1 /* $OpenBSD: sftp-server.c,v 1.117 2019/07/05 04:55:40 djm Exp $ */ 2 /* 3 * Copyright (c) 2000-2004 Markus Friedl. All rights reserved. 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include "includes.h" 19 20 #include <sys/types.h> 21 #include <sys/stat.h> 22 #ifdef HAVE_SYS_TIME_H 23 # include <sys/time.h> 24 #endif 25 #ifdef HAVE_SYS_MOUNT_H 26 #include <sys/mount.h> 27 #endif 28 #ifdef HAVE_SYS_STATVFS_H 29 #include <sys/statvfs.h> 30 #endif 31 32 #include <dirent.h> 33 #include <errno.h> 34 #include <fcntl.h> 35 #include <pwd.h> 36 #include <stdlib.h> 37 #include <stdio.h> 38 #include <string.h> 39 #include <time.h> 40 #include <unistd.h> 41 #include <stdarg.h> 42 43 #include "xmalloc.h" 44 #include "sshbuf.h" 45 #include "ssherr.h" 46 #include "log.h" 47 #include "misc.h" 48 #include "match.h" 49 #include "uidswap.h" 50 51 #include "sftp.h" 52 #include "sftp-common.h" 53 54 char *sftp_realpath(const char *, char *); /* sftp-realpath.c */ 55 56 /* Our verbosity */ 57 static LogLevel log_level = SYSLOG_LEVEL_ERROR; 58 59 /* Our client */ 60 static struct passwd *pw = NULL; 61 static char *client_addr = NULL; 62 63 /* input and output queue */ 64 struct sshbuf *iqueue; 65 struct sshbuf *oqueue; 66 67 /* Version of client */ 68 static u_int version; 69 70 /* SSH2_FXP_INIT received */ 71 static int init_done; 72 73 /* Disable writes */ 74 static int readonly; 75 76 /* Requests that are allowed/denied */ 77 static char *request_whitelist, *request_blacklist; 78 79 /* portable attributes, etc. */ 80 typedef struct Stat Stat; 81 82 struct Stat { 83 char *name; 84 char *long_name; 85 Attrib attrib; 86 }; 87 88 /* Packet handlers */ 89 static void process_open(u_int32_t id); 90 static void process_close(u_int32_t id); 91 static void process_read(u_int32_t id); 92 static void process_write(u_int32_t id); 93 static void process_stat(u_int32_t id); 94 static void process_lstat(u_int32_t id); 95 static void process_fstat(u_int32_t id); 96 static void process_setstat(u_int32_t id); 97 static void process_fsetstat(u_int32_t id); 98 static void process_opendir(u_int32_t id); 99 static void process_readdir(u_int32_t id); 100 static void process_remove(u_int32_t id); 101 static void process_mkdir(u_int32_t id); 102 static void process_rmdir(u_int32_t id); 103 static void process_realpath(u_int32_t id); 104 static void process_rename(u_int32_t id); 105 static void process_readlink(u_int32_t id); 106 static void process_symlink(u_int32_t id); 107 static void process_extended_posix_rename(u_int32_t id); 108 static void process_extended_statvfs(u_int32_t id); 109 static void process_extended_fstatvfs(u_int32_t id); 110 static void process_extended_hardlink(u_int32_t id); 111 static void process_extended_fsync(u_int32_t id); 112 static void process_extended_lsetstat(u_int32_t id); 113 static void process_extended(u_int32_t id); 114 115 struct sftp_handler { 116 const char *name; /* user-visible name for fine-grained perms */ 117 const char *ext_name; /* extended request name */ 118 u_int type; /* packet type, for non extended packets */ 119 void (*handler)(u_int32_t); 120 int does_write; /* if nonzero, banned for readonly mode */ 121 }; 122 123 static const struct sftp_handler handlers[] = { 124 /* NB. SSH2_FXP_OPEN does the readonly check in the handler itself */ 125 { "open", NULL, SSH2_FXP_OPEN, process_open, 0 }, 126 { "close", NULL, SSH2_FXP_CLOSE, process_close, 0 }, 127 { "read", NULL, SSH2_FXP_READ, process_read, 0 }, 128 { "write", NULL, SSH2_FXP_WRITE, process_write, 1 }, 129 { "lstat", NULL, SSH2_FXP_LSTAT, process_lstat, 0 }, 130 { "fstat", NULL, SSH2_FXP_FSTAT, process_fstat, 0 }, 131 { "setstat", NULL, SSH2_FXP_SETSTAT, process_setstat, 1 }, 132 { "fsetstat", NULL, SSH2_FXP_FSETSTAT, process_fsetstat, 1 }, 133 { "opendir", NULL, SSH2_FXP_OPENDIR, process_opendir, 0 }, 134 { "readdir", NULL, SSH2_FXP_READDIR, process_readdir, 0 }, 135 { "remove", NULL, SSH2_FXP_REMOVE, process_remove, 1 }, 136 { "mkdir", NULL, SSH2_FXP_MKDIR, process_mkdir, 1 }, 137 { "rmdir", NULL, SSH2_FXP_RMDIR, process_rmdir, 1 }, 138 { "realpath", NULL, SSH2_FXP_REALPATH, process_realpath, 0 }, 139 { "stat", NULL, SSH2_FXP_STAT, process_stat, 0 }, 140 { "rename", NULL, SSH2_FXP_RENAME, process_rename, 1 }, 141 { "readlink", NULL, SSH2_FXP_READLINK, process_readlink, 0 }, 142 { "symlink", NULL, SSH2_FXP_SYMLINK, process_symlink, 1 }, 143 { NULL, NULL, 0, NULL, 0 } 144 }; 145 146 /* SSH2_FXP_EXTENDED submessages */ 147 static const struct sftp_handler extended_handlers[] = { 148 { "posix-rename", "posix-rename@openssh.com", 0, 149 process_extended_posix_rename, 1 }, 150 { "statvfs", "statvfs@openssh.com", 0, process_extended_statvfs, 0 }, 151 { "fstatvfs", "fstatvfs@openssh.com", 0, process_extended_fstatvfs, 0 }, 152 { "hardlink", "hardlink@openssh.com", 0, process_extended_hardlink, 1 }, 153 { "fsync", "fsync@openssh.com", 0, process_extended_fsync, 1 }, 154 { "lsetstat", "lsetstat@openssh.com", 0, process_extended_lsetstat, 1 }, 155 { NULL, NULL, 0, NULL, 0 } 156 }; 157 158 static int 159 request_permitted(const struct sftp_handler *h) 160 { 161 char *result; 162 163 if (readonly && h->does_write) { 164 verbose("Refusing %s request in read-only mode", h->name); 165 return 0; 166 } 167 if (request_blacklist != NULL && 168 ((result = match_list(h->name, request_blacklist, NULL))) != NULL) { 169 free(result); 170 verbose("Refusing blacklisted %s request", h->name); 171 return 0; 172 } 173 if (request_whitelist != NULL && 174 ((result = match_list(h->name, request_whitelist, NULL))) != NULL) { 175 free(result); 176 debug2("Permitting whitelisted %s request", h->name); 177 return 1; 178 } 179 if (request_whitelist != NULL) { 180 verbose("Refusing non-whitelisted %s request", h->name); 181 return 0; 182 } 183 return 1; 184 } 185 186 static int 187 errno_to_portable(int unixerrno) 188 { 189 int ret = 0; 190 191 switch (unixerrno) { 192 case 0: 193 ret = SSH2_FX_OK; 194 break; 195 case ENOENT: 196 case ENOTDIR: 197 case EBADF: 198 case ELOOP: 199 ret = SSH2_FX_NO_SUCH_FILE; 200 break; 201 case EPERM: 202 case EACCES: 203 case EFAULT: 204 ret = SSH2_FX_PERMISSION_DENIED; 205 break; 206 case ENAMETOOLONG: 207 case EINVAL: 208 ret = SSH2_FX_BAD_MESSAGE; 209 break; 210 case ENOSYS: 211 ret = SSH2_FX_OP_UNSUPPORTED; 212 break; 213 default: 214 ret = SSH2_FX_FAILURE; 215 break; 216 } 217 return ret; 218 } 219 220 static int 221 flags_from_portable(int pflags) 222 { 223 int flags = 0; 224 225 if ((pflags & SSH2_FXF_READ) && 226 (pflags & SSH2_FXF_WRITE)) { 227 flags = O_RDWR; 228 } else if (pflags & SSH2_FXF_READ) { 229 flags = O_RDONLY; 230 } else if (pflags & SSH2_FXF_WRITE) { 231 flags = O_WRONLY; 232 } 233 if (pflags & SSH2_FXF_APPEND) 234 flags |= O_APPEND; 235 if (pflags & SSH2_FXF_CREAT) 236 flags |= O_CREAT; 237 if (pflags & SSH2_FXF_TRUNC) 238 flags |= O_TRUNC; 239 if (pflags & SSH2_FXF_EXCL) 240 flags |= O_EXCL; 241 return flags; 242 } 243 244 static const char * 245 string_from_portable(int pflags) 246 { 247 static char ret[128]; 248 249 *ret = '\0'; 250 251 #define PAPPEND(str) { \ 252 if (*ret != '\0') \ 253 strlcat(ret, ",", sizeof(ret)); \ 254 strlcat(ret, str, sizeof(ret)); \ 255 } 256 257 if (pflags & SSH2_FXF_READ) 258 PAPPEND("READ") 259 if (pflags & SSH2_FXF_WRITE) 260 PAPPEND("WRITE") 261 if (pflags & SSH2_FXF_APPEND) 262 PAPPEND("APPEND") 263 if (pflags & SSH2_FXF_CREAT) 264 PAPPEND("CREATE") 265 if (pflags & SSH2_FXF_TRUNC) 266 PAPPEND("TRUNCATE") 267 if (pflags & SSH2_FXF_EXCL) 268 PAPPEND("EXCL") 269 270 return ret; 271 } 272 273 /* handle handles */ 274 275 typedef struct Handle Handle; 276 struct Handle { 277 int use; 278 DIR *dirp; 279 int fd; 280 int flags; 281 char *name; 282 u_int64_t bytes_read, bytes_write; 283 int next_unused; 284 }; 285 286 enum { 287 HANDLE_UNUSED, 288 HANDLE_DIR, 289 HANDLE_FILE 290 }; 291 292 static Handle *handles = NULL; 293 static u_int num_handles = 0; 294 static int first_unused_handle = -1; 295 296 static void handle_unused(int i) 297 { 298 handles[i].use = HANDLE_UNUSED; 299 handles[i].next_unused = first_unused_handle; 300 first_unused_handle = i; 301 } 302 303 static int 304 handle_new(int use, const char *name, int fd, int flags, DIR *dirp) 305 { 306 int i; 307 308 if (first_unused_handle == -1) { 309 if (num_handles + 1 <= num_handles) 310 return -1; 311 num_handles++; 312 handles = xreallocarray(handles, num_handles, sizeof(Handle)); 313 handle_unused(num_handles - 1); 314 } 315 316 i = first_unused_handle; 317 first_unused_handle = handles[i].next_unused; 318 319 handles[i].use = use; 320 handles[i].dirp = dirp; 321 handles[i].fd = fd; 322 handles[i].flags = flags; 323 handles[i].name = xstrdup(name); 324 handles[i].bytes_read = handles[i].bytes_write = 0; 325 326 return i; 327 } 328 329 static int 330 handle_is_ok(int i, int type) 331 { 332 return i >= 0 && (u_int)i < num_handles && handles[i].use == type; 333 } 334 335 static int 336 handle_to_string(int handle, u_char **stringp, int *hlenp) 337 { 338 if (stringp == NULL || hlenp == NULL) 339 return -1; 340 *stringp = xmalloc(sizeof(int32_t)); 341 put_u32(*stringp, handle); 342 *hlenp = sizeof(int32_t); 343 return 0; 344 } 345 346 static int 347 handle_from_string(const u_char *handle, u_int hlen) 348 { 349 int val; 350 351 if (hlen != sizeof(int32_t)) 352 return -1; 353 val = get_u32(handle); 354 if (handle_is_ok(val, HANDLE_FILE) || 355 handle_is_ok(val, HANDLE_DIR)) 356 return val; 357 return -1; 358 } 359 360 static char * 361 handle_to_name(int handle) 362 { 363 if (handle_is_ok(handle, HANDLE_DIR)|| 364 handle_is_ok(handle, HANDLE_FILE)) 365 return handles[handle].name; 366 return NULL; 367 } 368 369 static DIR * 370 handle_to_dir(int handle) 371 { 372 if (handle_is_ok(handle, HANDLE_DIR)) 373 return handles[handle].dirp; 374 return NULL; 375 } 376 377 static int 378 handle_to_fd(int handle) 379 { 380 if (handle_is_ok(handle, HANDLE_FILE)) 381 return handles[handle].fd; 382 return -1; 383 } 384 385 static int 386 handle_to_flags(int handle) 387 { 388 if (handle_is_ok(handle, HANDLE_FILE)) 389 return handles[handle].flags; 390 return 0; 391 } 392 393 static void 394 handle_update_read(int handle, ssize_t bytes) 395 { 396 if (handle_is_ok(handle, HANDLE_FILE) && bytes > 0) 397 handles[handle].bytes_read += bytes; 398 } 399 400 static void 401 handle_update_write(int handle, ssize_t bytes) 402 { 403 if (handle_is_ok(handle, HANDLE_FILE) && bytes > 0) 404 handles[handle].bytes_write += bytes; 405 } 406 407 static u_int64_t 408 handle_bytes_read(int handle) 409 { 410 if (handle_is_ok(handle, HANDLE_FILE)) 411 return (handles[handle].bytes_read); 412 return 0; 413 } 414 415 static u_int64_t 416 handle_bytes_write(int handle) 417 { 418 if (handle_is_ok(handle, HANDLE_FILE)) 419 return (handles[handle].bytes_write); 420 return 0; 421 } 422 423 static int 424 handle_close(int handle) 425 { 426 int ret = -1; 427 428 if (handle_is_ok(handle, HANDLE_FILE)) { 429 ret = close(handles[handle].fd); 430 free(handles[handle].name); 431 handle_unused(handle); 432 } else if (handle_is_ok(handle, HANDLE_DIR)) { 433 ret = closedir(handles[handle].dirp); 434 free(handles[handle].name); 435 handle_unused(handle); 436 } else { 437 errno = ENOENT; 438 } 439 return ret; 440 } 441 442 static void 443 handle_log_close(int handle, char *emsg) 444 { 445 if (handle_is_ok(handle, HANDLE_FILE)) { 446 logit("%s%sclose \"%s\" bytes read %llu written %llu", 447 emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ", 448 handle_to_name(handle), 449 (unsigned long long)handle_bytes_read(handle), 450 (unsigned long long)handle_bytes_write(handle)); 451 } else { 452 logit("%s%sclosedir \"%s\"", 453 emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ", 454 handle_to_name(handle)); 455 } 456 } 457 458 static void 459 handle_log_exit(void) 460 { 461 u_int i; 462 463 for (i = 0; i < num_handles; i++) 464 if (handles[i].use != HANDLE_UNUSED) 465 handle_log_close(i, "forced"); 466 } 467 468 static int 469 get_handle(struct sshbuf *queue, int *hp) 470 { 471 u_char *handle; 472 int r; 473 size_t hlen; 474 475 *hp = -1; 476 if ((r = sshbuf_get_string(queue, &handle, &hlen)) != 0) 477 return r; 478 if (hlen < 256) 479 *hp = handle_from_string(handle, hlen); 480 free(handle); 481 return 0; 482 } 483 484 /* send replies */ 485 486 static void 487 send_msg(struct sshbuf *m) 488 { 489 int r; 490 491 if ((r = sshbuf_put_stringb(oqueue, m)) != 0) 492 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 493 sshbuf_reset(m); 494 } 495 496 static const char * 497 status_to_message(u_int32_t status) 498 { 499 const char *status_messages[] = { 500 "Success", /* SSH_FX_OK */ 501 "End of file", /* SSH_FX_EOF */ 502 "No such file", /* SSH_FX_NO_SUCH_FILE */ 503 "Permission denied", /* SSH_FX_PERMISSION_DENIED */ 504 "Failure", /* SSH_FX_FAILURE */ 505 "Bad message", /* SSH_FX_BAD_MESSAGE */ 506 "No connection", /* SSH_FX_NO_CONNECTION */ 507 "Connection lost", /* SSH_FX_CONNECTION_LOST */ 508 "Operation unsupported", /* SSH_FX_OP_UNSUPPORTED */ 509 "Unknown error" /* Others */ 510 }; 511 return (status_messages[MINIMUM(status,SSH2_FX_MAX)]); 512 } 513 514 static void 515 send_status(u_int32_t id, u_int32_t status) 516 { 517 struct sshbuf *msg; 518 int r; 519 520 debug3("request %u: sent status %u", id, status); 521 if (log_level > SYSLOG_LEVEL_VERBOSE || 522 (status != SSH2_FX_OK && status != SSH2_FX_EOF)) 523 logit("sent status %s", status_to_message(status)); 524 if ((msg = sshbuf_new()) == NULL) 525 fatal("%s: sshbuf_new failed", __func__); 526 if ((r = sshbuf_put_u8(msg, SSH2_FXP_STATUS)) != 0 || 527 (r = sshbuf_put_u32(msg, id)) != 0 || 528 (r = sshbuf_put_u32(msg, status)) != 0) 529 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 530 if (version >= 3) { 531 if ((r = sshbuf_put_cstring(msg, 532 status_to_message(status))) != 0 || 533 (r = sshbuf_put_cstring(msg, "")) != 0) 534 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 535 } 536 send_msg(msg); 537 sshbuf_free(msg); 538 } 539 static void 540 send_data_or_handle(char type, u_int32_t id, const u_char *data, int dlen) 541 { 542 struct sshbuf *msg; 543 int r; 544 545 if ((msg = sshbuf_new()) == NULL) 546 fatal("%s: sshbuf_new failed", __func__); 547 if ((r = sshbuf_put_u8(msg, type)) != 0 || 548 (r = sshbuf_put_u32(msg, id)) != 0 || 549 (r = sshbuf_put_string(msg, data, dlen)) != 0) 550 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 551 send_msg(msg); 552 sshbuf_free(msg); 553 } 554 555 static void 556 send_data(u_int32_t id, const u_char *data, int dlen) 557 { 558 debug("request %u: sent data len %d", id, dlen); 559 send_data_or_handle(SSH2_FXP_DATA, id, data, dlen); 560 } 561 562 static void 563 send_handle(u_int32_t id, int handle) 564 { 565 u_char *string; 566 int hlen; 567 568 handle_to_string(handle, &string, &hlen); 569 debug("request %u: sent handle handle %d", id, handle); 570 send_data_or_handle(SSH2_FXP_HANDLE, id, string, hlen); 571 free(string); 572 } 573 574 static void 575 send_names(u_int32_t id, int count, const Stat *stats) 576 { 577 struct sshbuf *msg; 578 int i, r; 579 580 if ((msg = sshbuf_new()) == NULL) 581 fatal("%s: sshbuf_new failed", __func__); 582 if ((r = sshbuf_put_u8(msg, SSH2_FXP_NAME)) != 0 || 583 (r = sshbuf_put_u32(msg, id)) != 0 || 584 (r = sshbuf_put_u32(msg, count)) != 0) 585 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 586 debug("request %u: sent names count %d", id, count); 587 for (i = 0; i < count; i++) { 588 if ((r = sshbuf_put_cstring(msg, stats[i].name)) != 0 || 589 (r = sshbuf_put_cstring(msg, stats[i].long_name)) != 0 || 590 (r = encode_attrib(msg, &stats[i].attrib)) != 0) 591 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 592 } 593 send_msg(msg); 594 sshbuf_free(msg); 595 } 596 597 static void 598 send_attrib(u_int32_t id, const Attrib *a) 599 { 600 struct sshbuf *msg; 601 int r; 602 603 debug("request %u: sent attrib have 0x%x", id, a->flags); 604 if ((msg = sshbuf_new()) == NULL) 605 fatal("%s: sshbuf_new failed", __func__); 606 if ((r = sshbuf_put_u8(msg, SSH2_FXP_ATTRS)) != 0 || 607 (r = sshbuf_put_u32(msg, id)) != 0 || 608 (r = encode_attrib(msg, a)) != 0) 609 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 610 send_msg(msg); 611 sshbuf_free(msg); 612 } 613 614 static void 615 send_statvfs(u_int32_t id, struct statvfs *st) 616 { 617 struct sshbuf *msg; 618 u_int64_t flag; 619 int r; 620 621 flag = (st->f_flag & ST_RDONLY) ? SSH2_FXE_STATVFS_ST_RDONLY : 0; 622 flag |= (st->f_flag & ST_NOSUID) ? SSH2_FXE_STATVFS_ST_NOSUID : 0; 623 624 if ((msg = sshbuf_new()) == NULL) 625 fatal("%s: sshbuf_new failed", __func__); 626 if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED_REPLY)) != 0 || 627 (r = sshbuf_put_u32(msg, id)) != 0 || 628 (r = sshbuf_put_u64(msg, st->f_bsize)) != 0 || 629 (r = sshbuf_put_u64(msg, st->f_frsize)) != 0 || 630 (r = sshbuf_put_u64(msg, st->f_blocks)) != 0 || 631 (r = sshbuf_put_u64(msg, st->f_bfree)) != 0 || 632 (r = sshbuf_put_u64(msg, st->f_bavail)) != 0 || 633 (r = sshbuf_put_u64(msg, st->f_files)) != 0 || 634 (r = sshbuf_put_u64(msg, st->f_ffree)) != 0 || 635 (r = sshbuf_put_u64(msg, st->f_favail)) != 0 || 636 (r = sshbuf_put_u64(msg, FSID_TO_ULONG(st->f_fsid))) != 0 || 637 (r = sshbuf_put_u64(msg, flag)) != 0 || 638 (r = sshbuf_put_u64(msg, st->f_namemax)) != 0) 639 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 640 send_msg(msg); 641 sshbuf_free(msg); 642 } 643 644 /* parse incoming */ 645 646 static void 647 process_init(void) 648 { 649 struct sshbuf *msg; 650 int r; 651 652 if ((r = sshbuf_get_u32(iqueue, &version)) != 0) 653 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 654 verbose("received client version %u", version); 655 if ((msg = sshbuf_new()) == NULL) 656 fatal("%s: sshbuf_new failed", __func__); 657 if ((r = sshbuf_put_u8(msg, SSH2_FXP_VERSION)) != 0 || 658 (r = sshbuf_put_u32(msg, SSH2_FILEXFER_VERSION)) != 0 || 659 /* POSIX rename extension */ 660 (r = sshbuf_put_cstring(msg, "posix-rename@openssh.com")) != 0 || 661 (r = sshbuf_put_cstring(msg, "1")) != 0 || /* version */ 662 /* statvfs extension */ 663 (r = sshbuf_put_cstring(msg, "statvfs@openssh.com")) != 0 || 664 (r = sshbuf_put_cstring(msg, "2")) != 0 || /* version */ 665 /* fstatvfs extension */ 666 (r = sshbuf_put_cstring(msg, "fstatvfs@openssh.com")) != 0 || 667 (r = sshbuf_put_cstring(msg, "2")) != 0 || /* version */ 668 /* hardlink extension */ 669 (r = sshbuf_put_cstring(msg, "hardlink@openssh.com")) != 0 || 670 (r = sshbuf_put_cstring(msg, "1")) != 0 || /* version */ 671 /* fsync extension */ 672 (r = sshbuf_put_cstring(msg, "fsync@openssh.com")) != 0 || 673 (r = sshbuf_put_cstring(msg, "1")) != 0 || /* version */ 674 (r = sshbuf_put_cstring(msg, "lsetstat@openssh.com")) != 0 || 675 (r = sshbuf_put_cstring(msg, "1")) != 0) /* version */ 676 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 677 send_msg(msg); 678 sshbuf_free(msg); 679 } 680 681 static void 682 process_open(u_int32_t id) 683 { 684 u_int32_t pflags; 685 Attrib a; 686 char *name; 687 int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE; 688 689 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || 690 (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */ 691 (r = decode_attrib(iqueue, &a)) != 0) 692 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 693 694 debug3("request %u: open flags %d", id, pflags); 695 flags = flags_from_portable(pflags); 696 mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666; 697 logit("open \"%s\" flags %s mode 0%o", 698 name, string_from_portable(pflags), mode); 699 if (readonly && 700 ((flags & O_ACCMODE) != O_RDONLY || 701 (flags & (O_CREAT|O_TRUNC)) != 0)) { 702 verbose("Refusing open request in read-only mode"); 703 status = SSH2_FX_PERMISSION_DENIED; 704 } else { 705 fd = open(name, flags, mode); 706 if (fd == -1) { 707 status = errno_to_portable(errno); 708 } else { 709 handle = handle_new(HANDLE_FILE, name, fd, flags, NULL); 710 if (handle < 0) { 711 close(fd); 712 } else { 713 send_handle(id, handle); 714 status = SSH2_FX_OK; 715 } 716 } 717 } 718 if (status != SSH2_FX_OK) 719 send_status(id, status); 720 free(name); 721 } 722 723 static void 724 process_close(u_int32_t id) 725 { 726 int r, handle, ret, status = SSH2_FX_FAILURE; 727 728 if ((r = get_handle(iqueue, &handle)) != 0) 729 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 730 731 debug3("request %u: close handle %u", id, handle); 732 handle_log_close(handle, NULL); 733 ret = handle_close(handle); 734 status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK; 735 send_status(id, status); 736 } 737 738 static void 739 process_read(u_int32_t id) 740 { 741 u_char buf[64*1024]; 742 u_int32_t len; 743 int r, handle, fd, ret, status = SSH2_FX_FAILURE; 744 u_int64_t off; 745 746 if ((r = get_handle(iqueue, &handle)) != 0 || 747 (r = sshbuf_get_u64(iqueue, &off)) != 0 || 748 (r = sshbuf_get_u32(iqueue, &len)) != 0) 749 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 750 751 debug("request %u: read \"%s\" (handle %d) off %llu len %d", 752 id, handle_to_name(handle), handle, (unsigned long long)off, len); 753 if (len > sizeof buf) { 754 len = sizeof buf; 755 debug2("read change len %d", len); 756 } 757 fd = handle_to_fd(handle); 758 if (fd >= 0) { 759 if (lseek(fd, off, SEEK_SET) == -1) { 760 error("process_read: seek failed"); 761 status = errno_to_portable(errno); 762 } else { 763 ret = read(fd, buf, len); 764 if (ret == -1) { 765 status = errno_to_portable(errno); 766 } else if (ret == 0) { 767 status = SSH2_FX_EOF; 768 } else { 769 send_data(id, buf, ret); 770 status = SSH2_FX_OK; 771 handle_update_read(handle, ret); 772 } 773 } 774 } 775 if (status != SSH2_FX_OK) 776 send_status(id, status); 777 } 778 779 static void 780 process_write(u_int32_t id) 781 { 782 u_int64_t off; 783 size_t len; 784 int r, handle, fd, ret, status; 785 u_char *data; 786 787 if ((r = get_handle(iqueue, &handle)) != 0 || 788 (r = sshbuf_get_u64(iqueue, &off)) != 0 || 789 (r = sshbuf_get_string(iqueue, &data, &len)) != 0) 790 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 791 792 debug("request %u: write \"%s\" (handle %d) off %llu len %zu", 793 id, handle_to_name(handle), handle, (unsigned long long)off, len); 794 fd = handle_to_fd(handle); 795 796 if (fd < 0) 797 status = SSH2_FX_FAILURE; 798 else { 799 if (!(handle_to_flags(handle) & O_APPEND) && 800 lseek(fd, off, SEEK_SET) == -1) { 801 status = errno_to_portable(errno); 802 error("process_write: seek failed"); 803 } else { 804 /* XXX ATOMICIO ? */ 805 ret = write(fd, data, len); 806 if (ret == -1) { 807 error("process_write: write failed"); 808 status = errno_to_portable(errno); 809 } else if ((size_t)ret == len) { 810 status = SSH2_FX_OK; 811 handle_update_write(handle, ret); 812 } else { 813 debug2("nothing at all written"); 814 status = SSH2_FX_FAILURE; 815 } 816 } 817 } 818 send_status(id, status); 819 free(data); 820 } 821 822 static void 823 process_do_stat(u_int32_t id, int do_lstat) 824 { 825 Attrib a; 826 struct stat st; 827 char *name; 828 int r, status = SSH2_FX_FAILURE; 829 830 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0) 831 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 832 833 debug3("request %u: %sstat", id, do_lstat ? "l" : ""); 834 verbose("%sstat name \"%s\"", do_lstat ? "l" : "", name); 835 r = do_lstat ? lstat(name, &st) : stat(name, &st); 836 if (r == -1) { 837 status = errno_to_portable(errno); 838 } else { 839 stat_to_attrib(&st, &a); 840 send_attrib(id, &a); 841 status = SSH2_FX_OK; 842 } 843 if (status != SSH2_FX_OK) 844 send_status(id, status); 845 free(name); 846 } 847 848 static void 849 process_stat(u_int32_t id) 850 { 851 process_do_stat(id, 0); 852 } 853 854 static void 855 process_lstat(u_int32_t id) 856 { 857 process_do_stat(id, 1); 858 } 859 860 static void 861 process_fstat(u_int32_t id) 862 { 863 Attrib a; 864 struct stat st; 865 int fd, r, handle, status = SSH2_FX_FAILURE; 866 867 if ((r = get_handle(iqueue, &handle)) != 0) 868 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 869 debug("request %u: fstat \"%s\" (handle %u)", 870 id, handle_to_name(handle), handle); 871 fd = handle_to_fd(handle); 872 if (fd >= 0) { 873 r = fstat(fd, &st); 874 if (r == -1) { 875 status = errno_to_portable(errno); 876 } else { 877 stat_to_attrib(&st, &a); 878 send_attrib(id, &a); 879 status = SSH2_FX_OK; 880 } 881 } 882 if (status != SSH2_FX_OK) 883 send_status(id, status); 884 } 885 886 static struct timeval * 887 attrib_to_tv(const Attrib *a) 888 { 889 static struct timeval tv[2]; 890 891 tv[0].tv_sec = a->atime; 892 tv[0].tv_usec = 0; 893 tv[1].tv_sec = a->mtime; 894 tv[1].tv_usec = 0; 895 return tv; 896 } 897 898 static struct timespec * 899 attrib_to_ts(const Attrib *a) 900 { 901 static struct timespec ts[2]; 902 903 ts[0].tv_sec = a->atime; 904 ts[0].tv_nsec = 0; 905 ts[1].tv_sec = a->mtime; 906 ts[1].tv_nsec = 0; 907 return ts; 908 } 909 910 static void 911 process_setstat(u_int32_t id) 912 { 913 Attrib a; 914 char *name; 915 int r, status = SSH2_FX_OK; 916 917 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || 918 (r = decode_attrib(iqueue, &a)) != 0) 919 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 920 921 debug("request %u: setstat name \"%s\"", id, name); 922 if (a.flags & SSH2_FILEXFER_ATTR_SIZE) { 923 logit("set \"%s\" size %llu", 924 name, (unsigned long long)a.size); 925 r = truncate(name, a.size); 926 if (r == -1) 927 status = errno_to_portable(errno); 928 } 929 if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { 930 logit("set \"%s\" mode %04o", name, a.perm); 931 r = chmod(name, a.perm & 07777); 932 if (r == -1) 933 status = errno_to_portable(errno); 934 } 935 if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) { 936 char buf[64]; 937 time_t t = a.mtime; 938 939 strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S", 940 localtime(&t)); 941 logit("set \"%s\" modtime %s", name, buf); 942 r = utimes(name, attrib_to_tv(&a)); 943 if (r == -1) 944 status = errno_to_portable(errno); 945 } 946 if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) { 947 logit("set \"%s\" owner %lu group %lu", name, 948 (u_long)a.uid, (u_long)a.gid); 949 r = chown(name, a.uid, a.gid); 950 if (r == -1) 951 status = errno_to_portable(errno); 952 } 953 send_status(id, status); 954 free(name); 955 } 956 957 static void 958 process_fsetstat(u_int32_t id) 959 { 960 Attrib a; 961 int handle, fd, r; 962 int status = SSH2_FX_OK; 963 964 if ((r = get_handle(iqueue, &handle)) != 0 || 965 (r = decode_attrib(iqueue, &a)) != 0) 966 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 967 968 debug("request %u: fsetstat handle %d", id, handle); 969 fd = handle_to_fd(handle); 970 if (fd < 0) 971 status = SSH2_FX_FAILURE; 972 else { 973 char *name = handle_to_name(handle); 974 975 if (a.flags & SSH2_FILEXFER_ATTR_SIZE) { 976 logit("set \"%s\" size %llu", 977 name, (unsigned long long)a.size); 978 r = ftruncate(fd, a.size); 979 if (r == -1) 980 status = errno_to_portable(errno); 981 } 982 if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { 983 logit("set \"%s\" mode %04o", name, a.perm); 984 #ifdef HAVE_FCHMOD 985 r = fchmod(fd, a.perm & 07777); 986 #else 987 r = chmod(name, a.perm & 07777); 988 #endif 989 if (r == -1) 990 status = errno_to_portable(errno); 991 } 992 if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) { 993 char buf[64]; 994 time_t t = a.mtime; 995 996 strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S", 997 localtime(&t)); 998 logit("set \"%s\" modtime %s", name, buf); 999 #ifdef HAVE_FUTIMES 1000 r = futimes(fd, attrib_to_tv(&a)); 1001 #else 1002 r = utimes(name, attrib_to_tv(&a)); 1003 #endif 1004 if (r == -1) 1005 status = errno_to_portable(errno); 1006 } 1007 if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) { 1008 logit("set \"%s\" owner %lu group %lu", name, 1009 (u_long)a.uid, (u_long)a.gid); 1010 #ifdef HAVE_FCHOWN 1011 r = fchown(fd, a.uid, a.gid); 1012 #else 1013 r = chown(name, a.uid, a.gid); 1014 #endif 1015 if (r == -1) 1016 status = errno_to_portable(errno); 1017 } 1018 } 1019 send_status(id, status); 1020 } 1021 1022 static void 1023 process_opendir(u_int32_t id) 1024 { 1025 DIR *dirp = NULL; 1026 char *path; 1027 int r, handle, status = SSH2_FX_FAILURE; 1028 1029 if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) 1030 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1031 1032 debug3("request %u: opendir", id); 1033 logit("opendir \"%s\"", path); 1034 dirp = opendir(path); 1035 if (dirp == NULL) { 1036 status = errno_to_portable(errno); 1037 } else { 1038 handle = handle_new(HANDLE_DIR, path, 0, 0, dirp); 1039 if (handle < 0) { 1040 closedir(dirp); 1041 } else { 1042 send_handle(id, handle); 1043 status = SSH2_FX_OK; 1044 } 1045 1046 } 1047 if (status != SSH2_FX_OK) 1048 send_status(id, status); 1049 free(path); 1050 } 1051 1052 static void 1053 process_readdir(u_int32_t id) 1054 { 1055 DIR *dirp; 1056 struct dirent *dp; 1057 char *path; 1058 int r, handle; 1059 1060 if ((r = get_handle(iqueue, &handle)) != 0) 1061 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1062 1063 debug("request %u: readdir \"%s\" (handle %d)", id, 1064 handle_to_name(handle), handle); 1065 dirp = handle_to_dir(handle); 1066 path = handle_to_name(handle); 1067 if (dirp == NULL || path == NULL) { 1068 send_status(id, SSH2_FX_FAILURE); 1069 } else { 1070 struct stat st; 1071 char pathname[PATH_MAX]; 1072 Stat *stats; 1073 int nstats = 10, count = 0, i; 1074 1075 stats = xcalloc(nstats, sizeof(Stat)); 1076 while ((dp = readdir(dirp)) != NULL) { 1077 if (count >= nstats) { 1078 nstats *= 2; 1079 stats = xreallocarray(stats, nstats, sizeof(Stat)); 1080 } 1081 /* XXX OVERFLOW ? */ 1082 snprintf(pathname, sizeof pathname, "%s%s%s", path, 1083 strcmp(path, "/") ? "/" : "", dp->d_name); 1084 if (lstat(pathname, &st) == -1) 1085 continue; 1086 stat_to_attrib(&st, &(stats[count].attrib)); 1087 stats[count].name = xstrdup(dp->d_name); 1088 stats[count].long_name = ls_file(dp->d_name, &st, 0, 0); 1089 count++; 1090 /* send up to 100 entries in one message */ 1091 /* XXX check packet size instead */ 1092 if (count == 100) 1093 break; 1094 } 1095 if (count > 0) { 1096 send_names(id, count, stats); 1097 for (i = 0; i < count; i++) { 1098 free(stats[i].name); 1099 free(stats[i].long_name); 1100 } 1101 } else { 1102 send_status(id, SSH2_FX_EOF); 1103 } 1104 free(stats); 1105 } 1106 } 1107 1108 static void 1109 process_remove(u_int32_t id) 1110 { 1111 char *name; 1112 int r, status = SSH2_FX_FAILURE; 1113 1114 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0) 1115 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1116 1117 debug3("request %u: remove", id); 1118 logit("remove name \"%s\"", name); 1119 r = unlink(name); 1120 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; 1121 send_status(id, status); 1122 free(name); 1123 } 1124 1125 static void 1126 process_mkdir(u_int32_t id) 1127 { 1128 Attrib a; 1129 char *name; 1130 int r, mode, status = SSH2_FX_FAILURE; 1131 1132 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || 1133 (r = decode_attrib(iqueue, &a)) != 0) 1134 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1135 1136 mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? 1137 a.perm & 07777 : 0777; 1138 debug3("request %u: mkdir", id); 1139 logit("mkdir name \"%s\" mode 0%o", name, mode); 1140 r = mkdir(name, mode); 1141 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; 1142 send_status(id, status); 1143 free(name); 1144 } 1145 1146 static void 1147 process_rmdir(u_int32_t id) 1148 { 1149 char *name; 1150 int r, status; 1151 1152 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0) 1153 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1154 1155 debug3("request %u: rmdir", id); 1156 logit("rmdir name \"%s\"", name); 1157 r = rmdir(name); 1158 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; 1159 send_status(id, status); 1160 free(name); 1161 } 1162 1163 static void 1164 process_realpath(u_int32_t id) 1165 { 1166 char resolvedname[PATH_MAX]; 1167 char *path; 1168 int r; 1169 1170 if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) 1171 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1172 1173 if (path[0] == '\0') { 1174 free(path); 1175 path = xstrdup("."); 1176 } 1177 debug3("request %u: realpath", id); 1178 verbose("realpath \"%s\"", path); 1179 if (sftp_realpath(path, resolvedname) == NULL) { 1180 send_status(id, errno_to_portable(errno)); 1181 } else { 1182 Stat s; 1183 attrib_clear(&s.attrib); 1184 s.name = s.long_name = resolvedname; 1185 send_names(id, 1, &s); 1186 } 1187 free(path); 1188 } 1189 1190 static void 1191 process_rename(u_int32_t id) 1192 { 1193 char *oldpath, *newpath; 1194 int r, status; 1195 struct stat sb; 1196 1197 if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 || 1198 (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0) 1199 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1200 1201 debug3("request %u: rename", id); 1202 logit("rename old \"%s\" new \"%s\"", oldpath, newpath); 1203 status = SSH2_FX_FAILURE; 1204 if (lstat(oldpath, &sb) == -1) 1205 status = errno_to_portable(errno); 1206 else if (S_ISREG(sb.st_mode)) { 1207 /* Race-free rename of regular files */ 1208 if (link(oldpath, newpath) == -1) { 1209 if (errno == EOPNOTSUPP || errno == ENOSYS 1210 #ifdef EXDEV 1211 || errno == EXDEV 1212 #endif 1213 #ifdef LINK_OPNOTSUPP_ERRNO 1214 || errno == LINK_OPNOTSUPP_ERRNO 1215 #endif 1216 ) { 1217 struct stat st; 1218 1219 /* 1220 * fs doesn't support links, so fall back to 1221 * stat+rename. This is racy. 1222 */ 1223 if (stat(newpath, &st) == -1) { 1224 if (rename(oldpath, newpath) == -1) 1225 status = 1226 errno_to_portable(errno); 1227 else 1228 status = SSH2_FX_OK; 1229 } 1230 } else { 1231 status = errno_to_portable(errno); 1232 } 1233 } else if (unlink(oldpath) == -1) { 1234 status = errno_to_portable(errno); 1235 /* clean spare link */ 1236 unlink(newpath); 1237 } else 1238 status = SSH2_FX_OK; 1239 } else if (stat(newpath, &sb) == -1) { 1240 if (rename(oldpath, newpath) == -1) 1241 status = errno_to_portable(errno); 1242 else 1243 status = SSH2_FX_OK; 1244 } 1245 send_status(id, status); 1246 free(oldpath); 1247 free(newpath); 1248 } 1249 1250 static void 1251 process_readlink(u_int32_t id) 1252 { 1253 int r, len; 1254 char buf[PATH_MAX]; 1255 char *path; 1256 1257 if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) 1258 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1259 1260 debug3("request %u: readlink", id); 1261 verbose("readlink \"%s\"", path); 1262 if ((len = readlink(path, buf, sizeof(buf) - 1)) == -1) 1263 send_status(id, errno_to_portable(errno)); 1264 else { 1265 Stat s; 1266 1267 buf[len] = '\0'; 1268 attrib_clear(&s.attrib); 1269 s.name = s.long_name = buf; 1270 send_names(id, 1, &s); 1271 } 1272 free(path); 1273 } 1274 1275 static void 1276 process_symlink(u_int32_t id) 1277 { 1278 char *oldpath, *newpath; 1279 int r, status; 1280 1281 if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 || 1282 (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0) 1283 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1284 1285 debug3("request %u: symlink", id); 1286 logit("symlink old \"%s\" new \"%s\"", oldpath, newpath); 1287 /* this will fail if 'newpath' exists */ 1288 r = symlink(oldpath, newpath); 1289 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; 1290 send_status(id, status); 1291 free(oldpath); 1292 free(newpath); 1293 } 1294 1295 static void 1296 process_extended_posix_rename(u_int32_t id) 1297 { 1298 char *oldpath, *newpath; 1299 int r, status; 1300 1301 if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 || 1302 (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0) 1303 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1304 1305 debug3("request %u: posix-rename", id); 1306 logit("posix-rename old \"%s\" new \"%s\"", oldpath, newpath); 1307 r = rename(oldpath, newpath); 1308 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; 1309 send_status(id, status); 1310 free(oldpath); 1311 free(newpath); 1312 } 1313 1314 static void 1315 process_extended_statvfs(u_int32_t id) 1316 { 1317 char *path; 1318 struct statvfs st; 1319 int r; 1320 1321 if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0) 1322 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1323 debug3("request %u: statvfs", id); 1324 logit("statvfs \"%s\"", path); 1325 1326 if (statvfs(path, &st) != 0) 1327 send_status(id, errno_to_portable(errno)); 1328 else 1329 send_statvfs(id, &st); 1330 free(path); 1331 } 1332 1333 static void 1334 process_extended_fstatvfs(u_int32_t id) 1335 { 1336 int r, handle, fd; 1337 struct statvfs st; 1338 1339 if ((r = get_handle(iqueue, &handle)) != 0) 1340 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1341 debug("request %u: fstatvfs \"%s\" (handle %u)", 1342 id, handle_to_name(handle), handle); 1343 if ((fd = handle_to_fd(handle)) < 0) { 1344 send_status(id, SSH2_FX_FAILURE); 1345 return; 1346 } 1347 if (fstatvfs(fd, &st) != 0) 1348 send_status(id, errno_to_portable(errno)); 1349 else 1350 send_statvfs(id, &st); 1351 } 1352 1353 static void 1354 process_extended_hardlink(u_int32_t id) 1355 { 1356 char *oldpath, *newpath; 1357 int r, status; 1358 1359 if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 || 1360 (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0) 1361 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1362 1363 debug3("request %u: hardlink", id); 1364 logit("hardlink old \"%s\" new \"%s\"", oldpath, newpath); 1365 r = link(oldpath, newpath); 1366 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; 1367 send_status(id, status); 1368 free(oldpath); 1369 free(newpath); 1370 } 1371 1372 static void 1373 process_extended_fsync(u_int32_t id) 1374 { 1375 int handle, fd, r, status = SSH2_FX_OP_UNSUPPORTED; 1376 1377 if ((r = get_handle(iqueue, &handle)) != 0) 1378 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1379 debug3("request %u: fsync (handle %u)", id, handle); 1380 verbose("fsync \"%s\"", handle_to_name(handle)); 1381 if ((fd = handle_to_fd(handle)) < 0) 1382 status = SSH2_FX_NO_SUCH_FILE; 1383 else if (handle_is_ok(handle, HANDLE_FILE)) { 1384 r = fsync(fd); 1385 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; 1386 } 1387 send_status(id, status); 1388 } 1389 1390 static void 1391 process_extended_lsetstat(u_int32_t id) 1392 { 1393 Attrib a; 1394 char *name; 1395 int r, status = SSH2_FX_OK; 1396 1397 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || 1398 (r = decode_attrib(iqueue, &a)) != 0) 1399 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1400 1401 debug("request %u: lsetstat name \"%s\"", id, name); 1402 if (a.flags & SSH2_FILEXFER_ATTR_SIZE) { 1403 /* nonsensical for links */ 1404 status = SSH2_FX_BAD_MESSAGE; 1405 goto out; 1406 } 1407 if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { 1408 logit("set \"%s\" mode %04o", name, a.perm); 1409 r = fchmodat(AT_FDCWD, name, 1410 a.perm & 07777, AT_SYMLINK_NOFOLLOW); 1411 if (r == -1) 1412 status = errno_to_portable(errno); 1413 } 1414 if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) { 1415 char buf[64]; 1416 time_t t = a.mtime; 1417 1418 strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S", 1419 localtime(&t)); 1420 logit("set \"%s\" modtime %s", name, buf); 1421 r = utimensat(AT_FDCWD, name, 1422 attrib_to_ts(&a), AT_SYMLINK_NOFOLLOW); 1423 if (r == -1) 1424 status = errno_to_portable(errno); 1425 } 1426 if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) { 1427 logit("set \"%s\" owner %lu group %lu", name, 1428 (u_long)a.uid, (u_long)a.gid); 1429 r = fchownat(AT_FDCWD, name, a.uid, a.gid, 1430 AT_SYMLINK_NOFOLLOW); 1431 if (r == -1) 1432 status = errno_to_portable(errno); 1433 } 1434 out: 1435 send_status(id, status); 1436 free(name); 1437 } 1438 1439 static void 1440 process_extended(u_int32_t id) 1441 { 1442 char *request; 1443 int i, r; 1444 1445 if ((r = sshbuf_get_cstring(iqueue, &request, NULL)) != 0) 1446 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1447 for (i = 0; extended_handlers[i].handler != NULL; i++) { 1448 if (strcmp(request, extended_handlers[i].ext_name) == 0) { 1449 if (!request_permitted(&extended_handlers[i])) 1450 send_status(id, SSH2_FX_PERMISSION_DENIED); 1451 else 1452 extended_handlers[i].handler(id); 1453 break; 1454 } 1455 } 1456 if (extended_handlers[i].handler == NULL) { 1457 error("Unknown extended request \"%.100s\"", request); 1458 send_status(id, SSH2_FX_OP_UNSUPPORTED); /* MUST */ 1459 } 1460 free(request); 1461 } 1462 1463 /* stolen from ssh-agent */ 1464 1465 static void 1466 process(void) 1467 { 1468 u_int msg_len; 1469 u_int buf_len; 1470 u_int consumed; 1471 u_char type; 1472 const u_char *cp; 1473 int i, r; 1474 u_int32_t id; 1475 1476 buf_len = sshbuf_len(iqueue); 1477 if (buf_len < 5) 1478 return; /* Incomplete message. */ 1479 cp = sshbuf_ptr(iqueue); 1480 msg_len = get_u32(cp); 1481 if (msg_len > SFTP_MAX_MSG_LENGTH) { 1482 error("bad message from %s local user %s", 1483 client_addr, pw->pw_name); 1484 sftp_server_cleanup_exit(11); 1485 } 1486 if (buf_len < msg_len + 4) 1487 return; 1488 if ((r = sshbuf_consume(iqueue, 4)) != 0) 1489 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1490 buf_len -= 4; 1491 if ((r = sshbuf_get_u8(iqueue, &type)) != 0) 1492 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1493 1494 switch (type) { 1495 case SSH2_FXP_INIT: 1496 process_init(); 1497 init_done = 1; 1498 break; 1499 case SSH2_FXP_EXTENDED: 1500 if (!init_done) 1501 fatal("Received extended request before init"); 1502 if ((r = sshbuf_get_u32(iqueue, &id)) != 0) 1503 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1504 process_extended(id); 1505 break; 1506 default: 1507 if (!init_done) 1508 fatal("Received %u request before init", type); 1509 if ((r = sshbuf_get_u32(iqueue, &id)) != 0) 1510 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1511 for (i = 0; handlers[i].handler != NULL; i++) { 1512 if (type == handlers[i].type) { 1513 if (!request_permitted(&handlers[i])) { 1514 send_status(id, 1515 SSH2_FX_PERMISSION_DENIED); 1516 } else { 1517 handlers[i].handler(id); 1518 } 1519 break; 1520 } 1521 } 1522 if (handlers[i].handler == NULL) 1523 error("Unknown message %u", type); 1524 } 1525 /* discard the remaining bytes from the current packet */ 1526 if (buf_len < sshbuf_len(iqueue)) { 1527 error("iqueue grew unexpectedly"); 1528 sftp_server_cleanup_exit(255); 1529 } 1530 consumed = buf_len - sshbuf_len(iqueue); 1531 if (msg_len < consumed) { 1532 error("msg_len %u < consumed %u", msg_len, consumed); 1533 sftp_server_cleanup_exit(255); 1534 } 1535 if (msg_len > consumed && 1536 (r = sshbuf_consume(iqueue, msg_len - consumed)) != 0) 1537 fatal("%s: buffer error: %s", __func__, ssh_err(r)); 1538 } 1539 1540 /* Cleanup handler that logs active handles upon normal exit */ 1541 void 1542 sftp_server_cleanup_exit(int i) 1543 { 1544 if (pw != NULL && client_addr != NULL) { 1545 handle_log_exit(); 1546 logit("session closed for local user %s from [%s]", 1547 pw->pw_name, client_addr); 1548 } 1549 _exit(i); 1550 } 1551 1552 static void 1553 sftp_server_usage(void) 1554 { 1555 extern char *__progname; 1556 1557 fprintf(stderr, 1558 "usage: %s [-ehR] [-d start_directory] [-f log_facility] " 1559 "[-l log_level]\n\t[-P blacklisted_requests] " 1560 "[-p whitelisted_requests] [-u umask]\n" 1561 " %s -Q protocol_feature\n", 1562 __progname, __progname); 1563 exit(1); 1564 } 1565 1566 int 1567 sftp_server_main(int argc, char **argv, struct passwd *user_pw) 1568 { 1569 fd_set *rset, *wset; 1570 int i, r, in, out, max, ch, skipargs = 0, log_stderr = 0; 1571 ssize_t len, olen, set_size; 1572 SyslogFacility log_facility = SYSLOG_FACILITY_AUTH; 1573 char *cp, *homedir = NULL, uidstr[32], buf[4*4096]; 1574 long mask; 1575 1576 extern char *optarg; 1577 extern char *__progname; 1578 1579 __progname = ssh_get_progname(argv[0]); 1580 log_init(__progname, log_level, log_facility, log_stderr); 1581 1582 pw = pwcopy(user_pw); 1583 1584 while (!skipargs && (ch = getopt(argc, argv, 1585 "d:f:l:P:p:Q:u:cehR")) != -1) { 1586 switch (ch) { 1587 case 'Q': 1588 if (strcasecmp(optarg, "requests") != 0) { 1589 fprintf(stderr, "Invalid query type\n"); 1590 exit(1); 1591 } 1592 for (i = 0; handlers[i].handler != NULL; i++) 1593 printf("%s\n", handlers[i].name); 1594 for (i = 0; extended_handlers[i].handler != NULL; i++) 1595 printf("%s\n", extended_handlers[i].name); 1596 exit(0); 1597 break; 1598 case 'R': 1599 readonly = 1; 1600 break; 1601 case 'c': 1602 /* 1603 * Ignore all arguments if we are invoked as a 1604 * shell using "sftp-server -c command" 1605 */ 1606 skipargs = 1; 1607 break; 1608 case 'e': 1609 log_stderr = 1; 1610 break; 1611 case 'l': 1612 log_level = log_level_number(optarg); 1613 if (log_level == SYSLOG_LEVEL_NOT_SET) 1614 error("Invalid log level \"%s\"", optarg); 1615 break; 1616 case 'f': 1617 log_facility = log_facility_number(optarg); 1618 if (log_facility == SYSLOG_FACILITY_NOT_SET) 1619 error("Invalid log facility \"%s\"", optarg); 1620 break; 1621 case 'd': 1622 cp = tilde_expand_filename(optarg, user_pw->pw_uid); 1623 snprintf(uidstr, sizeof(uidstr), "%llu", 1624 (unsigned long long)pw->pw_uid); 1625 homedir = percent_expand(cp, "d", user_pw->pw_dir, 1626 "u", user_pw->pw_name, "U", uidstr, (char *)NULL); 1627 free(cp); 1628 break; 1629 case 'p': 1630 if (request_whitelist != NULL) 1631 fatal("Permitted requests already set"); 1632 request_whitelist = xstrdup(optarg); 1633 break; 1634 case 'P': 1635 if (request_blacklist != NULL) 1636 fatal("Refused requests already set"); 1637 request_blacklist = xstrdup(optarg); 1638 break; 1639 case 'u': 1640 errno = 0; 1641 mask = strtol(optarg, &cp, 8); 1642 if (mask < 0 || mask > 0777 || *cp != '\0' || 1643 cp == optarg || (mask == 0 && errno != 0)) 1644 fatal("Invalid umask \"%s\"", optarg); 1645 (void)umask((mode_t)mask); 1646 break; 1647 case 'h': 1648 default: 1649 sftp_server_usage(); 1650 } 1651 } 1652 1653 log_init(__progname, log_level, log_facility, log_stderr); 1654 1655 /* 1656 * On platforms where we can, avoid making /proc/self/{mem,maps} 1657 * available to the user so that sftp access doesn't automatically 1658 * imply arbitrary code execution access that will break 1659 * restricted configurations. 1660 */ 1661 platform_disable_tracing(1); /* strict */ 1662 1663 /* Drop any fine-grained privileges we don't need */ 1664 platform_pledge_sftp_server(); 1665 1666 if ((cp = getenv("SSH_CONNECTION")) != NULL) { 1667 client_addr = xstrdup(cp); 1668 if ((cp = strchr(client_addr, ' ')) == NULL) { 1669 error("Malformed SSH_CONNECTION variable: \"%s\"", 1670 getenv("SSH_CONNECTION")); 1671 sftp_server_cleanup_exit(255); 1672 } 1673 *cp = '\0'; 1674 } else 1675 client_addr = xstrdup("UNKNOWN"); 1676 1677 logit("session opened for local user %s from [%s]", 1678 pw->pw_name, client_addr); 1679 1680 in = STDIN_FILENO; 1681 out = STDOUT_FILENO; 1682 1683 #ifdef HAVE_CYGWIN 1684 setmode(in, O_BINARY); 1685 setmode(out, O_BINARY); 1686 #endif 1687 1688 max = 0; 1689 if (in > max) 1690 max = in; 1691 if (out > max) 1692 max = out; 1693 1694 if ((iqueue = sshbuf_new()) == NULL) 1695 fatal("%s: sshbuf_new failed", __func__); 1696 if ((oqueue = sshbuf_new()) == NULL) 1697 fatal("%s: sshbuf_new failed", __func__); 1698 1699 rset = xcalloc(howmany(max + 1, NFDBITS), sizeof(fd_mask)); 1700 wset = xcalloc(howmany(max + 1, NFDBITS), sizeof(fd_mask)); 1701 1702 if (homedir != NULL) { 1703 if (chdir(homedir) != 0) { 1704 error("chdir to \"%s\" failed: %s", homedir, 1705 strerror(errno)); 1706 } 1707 } 1708 1709 set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask); 1710 for (;;) { 1711 memset(rset, 0, set_size); 1712 memset(wset, 0, set_size); 1713 1714 /* 1715 * Ensure that we can read a full buffer and handle 1716 * the worst-case length packet it can generate, 1717 * otherwise apply backpressure by stopping reads. 1718 */ 1719 if ((r = sshbuf_check_reserve(iqueue, sizeof(buf))) == 0 && 1720 (r = sshbuf_check_reserve(oqueue, 1721 SFTP_MAX_MSG_LENGTH)) == 0) 1722 FD_SET(in, rset); 1723 else if (r != SSH_ERR_NO_BUFFER_SPACE) 1724 fatal("%s: sshbuf_check_reserve failed: %s", 1725 __func__, ssh_err(r)); 1726 1727 olen = sshbuf_len(oqueue); 1728 if (olen > 0) 1729 FD_SET(out, wset); 1730 1731 if (select(max+1, rset, wset, NULL, NULL) == -1) { 1732 if (errno == EINTR) 1733 continue; 1734 error("select: %s", strerror(errno)); 1735 sftp_server_cleanup_exit(2); 1736 } 1737 1738 /* copy stdin to iqueue */ 1739 if (FD_ISSET(in, rset)) { 1740 len = read(in, buf, sizeof buf); 1741 if (len == 0) { 1742 debug("read eof"); 1743 sftp_server_cleanup_exit(0); 1744 } else if (len == -1) { 1745 error("read: %s", strerror(errno)); 1746 sftp_server_cleanup_exit(1); 1747 } else if ((r = sshbuf_put(iqueue, buf, len)) != 0) { 1748 fatal("%s: buffer error: %s", 1749 __func__, ssh_err(r)); 1750 } 1751 } 1752 /* send oqueue to stdout */ 1753 if (FD_ISSET(out, wset)) { 1754 len = write(out, sshbuf_ptr(oqueue), olen); 1755 if (len == -1) { 1756 error("write: %s", strerror(errno)); 1757 sftp_server_cleanup_exit(1); 1758 } else if ((r = sshbuf_consume(oqueue, len)) != 0) { 1759 fatal("%s: buffer error: %s", 1760 __func__, ssh_err(r)); 1761 } 1762 } 1763 1764 /* 1765 * Process requests from client if we can fit the results 1766 * into the output buffer, otherwise stop processing input 1767 * and let the output queue drain. 1768 */ 1769 r = sshbuf_check_reserve(oqueue, SFTP_MAX_MSG_LENGTH); 1770 if (r == 0) 1771 process(); 1772 else if (r != SSH_ERR_NO_BUFFER_SPACE) 1773 fatal("%s: sshbuf_check_reserve: %s", 1774 __func__, ssh_err(r)); 1775 } 1776 } 1777