1 /*	$NetBSD: sftp-server.c,v 1.4 2010/11/21 18:29:49 adam Exp $	*/
2 /* $OpenBSD: sftp-server.c,v 1.91 2010/01/13 01:40:16 djm Exp $ */
3 /*
4  * Copyright (c) 2000-2004 Markus Friedl.  All rights reserved.
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include "includes.h"
20 __RCSID("$NetBSD: sftp-server.c,v 1.4 2010/11/21 18:29:49 adam Exp $");
21 #include <sys/types.h>
22 #include <sys/stat.h>
23 #include <sys/time.h>
24 #include <sys/param.h>
25 #include <sys/mount.h>
26 #include <sys/statvfs.h>
27 
28 #include <dirent.h>
29 #include <errno.h>
30 #include <fcntl.h>
31 #include <stdlib.h>
32 #include <stdio.h>
33 #include <string.h>
34 #include <pwd.h>
35 #include <time.h>
36 #include <unistd.h>
37 #include <stdarg.h>
38 
39 #include "xmalloc.h"
40 #include "buffer.h"
41 #include "log.h"
42 #include "misc.h"
43 #include "uidswap.h"
44 
45 #include "sftp.h"
46 #include "sftp-common.h"
47 
48 /* helper */
49 #define get_int64()			buffer_get_int64(&iqueue);
50 #define get_int()			buffer_get_int(&iqueue);
51 #define get_string(lenp)		buffer_get_string(&iqueue, lenp);
52 
53 /* Our verbosity */
54 LogLevel log_level = SYSLOG_LEVEL_ERROR;
55 
56 /* Our client */
57 struct passwd *pw = NULL;
58 char *client_addr = NULL;
59 
60 /* input and output queue */
61 Buffer iqueue;
62 Buffer oqueue;
63 
64 /* Version of client */
65 int version;
66 
67 /* Disable writes */
68 int readonly;
69 
70 /* portable attributes, etc. */
71 
72 typedef struct Stat Stat;
73 
74 struct Stat {
75 	char *name;
76 	char *long_name;
77 	Attrib attrib;
78 };
79 
80 static int
81 errno_to_portable(int unixerrno)
82 {
83 	int ret = 0;
84 
85 	switch (unixerrno) {
86 	case 0:
87 		ret = SSH2_FX_OK;
88 		break;
89 	case ENOENT:
90 	case ENOTDIR:
91 	case EBADF:
92 	case ELOOP:
93 		ret = SSH2_FX_NO_SUCH_FILE;
94 		break;
95 	case EPERM:
96 	case EACCES:
97 	case EFAULT:
98 		ret = SSH2_FX_PERMISSION_DENIED;
99 		break;
100 	case ENAMETOOLONG:
101 	case EINVAL:
102 		ret = SSH2_FX_BAD_MESSAGE;
103 		break;
104 	case ENOSYS:
105 		ret = SSH2_FX_OP_UNSUPPORTED;
106 		break;
107 	default:
108 		ret = SSH2_FX_FAILURE;
109 		break;
110 	}
111 	return ret;
112 }
113 
114 static int
115 flags_from_portable(int pflags)
116 {
117 	int flags = 0;
118 
119 	if ((pflags & SSH2_FXF_READ) &&
120 	    (pflags & SSH2_FXF_WRITE)) {
121 		flags = O_RDWR;
122 	} else if (pflags & SSH2_FXF_READ) {
123 		flags = O_RDONLY;
124 	} else if (pflags & SSH2_FXF_WRITE) {
125 		flags = O_WRONLY;
126 	}
127 	if (pflags & SSH2_FXF_CREAT)
128 		flags |= O_CREAT;
129 	if (pflags & SSH2_FXF_TRUNC)
130 		flags |= O_TRUNC;
131 	if (pflags & SSH2_FXF_EXCL)
132 		flags |= O_EXCL;
133 	return flags;
134 }
135 
136 static const char *
137 string_from_portable(int pflags)
138 {
139 	static char ret[128];
140 
141 	*ret = '\0';
142 
143 #define PAPPEND(str)	{				\
144 		if (*ret != '\0')			\
145 			strlcat(ret, ",", sizeof(ret));	\
146 		strlcat(ret, str, sizeof(ret));		\
147 	}
148 
149 	if (pflags & SSH2_FXF_READ)
150 		PAPPEND("READ")
151 	if (pflags & SSH2_FXF_WRITE)
152 		PAPPEND("WRITE")
153 	if (pflags & SSH2_FXF_CREAT)
154 		PAPPEND("CREATE")
155 	if (pflags & SSH2_FXF_TRUNC)
156 		PAPPEND("TRUNCATE")
157 	if (pflags & SSH2_FXF_EXCL)
158 		PAPPEND("EXCL")
159 
160 	return ret;
161 }
162 
163 static Attrib *
164 get_attrib(void)
165 {
166 	return decode_attrib(&iqueue);
167 }
168 
169 /* handle handles */
170 
171 typedef struct Handle Handle;
172 struct Handle {
173 	int use;
174 	DIR *dirp;
175 	int fd;
176 	char *name;
177 	u_int64_t bytes_read, bytes_write;
178 	int next_unused;
179 };
180 
181 enum {
182 	HANDLE_UNUSED,
183 	HANDLE_DIR,
184 	HANDLE_FILE
185 };
186 
187 Handle *handles = NULL;
188 u_int num_handles = 0;
189 int first_unused_handle = -1;
190 
191 static void handle_unused(int i)
192 {
193 	handles[i].use = HANDLE_UNUSED;
194 	handles[i].next_unused = first_unused_handle;
195 	first_unused_handle = i;
196 }
197 
198 static int
199 handle_new(int use, const char *name, int fd, DIR *dirp)
200 {
201 	int i;
202 
203 	if (first_unused_handle == -1) {
204 		if (num_handles + 1 <= num_handles)
205 			return -1;
206 		num_handles++;
207 		handles = xrealloc(handles, num_handles, sizeof(Handle));
208 		handle_unused(num_handles - 1);
209 	}
210 
211 	i = first_unused_handle;
212 	first_unused_handle = handles[i].next_unused;
213 
214 	handles[i].use = use;
215 	handles[i].dirp = dirp;
216 	handles[i].fd = fd;
217 	handles[i].name = xstrdup(name);
218 	handles[i].bytes_read = handles[i].bytes_write = 0;
219 
220 	return i;
221 }
222 
223 static int
224 handle_is_ok(int i, int type)
225 {
226 	return i >= 0 && (u_int)i < num_handles && handles[i].use == type;
227 }
228 
229 static int
230 handle_to_string(int handle, char **stringp, int *hlenp)
231 {
232 	if (stringp == NULL || hlenp == NULL)
233 		return -1;
234 	*stringp = xmalloc(sizeof(int32_t));
235 	put_u32(*stringp, handle);
236 	*hlenp = sizeof(int32_t);
237 	return 0;
238 }
239 
240 static int
241 handle_from_string(const char *handle, u_int hlen)
242 {
243 	int val;
244 
245 	if (hlen != sizeof(int32_t))
246 		return -1;
247 	val = get_u32(handle);
248 	if (handle_is_ok(val, HANDLE_FILE) ||
249 	    handle_is_ok(val, HANDLE_DIR))
250 		return val;
251 	return -1;
252 }
253 
254 static char *
255 handle_to_name(int handle)
256 {
257 	if (handle_is_ok(handle, HANDLE_DIR)||
258 	    handle_is_ok(handle, HANDLE_FILE))
259 		return handles[handle].name;
260 	return NULL;
261 }
262 
263 static DIR *
264 handle_to_dir(int handle)
265 {
266 	if (handle_is_ok(handle, HANDLE_DIR))
267 		return handles[handle].dirp;
268 	return NULL;
269 }
270 
271 static int
272 handle_to_fd(int handle)
273 {
274 	if (handle_is_ok(handle, HANDLE_FILE))
275 		return handles[handle].fd;
276 	return -1;
277 }
278 
279 static void
280 handle_update_read(int handle, ssize_t bytes)
281 {
282 	if (handle_is_ok(handle, HANDLE_FILE) && bytes > 0)
283 		handles[handle].bytes_read += bytes;
284 }
285 
286 static void
287 handle_update_write(int handle, ssize_t bytes)
288 {
289 	if (handle_is_ok(handle, HANDLE_FILE) && bytes > 0)
290 		handles[handle].bytes_write += bytes;
291 }
292 
293 static u_int64_t
294 handle_bytes_read(int handle)
295 {
296 	if (handle_is_ok(handle, HANDLE_FILE))
297 		return (handles[handle].bytes_read);
298 	return 0;
299 }
300 
301 static u_int64_t
302 handle_bytes_write(int handle)
303 {
304 	if (handle_is_ok(handle, HANDLE_FILE))
305 		return (handles[handle].bytes_write);
306 	return 0;
307 }
308 
309 static int
310 handle_close(int handle)
311 {
312 	int ret = -1;
313 
314 	if (handle_is_ok(handle, HANDLE_FILE)) {
315 		ret = close(handles[handle].fd);
316 		xfree(handles[handle].name);
317 		handle_unused(handle);
318 	} else if (handle_is_ok(handle, HANDLE_DIR)) {
319 		ret = closedir(handles[handle].dirp);
320 		xfree(handles[handle].name);
321 		handle_unused(handle);
322 	} else {
323 		errno = ENOENT;
324 	}
325 	return ret;
326 }
327 
328 static void
329 handle_log_close(int handle, char *emsg)
330 {
331 	if (handle_is_ok(handle, HANDLE_FILE)) {
332 		logit("%s%sclose \"%s\" bytes read %llu written %llu",
333 		    emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ",
334 		    handle_to_name(handle),
335 		    (unsigned long long)handle_bytes_read(handle),
336 		    (unsigned long long)handle_bytes_write(handle));
337 	} else {
338 		logit("%s%sclosedir \"%s\"",
339 		    emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ",
340 		    handle_to_name(handle));
341 	}
342 }
343 
344 static void
345 handle_log_exit(void)
346 {
347 	u_int i;
348 
349 	for (i = 0; i < num_handles; i++)
350 		if (handles[i].use != HANDLE_UNUSED)
351 			handle_log_close(i, "forced");
352 }
353 
354 static int
355 get_handle(void)
356 {
357 	char *handle;
358 	int val = -1;
359 	u_int hlen;
360 
361 	handle = get_string(&hlen);
362 	if (hlen < 256)
363 		val = handle_from_string(handle, hlen);
364 	xfree(handle);
365 	return val;
366 }
367 
368 /* send replies */
369 
370 static void
371 send_msg(Buffer *m)
372 {
373 	int mlen = buffer_len(m);
374 
375 	buffer_put_int(&oqueue, mlen);
376 	buffer_append(&oqueue, buffer_ptr(m), mlen);
377 	buffer_consume(m, mlen);
378 }
379 
380 static const char *
381 status_to_message(u_int32_t status)
382 {
383 	const char *status_messages[] = {
384 		"Success",			/* SSH_FX_OK */
385 		"End of file",			/* SSH_FX_EOF */
386 		"No such file",			/* SSH_FX_NO_SUCH_FILE */
387 		"Permission denied",		/* SSH_FX_PERMISSION_DENIED */
388 		"Failure",			/* SSH_FX_FAILURE */
389 		"Bad message",			/* SSH_FX_BAD_MESSAGE */
390 		"No connection",		/* SSH_FX_NO_CONNECTION */
391 		"Connection lost",		/* SSH_FX_CONNECTION_LOST */
392 		"Operation unsupported",	/* SSH_FX_OP_UNSUPPORTED */
393 		"Unknown error"			/* Others */
394 	};
395 	return (status_messages[MIN(status,SSH2_FX_MAX)]);
396 }
397 
398 static void
399 send_status(u_int32_t id, u_int32_t status)
400 {
401 	Buffer msg;
402 
403 	debug3("request %u: sent status %u", id, status);
404 	if (log_level > SYSLOG_LEVEL_VERBOSE ||
405 	    (status != SSH2_FX_OK && status != SSH2_FX_EOF))
406 		logit("sent status %s", status_to_message(status));
407 	buffer_init(&msg);
408 	buffer_put_char(&msg, SSH2_FXP_STATUS);
409 	buffer_put_int(&msg, id);
410 	buffer_put_int(&msg, status);
411 	if (version >= 3) {
412 		buffer_put_cstring(&msg, status_to_message(status));
413 		buffer_put_cstring(&msg, "");
414 	}
415 	send_msg(&msg);
416 	buffer_free(&msg);
417 }
418 static void
419 send_data_or_handle(char type, u_int32_t id, const char *data, int dlen)
420 {
421 	Buffer msg;
422 
423 	buffer_init(&msg);
424 	buffer_put_char(&msg, type);
425 	buffer_put_int(&msg, id);
426 	buffer_put_string(&msg, data, dlen);
427 	send_msg(&msg);
428 	buffer_free(&msg);
429 }
430 
431 static void
432 send_data(u_int32_t id, const char *data, int dlen)
433 {
434 	debug("request %u: sent data len %d", id, dlen);
435 	send_data_or_handle(SSH2_FXP_DATA, id, data, dlen);
436 }
437 
438 static void
439 send_handle(u_int32_t id, int handle)
440 {
441 	char *string;
442 	int hlen;
443 
444 	handle_to_string(handle, &string, &hlen);
445 	debug("request %u: sent handle handle %d", id, handle);
446 	send_data_or_handle(SSH2_FXP_HANDLE, id, string, hlen);
447 	xfree(string);
448 }
449 
450 static void
451 send_names(u_int32_t id, int count, const Stat *stats)
452 {
453 	Buffer msg;
454 	int i;
455 
456 	buffer_init(&msg);
457 	buffer_put_char(&msg, SSH2_FXP_NAME);
458 	buffer_put_int(&msg, id);
459 	buffer_put_int(&msg, count);
460 	debug("request %u: sent names count %d", id, count);
461 	for (i = 0; i < count; i++) {
462 		buffer_put_cstring(&msg, stats[i].name);
463 		buffer_put_cstring(&msg, stats[i].long_name);
464 		encode_attrib(&msg, &stats[i].attrib);
465 	}
466 	send_msg(&msg);
467 	buffer_free(&msg);
468 }
469 
470 static void
471 send_attrib(u_int32_t id, const Attrib *a)
472 {
473 	Buffer msg;
474 
475 	debug("request %u: sent attrib have 0x%x", id, a->flags);
476 	buffer_init(&msg);
477 	buffer_put_char(&msg, SSH2_FXP_ATTRS);
478 	buffer_put_int(&msg, id);
479 	encode_attrib(&msg, a);
480 	send_msg(&msg);
481 	buffer_free(&msg);
482 }
483 
484 static void
485 send_statvfs(u_int32_t id, struct statvfs *st)
486 {
487 	Buffer msg;
488 	u_int64_t flag;
489 
490 	flag = (st->f_flag & ST_RDONLY) ? SSH2_FXE_STATVFS_ST_RDONLY : 0;
491 	flag |= (st->f_flag & ST_NOSUID) ? SSH2_FXE_STATVFS_ST_NOSUID : 0;
492 
493 	buffer_init(&msg);
494 	buffer_put_char(&msg, SSH2_FXP_EXTENDED_REPLY);
495 	buffer_put_int(&msg, id);
496 	buffer_put_int64(&msg, st->f_bsize);
497 	buffer_put_int64(&msg, st->f_frsize);
498 	buffer_put_int64(&msg, st->f_blocks);
499 	buffer_put_int64(&msg, st->f_bfree);
500 	buffer_put_int64(&msg, st->f_bavail);
501 	buffer_put_int64(&msg, st->f_files);
502 	buffer_put_int64(&msg, st->f_ffree);
503 	buffer_put_int64(&msg, st->f_favail);
504 	buffer_put_int64(&msg, st->f_fsid);
505 	buffer_put_int64(&msg, flag);
506 	buffer_put_int64(&msg, st->f_namemax);
507 	send_msg(&msg);
508 	buffer_free(&msg);
509 }
510 
511 /* parse incoming */
512 
513 static void
514 process_init(void)
515 {
516 	Buffer msg;
517 
518 	version = get_int();
519 	verbose("received client version %d", version);
520 	buffer_init(&msg);
521 	buffer_put_char(&msg, SSH2_FXP_VERSION);
522 	buffer_put_int(&msg, SSH2_FILEXFER_VERSION);
523 	/* POSIX rename extension */
524 	buffer_put_cstring(&msg, "posix-rename@openssh.com");
525 	buffer_put_cstring(&msg, "1"); /* version */
526 	/* statvfs extension */
527 	buffer_put_cstring(&msg, "statvfs@openssh.com");
528 	buffer_put_cstring(&msg, "2"); /* version */
529 	/* fstatvfs extension */
530 	buffer_put_cstring(&msg, "fstatvfs@openssh.com");
531 	buffer_put_cstring(&msg, "2"); /* version */
532 	send_msg(&msg);
533 	buffer_free(&msg);
534 }
535 
536 static void
537 process_open(void)
538 {
539 	u_int32_t id, pflags;
540 	Attrib *a;
541 	char *name;
542 	int handle, fd, flags, mode, status = SSH2_FX_FAILURE;
543 
544 	id = get_int();
545 	name = get_string(NULL);
546 	pflags = get_int();		/* portable flags */
547 	debug3("request %u: open flags %d", id, pflags);
548 	a = get_attrib();
549 	flags = flags_from_portable(pflags);
550 	mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a->perm : 0666;
551 	logit("open \"%s\" flags %s mode 0%o",
552 	    name, string_from_portable(pflags), mode);
553 	if (readonly &&
554 	    ((flags & O_ACCMODE) == O_WRONLY || (flags & O_ACCMODE) == O_RDWR))
555 		status = SSH2_FX_PERMISSION_DENIED;
556 	else {
557 		fd = open(name, flags, mode);
558 		if (fd < 0) {
559 			status = errno_to_portable(errno);
560 		} else {
561 			handle = handle_new(HANDLE_FILE, name, fd, NULL);
562 			if (handle < 0) {
563 				close(fd);
564 			} else {
565 				send_handle(id, handle);
566 				status = SSH2_FX_OK;
567 			}
568 		}
569 	}
570 	if (status != SSH2_FX_OK)
571 		send_status(id, status);
572 	xfree(name);
573 }
574 
575 static void
576 process_close(void)
577 {
578 	u_int32_t id;
579 	int handle, ret, status = SSH2_FX_FAILURE;
580 
581 	id = get_int();
582 	handle = get_handle();
583 	debug3("request %u: close handle %u", id, handle);
584 	handle_log_close(handle, NULL);
585 	ret = handle_close(handle);
586 	status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
587 	send_status(id, status);
588 }
589 
590 static void
591 process_read(void)
592 {
593 	char buf[64*1024];
594 	u_int32_t id, len;
595 	int handle, fd, ret, status = SSH2_FX_FAILURE;
596 	u_int64_t off;
597 
598 	id = get_int();
599 	handle = get_handle();
600 	off = get_int64();
601 	len = get_int();
602 
603 	debug("request %u: read \"%s\" (handle %d) off %llu len %d",
604 	    id, handle_to_name(handle), handle, (unsigned long long)off, len);
605 	if (len > sizeof buf) {
606 		len = sizeof buf;
607 		debug2("read change len %d", len);
608 	}
609 	fd = handle_to_fd(handle);
610 	if (fd >= 0) {
611 		if (lseek(fd, off, SEEK_SET) < 0) {
612 			error("process_read: seek failed");
613 			status = errno_to_portable(errno);
614 		} else {
615 			ret = read(fd, buf, len);
616 			if (ret < 0) {
617 				status = errno_to_portable(errno);
618 			} else if (ret == 0) {
619 				status = SSH2_FX_EOF;
620 			} else {
621 				send_data(id, buf, ret);
622 				status = SSH2_FX_OK;
623 				handle_update_read(handle, ret);
624 			}
625 		}
626 	}
627 	if (status != SSH2_FX_OK)
628 		send_status(id, status);
629 }
630 
631 static void
632 process_write(void)
633 {
634 	u_int32_t id;
635 	u_int64_t off;
636 	u_int len;
637 	int handle, fd, ret, status;
638 	char *data;
639 
640 	id = get_int();
641 	handle = get_handle();
642 	off = get_int64();
643 	data = get_string(&len);
644 
645 	debug("request %u: write \"%s\" (handle %d) off %llu len %d",
646 	    id, handle_to_name(handle), handle, (unsigned long long)off, len);
647 	fd = handle_to_fd(handle);
648 
649 	if (fd < 0)
650 		status = SSH2_FX_FAILURE;
651 	else if (readonly)
652 		status = SSH2_FX_PERMISSION_DENIED;
653 	else {
654 		if (lseek(fd, off, SEEK_SET) < 0) {
655 			status = errno_to_portable(errno);
656 			error("process_write: seek failed");
657 		} else {
658 /* XXX ATOMICIO ? */
659 			ret = write(fd, data, len);
660 			if (ret < 0) {
661 				error("process_write: write failed");
662 				status = errno_to_portable(errno);
663 			} else if ((size_t)ret == len) {
664 				status = SSH2_FX_OK;
665 				handle_update_write(handle, ret);
666 			} else {
667 				debug2("nothing at all written");
668 				status = SSH2_FX_FAILURE;
669 			}
670 		}
671 	}
672 	send_status(id, status);
673 	xfree(data);
674 }
675 
676 static void
677 process_do_stat(int do_lstat)
678 {
679 	Attrib a;
680 	struct stat st;
681 	u_int32_t id;
682 	char *name;
683 	int ret, status = SSH2_FX_FAILURE;
684 
685 	id = get_int();
686 	name = get_string(NULL);
687 	debug3("request %u: %sstat", id, do_lstat ? "l" : "");
688 	verbose("%sstat name \"%s\"", do_lstat ? "l" : "", name);
689 	ret = do_lstat ? lstat(name, &st) : stat(name, &st);
690 	if (ret < 0) {
691 		status = errno_to_portable(errno);
692 	} else {
693 		stat_to_attrib(&st, &a);
694 		send_attrib(id, &a);
695 		status = SSH2_FX_OK;
696 	}
697 	if (status != SSH2_FX_OK)
698 		send_status(id, status);
699 	xfree(name);
700 }
701 
702 static void
703 process_stat(void)
704 {
705 	process_do_stat(0);
706 }
707 
708 static void
709 process_lstat(void)
710 {
711 	process_do_stat(1);
712 }
713 
714 static void
715 process_fstat(void)
716 {
717 	Attrib a;
718 	struct stat st;
719 	u_int32_t id;
720 	int fd, ret, handle, status = SSH2_FX_FAILURE;
721 
722 	id = get_int();
723 	handle = get_handle();
724 	debug("request %u: fstat \"%s\" (handle %u)",
725 	    id, handle_to_name(handle), handle);
726 	fd = handle_to_fd(handle);
727 	if (fd >= 0) {
728 		ret = fstat(fd, &st);
729 		if (ret < 0) {
730 			status = errno_to_portable(errno);
731 		} else {
732 			stat_to_attrib(&st, &a);
733 			send_attrib(id, &a);
734 			status = SSH2_FX_OK;
735 		}
736 	}
737 	if (status != SSH2_FX_OK)
738 		send_status(id, status);
739 }
740 
741 static struct timeval *
742 attrib_to_tv(const Attrib *a)
743 {
744 	static struct timeval tv[2];
745 
746 	tv[0].tv_sec = a->atime;
747 	tv[0].tv_usec = 0;
748 	tv[1].tv_sec = a->mtime;
749 	tv[1].tv_usec = 0;
750 	return tv;
751 }
752 
753 static void
754 process_setstat(void)
755 {
756 	Attrib *a;
757 	u_int32_t id;
758 	char *name;
759 	int status = SSH2_FX_OK, ret;
760 
761 	id = get_int();
762 	name = get_string(NULL);
763 	a = get_attrib();
764 	debug("request %u: setstat name \"%s\"", id, name);
765 	if (readonly) {
766 		status = SSH2_FX_PERMISSION_DENIED;
767 		a->flags = 0;
768 	}
769 	if (a->flags & SSH2_FILEXFER_ATTR_SIZE) {
770 		logit("set \"%s\" size %llu",
771 		    name, (unsigned long long)a->size);
772 		ret = truncate(name, a->size);
773 		if (ret == -1)
774 			status = errno_to_portable(errno);
775 	}
776 	if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
777 		logit("set \"%s\" mode %04o", name, a->perm);
778 		ret = chmod(name, a->perm & 07777);
779 		if (ret == -1)
780 			status = errno_to_portable(errno);
781 	}
782 	if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
783 		char buf[64];
784 		time_t t = a->mtime;
785 
786 		strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S",
787 		    localtime(&t));
788 		logit("set \"%s\" modtime %s", name, buf);
789 		ret = utimes(name, attrib_to_tv(a));
790 		if (ret == -1)
791 			status = errno_to_portable(errno);
792 	}
793 	if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) {
794 		logit("set \"%s\" owner %lu group %lu", name,
795 		    (u_long)a->uid, (u_long)a->gid);
796 		ret = chown(name, a->uid, a->gid);
797 		if (ret == -1)
798 			status = errno_to_portable(errno);
799 	}
800 	send_status(id, status);
801 	xfree(name);
802 }
803 
804 static void
805 process_fsetstat(void)
806 {
807 	Attrib *a;
808 	u_int32_t id;
809 	int handle, fd, ret;
810 	int status = SSH2_FX_OK;
811 
812 	id = get_int();
813 	handle = get_handle();
814 	a = get_attrib();
815 	debug("request %u: fsetstat handle %d", id, handle);
816 	fd = handle_to_fd(handle);
817 	if (fd < 0)
818 		status = SSH2_FX_FAILURE;
819 	else if (readonly)
820 		status = SSH2_FX_PERMISSION_DENIED;
821 	else {
822 		char *name = handle_to_name(handle);
823 
824 		if (a->flags & SSH2_FILEXFER_ATTR_SIZE) {
825 			logit("set \"%s\" size %llu",
826 			    name, (unsigned long long)a->size);
827 			ret = ftruncate(fd, a->size);
828 			if (ret == -1)
829 				status = errno_to_portable(errno);
830 		}
831 		if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
832 			logit("set \"%s\" mode %04o", name, a->perm);
833 			ret = fchmod(fd, a->perm & 07777);
834 			if (ret == -1)
835 				status = errno_to_portable(errno);
836 		}
837 		if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
838 			char buf[64];
839 			time_t t = a->mtime;
840 
841 			strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S",
842 			    localtime(&t));
843 			logit("set \"%s\" modtime %s", name, buf);
844 			ret = futimes(fd, attrib_to_tv(a));
845 			if (ret == -1)
846 				status = errno_to_portable(errno);
847 		}
848 		if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) {
849 			logit("set \"%s\" owner %lu group %lu", name,
850 			    (u_long)a->uid, (u_long)a->gid);
851 			ret = fchown(fd, a->uid, a->gid);
852 			if (ret == -1)
853 				status = errno_to_portable(errno);
854 		}
855 	}
856 	send_status(id, status);
857 }
858 
859 static void
860 process_opendir(void)
861 {
862 	DIR *dirp = NULL;
863 	char *path;
864 	int handle, status = SSH2_FX_FAILURE;
865 	u_int32_t id;
866 
867 	id = get_int();
868 	path = get_string(NULL);
869 	debug3("request %u: opendir", id);
870 	logit("opendir \"%s\"", path);
871 	dirp = opendir(path);
872 	if (dirp == NULL) {
873 		status = errno_to_portable(errno);
874 	} else {
875 		handle = handle_new(HANDLE_DIR, path, 0, dirp);
876 		if (handle < 0) {
877 			closedir(dirp);
878 		} else {
879 			send_handle(id, handle);
880 			status = SSH2_FX_OK;
881 		}
882 
883 	}
884 	if (status != SSH2_FX_OK)
885 		send_status(id, status);
886 	xfree(path);
887 }
888 
889 static void
890 process_readdir(void)
891 {
892 	DIR *dirp;
893 	struct dirent *dp;
894 	char *path;
895 	int handle;
896 	u_int32_t id;
897 
898 	id = get_int();
899 	handle = get_handle();
900 	debug("request %u: readdir \"%s\" (handle %d)", id,
901 	    handle_to_name(handle), handle);
902 	dirp = handle_to_dir(handle);
903 	path = handle_to_name(handle);
904 	if (dirp == NULL || path == NULL) {
905 		send_status(id, SSH2_FX_FAILURE);
906 	} else {
907 		struct stat st;
908 		char pathname[MAXPATHLEN];
909 		Stat *stats;
910 		int nstats = 10, count = 0, i;
911 
912 		stats = xcalloc(nstats, sizeof(Stat));
913 		while ((dp = readdir(dirp)) != NULL) {
914 			if (count >= nstats) {
915 				nstats *= 2;
916 				stats = xrealloc(stats, nstats, sizeof(Stat));
917 			}
918 /* XXX OVERFLOW ? */
919 			snprintf(pathname, sizeof pathname, "%s%s%s", path,
920 			    strcmp(path, "/") ? "/" : "", dp->d_name);
921 			if (lstat(pathname, &st) < 0)
922 				continue;
923 			stat_to_attrib(&st, &(stats[count].attrib));
924 			stats[count].name = xstrdup(dp->d_name);
925 			stats[count].long_name = ls_file(dp->d_name, &st, 0, 0);
926 			count++;
927 			/* send up to 100 entries in one message */
928 			/* XXX check packet size instead */
929 			if (count == 100)
930 				break;
931 		}
932 		if (count > 0) {
933 			send_names(id, count, stats);
934 			for (i = 0; i < count; i++) {
935 				xfree(stats[i].name);
936 				xfree(stats[i].long_name);
937 			}
938 		} else {
939 			send_status(id, SSH2_FX_EOF);
940 		}
941 		xfree(stats);
942 	}
943 }
944 
945 static void
946 process_remove(void)
947 {
948 	char *name;
949 	u_int32_t id;
950 	int status = SSH2_FX_FAILURE;
951 	int ret;
952 
953 	id = get_int();
954 	name = get_string(NULL);
955 	debug3("request %u: remove", id);
956 	logit("remove name \"%s\"", name);
957 	if (readonly)
958 		status = SSH2_FX_PERMISSION_DENIED;
959 	else {
960 		ret = unlink(name);
961 		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
962 	}
963 	send_status(id, status);
964 	xfree(name);
965 }
966 
967 static void
968 process_mkdir(void)
969 {
970 	Attrib *a;
971 	u_int32_t id;
972 	char *name;
973 	int ret, mode, status = SSH2_FX_FAILURE;
974 
975 	id = get_int();
976 	name = get_string(NULL);
977 	a = get_attrib();
978 	mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
979 	    a->perm & 07777 : 0777;
980 	debug3("request %u: mkdir", id);
981 	logit("mkdir name \"%s\" mode 0%o", name, mode);
982 	if (readonly)
983 		status = SSH2_FX_PERMISSION_DENIED;
984 	else {
985 		ret = mkdir(name, mode);
986 		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
987 	}
988 	send_status(id, status);
989 	xfree(name);
990 }
991 
992 static void
993 process_rmdir(void)
994 {
995 	u_int32_t id;
996 	char *name;
997 	int ret, status;
998 
999 	id = get_int();
1000 	name = get_string(NULL);
1001 	debug3("request %u: rmdir", id);
1002 	logit("rmdir name \"%s\"", name);
1003 	if (readonly)
1004 		status = SSH2_FX_PERMISSION_DENIED;
1005 	else {
1006 		ret = rmdir(name);
1007 		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1008 	}
1009 	send_status(id, status);
1010 	xfree(name);
1011 }
1012 
1013 static void
1014 process_realpath(void)
1015 {
1016 	char resolvedname[MAXPATHLEN];
1017 	u_int32_t id;
1018 	char *path;
1019 
1020 	id = get_int();
1021 	path = get_string(NULL);
1022 	if (path[0] == '\0') {
1023 		xfree(path);
1024 		path = xstrdup(".");
1025 	}
1026 	debug3("request %u: realpath", id);
1027 	verbose("realpath \"%s\"", path);
1028 	if (realpath(path, resolvedname) == NULL) {
1029 		send_status(id, errno_to_portable(errno));
1030 	} else {
1031 		Stat s;
1032 		attrib_clear(&s.attrib);
1033 		s.name = s.long_name = resolvedname;
1034 		send_names(id, 1, &s);
1035 	}
1036 	xfree(path);
1037 }
1038 
1039 static void
1040 process_rename(void)
1041 {
1042 	u_int32_t id;
1043 	char *oldpath, *newpath;
1044 	int status;
1045 	struct stat sb;
1046 
1047 	id = get_int();
1048 	oldpath = get_string(NULL);
1049 	newpath = get_string(NULL);
1050 	debug3("request %u: rename", id);
1051 	logit("rename old \"%s\" new \"%s\"", oldpath, newpath);
1052 	status = SSH2_FX_FAILURE;
1053 	if (readonly)
1054 		status = SSH2_FX_PERMISSION_DENIED;
1055 	else if (lstat(oldpath, &sb) == -1)
1056 		status = errno_to_portable(errno);
1057 	else if (S_ISREG(sb.st_mode)) {
1058 		/* Race-free rename of regular files */
1059 		if (link(oldpath, newpath) == -1) {
1060 			if (errno == EOPNOTSUPP) {
1061 				struct stat st;
1062 
1063 				/*
1064 				 * fs doesn't support links, so fall back to
1065 				 * stat+rename.  This is racy.
1066 				 */
1067 				if (stat(newpath, &st) == -1) {
1068 					if (rename(oldpath, newpath) == -1)
1069 						status =
1070 						    errno_to_portable(errno);
1071 					else
1072 						status = SSH2_FX_OK;
1073 				}
1074 			} else {
1075 				status = errno_to_portable(errno);
1076 			}
1077 		} else if (unlink(oldpath) == -1) {
1078 			status = errno_to_portable(errno);
1079 			/* clean spare link */
1080 			unlink(newpath);
1081 		} else
1082 			status = SSH2_FX_OK;
1083 	} else if (stat(newpath, &sb) == -1) {
1084 		if (rename(oldpath, newpath) == -1)
1085 			status = errno_to_portable(errno);
1086 		else
1087 			status = SSH2_FX_OK;
1088 	}
1089 	send_status(id, status);
1090 	xfree(oldpath);
1091 	xfree(newpath);
1092 }
1093 
1094 static void
1095 process_readlink(void)
1096 {
1097 	u_int32_t id;
1098 	int len;
1099 	char buf[MAXPATHLEN];
1100 	char *path;
1101 
1102 	id = get_int();
1103 	path = get_string(NULL);
1104 	debug3("request %u: readlink", id);
1105 	verbose("readlink \"%s\"", path);
1106 	if ((len = readlink(path, buf, sizeof(buf) - 1)) == -1)
1107 		send_status(id, errno_to_portable(errno));
1108 	else {
1109 		Stat s;
1110 
1111 		buf[len] = '\0';
1112 		attrib_clear(&s.attrib);
1113 		s.name = s.long_name = buf;
1114 		send_names(id, 1, &s);
1115 	}
1116 	xfree(path);
1117 }
1118 
1119 static void
1120 process_symlink(void)
1121 {
1122 	u_int32_t id;
1123 	char *oldpath, *newpath;
1124 	int ret, status;
1125 
1126 	id = get_int();
1127 	oldpath = get_string(NULL);
1128 	newpath = get_string(NULL);
1129 	debug3("request %u: symlink", id);
1130 	logit("symlink old \"%s\" new \"%s\"", oldpath, newpath);
1131 	/* this will fail if 'newpath' exists */
1132 	if (readonly)
1133 		status = SSH2_FX_PERMISSION_DENIED;
1134 	else {
1135 		ret = symlink(oldpath, newpath);
1136 		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1137 	}
1138 	send_status(id, status);
1139 	xfree(oldpath);
1140 	xfree(newpath);
1141 }
1142 
1143 static void
1144 process_extended_posix_rename(u_int32_t id)
1145 {
1146 	char *oldpath, *newpath;
1147 	int ret, status;
1148 
1149 	oldpath = get_string(NULL);
1150 	newpath = get_string(NULL);
1151 	debug3("request %u: posix-rename", id);
1152 	logit("posix-rename old \"%s\" new \"%s\"", oldpath, newpath);
1153 	if (readonly)
1154 		status = SSH2_FX_PERMISSION_DENIED;
1155 	else {
1156 		ret = rename(oldpath, newpath);
1157 		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1158 	}
1159 	send_status(id, status);
1160 	xfree(oldpath);
1161 	xfree(newpath);
1162 }
1163 
1164 static void
1165 process_extended_statvfs(u_int32_t id)
1166 {
1167 	char *path;
1168 	struct statvfs st;
1169 
1170 	path = get_string(NULL);
1171 	debug3("request %u: statfs", id);
1172 	logit("statfs \"%s\"", path);
1173 
1174 	if (statvfs(path, &st) != 0)
1175 		send_status(id, errno_to_portable(errno));
1176 	else
1177 		send_statvfs(id, &st);
1178         xfree(path);
1179 }
1180 
1181 static void
1182 process_extended_fstatvfs(u_int32_t id)
1183 {
1184 	int handle, fd;
1185 	struct statvfs st;
1186 
1187 	handle = get_handle();
1188 	debug("request %u: fstatvfs \"%s\" (handle %u)",
1189 	    id, handle_to_name(handle), handle);
1190 	if ((fd = handle_to_fd(handle)) < 0) {
1191 		send_status(id, SSH2_FX_FAILURE);
1192 		return;
1193 	}
1194 	if (fstatvfs(fd, &st) != 0)
1195 		send_status(id, errno_to_portable(errno));
1196 	else
1197 		send_statvfs(id, &st);
1198 }
1199 
1200 static void
1201 process_extended(void)
1202 {
1203 	u_int32_t id;
1204 	char *request;
1205 
1206 	id = get_int();
1207 	request = get_string(NULL);
1208 	if (strcmp(request, "posix-rename@openssh.com") == 0)
1209 		process_extended_posix_rename(id);
1210 	else if (strcmp(request, "statvfs@openssh.com") == 0)
1211 		process_extended_statvfs(id);
1212 	else if (strcmp(request, "fstatvfs@openssh.com") == 0)
1213 		process_extended_fstatvfs(id);
1214 	else
1215 		send_status(id, SSH2_FX_OP_UNSUPPORTED);	/* MUST */
1216 	xfree(request);
1217 }
1218 
1219 /* stolen from ssh-agent */
1220 
1221 static void
1222 process(void)
1223 {
1224 	u_int msg_len;
1225 	u_int buf_len;
1226 	u_int consumed;
1227 	u_int type;
1228 	u_char *cp;
1229 
1230 	buf_len = buffer_len(&iqueue);
1231 	if (buf_len < 5)
1232 		return;		/* Incomplete message. */
1233 	cp = buffer_ptr(&iqueue);
1234 	msg_len = get_u32(cp);
1235 	if (msg_len > SFTP_MAX_MSG_LENGTH) {
1236 		error("bad message from %s local user %s",
1237 		    client_addr, pw->pw_name);
1238 		sftp_server_cleanup_exit(11);
1239 	}
1240 	if (buf_len < msg_len + 4)
1241 		return;
1242 	buffer_consume(&iqueue, 4);
1243 	buf_len -= 4;
1244 	type = buffer_get_char(&iqueue);
1245 	switch (type) {
1246 	case SSH2_FXP_INIT:
1247 		process_init();
1248 		break;
1249 	case SSH2_FXP_OPEN:
1250 		process_open();
1251 		break;
1252 	case SSH2_FXP_CLOSE:
1253 		process_close();
1254 		break;
1255 	case SSH2_FXP_READ:
1256 		process_read();
1257 		break;
1258 	case SSH2_FXP_WRITE:
1259 		process_write();
1260 		break;
1261 	case SSH2_FXP_LSTAT:
1262 		process_lstat();
1263 		break;
1264 	case SSH2_FXP_FSTAT:
1265 		process_fstat();
1266 		break;
1267 	case SSH2_FXP_SETSTAT:
1268 		process_setstat();
1269 		break;
1270 	case SSH2_FXP_FSETSTAT:
1271 		process_fsetstat();
1272 		break;
1273 	case SSH2_FXP_OPENDIR:
1274 		process_opendir();
1275 		break;
1276 	case SSH2_FXP_READDIR:
1277 		process_readdir();
1278 		break;
1279 	case SSH2_FXP_REMOVE:
1280 		process_remove();
1281 		break;
1282 	case SSH2_FXP_MKDIR:
1283 		process_mkdir();
1284 		break;
1285 	case SSH2_FXP_RMDIR:
1286 		process_rmdir();
1287 		break;
1288 	case SSH2_FXP_REALPATH:
1289 		process_realpath();
1290 		break;
1291 	case SSH2_FXP_STAT:
1292 		process_stat();
1293 		break;
1294 	case SSH2_FXP_RENAME:
1295 		process_rename();
1296 		break;
1297 	case SSH2_FXP_READLINK:
1298 		process_readlink();
1299 		break;
1300 	case SSH2_FXP_SYMLINK:
1301 		process_symlink();
1302 		break;
1303 	case SSH2_FXP_EXTENDED:
1304 		process_extended();
1305 		break;
1306 	default:
1307 		error("Unknown message %d", type);
1308 		break;
1309 	}
1310 	/* discard the remaining bytes from the current packet */
1311 	if (buf_len < buffer_len(&iqueue)) {
1312 		error("iqueue grew unexpectedly");
1313 		sftp_server_cleanup_exit(255);
1314 	}
1315 	consumed = buf_len - buffer_len(&iqueue);
1316 	if (msg_len < consumed) {
1317 		error("msg_len %d < consumed %d", msg_len, consumed);
1318 		sftp_server_cleanup_exit(255);
1319 	}
1320 	if (msg_len > consumed)
1321 		buffer_consume(&iqueue, msg_len - consumed);
1322 }
1323 
1324 /* Cleanup handler that logs active handles upon normal exit */
1325 void
1326 sftp_server_cleanup_exit(int i)
1327 {
1328 	if (pw != NULL && client_addr != NULL) {
1329 		handle_log_exit();
1330 		logit("session closed for local user %s from [%s]",
1331 		    pw->pw_name, client_addr);
1332 	}
1333 	_exit(i);
1334 }
1335 
1336 static void
1337 sftp_server_usage(void)
1338 {
1339 	extern char *__progname;
1340 
1341 	fprintf(stderr,
1342 	    "usage: %s [-ehR] [-f log_facility] [-l log_level] [-u umask]\n",
1343 	    __progname);
1344 	exit(1);
1345 }
1346 
1347 int
1348 sftp_server_main(int argc, char **argv, struct passwd *user_pw)
1349 {
1350 	fd_set *rset, *wset;
1351 	int in, out, max, ch, skipargs = 0, log_stderr = 0;
1352 	ssize_t len, olen, set_size;
1353 	SyslogFacility log_facility = SYSLOG_FACILITY_AUTH;
1354 	char *cp, buf[4*4096];
1355 	const char *errmsg;
1356 	mode_t mask;
1357 
1358 	extern char *optarg;
1359 	extern char *__progname;
1360 
1361 	log_init(__progname, log_level, log_facility, log_stderr);
1362 
1363 	while (!skipargs && (ch = getopt(argc, argv, "f:l:u:cehR")) != -1) {
1364 		switch (ch) {
1365 		case 'R':
1366 			readonly = 1;
1367 			break;
1368 		case 'c':
1369 			/*
1370 			 * Ignore all arguments if we are invoked as a
1371 			 * shell using "sftp-server -c command"
1372 			 */
1373 			skipargs = 1;
1374 			break;
1375 		case 'e':
1376 			log_stderr = 1;
1377 			break;
1378 		case 'l':
1379 			log_level = log_level_number(optarg);
1380 			if (log_level == SYSLOG_LEVEL_NOT_SET)
1381 				error("Invalid log level \"%s\"", optarg);
1382 			break;
1383 		case 'f':
1384 			log_facility = log_facility_number(optarg);
1385 			if (log_facility == SYSLOG_FACILITY_NOT_SET)
1386 				error("Invalid log facility \"%s\"", optarg);
1387 			break;
1388 		case 'u':
1389 			mask = (mode_t)strtonum(optarg, 0, 0777, &errmsg);
1390 			if (errmsg != NULL)
1391 				fatal("Invalid umask \"%s\": %s",
1392 				    optarg, errmsg);
1393 			(void)umask(mask);
1394 			break;
1395 		case 'h':
1396 		default:
1397 			sftp_server_usage();
1398 		}
1399 	}
1400 
1401 	log_init(__progname, log_level, log_facility, log_stderr);
1402 
1403 	if ((cp = getenv("SSH_CONNECTION")) != NULL) {
1404 		client_addr = xstrdup(cp);
1405 		if ((cp = strchr(client_addr, ' ')) == NULL) {
1406 			error("Malformed SSH_CONNECTION variable: \"%s\"",
1407 			    getenv("SSH_CONNECTION"));
1408 			sftp_server_cleanup_exit(255);
1409 		}
1410 		*cp = '\0';
1411 	} else
1412 		client_addr = xstrdup("UNKNOWN");
1413 
1414 	pw = pwcopy(user_pw);
1415 
1416 	logit("session opened for local user %s from [%s]",
1417 	    pw->pw_name, client_addr);
1418 
1419 	in = STDIN_FILENO;
1420 	out = STDOUT_FILENO;
1421 
1422 	max = 0;
1423 	if (in > max)
1424 		max = in;
1425 	if (out > max)
1426 		max = out;
1427 
1428 	buffer_init(&iqueue);
1429 	buffer_init(&oqueue);
1430 
1431 	set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask);
1432 	rset = (fd_set *)xmalloc(set_size);
1433 	wset = (fd_set *)xmalloc(set_size);
1434 
1435 	for (;;) {
1436 		memset(rset, 0, set_size);
1437 		memset(wset, 0, set_size);
1438 
1439 		/*
1440 		 * Ensure that we can read a full buffer and handle
1441 		 * the worst-case length packet it can generate,
1442 		 * otherwise apply backpressure by stopping reads.
1443 		 */
1444 		if (buffer_check_alloc(&iqueue, sizeof(buf)) &&
1445 		    buffer_check_alloc(&oqueue, SFTP_MAX_MSG_LENGTH))
1446 			FD_SET(in, rset);
1447 
1448 		olen = buffer_len(&oqueue);
1449 		if (olen > 0)
1450 			FD_SET(out, wset);
1451 
1452 		if (select(max+1, rset, wset, NULL, NULL) < 0) {
1453 			if (errno == EINTR)
1454 				continue;
1455 			error("select: %s", strerror(errno));
1456 			sftp_server_cleanup_exit(2);
1457 		}
1458 
1459 		/* copy stdin to iqueue */
1460 		if (FD_ISSET(in, rset)) {
1461 			len = read(in, buf, sizeof buf);
1462 			if (len == 0) {
1463 				debug("read eof");
1464 				sftp_server_cleanup_exit(0);
1465 			} else if (len < 0) {
1466 				error("read: %s", strerror(errno));
1467 				sftp_server_cleanup_exit(1);
1468 			} else {
1469 				buffer_append(&iqueue, buf, len);
1470 			}
1471 		}
1472 		/* send oqueue to stdout */
1473 		if (FD_ISSET(out, wset)) {
1474 			len = write(out, buffer_ptr(&oqueue), olen);
1475 			if (len < 0) {
1476 				error("write: %s", strerror(errno));
1477 				sftp_server_cleanup_exit(1);
1478 			} else {
1479 				buffer_consume(&oqueue, len);
1480 			}
1481 		}
1482 
1483 		/*
1484 		 * Process requests from client if we can fit the results
1485 		 * into the output buffer, otherwise stop processing input
1486 		 * and let the output queue drain.
1487 		 */
1488 		if (buffer_check_alloc(&oqueue, SFTP_MAX_MSG_LENGTH))
1489 			process();
1490 	}
1491 }
1492