (!channel_setup_local_fwd_listener(ssh, &fwd, 822 &options.fwd_opts)) { 823 fail: 824 logit("%s: requested %s failed", __func__, fwd_desc); 825 reply_error(reply, MUX_S_FAILURE, rid, 826 "Port forwarding failed"); 827 goto out; 828 } 829 add_local_forward(&options, &fwd); 830 freefwd = 0; 831 } else { 832 struct mux_channel_confirm_ctx *fctx; 833 834 fwd.handle = channel_request_remote_forwarding(ssh, &fwd); 835 if (fwd.handle < 0) 836 goto fail; 837 add_remote_forward(&options, &fwd); 838 fctx = xcalloc(1, sizeof(*fctx)); 839 fctx->cid = c->self; 840 fctx->rid = rid; 841 fctx->fid = options.num_remote_forwards - 1; 842 client_register_global_confirm(mux_confirm_remote_forward, 843 fctx); 844 freefwd = 0; 845 c->mux_pause = 1; /* wait for mux_confirm_remote_forward */ 846 /* delayed reply in mux_confirm_remote_forward */ 847 goto out; 848 } 849 reply_ok(reply, rid); 850 out: 851 free(fwd_desc); 852 if (freefwd) { 853 free(fwd.listen_host); 854 free(fwd.listen_path); 855 free(fwd.connect_host); 856 free(fwd.connect_path); 857 } 858 return ret; 859 } 860 861 static int 862 mux_master_process_close_fwd(struct ssh *ssh, u_int rid, 863 Channel *c, struct sshbuf *m, struct sshbuf *reply) 864 { 865 struct Forward fwd, *found_fwd; 866 char *fwd_desc = NULL; 867 const char *error_reason = NULL; 868 char *listen_addr = NULL, *connect_addr = NULL; 869 u_int ftype; 870 int r, i, ret = 0; 871 u_int lport, cport; 872 873 memset(&fwd, 0, sizeof(fwd)); 874 875 if ((r = sshbuf_get_u32(m, &ftype)) != 0 || 876 (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 || 877 (r = sshbuf_get_u32(m, &lport)) != 0 || 878 (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 || 879 (r = sshbuf_get_u32(m, &cport)) != 0 || 880 (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) || 881 (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) { 882 error("%s: malformed message", __func__); 883 ret = -1; 884 goto out; 885 } 886 887 if (*listen_addr == '\0') { 888 free(listen_addr); 889 listen_addr = NULL; 890 } 891 if (*connect_addr == '\0') { 892 free(connect_addr); 893 connect_addr = NULL; 894 } 895 896 memset(&fwd, 0, sizeof(fwd)); 897 fwd.listen_port = lport; 898 if (fwd.listen_port == PORT_STREAMLOCAL) 899 fwd.listen_path = listen_addr; 900 else 901 fwd.listen_host = listen_addr; 902 fwd.connect_port = cport; 903 if (fwd.connect_port == PORT_STREAMLOCAL) 904 fwd.connect_path = connect_addr; 905 else 906 fwd.connect_host = connect_addr; 907 908 debug2("%s: channel %d: request cancel %s", __func__, c->self, 909 (fwd_desc = format_forward(ftype, &fwd))); 910 911 /* make sure this has been requested */ 912 found_fwd = NULL; 913 switch (ftype) { 914 case MUX_FWD_LOCAL: 915 case MUX_FWD_DYNAMIC: 916 for (i = 0; i < options.num_local_forwards; i++) { 917 if (compare_forward(&fwd, 918 options.local_forwards + i)) { 919 found_fwd = options.local_forwards + i; 920 break; 921 } 922 } 923 break; 924 case MUX_FWD_REMOTE: 925 for (i = 0; i < options.num_remote_forwards; i++) { 926 if (compare_forward(&fwd, 927 options.remote_forwards + i)) { 928 found_fwd = options.remote_forwards + i; 929 break; 930 } 931 } 932 break; 933 } 934 935 if (found_fwd == NULL) 936 error_reason = "port not forwarded"; 937 else if (ftype == MUX_FWD_REMOTE) { 938 /* 939 * This shouldn't fail unless we confused the host/port 940 * between options.remote_forwards and permitted_opens. 941 * However, for dynamic allocated listen ports we need 942 * to use the actual listen port. 943 */ 944 if (channel_request_rforward_cancel(ssh, found_fwd) == -1) 945 error_reason = "port not in permitted opens"; 946 } else { /* local and dynamic forwards */ 947 /* Ditto */ 948 if (channel_cancel_lport_listener(ssh, &fwd, fwd.connect_port, 949 &options.fwd_opts) == -1) 950 error_reason = "port not found"; 951 } 952 953 if (error_reason != NULL) 954 reply_error(reply, MUX_S_FAILURE, rid, error_reason); 955 else { 956 reply_ok(reply, rid); 957 free(found_fwd->listen_host); 958 free(found_fwd->listen_path); 959 free(found_fwd->connect_host); 960 free(found_fwd->connect_path); 961 found_fwd->listen_host = found_fwd->connect_host = NULL; 962 found_fwd->listen_path = found_fwd->connect_path = NULL; 963 found_fwd->listen_port = found_fwd->connect_port = 0; 964 } 965 out: 966 free(fwd_desc); 967 free(listen_addr); 968 free(connect_addr); 969 970 return ret; 971 } 972 973 static int 974 mux_master_process_stdio_fwd(struct ssh *ssh, u_int rid, 975 Channel *c, struct sshbuf *m, struct sshbuf *reply) 976 { 977 Channel *nc; 978 char *chost = NULL; 979 u_int cport, i, j; 980 int r, new_fd[2]; 981 struct mux_stdio_confirm_ctx *cctx; 982 983 if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */ 984 (r = sshbuf_get_cstring(m, &chost, NULL)) != 0 || 985 (r = sshbuf_get_u32(m, &cport)) != 0) { 986 free(chost); 987 error("%s: malformed message", __func__); 988 return -1; 989 } 990 991 debug2("%s: channel %d: request stdio fwd to %s:%u", 992 __func__, c->self, chost, cport); 993 994 /* Gather fds from client */ 995 for(i = 0; i < 2; i++) { 996 if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) { 997 error("%s: failed to receive fd %d from slave", 998 __func__, i); 999 for (j = 0; j < i; j++) 1000 close(new_fd[j]); 1001 free(chost); 1002 1003 /* prepare reply */ 1004 reply_error(reply, MUX_S_FAILURE, rid, 1005 "did not receive file descriptors"); 1006 return -1; 1007 } 1008 } 1009 1010 debug3("%s: got fds stdin %d, stdout %d", __func__, 1011 new_fd[0], new_fd[1]); 1012 1013 /* XXX support multiple child sessions in future */ 1014 if (c->have_remote_id) { 1015 debug2("%s: session already open", __func__); 1016 reply_error(reply, MUX_S_FAILURE, rid, 1017 "Multiple sessions not supported"); 1018 cleanup: 1019 close(new_fd[0]); 1020 close(new_fd[1]); 1021 free(chost); 1022 return 0; 1023 } 1024 1025 if (options.control_master == SSHCTL_MASTER_ASK || 1026 options.control_master == SSHCTL_MASTER_AUTO_ASK) { 1027 if (!ask_permission("Allow forward to %s:%u? ", 1028 chost, cport)) { 1029 debug2("%s: stdio fwd refused by user", __func__); 1030 reply_error(reply, MUX_S_PERMISSION_DENIED, rid, 1031 "Permission denied"); 1032 goto cleanup; 1033 } 1034 } 1035 1036 /* enable nonblocking unless tty */ 1037 if (!isatty(new_fd[0])) 1038 set_nonblock(new_fd[0]); 1039 if (!isatty(new_fd[1])) 1040 set_nonblock(new_fd[1]); 1041 1042 nc = channel_connect_stdio_fwd(ssh, chost, cport, new_fd[0], new_fd[1]); 1043 free(chost); 1044 1045 nc->ctl_chan = c->self; /* link session -> control channel */ 1046 c->remote_id = nc->self; /* link control -> session channel */ 1047 c->have_remote_id = 1; 1048 1049 debug2("%s: channel_new: %d linked to control channel %d", 1050 __func__, nc->self, nc->ctl_chan); 1051 1052 channel_register_cleanup(ssh, nc->self, 1053 mux_master_session_cleanup_cb, 1); 1054 1055 cctx = xcalloc(1, sizeof(*cctx)); 1056 cctx->rid = rid; 1057 channel_register_open_confirm(ssh, nc->self, mux_stdio_confirm, cctx); 1058 c->mux_pause = 1; /* stop handling messages until open_confirm done */ 1059 1060 /* reply is deferred, sent by mux_session_confirm */ 1061 return 0; 1062 } 1063 1064 /* Callback on open confirmation in mux master for a mux stdio fwd session. */ 1065 static void 1066 mux_stdio_confirm(struct ssh *ssh, int id, int success, void *arg) 1067 { 1068 struct mux_stdio_confirm_ctx *cctx = arg; 1069 Channel *c, *cc; 1070 struct sshbuf *reply; 1071 int r; 1072 1073 if (cctx == NULL) 1074 fatal("%s: cctx == NULL", __func__); 1075 if ((c = channel_by_id(ssh, id)) == NULL) 1076 fatal("%s: no channel for id %d", __func__, id); 1077 if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL) 1078 fatal("%s: channel %d lacks control channel %d", __func__, 1079 id, c->ctl_chan); 1080 if ((reply = sshbuf_new()) == NULL) 1081 fatal("%s: sshbuf_new", __func__); 1082 1083 if (!success) { 1084 debug3("%s: sending failure reply", __func__); 1085 reply_error(reply, MUX_S_FAILURE, cctx->rid, 1086 "Session open refused by peer"); 1087 /* prepare reply */ 1088 goto done; 1089 } 1090 1091 debug3("%s: sending success reply", __func__); 1092 /* prepare reply */ 1093 if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 || 1094 (r = sshbuf_put_u32(reply, cctx->rid)) != 0 || 1095 (r = sshbuf_put_u32(reply, c->self)) != 0) 1096 fatal("%s: reply: %s", __func__, ssh_err(r)); 1097 1098 done: 1099 /* Send reply */ 1100 if ((r = sshbuf_put_stringb(cc->output, reply)) != 0) 1101 fatal("%s: sshbuf_put_stringb: %s", __func__, ssh_err(r)); 1102 sshbuf_free(reply); 1103 1104 if (cc->mux_pause <= 0) 1105 fatal("%s: mux_pause %d", __func__, cc->mux_pause); 1106 cc->mux_pause = 0; /* start processing messages again */ 1107 c->open_confirm_ctx = NULL; 1108 free(cctx); 1109 } 1110 1111 static int 1112 mux_master_process_stop_listening(struct ssh *ssh, u_int rid, 1113 Channel *c, struct sshbuf *m, struct sshbuf *reply) 1114 { 1115 debug("%s: channel %d: stop listening", __func__, c->self); 1116 1117 if (options.control_master == SSHCTL_MASTER_ASK || 1118 options.control_master == SSHCTL_MASTER_AUTO_ASK) { 1119 if (!ask_permission("Disable further multiplexing on shared " 1120 "connection to %s? ", host)) { 1121 debug2("%s: stop listen refused by user", __func__); 1122 reply_error(reply, MUX_S_PERMISSION_DENIED, rid, 1123 "Permission denied"); 1124 return 0; 1125 } 1126 } 1127 1128 if (mux_listener_channel != NULL) { 1129 channel_free(ssh, mux_listener_channel); 1130 client_stop_mux(); 1131 free(options.control_path); 1132 options.control_path = NULL; 1133 mux_listener_channel = NULL; 1134 muxserver_sock = -1; 1135 } 1136 1137 reply_ok(reply, rid); 1138 return 0; 1139 } 1140 1141 static int 1142 mux_master_process_proxy(struct ssh *ssh, u_int rid, 1143 Channel *c, struct sshbuf *m, struct sshbuf *reply) 1144 { 1145 int r; 1146 1147 debug("%s: channel %d: proxy request", __func__, c->self); 1148 1149 c->mux_rcb = channel_proxy_downstream; 1150 if ((r = sshbuf_put_u32(reply, MUX_S_PROXY)) != 0 || 1151 (r = sshbuf_put_u32(reply, rid)) != 0) 1152 fatal("%s: reply: %s", __func__, ssh_err(r)); 1153 1154 return 0; 1155 } 1156 1157 /* Channel callbacks fired on read/write from mux slave fd */ 1158 static int 1159 mux_master_read_cb(struct ssh *ssh, Channel *c) 1160 { 1161 struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx; 1162 struct sshbuf *in = NULL, *out = NULL; 1163 u_int type, rid, i; 1164 int r, ret = -1; 1165 1166 if ((out = sshbuf_new()) == NULL) 1167 fatal("%s: sshbuf_new", __func__); 1168 1169 /* Setup ctx and */ 1170 if (c->mux_ctx == NULL) { 1171 state = xcalloc(1, sizeof(*state)); 1172 c->mux_ctx = state; 1173 channel_register_cleanup(ssh, c->self, 1174 mux_master_control_cleanup_cb, 0); 1175 1176 /* Send hello */ 1177 if ((r = sshbuf_put_u32(out, MUX_MSG_HELLO)) != 0 || 1178 (r = sshbuf_put_u32(out, SSHMUX_VER)) != 0) 1179 fatal("%s: reply: %s", __func__, ssh_err(r)); 1180 /* no extensions */ 1181 if ((r = sshbuf_put_stringb(c->output, out)) != 0) 1182 fatal("%s: sshbuf_put_stringb: %s", 1183 __func__, ssh_err(r)); 1184 debug3("%s: channel %d: hello sent", __func__, c->self); 1185 ret = 0; 1186 goto out; 1187 } 1188 1189 /* Channel code ensures that we receive whole packets */ 1190 if ((r = sshbuf_froms(c->input, &in)) != 0) { 1191 malf: 1192 error("%s: malformed message", __func__); 1193 goto out; 1194 } 1195 1196 if ((r = sshbuf_get_u32(in, &type)) != 0) 1197 goto malf; 1198 debug3("%s: channel %d packet type 0x%08x len %zu", 1199 __func__, c->self, type, sshbuf_len(in)); 1200 1201 if (type == MUX_MSG_HELLO) 1202 rid = 0; 1203 else { 1204 if (!state->hello_rcvd) { 1205 error("%s: expected MUX_MSG_HELLO(0x%08x), " 1206 "received 0x%08x", __func__, MUX_MSG_HELLO, type); 1207 goto out; 1208 } 1209 if ((r = sshbuf_get_u32(in, &rid)) != 0) 1210 goto malf; 1211 } 1212 1213 for (i = 0; mux_master_handlers[i].handler != NULL; i++) { 1214 if (type == mux_master_handlers[i].type) { 1215 ret = mux_master_handlers[i].handler(ssh, rid, 1216 c, in, out); 1217 break; 1218 } 1219 } 1220 if (mux_master_handlers[i].handler == NULL) { 1221 error("%s: unsupported mux message 0x%08x", __func__, type); 1222 reply_error(out, MUX_S_FAILURE, rid, "unsupported request"); 1223 ret = 0; 1224 } 1225 /* Enqueue reply packet */ 1226 if (sshbuf_len(out) != 0) { 1227 if ((r = sshbuf_put_stringb(c->output, out)) != 0) 1228 fatal("%s: sshbuf_put_stringb: %s", 1229 __func__, ssh_err(r)); 1230 } 1231 out: 1232 sshbuf_free(in); 1233 sshbuf_free(out); 1234 return ret; 1235 } 1236 1237 void 1238 mux_exit_message(struct ssh *ssh, Channel *c, int exitval) 1239 { 1240 struct sshbuf *m; 1241 Channel *mux_chan; 1242 int r; 1243 1244 debug3("%s: channel %d: exit message, exitval %d", __func__, c->self, 1245 exitval); 1246 1247 if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL) 1248 fatal("%s: channel %d missing mux channel %d", 1249 __func__, c->self, c->ctl_chan); 1250 1251 /* Append exit message packet to control socket output queue */ 1252 if ((m = sshbuf_new()) == NULL) 1253 fatal("%s: sshbuf_new", __func__); 1254 if ((r = sshbuf_put_u32(m, MUX_S_EXIT_MESSAGE)) != 0 || 1255 (r = sshbuf_put_u32(m, c->self)) != 0 || 1256 (r = sshbuf_put_u32(m, exitval)) != 0 || 1257 (r = sshbuf_put_stringb(mux_chan->output, m)) != 0) 1258 fatal("%s: reply: %s", __func__, ssh_err(r)); 1259 sshbuf_free(m); 1260 } 1261 1262 void 1263 mux_tty_alloc_failed(struct ssh *ssh, Channel *c) 1264 { 1265 struct sshbuf *m; 1266 Channel *mux_chan; 1267 int r; 1268 1269 debug3("%s: channel %d: TTY alloc failed", __func__, c->self); 1270 1271 if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL) 1272 fatal("%s: channel %d missing mux channel %d", 1273 __func__, c->self, c->ctl_chan); 1274 1275 /* Append exit message packet to control socket output queue */ 1276 if ((m = sshbuf_new()) == NULL) 1277 fatal("%s: sshbuf_new", __func__); 1278 if ((r = sshbuf_put_u32(m, MUX_S_TTY_ALLOC_FAIL)) != 0 || 1279 (r = sshbuf_put_u32(m, c->self)) != 0 || 1280 (r = sshbuf_put_stringb(mux_chan->output, m)) != 0) 1281 fatal("%s: reply: %s", __func__, ssh_err(r)); 1282 sshbuf_free(m); 1283 } 1284 1285 /* Prepare a mux master to listen on a Unix domain socket. */ 1286 void 1287 muxserver_listen(struct ssh *ssh) 1288 { 1289 mode_t old_umask; 1290 char *orig_control_path = options.control_path; 1291 char rbuf[16+1]; 1292 u_int i, r; 1293 int oerrno; 1294 1295 if (options.control_path == NULL || 1296 options.control_master == SSHCTL_MASTER_NO) 1297 return; 1298 1299 debug("setting up multiplex master socket"); 1300 1301 /* 1302 * Use a temporary path before listen so we can pseudo-atomically 1303 * establish the listening socket in its final location to avoid 1304 * other processes racing in between bind() and listen() and hitting 1305 * an unready socket. 1306 */ 1307 for (i = 0; i < sizeof(rbuf) - 1; i++) { 1308 r = arc4random_uniform(26+26+10); 1309 rbuf[i] = (r < 26) ? 'a' + r : 1310 (r < 26*2) ? 'A' + r - 26 : 1311 '0' + r - 26 - 26; 1312 } 1313 rbuf[sizeof(rbuf) - 1] = '\0'; 1314 options.control_path = NULL; 1315 xasprintf(&options.control_path, "%s.%s", orig_control_path, rbuf); 1316 debug3("%s: temporary control path %s", __func__, options.control_path); 1317 1318 old_umask = umask(0177); 1319 muxserver_sock = unix_listener(options.control_path, 64, 0); 1320 oerrno = errno; 1321 umask(old_umask); 1322 if (muxserver_sock < 0) { 1323 if (oerrno == EINVAL || oerrno == EADDRINUSE) { 1324 error("ControlSocket %s already exists, " 1325 "disabling multiplexing", options.control_path); 1326 disable_mux_master: 1327 if (muxserver_sock != -1) { 1328 close(muxserver_sock); 1329 muxserver_sock = -1; 1330 } 1331 free(orig_control_path); 1332 free(options.control_path); 1333 options.control_path = NULL; 1334 options.control_master = SSHCTL_MASTER_NO; 1335 return; 1336 } else { 1337 /* unix_listener() logs the error */ 1338 cleanup_exit(255); 1339 } 1340 } 1341 1342 /* Now atomically "move" the mux socket into position */ 1343 if (link(options.control_path, orig_control_path) != 0) { 1344 if (errno != EEXIST) { 1345 fatal("%s: link mux listener %s => %s: %s", __func__, 1346 options.control_path, orig_control_path, 1347 strerror(errno)); 1348 } 1349 error("ControlSocket %s already exists, disabling multiplexing", 1350 orig_control_path); 1351 unlink(options.control_path); 1352 goto disable_mux_master; 1353 } 1354 unlink(options.control_path); 1355 free(options.control_path); 1356 options.control_path = orig_control_path; 1357 1358 set_nonblock(muxserver_sock); 1359 1360 mux_listener_channel = channel_new(ssh, "mux listener", 1361 SSH_CHANNEL_MUX_LISTENER, muxserver_sock, muxserver_sock, -1, 1362 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 1363 0, options.control_path, 1); 1364 mux_listener_channel->mux_rcb = mux_master_read_cb; 1365 debug3("%s: mux listener channel %d fd %d", __func__, 1366 mux_listener_channel->self, mux_listener_channel->sock); 1367 } 1368 1369 /* Callback on open confirmation in mux master for a mux client session. */ 1370 static void 1371 mux_session_confirm(struct ssh *ssh, int id, int success, void *arg) 1372 { 1373 struct mux_session_confirm_ctx *cctx = arg; 1374 const char *display; 1375 Channel *c, *cc; 1376 int i, r; 1377 struct sshbuf *reply; 1378 1379 if (cctx == NULL) 1380 fatal("%s: cctx == NULL", __func__); 1381 if ((c = channel_by_id(ssh, id)) == NULL) 1382 fatal("%s: no channel for id %d", __func__, id); 1383 if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL) 1384 fatal("%s: channel %d lacks control channel %d", __func__, 1385 id, c->ctl_chan); 1386 if ((reply = sshbuf_new()) == NULL) 1387 fatal("%s: sshbuf_new", __func__); 1388 1389 if (!success) { 1390 debug3("%s: sending failure reply", __func__); 1391 reply_error(reply, MUX_S_FAILURE, cctx->rid, 1392 "Session open refused by peer"); 1393 goto done; 1394 } 1395 1396 display = getenv("DISPLAY"); 1397 if (cctx->want_x_fwd && options.forward_x11 && display != NULL) { 1398 char *proto, *data; 1399 1400 /* Get reasonable local authentication information. */ 1401 if (client_x11_get_proto(ssh, display, options.xauth_location, 1402 options.forward_x11_trusted, options.forward_x11_timeout, 1403 &proto, &data) == 0) { 1404 /* Request forwarding with authentication spoofing. */ 1405 debug("Requesting X11 forwarding with authentication " 1406 "spoofing."); 1407 x11_request_forwarding_with_spoofing(ssh, id, 1408 display, proto, data, 1); 1409 /* XXX exit_on_forward_failure */ 1410 client_expect_confirm(ssh, id, "X11 forwarding", 1411 CONFIRM_WARN); 1412 } 1413 } 1414 1415 if (cctx->want_agent_fwd && options.forward_agent) { 1416 debug("Requesting authentication agent forwarding."); 1417 channel_request_start(ssh, id, "auth-agent-req@openssh.com", 0); 1418 if ((r = sshpkt_send(ssh)) != 0) 1419 fatal("%s: packet error: %s", __func__, ssh_err(r)); 1420 } 1421 1422 client_session2_setup(ssh, id, cctx->want_tty, cctx->want_subsys, 1423 cctx->term, &cctx->tio, c->rfd, cctx->cmd, cctx->env); 1424 1425 debug3("%s: sending success reply", __func__); 1426 /* prepare reply */ 1427 if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 || 1428 (r = sshbuf_put_u32(reply, cctx->rid)) != 0 || 1429 (r = sshbuf_put_u32(reply, c->self)) != 0) 1430 fatal("%s: reply: %s", __func__, ssh_err(r)); 1431 1432 done: 1433 /* Send reply */ 1434 if ((r = sshbuf_put_stringb(cc->output, reply)) != 0) 1435 fatal("%s: sshbuf_put_stringb: %s", __func__, ssh_err(r)); 1436 sshbuf_free(reply); 1437 1438 if (cc->mux_pause <= 0) 1439 fatal("%s: mux_pause %d", __func__, cc->mux_pause); 1440 cc->mux_pause = 0; /* start processing messages again */ 1441 c->open_confirm_ctx = NULL; 1442 sshbuf_free(cctx->cmd); 1443 free(cctx->term); 1444 if (cctx->env != NULL) { 1445 for (i = 0; cctx->env[i] != NULL; i++) 1446 free(cctx->env[i]); 1447 free(cctx->env); 1448 } 1449 free(cctx); 1450 } 1451 1452 /* ** Multiplexing client support */ 1453 1454 /* Exit signal handler */ 1455 static void 1456 control_client_sighandler(int signo) 1457 { 1458 muxclient_terminate = signo; 1459 } 1460 1461 /* 1462 * Relay signal handler - used to pass some signals from mux client to 1463 * mux master. 1464 */ 1465 static void 1466 control_client_sigrelay(int signo) 1467 { 1468 int save_errno = errno; 1469 1470 if (muxserver_pid > 1) 1471 kill(muxserver_pid, signo); 1472 1473 errno = save_errno; 1474 } 1475 1476 static int 1477 mux_client_read(int fd, struct sshbuf *b, size_t need) 1478 { 1479 size_t have; 1480 ssize_t len; 1481 u_char *p; 1482 struct pollfd pfd; 1483 int r; 1484 1485 pfd.fd = fd; 1486 pfd.events = POLLIN; 1487 if ((r = sshbuf_reserve(b, need, &p)) != 0) 1488 fatal("%s: reserve: %s", __func__, ssh_err(r)); 1489 for (have = 0; have < need; ) { 1490 if (muxclient_terminate) { 1491 errno = EINTR; 1492 return -1; 1493 } 1494 len = read(fd, p + have, need - have); 1495 if (len < 0) { 1496 switch (errno) { 1497 #if defined(EWOULDBLOCK) && (EWOULDBLOCK != EAGAIN) 1498 case EWOULDBLOCK: 1499 #endif 1500 case EAGAIN: 1501 (void)poll(&pfd, 1, -1); 1502 /* FALLTHROUGH */ 1503 case EINTR: 1504 continue; 1505 default: 1506 return -1; 1507 } 1508 } 1509 if (len == 0) { 1510 errno = EPIPE; 1511 return -1; 1512 } 1513 have += (size_t)len; 1514 } 1515 return 0; 1516 } 1517 1518 static int 1519 mux_client_write_packet(int fd, struct sshbuf *m) 1520 { 1521 struct sshbuf *queue; 1522 u_int have, need; 1523 int r, oerrno, len; 1524 const u_char *ptr; 1525 struct pollfd pfd; 1526 1527 pfd.fd = fd; 1528 pfd.events = POLLOUT; 1529 if ((queue = sshbuf_new()) == NULL) 1530 fatal("%s: sshbuf_new", __func__); 1531 if ((r = sshbuf_put_stringb(queue, m)) != 0) 1532 fatal("%s: sshbuf_put_stringb: %s", __func__, ssh_err(r)); 1533 1534 need = sshbuf_len(queue); 1535 ptr = sshbuf_ptr(queue); 1536 1537 for (have = 0; have < need; ) { 1538 if (muxclient_terminate) { 1539 sshbuf_free(queue); 1540 errno = EINTR; 1541 return -1; 1542 } 1543 len = write(fd, ptr + have, need - have); 1544 if (len < 0) { 1545 switch (errno) { 1546 #if defined(EWOULDBLOCK) && (EWOULDBLOCK != EAGAIN) 1547 case EWOULDBLOCK: 1548 #endif 1549 case EAGAIN: 1550 (void)poll(&pfd, 1, -1); 1551 /* FALLTHROUGH */ 1552 case EINTR: 1553 continue; 1554 default: 1555 oerrno = errno; 1556 sshbuf_free(queue); 1557 errno = oerrno; 1558 return -1; 1559 } 1560 } 1561 if (len == 0) { 1562 sshbuf_free(queue); 1563 errno = EPIPE; 1564 return -1; 1565 } 1566 have += (u_int)len; 1567 } 1568 sshbuf_free(queue); 1569 return 0; 1570 } 1571 1572 static int 1573 mux_client_read_packet(int fd, struct sshbuf *m) 1574 { 1575 struct sshbuf *queue; 1576 size_t need, have; 1577 const u_char *ptr; 1578 int r, oerrno; 1579 1580 if ((queue = sshbuf_new()) == NULL) 1581 fatal("%s: sshbuf_new", __func__); 1582 if (mux_client_read(fd, queue, 4) != 0) { 1583 if ((oerrno = errno) == EPIPE) 1584 debug3("%s: read header failed: %s", __func__, 1585 strerror(errno)); 1586 sshbuf_free(queue); 1587 errno = oerrno; 1588 return -1; 1589 } 1590 need = PEEK_U32(sshbuf_ptr(queue)); 1591 if (mux_client_read(fd, queue, need) != 0) { 1592 oerrno = errno; 1593 debug3("%s: read body failed: %s", __func__, strerror(errno)); 1594 sshbuf_free(queue); 1595 errno = oerrno; 1596 return -1; 1597 } 1598 if ((r = sshbuf_get_string_direct(queue, &ptr, &have)) != 0 || 1599 (r = sshbuf_put(m, ptr, have)) != 0) 1600 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1601 sshbuf_free(queue); 1602 return 0; 1603 } 1604 1605 static int 1606 mux_client_hello_exchange(int fd) 1607 { 1608 struct sshbuf *m; 1609 u_int type, ver; 1610 int r, ret = -1; 1611 1612 if ((m = sshbuf_new()) == NULL) 1613 fatal("%s: sshbuf_new", __func__); 1614 if ((r = sshbuf_put_u32(m, MUX_MSG_HELLO)) != 0 || 1615 (r = sshbuf_put_u32(m, SSHMUX_VER)) != 0) 1616 fatal("%s: hello: %s", __func__, ssh_err(r)); 1617 /* no extensions */ 1618 1619 if (mux_client_write_packet(fd, m) != 0) { 1620 debug("%s: write packet: %s", __func__, strerror(errno)); 1621 goto out; 1622 } 1623 1624 sshbuf_reset(m); 1625 1626 /* Read their HELLO */ 1627 if (mux_client_read_packet(fd, m) != 0) { 1628 debug("%s: read packet failed", __func__); 1629 goto out; 1630 } 1631 1632 if ((r = sshbuf_get_u32(m, &type)) != 0) 1633 fatal("%s: decode type: %s", __func__, ssh_err(r)); 1634 if (type != MUX_MSG_HELLO) { 1635 error("%s: expected HELLO (%u) received %u", 1636 __func__, MUX_MSG_HELLO, type); 1637 goto out; 1638 } 1639 if ((r = sshbuf_get_u32(m, &ver)) != 0) 1640 fatal("%s: decode version: %s", __func__, ssh_err(r)); 1641 if (ver != SSHMUX_VER) { 1642 error("Unsupported multiplexing protocol version %d " 1643 "(expected %d)", ver, SSHMUX_VER); 1644 goto out; 1645 } 1646 debug2("%s: master version %u", __func__, ver); 1647 /* No extensions are presently defined */ 1648 while (sshbuf_len(m) > 0) { 1649 char *name = NULL; 1650 1651 if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 || 1652 (r = sshbuf_skip_string(m)) != 0) { /* value */ 1653 error("%s: malformed extension: %s", 1654 __func__, ssh_err(r)); 1655 goto out; 1656 } 1657 debug2("Unrecognised master extension \"%s\"", name); 1658 free(name); 1659 } 1660 /* success */ 1661 ret = 0; 1662 out: 1663 sshbuf_free(m); 1664 return ret; 1665 } 1666 1667 static u_int 1668 mux_client_request_alive(int fd) 1669 { 1670 struct sshbuf *m; 1671 char *e; 1672 u_int pid, type, rid; 1673 int r; 1674 1675 debug3("%s: entering", __func__); 1676 1677 if ((m = sshbuf_new()) == NULL) 1678 fatal("%s: sshbuf_new", __func__); 1679 if ((r = sshbuf_put_u32(m, MUX_C_ALIVE_CHECK)) != 0 || 1680 (r = sshbuf_put_u32(m, muxclient_request_id)) != 0) 1681 fatal("%s: request: %s", __func__, ssh_err(r)); 1682 1683 if (mux_client_write_packet(fd, m) != 0) 1684 fatal("%s: write packet: %s", __func__, strerror(errno)); 1685 1686 sshbuf_reset(m); 1687 1688 /* Read their reply */ 1689 if (mux_client_read_packet(fd, m) != 0) { 1690 sshbuf_free(m); 1691 return 0; 1692 } 1693 1694 if ((r = sshbuf_get_u32(m, &type)) != 0) 1695 fatal("%s: decode type: %s", __func__, ssh_err(r)); 1696 if (type != MUX_S_ALIVE) { 1697 if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0) 1698 fatal("%s: decode error: %s", __func__, ssh_err(r)); 1699 fatal("%s: master returned error: %s", __func__, e); 1700 } 1701 1702 if ((r = sshbuf_get_u32(m, &rid)) != 0) 1703 fatal("%s: decode remote ID: %s", __func__, ssh_err(r)); 1704 if (rid != muxclient_request_id) 1705 fatal("%s: out of sequence reply: my id %u theirs %u", 1706 __func__, muxclient_request_id, rid); 1707 if ((r = sshbuf_get_u32(m, &pid)) != 0) 1708 fatal("%s: decode PID: %s", __func__, ssh_err(r)); 1709 sshbuf_free(m); 1710 1711 debug3("%s: done pid = %u", __func__, pid); 1712 1713 muxclient_request_id++; 1714 1715 return pid; 1716 } 1717 1718 static void 1719 mux_client_request_terminate(int fd) 1720 { 1721 struct sshbuf *m; 1722 char *e; 1723 u_int type, rid; 1724 int r; 1725 1726 debug3("%s: entering", __func__); 1727 1728 if ((m = sshbuf_new()) == NULL) 1729 fatal("%s: sshbuf_new", __func__); 1730 if ((r = sshbuf_put_u32(m, MUX_C_TERMINATE)) != 0 || 1731 (r = sshbuf_put_u32(m, muxclient_request_id)) != 0) 1732 fatal("%s: request: %s", __func__, ssh_err(r)); 1733 1734 if (mux_client_write_packet(fd, m) != 0) 1735 fatal("%s: write packet: %s", __func__, strerror(errno)); 1736 1737 sshbuf_reset(m); 1738 1739 /* Read their reply */ 1740 if (mux_client_read_packet(fd, m) != 0) { 1741 /* Remote end exited already */ 1742 if (errno == EPIPE) { 1743 sshbuf_free(m); 1744 return; 1745 } 1746 fatal("%s: read from master failed: %s", 1747 __func__, strerror(errno)); 1748 } 1749 1750 if ((r = sshbuf_get_u32(m, &type)) != 0 || 1751 (r = sshbuf_get_u32(m, &rid)) != 0) 1752 fatal("%s: decode: %s", __func__, ssh_err(r)); 1753 if (rid != muxclient_request_id) 1754 fatal("%s: out of sequence reply: my id %u theirs %u", 1755 __func__, muxclient_request_id, rid); 1756 switch (type) { 1757 case MUX_S_OK: 1758 break; 1759 case MUX_S_PERMISSION_DENIED: 1760 if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0) 1761 fatal("%s: decode error: %s", __func__, ssh_err(r)); 1762 fatal("Master refused termination request: %s", e); 1763 case MUX_S_FAILURE: 1764 if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0) 1765 fatal("%s: decode error: %s", __func__, ssh_err(r)); 1766 fatal("%s: termination request failed: %s", __func__, e); 1767 default: 1768 fatal("%s: unexpected response from master 0x%08x", 1769 __func__, type); 1770 } 1771 sshbuf_free(m); 1772 muxclient_request_id++; 1773 } 1774 1775 static int 1776 mux_client_forward(int fd, int cancel_flag, u_int ftype, struct Forward *fwd) 1777 { 1778 struct sshbuf *m; 1779 char *e, *fwd_desc; 1780 const char *lhost, *chost; 1781 u_int type, rid; 1782 int r; 1783 1784 fwd_desc = format_forward(ftype, fwd); 1785 debug("Requesting %s %s", 1786 cancel_flag ? "cancellation of" : "forwarding of", fwd_desc); 1787 free(fwd_desc); 1788 1789 type = cancel_flag ? MUX_C_CLOSE_FWD : MUX_C_OPEN_FWD; 1790 if (fwd->listen_path != NULL) 1791 lhost = fwd->listen_path; 1792 else if (fwd->listen_host == NULL) 1793 lhost = ""; 1794 else if (*fwd->listen_host == '\0') 1795 lhost = "*"; 1796 else 1797 lhost = fwd->listen_host; 1798 1799 if (fwd->connect_path != NULL) 1800 chost = fwd->connect_path; 1801 else if (fwd->connect_host == NULL) 1802 chost = ""; 1803 else 1804 chost = fwd->connect_host; 1805 1806 if ((m = sshbuf_new()) == NULL) 1807 fatal("%s: sshbuf_new", __func__); 1808 if ((r = sshbuf_put_u32(m, type)) != 0 || 1809 (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 || 1810 (r = sshbuf_put_u32(m, ftype)) != 0 || 1811 (r = sshbuf_put_cstring(m, lhost)) != 0 || 1812 (r = sshbuf_put_u32(m, fwd->listen_port)) != 0 || 1813 (r = sshbuf_put_cstring(m, chost)) != 0 || 1814 (r = sshbuf_put_u32(m, fwd->connect_port)) != 0) 1815 fatal("%s: request: %s", __func__, ssh_err(r)); 1816 1817 if (mux_client_write_packet(fd, m) != 0) 1818 fatal("%s: write packet: %s", __func__, strerror(errno)); 1819 1820 sshbuf_reset(m); 1821 1822 /* Read their reply */ 1823 if (mux_client_read_packet(fd, m) != 0) { 1824 sshbuf_free(m); 1825 return -1; 1826 } 1827 1828 if ((r = sshbuf_get_u32(m, &type)) != 0 || 1829 (r = sshbuf_get_u32(m, &rid)) != 0) 1830 fatal("%s: decode: %s", __func__, ssh_err(r)); 1831 if (rid != muxclient_request_id) 1832 fatal("%s: out of sequence reply: my id %u theirs %u", 1833 __func__, muxclient_request_id, rid); 1834 1835 switch (type) { 1836 case MUX_S_OK: 1837 break; 1838 case MUX_S_REMOTE_PORT: 1839 if (cancel_flag) 1840 fatal("%s: got MUX_S_REMOTE_PORT for cancel", __func__); 1841 if ((r = sshbuf_get_u32(m, &fwd->allocated_port)) != 0) 1842 fatal("%s: decode port: %s", __func__, ssh_err(r)); 1843 verbose("Allocated port %u for remote forward to %s:%d", 1844 fwd->allocated_port, 1845 fwd->connect_host ? fwd->connect_host : "", 1846 fwd->connect_port); 1847 if (muxclient_command == SSHMUX_COMMAND_FORWARD) 1848 fprintf(stdout, "%i\n", fwd->allocated_port); 1849 break; 1850 case MUX_S_PERMISSION_DENIED: 1851 if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0) 1852 fatal("%s: decode error: %s", __func__, ssh_err(r)); 1853 sshbuf_free(m); 1854 error("Master refused forwarding request: %s", e); 1855 return -1; 1856 case MUX_S_FAILURE: 1857 if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0) 1858 fatal("%s: decode error: %s", __func__, ssh_err(r)); 1859 sshbuf_free(m); 1860 error("%s: forwarding request failed: %s", __func__, e); 1861 return -1; 1862 default: 1863 fatal("%s: unexpected response from master 0x%08x", 1864 __func__, type); 1865 } 1866 sshbuf_free(m); 1867 1868 muxclient_request_id++; 1869 return 0; 1870 } 1871 1872 static int 1873 mux_client_forwards(int fd, int cancel_flag) 1874 { 1875 int i, ret = 0; 1876 1877 debug3("%s: %s forwardings: %d local, %d remote", __func__, 1878 cancel_flag ? "cancel" : "request", 1879 options.num_local_forwards, options.num_remote_forwards); 1880 1881 /* XXX ExitOnForwardingFailure */ 1882 for (i = 0; i < options.num_local_forwards; i++) { 1883 if (mux_client_forward(fd, cancel_flag, 1884 options.local_forwards[i].connect_port == 0 ? 1885 MUX_FWD_DYNAMIC : MUX_FWD_LOCAL, 1886 options.local_forwards + i) != 0) 1887 ret = -1; 1888 } 1889 for (i = 0; i < options.num_remote_forwards; i++) { 1890 if (mux_client_forward(fd, cancel_flag, MUX_FWD_REMOTE, 1891 options.remote_forwards + i) != 0) 1892 ret = -1; 1893 } 1894 return ret; 1895 } 1896 1897 static int 1898 mux_client_request_session(int fd) 1899 { 1900 struct sshbuf *m; 1901 char *e; 1902 const char *term; 1903 u_int echar, rid, sid, esid, exitval, type, exitval_seen; 1904 extern char **environ; 1905 int r, i, devnull, rawmode; 1906 1907 debug3("%s: entering", __func__); 1908 1909 if ((muxserver_pid = mux_client_request_alive(fd)) == 0) { 1910 error("%s: master alive request failed", __func__); 1911 return -1; 1912 } 1913 1914 signal(SIGPIPE, SIG_IGN); 1915 1916 if (stdin_null_flag) { 1917 if ((devnull = open(_PATH_DEVNULL, O_RDONLY)) == -1) 1918 fatal("open(/dev/null): %s", strerror(errno)); 1919 if (dup2(devnull, STDIN_FILENO) == -1) 1920 fatal("dup2: %s", strerror(errno)); 1921 if (devnull > STDERR_FILENO) 1922 close(devnull); 1923 } 1924 1925 if ((term = getenv("TERM")) == NULL) 1926 term = ""; 1927 echar = 0xffffffff; 1928 if (options.escape_char != SSH_ESCAPECHAR_NONE) 1929 echar = (u_int)options.escape_char; 1930 1931 if ((m = sshbuf_new()) == NULL) 1932 fatal("%s: sshbuf_new", __func__); 1933 if ((r = sshbuf_put_u32(m, MUX_C_NEW_SESSION)) != 0 || 1934 (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 || 1935 (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */ 1936 (r = sshbuf_put_u32(m, tty_flag)) != 0 || 1937 (r = sshbuf_put_u32(m, options.forward_x11)) != 0 || 1938 (r = sshbuf_put_u32(m, options.forward_agent)) != 0 || 1939 (r = sshbuf_put_u32(m, subsystem_flag)) != 0 || 1940 (r = sshbuf_put_u32(m, echar)) != 0 || 1941 (r = sshbuf_put_cstring(m, term)) != 0 || 1942 (r = sshbuf_put_stringb(m, command)) != 0) 1943 fatal("%s: request: %s", __func__, ssh_err(r)); 1944 1945 /* Pass environment */ 1946 if (options.num_send_env > 0 && environ != NULL) { 1947 for (i = 0; environ[i] != NULL; i++) { 1948 if (!env_permitted(environ[i])) 1949 continue; 1950 if ((r = sshbuf_put_cstring(m, environ[i])) != 0) 1951 fatal("%s: request: %s", __func__, ssh_err(r)); 1952 } 1953 } 1954 for (i = 0; i < options.num_setenv; i++) { 1955 if ((r = sshbuf_put_cstring(m, options.setenv[i])) != 0) 1956 fatal("%s: request: %s", __func__, ssh_err(r)); 1957 } 1958 1959 if (mux_client_write_packet(fd, m) != 0) 1960 fatal("%s: write packet: %s", __func__, strerror(errno)); 1961 1962 /* Send the stdio file descriptors */ 1963 if (mm_send_fd(fd, STDIN_FILENO) == -1 || 1964 mm_send_fd(fd, STDOUT_FILENO) == -1 || 1965 mm_send_fd(fd, STDERR_FILENO) == -1) 1966 fatal("%s: send fds failed", __func__); 1967 1968 debug3("%s: session request sent", __func__); 1969 1970 /* Read their reply */ 1971 sshbuf_reset(m); 1972 if (mux_client_read_packet(fd, m) != 0) { 1973 error("%s: read from master failed: %s", 1974 __func__, strerror(errno)); 1975 sshbuf_free(m); 1976 return -1; 1977 } 1978 1979 if ((r = sshbuf_get_u32(m, &type)) != 0 || 1980 (r = sshbuf_get_u32(m, &rid)) != 0) 1981 fatal("%s: decode: %s", __func__, ssh_err(r)); 1982 if (rid != muxclient_request_id) 1983 fatal("%s: out of sequence reply: my id %u theirs %u", 1984 __func__, muxclient_request_id, rid); 1985 1986 switch (type) { 1987 case MUX_S_SESSION_OPENED: 1988 if ((r = sshbuf_get_u32(m, &sid)) != 0) 1989 fatal("%s: decode ID: %s", __func__, ssh_err(r)); 1990 break; 1991 case MUX_S_PERMISSION_DENIED: 1992 if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0) 1993 fatal("%s: decode error: %s", __func__, ssh_err(r)); 1994 error("Master refused session request: %s", e); 1995 sshbuf_free(m); 1996 return -1; 1997 case MUX_S_FAILURE: 1998 if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0) 1999 fatal("%s: decode error: %s", __func__, ssh_err(r)); 2000 error("%s: session request failed: %s", __func__, e); 2001 sshbuf_free(m); 2002 return -1; 2003 default: 2004 sshbuf_free(m); 2005 error("%s: unexpected response from master 0x%08x", 2006 __func__, type); 2007 return -1; 2008 } 2009 muxclient_request_id++; 2010 2011 if (pledge("stdio proc tty", NULL) == -1) 2012 fatal("%s pledge(): %s", __func__, strerror(errno)); 2013 platform_pledge_mux(); 2014 2015 signal(SIGHUP, control_client_sighandler); 2016 signal(SIGINT, control_client_sighandler); 2017 signal(SIGTERM, control_client_sighandler); 2018 signal(SIGWINCH, control_client_sigrelay); 2019 2020 rawmode = tty_flag; 2021 if (tty_flag) 2022 enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE); 2023 2024 /* 2025 * Stick around until the controlee closes the client_fd. 2026 * Before it does, it is expected to write an exit message. 2027 * This process must read the value and wait for the closure of 2028 * the client_fd; if this one closes early, the multiplex master will 2029 * terminate early too (possibly losing data). 2030 */ 2031 for (exitval = 255, exitval_seen = 0;;) { 2032 sshbuf_reset(m); 2033 if (mux_client_read_packet(fd, m) != 0) 2034 break; 2035 if ((r = sshbuf_get_u32(m, &type)) != 0) 2036 fatal("%s: decode type: %s", __func__, ssh_err(r)); 2037 switch (type) { 2038 case MUX_S_TTY_ALLOC_FAIL: 2039 if ((r = sshbuf_get_u32(m, &esid)) != 0) 2040 fatal("%s: decode ID: %s", 2041 __func__, ssh_err(r)); 2042 if (esid != sid) 2043 fatal("%s: tty alloc fail on unknown session: " 2044 "my id %u theirs %u", 2045 __func__, sid, esid); 2046 leave_raw_mode(options.request_tty == 2047 REQUEST_TTY_FORCE); 2048 rawmode = 0; 2049 continue; 2050 case MUX_S_EXIT_MESSAGE: 2051 if ((r = sshbuf_get_u32(m, &esid)) != 0) 2052 fatal("%s: decode ID: %s", 2053 __func__, ssh_err(r)); 2054 if (esid != sid) 2055 fatal("%s: exit on unknown session: " 2056 "my id %u theirs %u", 2057 __func__, sid, esid); 2058 if (exitval_seen) 2059 fatal("%s: exitval sent twice", __func__); 2060 if ((r = sshbuf_get_u32(m, &exitval)) != 0) 2061 fatal("%s: decode exit value: %s", 2062 __func__, ssh_err(r)); 2063 exitval_seen = 1; 2064 continue; 2065 default: 2066 if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0) 2067 fatal("%s: decode error: %s", 2068 __func__, ssh_err(r)); 2069 fatal("%s: master returned error: %s", __func__, e); 2070 } 2071 } 2072 2073 close(fd); 2074 if (rawmode) 2075 leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE); 2076 2077 if (muxclient_terminate) { 2078 debug2("Exiting on signal: %s", strsignal(muxclient_terminate)); 2079 exitval = 255; 2080 } else if (!exitval_seen) { 2081 debug2("Control master terminated unexpectedly"); 2082 exitval = 255; 2083 } else 2084 debug2("Received exit status from master %d", exitval); 2085 2086 if (tty_flag && options.log_level != SYSLOG_LEVEL_QUIET) 2087 fprintf(stderr, "Shared connection to %s closed.\r\n", host); 2088 2089 exit(exitval); 2090 } 2091 2092 static int 2093 mux_client_proxy(int fd) 2094 { 2095 struct sshbuf *m; 2096 char *e; 2097 u_int type, rid; 2098 int r; 2099 2100 if ((m = sshbuf_new()) == NULL) 2101 fatal("%s: sshbuf_new", __func__); 2102 if ((r = sshbuf_put_u32(m, MUX_C_PROXY)) != 0 || 2103 (r = sshbuf_put_u32(m, muxclient_request_id)) != 0) 2104 fatal("%s: request: %s", __func__, ssh_err(r)); 2105 if (mux_client_write_packet(fd, m) != 0) 2106 fatal("%s: write packet: %s", __func__, strerror(errno)); 2107 2108 sshbuf_reset(m); 2109 2110 /* Read their reply */ 2111 if (mux_client_read_packet(fd, m) != 0) { 2112 sshbuf_free(m); 2113 return 0; 2114 } 2115 if ((r = sshbuf_get_u32(m, &type)) != 0 || 2116 (r = sshbuf_get_u32(m, &rid)) != 0) 2117 fatal("%s: decode: %s", __func__, ssh_err(r)); 2118 if (rid != muxclient_request_id) 2119 fatal("%s: out of sequence reply: my id %u theirs %u", 2120 __func__, muxclient_request_id, rid); 2121 if (type != MUX_S_PROXY) { 2122 if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0) 2123 fatal("%s: decode error: %s", __func__, ssh_err(r)); 2124 fatal("%s: master returned error: %s", __func__, e); 2125 } 2126 sshbuf_free(m); 2127 2128 debug3("%s: done", __func__); 2129 muxclient_request_id++; 2130 return 0; 2131 } 2132 2133 static int 2134 mux_client_request_stdio_fwd(int fd) 2135 { 2136 struct sshbuf *m; 2137 char *e; 2138 u_int type, rid, sid; 2139 int r, devnull; 2140 2141 debug3("%s: entering", __func__); 2142 2143 if ((muxserver_pid = mux_client_request_alive(fd)) == 0) { 2144 error("%s: master alive request failed", __func__); 2145 return -1; 2146 } 2147 2148 signal(SIGPIPE, SIG_IGN); 2149 2150 if (stdin_null_flag) { 2151 if ((devnull = open(_PATH_DEVNULL, O_RDONLY)) == -1) 2152 fatal("open(/dev/null): %s", strerror(errno)); 2153 if (dup2(devnull, STDIN_FILENO) == -1) 2154 fatal("dup2: %s", strerror(errno)); 2155 if (devnull > STDERR_FILENO) 2156 close(devnull); 2157 } 2158 2159 if ((m = sshbuf_new()) == NULL) 2160 fatal("%s: sshbuf_new", __func__); 2161 if ((r = sshbuf_put_u32(m, MUX_C_NEW_STDIO_FWD)) != 0 || 2162 (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 || 2163 (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */ 2164 (r = sshbuf_put_cstring(m, options.stdio_forward_host)) != 0 || 2165 (r = sshbuf_put_u32(m, options.stdio_forward_port)) != 0) 2166 fatal("%s: request: %s", __func__, ssh_err(r)); 2167 2168 if (mux_client_write_packet(fd, m) != 0) 2169 fatal("%s: write packet: %s", __func__, strerror(errno)); 2170 2171 /* Send the stdio file descriptors */ 2172 if (mm_send_fd(fd, STDIN_FILENO) == -1 || 2173 mm_send_fd(fd, STDOUT_FILENO) == -1) 2174 fatal("%s: send fds failed", __func__); 2175 2176 if (pledge("stdio proc tty", NULL) == -1) 2177 fatal("%s pledge(): %s", __func__, strerror(errno)); 2178 platform_pledge_mux(); 2179 2180 debug3("%s: stdio forward request sent", __func__); 2181 2182 /* Read their reply */ 2183 sshbuf_reset(m); 2184 2185 if (mux_client_read_packet(fd, m) != 0) { 2186 error("%s: read from master failed: %s", 2187 __func__, strerror(errno)); 2188 sshbuf_free(m); 2189 return -1; 2190 } 2191 2192 if ((r = sshbuf_get_u32(m, &type)) != 0 || 2193 (r = sshbuf_get_u32(m, &rid)) != 0) 2194 fatal("%s: decode: %s", __func__, ssh_err(r)); 2195 if (rid != muxclient_request_id) 2196 fatal("%s: out of sequence reply: my id %u theirs %u", 2197 __func__, muxclient_request_id, rid); 2198 switch (type) { 2199 case MUX_S_SESSION_OPENED: 2200 if ((r = sshbuf_get_u32(m, &sid)) != 0) 2201 fatal("%s: decode ID: %s", __func__, ssh_err(r)); 2202 debug("%s: master session id: %u", __func__, sid); 2203 break; 2204 case MUX_S_PERMISSION_DENIED: 2205 if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0) 2206 fatal("%s: decode error: %s", __func__, ssh_err(r)); 2207 sshbuf_free(m); 2208 fatal("Master refused stdio forwarding request: %s", e); 2209 case MUX_S_FAILURE: 2210 if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0) 2211 fatal("%s: decode error: %s", __func__, ssh_err(r)); 2212 sshbuf_free(m); 2213 fatal("Stdio forwarding request failed: %s", e); 2214 default: 2215 sshbuf_free(m); 2216 error("%s: unexpected response from master 0x%08x", 2217 __func__, type); 2218 return -1; 2219 } 2220 muxclient_request_id++; 2221 2222 signal(SIGHUP, control_client_sighandler); 2223 signal(SIGINT, control_client_sighandler); 2224 signal(SIGTERM, control_client_sighandler); 2225 signal(SIGWINCH, control_client_sigrelay); 2226 2227 /* 2228 * Stick around until the controlee closes the client_fd. 2229 */ 2230 sshbuf_reset(m); 2231 if (mux_client_read_packet(fd, m) != 0) { 2232 if (errno == EPIPE || 2233 (errno == EINTR && muxclient_terminate != 0)) 2234 return 0; 2235 fatal("%s: mux_client_read_packet: %s", 2236 __func__, strerror(errno)); 2237 } 2238 fatal("%s: master returned unexpected message %u", __func__, type); 2239 } 2240 2241 static void 2242 mux_client_request_stop_listening(int fd) 2243 { 2244 struct sshbuf *m; 2245 char *e; 2246 u_int type, rid; 2247 int r; 2248 2249 debug3("%s: entering", __func__); 2250 2251 if ((m = sshbuf_new()) == NULL) 2252 fatal("%s: sshbuf_new", __func__); 2253 if ((r = sshbuf_put_u32(m, MUX_C_STOP_LISTENING)) != 0 || 2254 (r = sshbuf_put_u32(m, muxclient_request_id)) != 0) 2255 fatal("%s: request: %s", __func__, ssh_err(r)); 2256 2257 if (mux_client_write_packet(fd, m) != 0) 2258 fatal("%s: write packet: %s", __func__, strerror(errno)); 2259 2260 sshbuf_reset(m); 2261 2262 /* Read their reply */ 2263 if (mux_client_read_packet(fd, m) != 0) 2264 fatal("%s: read from master failed: %s", 2265 __func__, strerror(errno)); 2266 2267 if ((r = sshbuf_get_u32(m, &type)) != 0 || 2268 (r = sshbuf_get_u32(m, &rid)) != 0) 2269 fatal("%s: decode: %s", __func__, ssh_err(r)); 2270 if (rid != muxclient_request_id) 2271 fatal("%s: out of sequence reply: my id %u theirs %u", 2272 __func__, muxclient_request_id, rid); 2273 2274 switch (type) { 2275 case MUX_S_OK: 2276 break; 2277 case MUX_S_PERMISSION_DENIED: 2278 if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0) 2279 fatal("%s: decode error: %s", __func__, ssh_err(r)); 2280 fatal("Master refused stop listening request: %s", e); 2281 case MUX_S_FAILURE: 2282 if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0) 2283 fatal("%s: decode error: %s", __func__, ssh_err(r)); 2284 fatal("%s: stop listening request failed: %s", __func__, e); 2285 default: 2286 fatal("%s: unexpected response from master 0x%08x", 2287 __func__, type); 2288 } 2289 sshbuf_free(m); 2290 muxclient_request_id++; 2291 } 2292 2293 /* Multiplex client main loop. */ 2294 int 2295 muxclient(const char *path) 2296 { 2297 struct sockaddr_un addr; 2298 int sock; 2299 u_int pid; 2300 2301 if (muxclient_command == 0) { 2302 if (options.stdio_forward_host != NULL) 2303 muxclient_command = SSHMUX_COMMAND_STDIO_FWD; 2304 else 2305 muxclient_command = SSHMUX_COMMAND_OPEN; 2306 } 2307 2308 switch (options.control_master) { 2309 case SSHCTL_MASTER_AUTO: 2310 case SSHCTL_MASTER_AUTO_ASK: 2311 debug("auto-mux: Trying existing master"); 2312 /* FALLTHROUGH */ 2313 case SSHCTL_MASTER_NO: 2314 break; 2315 default: 2316 return -1; 2317 } 2318 2319 memset(&addr, '\0', sizeof(addr)); 2320 addr.sun_family = AF_UNIX; 2321 2322 if (strlcpy(addr.sun_path, path, 2323 sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) 2324 fatal("ControlPath too long ('%s' >= %u bytes)", path, 2325 (unsigned int)sizeof(addr.sun_path)); 2326 2327 if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) < 0) 2328 fatal("%s socket(): %s", __func__, strerror(errno)); 2329 2330 if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == -1) { 2331 switch (muxclient_command) { 2332 case SSHMUX_COMMAND_OPEN: 2333 case SSHMUX_COMMAND_STDIO_FWD: 2334 break; 2335 default: 2336 fatal("Control socket connect(%.100s): %s", path, 2337 strerror(errno)); 2338 } 2339 if (errno == ECONNREFUSED && 2340 options.control_master != SSHCTL_MASTER_NO) { 2341 debug("Stale control socket %.100s, unlinking", path); 2342 unlink(path); 2343 } else if (errno == ENOENT) { 2344 debug("Control socket \"%.100s\" does not exist", path); 2345 } else { 2346 error("Control socket connect(%.100s): %s", path, 2347 strerror(errno)); 2348 } 2349 close(sock); 2350 return -1; 2351 } 2352 set_nonblock(sock); 2353 2354 if (mux_client_hello_exchange(sock) != 0) { 2355 error("%s: master hello exchange failed", __func__); 2356 close(sock); 2357 return -1; 2358 } 2359 2360 switch (muxclient_command) { 2361 case SSHMUX_COMMAND_ALIVE_CHECK: 2362 if ((pid = mux_client_request_alive(sock)) == 0) 2363 fatal("%s: master alive check failed", __func__); 2364 fprintf(stderr, "Master running (pid=%u)\r\n", pid); 2365 exit(0); 2366 case SSHMUX_COMMAND_TERMINATE: 2367 mux_client_request_terminate(sock); 2368 if (options.log_level != SYSLOG_LEVEL_QUIET) 2369 fprintf(stderr, "Exit request sent.\r\n"); 2370 exit(0); 2371 case SSHMUX_COMMAND_FORWARD: 2372 if (mux_client_forwards(sock, 0) != 0) 2373 fatal("%s: master forward request failed", __func__); 2374 exit(0); 2375 case SSHMUX_COMMAND_OPEN: 2376 if (mux_client_forwards(sock, 0) != 0) { 2377 error("%s: master forward request failed", __func__); 2378 return -1; 2379 } 2380 mux_client_request_session(sock); 2381 return -1; 2382 case SSHMUX_COMMAND_STDIO_FWD: 2383 mux_client_request_stdio_fwd(sock); 2384 exit(0); 2385 case SSHMUX_COMMAND_STOP: 2386 mux_client_request_stop_listening(sock); 2387 if (options.log_level != SYSLOG_LEVEL_QUIET) 2388 fprintf(stderr, "Stop listening request sent.\r\n"); 2389 exit(0); 2390 case SSHMUX_COMMAND_CANCEL_FWD: 2391 if (mux_client_forwards(sock, 1) != 0) 2392 error("%s: master cancel forward request failed", 2393 __func__); 2394 exit(0); 2395 case SSHMUX_COMMAND_PROXY: 2396 mux_client_proxy(sock); 2397 return (sock); 2398 default: 2399 fatal("unrecognised muxclient_command %d", muxclient_command); 2400 } 2401 } 2402