1 /* 2 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * All rights reserved 5 * The main loop for the interactive session (client side). 6 * 7 * As far as I am concerned, the code I have written for this software 8 * can be used freely for any purpose. Any derived versions of this 9 * software must be clearly marked as such, and if the derived work is 10 * incompatible with the protocol description in the RFC file, it must be 11 * called by a name other than "ssh" or "Secure Shell". 12 * 13 * 14 * Copyright (c) 1999 Theo de Raadt. All rights reserved. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions 18 * are met: 19 * 1. Redistributions of source code must retain the above copyright 20 * notice, this list of conditions and the following disclaimer. 21 * 2. Redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35 * 36 * 37 * SSH2 support added by Markus Friedl. 38 * Copyright (c) 1999, 2000, 2001 Markus Friedl. All rights reserved. 39 * 40 * Redistribution and use in source and binary forms, with or without 41 * modification, are permitted provided that the following conditions 42 * are met: 43 * 1. Redistributions of source code must retain the above copyright 44 * notice, this list of conditions and the following disclaimer. 45 * 2. Redistributions in binary form must reproduce the above copyright 46 * notice, this list of conditions and the following disclaimer in the 47 * documentation and/or other materials provided with the distribution. 48 * 49 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 50 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 51 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 52 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 53 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 54 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 55 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 56 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 57 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 58 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 59 */ 60 61 #include "includes.h" 62 RCSID("$OpenBSD: clientloop.c,v 1.81 2001/07/17 21:04:57 markus Exp $"); 63 64 #include "ssh.h" 65 #include "ssh1.h" 66 #include "ssh2.h" 67 #include "xmalloc.h" 68 #include "packet.h" 69 #include "buffer.h" 70 #include "compat.h" 71 #include "channels.h" 72 #include "dispatch.h" 73 #include "buffer.h" 74 #include "bufaux.h" 75 #include "key.h" 76 #include "kex.h" 77 #include "log.h" 78 #include "readconf.h" 79 #include "clientloop.h" 80 #include "authfd.h" 81 #include "atomicio.h" 82 #include "sshtty.h" 83 #include "misc.h" 84 85 /* import options */ 86 extern Options options; 87 88 /* Flag indicating that stdin should be redirected from /dev/null. */ 89 extern int stdin_null_flag; 90 91 /* 92 * Name of the host we are connecting to. This is the name given on the 93 * command line, or the HostName specified for the user-supplied name in a 94 * configuration file. 95 */ 96 extern char *host; 97 98 /* 99 * Flag to indicate that we have received a window change signal which has 100 * not yet been processed. This will cause a message indicating the new 101 * window size to be sent to the server a little later. This is volatile 102 * because this is updated in a signal handler. 103 */ 104 static volatile int received_window_change_signal = 0; 105 static volatile int received_signal = 0; 106 107 /* Flag indicating whether the user\'s terminal is in non-blocking mode. */ 108 static int in_non_blocking_mode = 0; 109 110 /* Common data for the client loop code. */ 111 static int quit_pending; /* Set to non-zero to quit the client loop. */ 112 static int escape_char; /* Escape character. */ 113 static int escape_pending; /* Last character was the escape character */ 114 static int last_was_cr; /* Last character was a newline. */ 115 static int exit_status; /* Used to store the exit status of the command. */ 116 static int stdin_eof; /* EOF has been encountered on standard error. */ 117 static Buffer stdin_buffer; /* Buffer for stdin data. */ 118 static Buffer stdout_buffer; /* Buffer for stdout data. */ 119 static Buffer stderr_buffer; /* Buffer for stderr data. */ 120 static u_long stdin_bytes, stdout_bytes, stderr_bytes; 121 static u_int buffer_high;/* Soft max buffer size. */ 122 static int connection_in; /* Connection to server (input). */ 123 static int connection_out; /* Connection to server (output). */ 124 static int need_rekeying; /* Set to non-zero if rekeying is requested. */ 125 static int session_closed = 0; /* In SSH2: login session closed. */ 126 127 static void client_init_dispatch(void); 128 int session_ident = -1; 129 130 /*XXX*/ 131 extern Kex *xxx_kex; 132 133 /* Restores stdin to blocking mode. */ 134 135 static void 136 leave_non_blocking(void) 137 { 138 if (in_non_blocking_mode) { 139 (void) fcntl(fileno(stdin), F_SETFL, 0); 140 in_non_blocking_mode = 0; 141 fatal_remove_cleanup((void (*) (void *)) leave_non_blocking, NULL); 142 } 143 } 144 145 /* Puts stdin terminal in non-blocking mode. */ 146 147 static void 148 enter_non_blocking(void) 149 { 150 in_non_blocking_mode = 1; 151 (void) fcntl(fileno(stdin), F_SETFL, O_NONBLOCK); 152 fatal_add_cleanup((void (*) (void *)) leave_non_blocking, NULL); 153 } 154 155 /* 156 * Signal handler for the window change signal (SIGWINCH). This just sets a 157 * flag indicating that the window has changed. 158 */ 159 160 static void 161 window_change_handler(int sig) 162 { 163 received_window_change_signal = 1; 164 signal(SIGWINCH, window_change_handler); 165 } 166 167 /* 168 * Signal handler for signals that cause the program to terminate. These 169 * signals must be trapped to restore terminal modes. 170 */ 171 172 static void 173 signal_handler(int sig) 174 { 175 received_signal = sig; 176 quit_pending = 1; 177 } 178 179 /* 180 * Returns current time in seconds from Jan 1, 1970 with the maximum 181 * available resolution. 182 */ 183 184 static double 185 get_current_time(void) 186 { 187 struct timeval tv; 188 gettimeofday(&tv, NULL); 189 return (double) tv.tv_sec + (double) tv.tv_usec / 1000000.0; 190 } 191 192 /* 193 * This is called when the interactive is entered. This checks if there is 194 * an EOF coming on stdin. We must check this explicitly, as select() does 195 * not appear to wake up when redirecting from /dev/null. 196 */ 197 198 static void 199 client_check_initial_eof_on_stdin(void) 200 { 201 int len; 202 char buf[1]; 203 204 /* 205 * If standard input is to be "redirected from /dev/null", we simply 206 * mark that we have seen an EOF and send an EOF message to the 207 * server. Otherwise, we try to read a single character; it appears 208 * that for some files, such /dev/null, select() never wakes up for 209 * read for this descriptor, which means that we never get EOF. This 210 * way we will get the EOF if stdin comes from /dev/null or similar. 211 */ 212 if (stdin_null_flag) { 213 /* Fake EOF on stdin. */ 214 debug("Sending eof."); 215 stdin_eof = 1; 216 packet_start(SSH_CMSG_EOF); 217 packet_send(); 218 } else { 219 enter_non_blocking(); 220 221 /* Check for immediate EOF on stdin. */ 222 len = read(fileno(stdin), buf, 1); 223 if (len == 0) { 224 /* EOF. Record that we have seen it and send EOF to server. */ 225 debug("Sending eof."); 226 stdin_eof = 1; 227 packet_start(SSH_CMSG_EOF); 228 packet_send(); 229 } else if (len > 0) { 230 /* 231 * Got data. We must store the data in the buffer, 232 * and also process it as an escape character if 233 * appropriate. 234 */ 235 if ((u_char) buf[0] == escape_char) 236 escape_pending = 1; 237 else 238 buffer_append(&stdin_buffer, buf, 1); 239 } 240 leave_non_blocking(); 241 } 242 } 243 244 245 /* 246 * Make packets from buffered stdin data, and buffer them for sending to the 247 * connection. 248 */ 249 250 static void 251 client_make_packets_from_stdin_data(void) 252 { 253 u_int len; 254 255 /* Send buffered stdin data to the server. */ 256 while (buffer_len(&stdin_buffer) > 0 && 257 packet_not_very_much_data_to_write()) { 258 len = buffer_len(&stdin_buffer); 259 /* Keep the packets at reasonable size. */ 260 if (len > packet_get_maxsize()) 261 len = packet_get_maxsize(); 262 packet_start(SSH_CMSG_STDIN_DATA); 263 packet_put_string(buffer_ptr(&stdin_buffer), len); 264 packet_send(); 265 buffer_consume(&stdin_buffer, len); 266 stdin_bytes += len; 267 /* If we have a pending EOF, send it now. */ 268 if (stdin_eof && buffer_len(&stdin_buffer) == 0) { 269 packet_start(SSH_CMSG_EOF); 270 packet_send(); 271 } 272 } 273 } 274 275 /* 276 * Checks if the client window has changed, and sends a packet about it to 277 * the server if so. The actual change is detected elsewhere (by a software 278 * interrupt on Unix); this just checks the flag and sends a message if 279 * appropriate. 280 */ 281 282 static void 283 client_check_window_change(void) 284 { 285 struct winsize ws; 286 287 if (! received_window_change_signal) 288 return; 289 /** XXX race */ 290 received_window_change_signal = 0; 291 292 if (ioctl(fileno(stdin), TIOCGWINSZ, &ws) < 0) 293 return; 294 295 debug2("client_check_window_change: changed"); 296 297 if (compat20) { 298 channel_request_start(session_ident, "window-change", 0); 299 packet_put_int(ws.ws_col); 300 packet_put_int(ws.ws_row); 301 packet_put_int(ws.ws_xpixel); 302 packet_put_int(ws.ws_ypixel); 303 packet_send(); 304 } else { 305 packet_start(SSH_CMSG_WINDOW_SIZE); 306 packet_put_int(ws.ws_row); 307 packet_put_int(ws.ws_col); 308 packet_put_int(ws.ws_xpixel); 309 packet_put_int(ws.ws_ypixel); 310 packet_send(); 311 } 312 } 313 314 /* 315 * Waits until the client can do something (some data becomes available on 316 * one of the file descriptors). 317 */ 318 319 static void 320 client_wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp, 321 int *maxfdp, int *nallocp, int rekeying) 322 { 323 /* Add any selections by the channel mechanism. */ 324 channel_prepare_select(readsetp, writesetp, maxfdp, nallocp, rekeying); 325 326 if (!compat20) { 327 /* Read from the connection, unless our buffers are full. */ 328 if (buffer_len(&stdout_buffer) < buffer_high && 329 buffer_len(&stderr_buffer) < buffer_high && 330 channel_not_very_much_buffered_data()) 331 FD_SET(connection_in, *readsetp); 332 /* 333 * Read from stdin, unless we have seen EOF or have very much 334 * buffered data to send to the server. 335 */ 336 if (!stdin_eof && packet_not_very_much_data_to_write()) 337 FD_SET(fileno(stdin), *readsetp); 338 339 /* Select stdout/stderr if have data in buffer. */ 340 if (buffer_len(&stdout_buffer) > 0) 341 FD_SET(fileno(stdout), *writesetp); 342 if (buffer_len(&stderr_buffer) > 0) 343 FD_SET(fileno(stderr), *writesetp); 344 } else { 345 /* channel_prepare_select could have closed the last channel */ 346 if (session_closed && !channel_still_open()) { 347 if (!packet_have_data_to_write()) 348 return; 349 } else { 350 FD_SET(connection_in, *readsetp); 351 } 352 } 353 354 /* Select server connection if have data to write to the server. */ 355 if (packet_have_data_to_write()) 356 FD_SET(connection_out, *writesetp); 357 358 /* 359 * Wait for something to happen. This will suspend the process until 360 * some selected descriptor can be read, written, or has some other 361 * event pending. Note: if you want to implement SSH_MSG_IGNORE 362 * messages to fool traffic analysis, this might be the place to do 363 * it: just have a random timeout for the select, and send a random 364 * SSH_MSG_IGNORE packet when the timeout expires. 365 */ 366 367 if (select((*maxfdp)+1, *readsetp, *writesetp, NULL, NULL) < 0) { 368 char buf[100]; 369 370 /* 371 * We have to clear the select masks, because we return. 372 * We have to return, because the mainloop checks for the flags 373 * set by the signal handlers. 374 */ 375 memset(*readsetp, 0, *maxfdp); 376 memset(*writesetp, 0, *maxfdp); 377 378 if (errno == EINTR) 379 return; 380 /* Note: we might still have data in the buffers. */ 381 snprintf(buf, sizeof buf, "select: %s\r\n", strerror(errno)); 382 buffer_append(&stderr_buffer, buf, strlen(buf)); 383 quit_pending = 1; 384 } 385 } 386 387 static void 388 client_suspend_self(Buffer *bin, Buffer *bout, Buffer *berr) 389 { 390 struct winsize oldws, newws; 391 392 /* Flush stdout and stderr buffers. */ 393 if (buffer_len(bout) > 0) 394 atomicio(write, fileno(stdout), buffer_ptr(bout), buffer_len(bout)); 395 if (buffer_len(berr) > 0) 396 atomicio(write, fileno(stderr), buffer_ptr(berr), buffer_len(berr)); 397 398 leave_raw_mode(); 399 400 /* 401 * Free (and clear) the buffer to reduce the amount of data that gets 402 * written to swap. 403 */ 404 buffer_free(bin); 405 buffer_free(bout); 406 buffer_free(berr); 407 408 /* Save old window size. */ 409 ioctl(fileno(stdin), TIOCGWINSZ, &oldws); 410 411 /* Send the suspend signal to the program itself. */ 412 kill(getpid(), SIGTSTP); 413 414 /* Check if the window size has changed. */ 415 if (ioctl(fileno(stdin), TIOCGWINSZ, &newws) >= 0 && 416 (oldws.ws_row != newws.ws_row || 417 oldws.ws_col != newws.ws_col || 418 oldws.ws_xpixel != newws.ws_xpixel || 419 oldws.ws_ypixel != newws.ws_ypixel)) 420 received_window_change_signal = 1; 421 422 /* OK, we have been continued by the user. Reinitialize buffers. */ 423 buffer_init(bin); 424 buffer_init(bout); 425 buffer_init(berr); 426 427 enter_raw_mode(); 428 } 429 430 static void 431 client_process_net_input(fd_set * readset) 432 { 433 int len; 434 char buf[8192]; 435 436 /* 437 * Read input from the server, and add any such data to the buffer of 438 * the packet subsystem. 439 */ 440 if (FD_ISSET(connection_in, readset)) { 441 /* Read as much as possible. */ 442 len = read(connection_in, buf, sizeof(buf)); 443 if (len == 0) { 444 /* Received EOF. The remote host has closed the connection. */ 445 snprintf(buf, sizeof buf, "Connection to %.300s closed by remote host.\r\n", 446 host); 447 buffer_append(&stderr_buffer, buf, strlen(buf)); 448 quit_pending = 1; 449 return; 450 } 451 /* 452 * There is a kernel bug on Solaris that causes select to 453 * sometimes wake up even though there is no data available. 454 */ 455 if (len < 0 && (errno == EAGAIN || errno == EINTR)) 456 len = 0; 457 458 if (len < 0) { 459 /* An error has encountered. Perhaps there is a network problem. */ 460 snprintf(buf, sizeof buf, "Read from remote host %.300s: %.100s\r\n", 461 host, strerror(errno)); 462 buffer_append(&stderr_buffer, buf, strlen(buf)); 463 quit_pending = 1; 464 return; 465 } 466 packet_process_incoming(buf, len); 467 } 468 } 469 470 /* process the characters one by one */ 471 static int 472 process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len) 473 { 474 char string[1024]; 475 pid_t pid; 476 int bytes = 0; 477 u_int i; 478 u_char ch; 479 char *s; 480 481 for (i = 0; i < len; i++) { 482 /* Get one character at a time. */ 483 ch = buf[i]; 484 485 if (escape_pending) { 486 /* We have previously seen an escape character. */ 487 /* Clear the flag now. */ 488 escape_pending = 0; 489 490 /* Process the escaped character. */ 491 switch (ch) { 492 case '.': 493 /* Terminate the connection. */ 494 snprintf(string, sizeof string, "%c.\r\n", escape_char); 495 buffer_append(berr, string, strlen(string)); 496 497 quit_pending = 1; 498 return -1; 499 500 case 'Z' - 64: 501 /* Suspend the program. */ 502 /* Print a message to that effect to the user. */ 503 snprintf(string, sizeof string, "%c^Z [suspend ssh]\r\n", escape_char); 504 buffer_append(berr, string, strlen(string)); 505 506 /* Restore terminal modes and suspend. */ 507 client_suspend_self(bin, bout, berr); 508 509 /* We have been continued. */ 510 continue; 511 512 case 'R': 513 if (compat20) { 514 if (datafellows & SSH_BUG_NOREKEY) 515 log("Server does not support re-keying"); 516 else 517 need_rekeying = 1; 518 } 519 continue; 520 521 case '&': 522 /* XXX does not work yet with proto 2 */ 523 if (compat20) 524 continue; 525 /* 526 * Detach the program (continue to serve connections, 527 * but put in background and no more new connections). 528 */ 529 if (!stdin_eof) { 530 /* 531 * Sending SSH_CMSG_EOF alone does not always appear 532 * to be enough. So we try to send an EOF character 533 * first. 534 */ 535 packet_start(SSH_CMSG_STDIN_DATA); 536 packet_put_string("\004", 1); 537 packet_send(); 538 /* Close stdin. */ 539 stdin_eof = 1; 540 if (buffer_len(bin) == 0) { 541 packet_start(SSH_CMSG_EOF); 542 packet_send(); 543 } 544 } 545 /* Restore tty modes. */ 546 leave_raw_mode(); 547 548 /* Stop listening for new connections. */ 549 channel_close_all(); /* proto1 only XXXX */ 550 551 printf("%c& [backgrounded]\n", escape_char); 552 553 /* Fork into background. */ 554 pid = fork(); 555 if (pid < 0) { 556 error("fork: %.100s", strerror(errno)); 557 continue; 558 } 559 if (pid != 0) { /* This is the parent. */ 560 /* The parent just exits. */ 561 exit(0); 562 } 563 /* The child continues serving connections. */ 564 continue; /*XXX ? */ 565 566 case '?': 567 snprintf(string, sizeof string, 568 "%c?\r\n\ 569 Supported escape sequences:\r\n\ 570 ~. - terminate connection\r\n\ 571 ~R - Request rekey (SSH protocol 2 only)\r\n\ 572 ~^Z - suspend ssh\r\n\ 573 ~# - list forwarded connections\r\n\ 574 ~& - background ssh (when waiting for connections to terminate)\r\n\ 575 ~? - this message\r\n\ 576 ~~ - send the escape character by typing it twice\r\n\ 577 (Note that escapes are only recognized immediately after newline.)\r\n", 578 escape_char); 579 buffer_append(berr, string, strlen(string)); 580 continue; 581 582 case '#': 583 snprintf(string, sizeof string, "%c#\r\n", escape_char); 584 buffer_append(berr, string, strlen(string)); 585 s = channel_open_message(); 586 buffer_append(berr, s, strlen(s)); 587 xfree(s); 588 continue; 589 590 default: 591 if (ch != escape_char) { 592 buffer_put_char(bin, escape_char); 593 bytes++; 594 } 595 /* Escaped characters fall through here */ 596 break; 597 } 598 } else { 599 /* 600 * The previous character was not an escape char. Check if this 601 * is an escape. 602 */ 603 if (last_was_cr && ch == escape_char) { 604 /* It is. Set the flag and continue to next character. */ 605 escape_pending = 1; 606 continue; 607 } 608 } 609 610 /* 611 * Normal character. Record whether it was a newline, 612 * and append it to the buffer. 613 */ 614 last_was_cr = (ch == '\r' || ch == '\n'); 615 buffer_put_char(bin, ch); 616 bytes++; 617 } 618 return bytes; 619 } 620 621 static void 622 client_process_input(fd_set * readset) 623 { 624 int len; 625 char buf[8192]; 626 627 /* Read input from stdin. */ 628 if (FD_ISSET(fileno(stdin), readset)) { 629 /* Read as much as possible. */ 630 len = read(fileno(stdin), buf, sizeof(buf)); 631 if (len < 0 && (errno == EAGAIN || errno == EINTR)) 632 return; /* we'll try again later */ 633 if (len <= 0) { 634 /* 635 * Received EOF or error. They are treated 636 * similarly, except that an error message is printed 637 * if it was an error condition. 638 */ 639 if (len < 0) { 640 snprintf(buf, sizeof buf, "read: %.100s\r\n", strerror(errno)); 641 buffer_append(&stderr_buffer, buf, strlen(buf)); 642 } 643 /* Mark that we have seen EOF. */ 644 stdin_eof = 1; 645 /* 646 * Send an EOF message to the server unless there is 647 * data in the buffer. If there is data in the 648 * buffer, no message will be sent now. Code 649 * elsewhere will send the EOF when the buffer 650 * becomes empty if stdin_eof is set. 651 */ 652 if (buffer_len(&stdin_buffer) == 0) { 653 packet_start(SSH_CMSG_EOF); 654 packet_send(); 655 } 656 } else if (escape_char == SSH_ESCAPECHAR_NONE) { 657 /* 658 * Normal successful read, and no escape character. 659 * Just append the data to buffer. 660 */ 661 buffer_append(&stdin_buffer, buf, len); 662 } else { 663 /* 664 * Normal, successful read. But we have an escape character 665 * and have to process the characters one by one. 666 */ 667 if (process_escapes(&stdin_buffer, &stdout_buffer, 668 &stderr_buffer, buf, len) == -1) 669 return; 670 } 671 } 672 } 673 674 static void 675 client_process_output(fd_set * writeset) 676 { 677 int len; 678 char buf[100]; 679 680 /* Write buffered output to stdout. */ 681 if (FD_ISSET(fileno(stdout), writeset)) { 682 /* Write as much data as possible. */ 683 len = write(fileno(stdout), buffer_ptr(&stdout_buffer), 684 buffer_len(&stdout_buffer)); 685 if (len <= 0) { 686 if (errno == EINTR || errno == EAGAIN) 687 len = 0; 688 else { 689 /* 690 * An error or EOF was encountered. Put an 691 * error message to stderr buffer. 692 */ 693 snprintf(buf, sizeof buf, "write stdout: %.50s\r\n", strerror(errno)); 694 buffer_append(&stderr_buffer, buf, strlen(buf)); 695 quit_pending = 1; 696 return; 697 } 698 } 699 /* Consume printed data from the buffer. */ 700 buffer_consume(&stdout_buffer, len); 701 stdout_bytes += len; 702 } 703 /* Write buffered output to stderr. */ 704 if (FD_ISSET(fileno(stderr), writeset)) { 705 /* Write as much data as possible. */ 706 len = write(fileno(stderr), buffer_ptr(&stderr_buffer), 707 buffer_len(&stderr_buffer)); 708 if (len <= 0) { 709 if (errno == EINTR || errno == EAGAIN) 710 len = 0; 711 else { 712 /* EOF or error, but can't even print error message. */ 713 quit_pending = 1; 714 return; 715 } 716 } 717 /* Consume printed characters from the buffer. */ 718 buffer_consume(&stderr_buffer, len); 719 stderr_bytes += len; 720 } 721 } 722 723 /* 724 * Get packets from the connection input buffer, and process them as long as 725 * there are packets available. 726 * 727 * Any unknown packets received during the actual 728 * session cause the session to terminate. This is 729 * intended to make debugging easier since no 730 * confirmations are sent. Any compatible protocol 731 * extensions must be negotiated during the 732 * preparatory phase. 733 */ 734 735 static void 736 client_process_buffered_input_packets(void) 737 { 738 dispatch_run(DISPATCH_NONBLOCK, &quit_pending, compat20 ? xxx_kex : NULL); 739 } 740 741 /* scan buf[] for '~' before sending data to the peer */ 742 743 static int 744 simple_escape_filter(Channel *c, char *buf, int len) 745 { 746 /* XXX we assume c->extended is writeable */ 747 return process_escapes(&c->input, &c->output, &c->extended, buf, len); 748 } 749 750 static void 751 client_channel_closed(int id, void *arg) 752 { 753 if (id != session_ident) 754 error("client_channel_closed: id %d != session_ident %d", 755 id, session_ident); 756 session_closed = 1; 757 if (in_raw_mode()) 758 leave_raw_mode(); 759 } 760 761 /* 762 * Implements the interactive session with the server. This is called after 763 * the user has been authenticated, and a command has been started on the 764 * remote host. If escape_char != SSH_ESCAPECHAR_NONE, it is the character 765 * used as an escape character for terminating or suspending the session. 766 */ 767 768 int 769 client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) 770 { 771 fd_set *readset = NULL, *writeset = NULL; 772 double start_time, total_time; 773 int max_fd = 0, max_fd2 = 0, len, rekeying = 0, nalloc = 0; 774 char buf[100]; 775 776 debug("Entering interactive session."); 777 778 start_time = get_current_time(); 779 780 /* Initialize variables. */ 781 escape_pending = 0; 782 last_was_cr = 1; 783 exit_status = -1; 784 stdin_eof = 0; 785 buffer_high = 64 * 1024; 786 connection_in = packet_get_connection_in(); 787 connection_out = packet_get_connection_out(); 788 max_fd = MAX(connection_in, connection_out); 789 790 if (!compat20) { 791 /* enable nonblocking unless tty */ 792 if (!isatty(fileno(stdin))) 793 set_nonblock(fileno(stdin)); 794 if (!isatty(fileno(stdout))) 795 set_nonblock(fileno(stdout)); 796 if (!isatty(fileno(stderr))) 797 set_nonblock(fileno(stderr)); 798 max_fd = MAX(max_fd, fileno(stdin)); 799 max_fd = MAX(max_fd, fileno(stdout)); 800 max_fd = MAX(max_fd, fileno(stderr)); 801 } 802 stdin_bytes = 0; 803 stdout_bytes = 0; 804 stderr_bytes = 0; 805 quit_pending = 0; 806 escape_char = escape_char_arg; 807 808 /* Initialize buffers. */ 809 buffer_init(&stdin_buffer); 810 buffer_init(&stdout_buffer); 811 buffer_init(&stderr_buffer); 812 813 client_init_dispatch(); 814 815 /* Set signal handlers to restore non-blocking mode. */ 816 signal(SIGINT, signal_handler); 817 signal(SIGQUIT, signal_handler); 818 signal(SIGTERM, signal_handler); 819 signal(SIGPIPE, SIG_IGN); 820 if (have_pty) 821 signal(SIGWINCH, window_change_handler); 822 823 if (have_pty) 824 enter_raw_mode(); 825 826 if (compat20) { 827 session_ident = ssh2_chan_id; 828 if (escape_char != SSH_ESCAPECHAR_NONE) 829 channel_register_filter(session_ident, 830 simple_escape_filter); 831 if (session_ident != -1) 832 channel_register_cleanup(session_ident, 833 client_channel_closed); 834 } else { 835 /* Check if we should immediately send eof on stdin. */ 836 client_check_initial_eof_on_stdin(); 837 } 838 839 /* Main loop of the client for the interactive session mode. */ 840 while (!quit_pending) { 841 842 /* Process buffered packets sent by the server. */ 843 client_process_buffered_input_packets(); 844 845 if (compat20 && session_closed && !channel_still_open()) 846 break; 847 848 rekeying = (xxx_kex != NULL && !xxx_kex->done); 849 850 if (rekeying) { 851 debug("rekeying in progress"); 852 } else { 853 /* 854 * Make packets of buffered stdin data, and buffer 855 * them for sending to the server. 856 */ 857 if (!compat20) 858 client_make_packets_from_stdin_data(); 859 860 /* 861 * Make packets from buffered channel data, and 862 * enqueue them for sending to the server. 863 */ 864 if (packet_not_very_much_data_to_write()) 865 channel_output_poll(); 866 867 /* 868 * Check if the window size has changed, and buffer a 869 * message about it to the server if so. 870 */ 871 client_check_window_change(); 872 873 if (quit_pending) 874 break; 875 } 876 /* 877 * Wait until we have something to do (something becomes 878 * available on one of the descriptors). 879 */ 880 max_fd2 = max_fd; 881 client_wait_until_can_do_something(&readset, &writeset, 882 &max_fd2, &nalloc, rekeying); 883 884 if (quit_pending) 885 break; 886 887 /* Do channel operations unless rekeying in progress. */ 888 if (!rekeying) { 889 channel_after_select(readset, writeset); 890 891 if (need_rekeying) { 892 debug("user requests rekeying"); 893 xxx_kex->done = 0; 894 kex_send_kexinit(xxx_kex); 895 need_rekeying = 0; 896 } 897 } 898 899 /* Buffer input from the connection. */ 900 client_process_net_input(readset); 901 902 if (quit_pending) 903 break; 904 905 if (!compat20) { 906 /* Buffer data from stdin */ 907 client_process_input(readset); 908 /* 909 * Process output to stdout and stderr. Output to 910 * the connection is processed elsewhere (above). 911 */ 912 client_process_output(writeset); 913 } 914 915 /* Send as much buffered packet data as possible to the sender. */ 916 if (FD_ISSET(connection_out, writeset)) 917 packet_write_poll(); 918 } 919 if (readset) 920 xfree(readset); 921 if (writeset) 922 xfree(writeset); 923 924 /* Terminate the session. */ 925 926 /* Stop watching for window change. */ 927 if (have_pty) 928 signal(SIGWINCH, SIG_DFL); 929 930 channel_free_all(); 931 932 if (have_pty) 933 leave_raw_mode(); 934 935 /* restore blocking io */ 936 if (!isatty(fileno(stdin))) 937 unset_nonblock(fileno(stdin)); 938 if (!isatty(fileno(stdout))) 939 unset_nonblock(fileno(stdout)); 940 if (!isatty(fileno(stderr))) 941 unset_nonblock(fileno(stderr)); 942 943 if (received_signal) { 944 if (in_non_blocking_mode) /* XXX */ 945 leave_non_blocking(); 946 fatal("Killed by signal %d.", received_signal); 947 } 948 949 /* 950 * In interactive mode (with pseudo tty) display a message indicating 951 * that the connection has been closed. 952 */ 953 if (have_pty && options.log_level != SYSLOG_LEVEL_QUIET) { 954 snprintf(buf, sizeof buf, "Connection to %.64s closed.\r\n", host); 955 buffer_append(&stderr_buffer, buf, strlen(buf)); 956 } 957 958 /* Output any buffered data for stdout. */ 959 while (buffer_len(&stdout_buffer) > 0) { 960 len = write(fileno(stdout), buffer_ptr(&stdout_buffer), 961 buffer_len(&stdout_buffer)); 962 if (len <= 0) { 963 error("Write failed flushing stdout buffer."); 964 break; 965 } 966 buffer_consume(&stdout_buffer, len); 967 stdout_bytes += len; 968 } 969 970 /* Output any buffered data for stderr. */ 971 while (buffer_len(&stderr_buffer) > 0) { 972 len = write(fileno(stderr), buffer_ptr(&stderr_buffer), 973 buffer_len(&stderr_buffer)); 974 if (len <= 0) { 975 error("Write failed flushing stderr buffer."); 976 break; 977 } 978 buffer_consume(&stderr_buffer, len); 979 stderr_bytes += len; 980 } 981 982 /* Clear and free any buffers. */ 983 memset(buf, 0, sizeof(buf)); 984 buffer_free(&stdin_buffer); 985 buffer_free(&stdout_buffer); 986 buffer_free(&stderr_buffer); 987 988 /* Report bytes transferred, and transfer rates. */ 989 total_time = get_current_time() - start_time; 990 debug("Transferred: stdin %lu, stdout %lu, stderr %lu bytes in %.1f seconds", 991 stdin_bytes, stdout_bytes, stderr_bytes, total_time); 992 if (total_time > 0) 993 debug("Bytes per second: stdin %.1f, stdout %.1f, stderr %.1f", 994 stdin_bytes / total_time, stdout_bytes / total_time, 995 stderr_bytes / total_time); 996 997 /* Return the exit status of the program. */ 998 debug("Exit status %d", exit_status); 999 return exit_status; 1000 } 1001 1002 /*********/ 1003 1004 static void 1005 client_input_stdout_data(int type, int plen, void *ctxt) 1006 { 1007 u_int data_len; 1008 char *data = packet_get_string(&data_len); 1009 packet_integrity_check(plen, 4 + data_len, type); 1010 buffer_append(&stdout_buffer, data, data_len); 1011 memset(data, 0, data_len); 1012 xfree(data); 1013 } 1014 static void 1015 client_input_stderr_data(int type, int plen, void *ctxt) 1016 { 1017 u_int data_len; 1018 char *data = packet_get_string(&data_len); 1019 packet_integrity_check(plen, 4 + data_len, type); 1020 buffer_append(&stderr_buffer, data, data_len); 1021 memset(data, 0, data_len); 1022 xfree(data); 1023 } 1024 static void 1025 client_input_exit_status(int type, int plen, void *ctxt) 1026 { 1027 packet_integrity_check(plen, 4, type); 1028 exit_status = packet_get_int(); 1029 /* Acknowledge the exit. */ 1030 packet_start(SSH_CMSG_EXIT_CONFIRMATION); 1031 packet_send(); 1032 /* 1033 * Must wait for packet to be sent since we are 1034 * exiting the loop. 1035 */ 1036 packet_write_wait(); 1037 /* Flag that we want to exit. */ 1038 quit_pending = 1; 1039 } 1040 1041 static Channel * 1042 client_request_forwarded_tcpip(const char *request_type, int rchan) 1043 { 1044 Channel* c = NULL; 1045 char *listen_address, *originator_address; 1046 int listen_port, originator_port; 1047 int sock; 1048 1049 /* Get rest of the packet */ 1050 listen_address = packet_get_string(NULL); 1051 listen_port = packet_get_int(); 1052 originator_address = packet_get_string(NULL); 1053 originator_port = packet_get_int(); 1054 packet_done(); 1055 1056 debug("client_request_forwarded_tcpip: listen %s port %d, originator %s port %d", 1057 listen_address, listen_port, originator_address, originator_port); 1058 1059 sock = channel_connect_by_listen_address(listen_port); 1060 if (sock < 0) { 1061 xfree(originator_address); 1062 xfree(listen_address); 1063 return NULL; 1064 } 1065 c = channel_new("forwarded-tcpip", 1066 SSH_CHANNEL_CONNECTING, sock, sock, -1, 1067 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_WINDOW_DEFAULT, 0, 1068 xstrdup(originator_address), 1); 1069 if (c == NULL) { 1070 error("client_request_forwarded_tcpip: channel_new failed"); 1071 close(sock); 1072 } 1073 xfree(originator_address); 1074 xfree(listen_address); 1075 return c; 1076 } 1077 1078 static Channel* 1079 client_request_x11(const char *request_type, int rchan) 1080 { 1081 Channel *c = NULL; 1082 char *originator; 1083 int originator_port; 1084 int sock; 1085 1086 if (!options.forward_x11) { 1087 error("Warning: ssh server tried X11 forwarding."); 1088 error("Warning: this is probably a break in attempt by a malicious server."); 1089 return NULL; 1090 } 1091 originator = packet_get_string(NULL); 1092 if (datafellows & SSH_BUG_X11FWD) { 1093 debug2("buggy server: x11 request w/o originator_port"); 1094 originator_port = 0; 1095 } else { 1096 originator_port = packet_get_int(); 1097 } 1098 packet_done(); 1099 /* XXX check permission */ 1100 debug("client_request_x11: request from %s %d", originator, 1101 originator_port); 1102 xfree(originator); 1103 sock = x11_connect_display(); 1104 if (sock < 0) 1105 return NULL; 1106 c = channel_new("x11", 1107 SSH_CHANNEL_X11_OPEN, sock, sock, -1, 1108 CHAN_TCP_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 0, 1109 xstrdup("x11"), 1); 1110 if (c == NULL) { 1111 error("client_request_x11: channel_new failed"); 1112 close(sock); 1113 } 1114 return c; 1115 } 1116 1117 static Channel* 1118 client_request_agent(const char *request_type, int rchan) 1119 { 1120 Channel *c = NULL; 1121 int sock; 1122 1123 if (!options.forward_agent) { 1124 error("Warning: ssh server tried agent forwarding."); 1125 error("Warning: this is probably a break in attempt by a malicious server."); 1126 return NULL; 1127 } 1128 sock = ssh_get_authentication_socket(); 1129 if (sock < 0) 1130 return NULL; 1131 c = channel_new("authentication agent connection", 1132 SSH_CHANNEL_OPEN, sock, sock, -1, 1133 CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_WINDOW_DEFAULT, 0, 1134 xstrdup("authentication agent connection"), 1); 1135 if (c == NULL) { 1136 error("client_request_agent: channel_new failed"); 1137 close(sock); 1138 } 1139 return c; 1140 } 1141 1142 /* XXXX move to generic input handler */ 1143 static void 1144 client_input_channel_open(int type, int plen, void *ctxt) 1145 { 1146 Channel *c = NULL; 1147 char *ctype; 1148 u_int len; 1149 int rchan; 1150 int rmaxpack; 1151 int rwindow; 1152 1153 ctype = packet_get_string(&len); 1154 rchan = packet_get_int(); 1155 rwindow = packet_get_int(); 1156 rmaxpack = packet_get_int(); 1157 1158 debug("client_input_channel_open: ctype %s rchan %d win %d max %d", 1159 ctype, rchan, rwindow, rmaxpack); 1160 1161 if (strcmp(ctype, "forwarded-tcpip") == 0) { 1162 c = client_request_forwarded_tcpip(ctype, rchan); 1163 } else if (strcmp(ctype, "x11") == 0) { 1164 c = client_request_x11(ctype, rchan); 1165 } else if (strcmp(ctype, "auth-agent@openssh.com") == 0) { 1166 c = client_request_agent(ctype, rchan); 1167 } 1168 /* XXX duplicate : */ 1169 if (c != NULL) { 1170 debug("confirm %s", ctype); 1171 c->remote_id = rchan; 1172 c->remote_window = rwindow; 1173 c->remote_maxpacket = rmaxpack; 1174 if (c->type != SSH_CHANNEL_CONNECTING) { 1175 packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); 1176 packet_put_int(c->remote_id); 1177 packet_put_int(c->self); 1178 packet_put_int(c->local_window); 1179 packet_put_int(c->local_maxpacket); 1180 packet_send(); 1181 } 1182 } else { 1183 debug("failure %s", ctype); 1184 packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE); 1185 packet_put_int(rchan); 1186 packet_put_int(SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED); 1187 if (!(datafellows & SSH_BUG_OPENFAILURE)) { 1188 packet_put_cstring("open failed"); 1189 packet_put_cstring(""); 1190 } 1191 packet_send(); 1192 } 1193 xfree(ctype); 1194 } 1195 static void 1196 client_input_channel_req(int type, int plen, void *ctxt) 1197 { 1198 Channel *c = NULL; 1199 int id, reply, success = 0; 1200 char *rtype; 1201 1202 id = packet_get_int(); 1203 rtype = packet_get_string(NULL); 1204 reply = packet_get_char(); 1205 1206 debug("client_input_channel_req: channel %d rtype %s reply %d", 1207 id, rtype, reply); 1208 1209 if (session_ident == -1) { 1210 error("client_input_channel_req: no channel %d", session_ident); 1211 } else if (id != session_ident) { 1212 error("client_input_channel_req: channel %d: wrong channel: %d", 1213 session_ident, id); 1214 } 1215 c = channel_lookup(id); 1216 if (c == NULL) { 1217 error("client_input_channel_req: channel %d: unknown channel", id); 1218 } else if (strcmp(rtype, "exit-status") == 0) { 1219 success = 1; 1220 exit_status = packet_get_int(); 1221 packet_done(); 1222 } 1223 if (reply) { 1224 packet_start(success ? 1225 SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE); 1226 packet_put_int(c->remote_id); 1227 packet_send(); 1228 } 1229 xfree(rtype); 1230 } 1231 1232 static void 1233 client_init_dispatch_20(void) 1234 { 1235 dispatch_init(&dispatch_protocol_error); 1236 dispatch_set(SSH2_MSG_CHANNEL_CLOSE, &channel_input_oclose); 1237 dispatch_set(SSH2_MSG_CHANNEL_DATA, &channel_input_data); 1238 dispatch_set(SSH2_MSG_CHANNEL_EOF, &channel_input_ieof); 1239 dispatch_set(SSH2_MSG_CHANNEL_EXTENDED_DATA, &channel_input_extended_data); 1240 dispatch_set(SSH2_MSG_CHANNEL_OPEN, &client_input_channel_open); 1241 dispatch_set(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation); 1242 dispatch_set(SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure); 1243 dispatch_set(SSH2_MSG_CHANNEL_REQUEST, &client_input_channel_req); 1244 dispatch_set(SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust); 1245 1246 /* rekeying */ 1247 dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit); 1248 } 1249 static void 1250 client_init_dispatch_13(void) 1251 { 1252 dispatch_init(NULL); 1253 dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_close); 1254 dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, &channel_input_close_confirmation); 1255 dispatch_set(SSH_MSG_CHANNEL_DATA, &channel_input_data); 1256 dispatch_set(SSH_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation); 1257 dispatch_set(SSH_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure); 1258 dispatch_set(SSH_MSG_PORT_OPEN, &channel_input_port_open); 1259 dispatch_set(SSH_SMSG_EXITSTATUS, &client_input_exit_status); 1260 dispatch_set(SSH_SMSG_STDERR_DATA, &client_input_stderr_data); 1261 dispatch_set(SSH_SMSG_STDOUT_DATA, &client_input_stdout_data); 1262 1263 dispatch_set(SSH_SMSG_AGENT_OPEN, options.forward_agent ? 1264 &auth_input_open_request : &deny_input_open); 1265 dispatch_set(SSH_SMSG_X11_OPEN, options.forward_x11 ? 1266 &x11_input_open : &deny_input_open); 1267 } 1268 static void 1269 client_init_dispatch_15(void) 1270 { 1271 client_init_dispatch_13(); 1272 dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_ieof); 1273 dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, & channel_input_oclose); 1274 } 1275 static void 1276 client_init_dispatch(void) 1277 { 1278 if (compat20) 1279 client_init_dispatch_20(); 1280 else if (compat13) 1281 client_init_dispatch_13(); 1282 else 1283 client_init_dispatch_15(); 1284 } 1285