1 /* $OpenBSD: nchan.c,v 1.63 2010/01/26 01:28:35 djm Exp $ */ 2 /* 3 * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26 #include <sys/types.h> 27 #include <sys/socket.h> 28 #include <sys/queue.h> 29 30 #include <errno.h> 31 #include <string.h> 32 #include <stdarg.h> 33 34 #include "ssh1.h" 35 #include "ssh2.h" 36 #include "buffer.h" 37 #include "packet.h" 38 #include "channels.h" 39 #include "compat.h" 40 #include "log.h" 41 42 /* 43 * SSH Protocol 1.5 aka New Channel Protocol 44 * Thanks to Martina, Axel and everyone who left Erlangen, leaving me bored. 45 * Written by Markus Friedl in October 1999 46 * 47 * Protocol versions 1.3 and 1.5 differ in the handshake protocol used for the 48 * tear down of channels: 49 * 50 * 1.3: strict request-ack-protocol: 51 * CLOSE -> 52 * <- CLOSE_CONFIRM 53 * 54 * 1.5: uses variations of: 55 * IEOF -> 56 * <- OCLOSE 57 * <- IEOF 58 * OCLOSE -> 59 * i.e. both sides have to close the channel 60 * 61 * 2.0: the EOF messages are optional 62 * 63 * See the debugging output from 'ssh -v' and 'sshd -d' of 64 * ssh-1.2.27 as an example. 65 * 66 */ 67 68 /* functions manipulating channel states */ 69 /* 70 * EVENTS update channel input/output states execute ACTIONS 71 */ 72 /* 73 * ACTIONS: should never update the channel states 74 */ 75 static void chan_send_ieof1(Channel *); 76 static void chan_send_oclose1(Channel *); 77 static void chan_send_close2(Channel *); 78 static void chan_send_eof2(Channel *); 79 static void chan_send_eow2(Channel *); 80 81 /* helper */ 82 static void chan_shutdown_write(Channel *); 83 static void chan_shutdown_read(Channel *); 84 85 static char *ostates[] = { "open", "drain", "wait_ieof", "closed" }; 86 static char *istates[] = { "open", "drain", "wait_oclose", "closed" }; 87 88 static void 89 chan_set_istate(Channel *c, u_int next) 90 { 91 if (c->istate > CHAN_INPUT_CLOSED || next > CHAN_INPUT_CLOSED) 92 fatal("chan_set_istate: bad state %d -> %d", c->istate, next); 93 debug2("channel %d: input %s -> %s", c->self, istates[c->istate], 94 istates[next]); 95 c->istate = next; 96 } 97 static void 98 chan_set_ostate(Channel *c, u_int next) 99 { 100 if (c->ostate > CHAN_OUTPUT_CLOSED || next > CHAN_OUTPUT_CLOSED) 101 fatal("chan_set_ostate: bad state %d -> %d", c->ostate, next); 102 debug2("channel %d: output %s -> %s", c->self, ostates[c->ostate], 103 ostates[next]); 104 c->ostate = next; 105 } 106 107 /* 108 * SSH1 specific implementation of event functions 109 */ 110 111 static void 112 chan_rcvd_oclose1(Channel *c) 113 { 114 debug2("channel %d: rcvd oclose", c->self); 115 switch (c->istate) { 116 case CHAN_INPUT_WAIT_OCLOSE: 117 chan_set_istate(c, CHAN_INPUT_CLOSED); 118 break; 119 case CHAN_INPUT_OPEN: 120 chan_shutdown_read(c); 121 chan_send_ieof1(c); 122 chan_set_istate(c, CHAN_INPUT_CLOSED); 123 break; 124 case CHAN_INPUT_WAIT_DRAIN: 125 /* both local read_failed and remote write_failed */ 126 chan_send_ieof1(c); 127 chan_set_istate(c, CHAN_INPUT_CLOSED); 128 break; 129 default: 130 error("channel %d: protocol error: rcvd_oclose for istate %d", 131 c->self, c->istate); 132 return; 133 } 134 } 135 void 136 chan_read_failed(Channel *c) 137 { 138 debug2("channel %d: read failed", c->self); 139 switch (c->istate) { 140 case CHAN_INPUT_OPEN: 141 chan_shutdown_read(c); 142 chan_set_istate(c, CHAN_INPUT_WAIT_DRAIN); 143 break; 144 default: 145 error("channel %d: chan_read_failed for istate %d", 146 c->self, c->istate); 147 break; 148 } 149 } 150 void 151 chan_ibuf_empty(Channel *c) 152 { 153 debug2("channel %d: ibuf empty", c->self); 154 if (buffer_len(&c->input)) { 155 error("channel %d: chan_ibuf_empty for non empty buffer", 156 c->self); 157 return; 158 } 159 switch (c->istate) { 160 case CHAN_INPUT_WAIT_DRAIN: 161 if (compat20) { 162 if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_LOCAL))) 163 chan_send_eof2(c); 164 chan_set_istate(c, CHAN_INPUT_CLOSED); 165 } else { 166 chan_send_ieof1(c); 167 chan_set_istate(c, CHAN_INPUT_WAIT_OCLOSE); 168 } 169 break; 170 default: 171 error("channel %d: chan_ibuf_empty for istate %d", 172 c->self, c->istate); 173 break; 174 } 175 } 176 static void 177 chan_rcvd_ieof1(Channel *c) 178 { 179 debug2("channel %d: rcvd ieof", c->self); 180 switch (c->ostate) { 181 case CHAN_OUTPUT_OPEN: 182 chan_set_ostate(c, CHAN_OUTPUT_WAIT_DRAIN); 183 break; 184 case CHAN_OUTPUT_WAIT_IEOF: 185 chan_set_ostate(c, CHAN_OUTPUT_CLOSED); 186 break; 187 default: 188 error("channel %d: protocol error: rcvd_ieof for ostate %d", 189 c->self, c->ostate); 190 break; 191 } 192 } 193 static void 194 chan_write_failed1(Channel *c) 195 { 196 debug2("channel %d: write failed", c->self); 197 switch (c->ostate) { 198 case CHAN_OUTPUT_OPEN: 199 chan_shutdown_write(c); 200 chan_send_oclose1(c); 201 chan_set_ostate(c, CHAN_OUTPUT_WAIT_IEOF); 202 break; 203 case CHAN_OUTPUT_WAIT_DRAIN: 204 chan_shutdown_write(c); 205 chan_send_oclose1(c); 206 chan_set_ostate(c, CHAN_OUTPUT_CLOSED); 207 break; 208 default: 209 error("channel %d: chan_write_failed for ostate %d", 210 c->self, c->ostate); 211 break; 212 } 213 } 214 void 215 chan_obuf_empty(Channel *c) 216 { 217 debug2("channel %d: obuf empty", c->self); 218 if (buffer_len(&c->output)) { 219 error("channel %d: chan_obuf_empty for non empty buffer", 220 c->self); 221 return; 222 } 223 switch (c->ostate) { 224 case CHAN_OUTPUT_WAIT_DRAIN: 225 chan_shutdown_write(c); 226 if (!compat20) 227 chan_send_oclose1(c); 228 chan_set_ostate(c, CHAN_OUTPUT_CLOSED); 229 break; 230 default: 231 error("channel %d: internal error: obuf_empty for ostate %d", 232 c->self, c->ostate); 233 break; 234 } 235 } 236 static void 237 chan_send_ieof1(Channel *c) 238 { 239 debug2("channel %d: send ieof", c->self); 240 switch (c->istate) { 241 case CHAN_INPUT_OPEN: 242 case CHAN_INPUT_WAIT_DRAIN: 243 packet_start(SSH_MSG_CHANNEL_INPUT_EOF); 244 packet_put_int(c->remote_id); 245 packet_send(); 246 break; 247 default: 248 error("channel %d: cannot send ieof for istate %d", 249 c->self, c->istate); 250 break; 251 } 252 } 253 static void 254 chan_send_oclose1(Channel *c) 255 { 256 debug2("channel %d: send oclose", c->self); 257 switch (c->ostate) { 258 case CHAN_OUTPUT_OPEN: 259 case CHAN_OUTPUT_WAIT_DRAIN: 260 buffer_clear(&c->output); 261 packet_start(SSH_MSG_CHANNEL_OUTPUT_CLOSE); 262 packet_put_int(c->remote_id); 263 packet_send(); 264 break; 265 default: 266 error("channel %d: cannot send oclose for ostate %d", 267 c->self, c->ostate); 268 break; 269 } 270 } 271 272 /* 273 * the same for SSH2 274 */ 275 static void 276 chan_rcvd_close2(Channel *c) 277 { 278 debug2("channel %d: rcvd close", c->self); 279 if (!(c->flags & CHAN_LOCAL)) { 280 if (c->flags & CHAN_CLOSE_RCVD) 281 error("channel %d: protocol error: close rcvd twice", 282 c->self); 283 c->flags |= CHAN_CLOSE_RCVD; 284 } 285 if (c->type == SSH_CHANNEL_LARVAL) { 286 /* tear down larval channels immediately */ 287 chan_set_ostate(c, CHAN_OUTPUT_CLOSED); 288 chan_set_istate(c, CHAN_INPUT_CLOSED); 289 return; 290 } 291 switch (c->ostate) { 292 case CHAN_OUTPUT_OPEN: 293 /* 294 * wait until a data from the channel is consumed if a CLOSE 295 * is received 296 */ 297 chan_set_ostate(c, CHAN_OUTPUT_WAIT_DRAIN); 298 break; 299 } 300 switch (c->istate) { 301 case CHAN_INPUT_OPEN: 302 chan_shutdown_read(c); 303 chan_set_istate(c, CHAN_INPUT_CLOSED); 304 break; 305 case CHAN_INPUT_WAIT_DRAIN: 306 if (!(c->flags & CHAN_LOCAL)) 307 chan_send_eof2(c); 308 chan_set_istate(c, CHAN_INPUT_CLOSED); 309 break; 310 } 311 } 312 313 void 314 chan_rcvd_eow(Channel *c) 315 { 316 debug2("channel %d: rcvd eow", c->self); 317 switch (c->istate) { 318 case CHAN_INPUT_OPEN: 319 chan_shutdown_read(c); 320 chan_set_istate(c, CHAN_INPUT_CLOSED); 321 break; 322 } 323 } 324 static void 325 chan_rcvd_eof2(Channel *c) 326 { 327 debug2("channel %d: rcvd eof", c->self); 328 c->flags |= CHAN_EOF_RCVD; 329 if (c->ostate == CHAN_OUTPUT_OPEN) 330 chan_set_ostate(c, CHAN_OUTPUT_WAIT_DRAIN); 331 } 332 static void 333 chan_write_failed2(Channel *c) 334 { 335 debug2("channel %d: write failed", c->self); 336 switch (c->ostate) { 337 case CHAN_OUTPUT_OPEN: 338 case CHAN_OUTPUT_WAIT_DRAIN: 339 chan_shutdown_write(c); 340 if (strcmp(c->ctype, "session") == 0) 341 chan_send_eow2(c); 342 chan_set_ostate(c, CHAN_OUTPUT_CLOSED); 343 break; 344 default: 345 error("channel %d: chan_write_failed for ostate %d", 346 c->self, c->ostate); 347 break; 348 } 349 } 350 static void 351 chan_send_eof2(Channel *c) 352 { 353 debug2("channel %d: send eof", c->self); 354 switch (c->istate) { 355 case CHAN_INPUT_WAIT_DRAIN: 356 packet_start(SSH2_MSG_CHANNEL_EOF); 357 packet_put_int(c->remote_id); 358 packet_send(); 359 c->flags |= CHAN_EOF_SENT; 360 break; 361 default: 362 error("channel %d: cannot send eof for istate %d", 363 c->self, c->istate); 364 break; 365 } 366 } 367 static void 368 chan_send_close2(Channel *c) 369 { 370 debug2("channel %d: send close", c->self); 371 if (c->ostate != CHAN_OUTPUT_CLOSED || 372 c->istate != CHAN_INPUT_CLOSED) { 373 error("channel %d: cannot send close for istate/ostate %d/%d", 374 c->self, c->istate, c->ostate); 375 } else if (c->flags & CHAN_CLOSE_SENT) { 376 error("channel %d: already sent close", c->self); 377 } else { 378 packet_start(SSH2_MSG_CHANNEL_CLOSE); 379 packet_put_int(c->remote_id); 380 packet_send(); 381 c->flags |= CHAN_CLOSE_SENT; 382 } 383 } 384 static void 385 chan_send_eow2(Channel *c) 386 { 387 debug2("channel %d: send eow", c->self); 388 if (c->ostate == CHAN_OUTPUT_CLOSED) { 389 error("channel %d: must not sent eow on closed output", 390 c->self); 391 return; 392 } 393 if (!(datafellows & SSH_NEW_OPENSSH)) 394 return; 395 packet_start(SSH2_MSG_CHANNEL_REQUEST); 396 packet_put_int(c->remote_id); 397 packet_put_cstring("eow@openssh.com"); 398 packet_put_char(0); 399 packet_send(); 400 } 401 402 /* shared */ 403 404 void 405 chan_rcvd_ieof(Channel *c) 406 { 407 if (compat20) 408 chan_rcvd_eof2(c); 409 else 410 chan_rcvd_ieof1(c); 411 if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN && 412 buffer_len(&c->output) == 0 && 413 !CHANNEL_EFD_OUTPUT_ACTIVE(c)) 414 chan_obuf_empty(c); 415 } 416 void 417 chan_rcvd_oclose(Channel *c) 418 { 419 if (compat20) 420 chan_rcvd_close2(c); 421 else 422 chan_rcvd_oclose1(c); 423 } 424 void 425 chan_write_failed(Channel *c) 426 { 427 if (compat20) 428 chan_write_failed2(c); 429 else 430 chan_write_failed1(c); 431 } 432 433 void 434 chan_mark_dead(Channel *c) 435 { 436 c->type = SSH_CHANNEL_ZOMBIE; 437 } 438 439 int 440 chan_is_dead(Channel *c, int do_send) 441 { 442 if (c->type == SSH_CHANNEL_ZOMBIE) { 443 debug2("channel %d: zombie", c->self); 444 return 1; 445 } 446 if (c->istate != CHAN_INPUT_CLOSED || c->ostate != CHAN_OUTPUT_CLOSED) 447 return 0; 448 if (!compat20) { 449 debug2("channel %d: is dead", c->self); 450 return 1; 451 } 452 if ((datafellows & SSH_BUG_EXTEOF) && 453 c->extended_usage == CHAN_EXTENDED_WRITE && 454 c->efd != -1 && 455 buffer_len(&c->extended) > 0) { 456 debug2("channel %d: active efd: %d len %d", 457 c->self, c->efd, buffer_len(&c->extended)); 458 return 0; 459 } 460 if (c->flags & CHAN_LOCAL) { 461 debug2("channel %d: is dead (local)", c->self); 462 return 1; 463 } 464 if (!(c->flags & CHAN_CLOSE_SENT)) { 465 if (do_send) { 466 chan_send_close2(c); 467 } else { 468 /* channel would be dead if we sent a close */ 469 if (c->flags & CHAN_CLOSE_RCVD) { 470 debug2("channel %d: almost dead", 471 c->self); 472 return 1; 473 } 474 } 475 } 476 if ((c->flags & CHAN_CLOSE_SENT) && 477 (c->flags & CHAN_CLOSE_RCVD)) { 478 debug2("channel %d: is dead", c->self); 479 return 1; 480 } 481 return 0; 482 } 483 484 /* helper */ 485 static void 486 chan_shutdown_write(Channel *c) 487 { 488 buffer_clear(&c->output); 489 if (compat20 && c->type == SSH_CHANNEL_LARVAL) 490 return; 491 /* shutdown failure is allowed if write failed already */ 492 debug2("channel %d: close_write", c->self); 493 if (c->sock != -1) { 494 if (shutdown(c->sock, SHUT_WR) < 0) 495 debug2("channel %d: chan_shutdown_write: " 496 "shutdown() failed for fd %d: %.100s", 497 c->self, c->sock, strerror(errno)); 498 } else { 499 if (channel_close_fd(&c->wfd) < 0) 500 logit("channel %d: chan_shutdown_write: " 501 "close() failed for fd %d: %.100s", 502 c->self, c->wfd, strerror(errno)); 503 } 504 } 505 static void 506 chan_shutdown_read(Channel *c) 507 { 508 if (compat20 && c->type == SSH_CHANNEL_LARVAL) 509 return; 510 debug2("channel %d: close_read", c->self); 511 if (c->sock != -1) { 512 if (shutdown(c->sock, SHUT_RD) < 0) 513 error("channel %d: chan_shutdown_read: " 514 "shutdown() failed for fd %d [i%d o%d]: %.100s", 515 c->self, c->sock, c->istate, c->ostate, 516 strerror(errno)); 517 } else { 518 if (channel_close_fd(&c->rfd) < 0) 519 logit("channel %d: chan_shutdown_read: " 520 "close() failed for fd %d: %.100s", 521 c->self, c->rfd, strerror(errno)); 522 } 523 } 524