1 /* $OpenBSD: ssh.c,v 1.582 2023/01/06 02:39:59 djm Exp $ */ 2 /* 3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5 * All rights reserved 6 * Ssh client program. This program can be used to log into a remote machine. 7 * The software supports strong authentication, encryption, and forwarding 8 * of X11, TCP/IP, and authentication connections. 9 * 10 * As far as I am concerned, the code I have written for this software 11 * can be used freely for any purpose. Any derived versions of this 12 * software must be clearly marked as such, and if the derived work is 13 * incompatible with the protocol description in the RFC file, it must be 14 * called by a name other than "ssh" or "Secure Shell". 15 * 16 * Copyright (c) 1999 Niels Provos. All rights reserved. 17 * Copyright (c) 2000, 2001, 2002, 2003 Markus Friedl. All rights reserved. 18 * 19 * Modified to work with SSLeay by Niels Provos <provos@citi.umich.edu> 20 * in Canada (German citizen). 21 * 22 * Redistribution and use in source and binary forms, with or without 23 * modification, are permitted provided that the following conditions 24 * are met: 25 * 1. Redistributions of source code must retain the above copyright 26 * notice, this list of conditions and the following disclaimer. 27 * 2. Redistributions in binary form must reproduce the above copyright 28 * notice, this list of conditions and the following disclaimer in the 29 * documentation and/or other materials provided with the distribution. 30 * 31 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 32 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 33 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 34 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 35 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 36 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 37 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 38 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 39 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 40 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 41 */ 42 43 #include <sys/types.h> 44 #include <sys/ioctl.h> 45 #include <sys/queue.h> 46 #include <sys/resource.h> 47 #include <sys/socket.h> 48 #include <sys/stat.h> 49 #include <sys/time.h> 50 #include <sys/wait.h> 51 52 #include <ctype.h> 53 #include <errno.h> 54 #include <fcntl.h> 55 #include <netdb.h> 56 #include <paths.h> 57 #include <pwd.h> 58 #include <signal.h> 59 #include <stddef.h> 60 #include <stdio.h> 61 #include <stdlib.h> 62 #include <string.h> 63 #include <stdarg.h> 64 #include <unistd.h> 65 #include <limits.h> 66 #include <locale.h> 67 68 #ifdef WITH_OPENSSL 69 #include <openssl/evp.h> 70 #include <openssl/err.h> 71 #endif 72 73 #include "xmalloc.h" 74 #include "ssh.h" 75 #include "ssh2.h" 76 #include "canohost.h" 77 #include "compat.h" 78 #include "cipher.h" 79 #include "packet.h" 80 #include "sshbuf.h" 81 #include "channels.h" 82 #include "sshkey.h" 83 #include "authfd.h" 84 #include "authfile.h" 85 #include "pathnames.h" 86 #include "dispatch.h" 87 #include "clientloop.h" 88 #include "log.h" 89 #include "misc.h" 90 #include "readconf.h" 91 #include "sshconnect.h" 92 #include "kex.h" 93 #include "mac.h" 94 #include "sshpty.h" 95 #include "match.h" 96 #include "msg.h" 97 #include "version.h" 98 #include "ssherr.h" 99 #include "myproposal.h" 100 101 #ifdef ENABLE_PKCS11 102 #include "ssh-pkcs11.h" 103 #endif 104 105 extern char *__progname; 106 107 /* Flag indicating whether debug mode is on. May be set on the command line. */ 108 int debug_flag = 0; 109 110 /* Flag indicating whether a tty should be requested */ 111 int tty_flag = 0; 112 113 /* 114 * Flag indicating that the current process should be backgrounded and 115 * a new mux-client launched in the foreground for ControlPersist. 116 */ 117 int need_controlpersist_detach = 0; 118 119 /* Copies of flags for ControlPersist foreground mux-client */ 120 int ostdin_null_flag, osession_type, otty_flag, orequest_tty; 121 122 /* 123 * General data structure for command line options and options configurable 124 * in configuration files. See readconf.h. 125 */ 126 Options options; 127 128 /* optional user configfile */ 129 char *config = NULL; 130 131 /* 132 * Name of the host we are connecting to. This is the name given on the 133 * command line, or the Hostname specified for the user-supplied name in a 134 * configuration file. 135 */ 136 char *host; 137 138 /* 139 * A config can specify a path to forward, overriding SSH_AUTH_SOCK. If this is 140 * not NULL, forward the socket at this path instead. 141 */ 142 char *forward_agent_sock_path = NULL; 143 144 /* socket address the host resolves to */ 145 struct sockaddr_storage hostaddr; 146 147 /* Private host keys. */ 148 Sensitive sensitive_data; 149 150 /* command to be executed */ 151 struct sshbuf *command; 152 153 /* # of replies received for global requests */ 154 static int forward_confirms_pending = -1; 155 156 /* mux.c */ 157 extern int muxserver_sock; 158 extern u_int muxclient_command; 159 160 /* Prints a help message to the user. This function never returns. */ 161 162 static void 163 usage(void) 164 { 165 fprintf(stderr, 166 "usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface]\n" 167 " [-b bind_address] [-c cipher_spec] [-D [bind_address:]port]\n" 168 " [-E log_file] [-e escape_char] [-F configfile] [-I pkcs11]\n" 169 " [-i identity_file] [-J [user@]host[:port]] [-L address]\n" 170 " [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]\n" 171 " [-Q query_option] [-R address] [-S ctl_path] [-W host:port]\n" 172 " [-w local_tun[:remote_tun]] destination [command [argument ...]]\n" 173 ); 174 exit(255); 175 } 176 177 static int ssh_session2(struct ssh *, const struct ssh_conn_info *); 178 static void load_public_identity_files(const struct ssh_conn_info *); 179 static void main_sigchld_handler(int); 180 181 /* ~/ expand a list of paths. NB. assumes path[n] is heap-allocated. */ 182 static void 183 tilde_expand_paths(char **paths, u_int num_paths) 184 { 185 u_int i; 186 char *cp; 187 188 for (i = 0; i < num_paths; i++) { 189 cp = tilde_expand_filename(paths[i], getuid()); 190 free(paths[i]); 191 paths[i] = cp; 192 } 193 } 194 195 /* 196 * Expands the set of percent_expand options used by the majority of keywords 197 * in the client that support percent expansion. 198 * Caller must free returned string. 199 */ 200 static char * 201 default_client_percent_expand(const char *str, 202 const struct ssh_conn_info *cinfo) 203 { 204 return percent_expand(str, 205 DEFAULT_CLIENT_PERCENT_EXPAND_ARGS(cinfo), 206 (char *)NULL); 207 } 208 209 /* 210 * Expands the set of percent_expand options used by the majority of keywords 211 * AND perform environment variable substitution. 212 * Caller must free returned string. 213 */ 214 static char * 215 default_client_percent_dollar_expand(const char *str, 216 const struct ssh_conn_info *cinfo) 217 { 218 char *ret; 219 220 ret = percent_dollar_expand(str, 221 DEFAULT_CLIENT_PERCENT_EXPAND_ARGS(cinfo), 222 (char *)NULL); 223 if (ret == NULL) 224 fatal("invalid environment variable expansion"); 225 return ret; 226 } 227 228 /* 229 * Attempt to resolve a host name / port to a set of addresses and 230 * optionally return any CNAMEs encountered along the way. 231 * Returns NULL on failure. 232 * NB. this function must operate with a options having undefined members. 233 */ 234 static struct addrinfo * 235 resolve_host(const char *name, int port, int logerr, char *cname, size_t clen) 236 { 237 char strport[NI_MAXSERV]; 238 const char *errstr = NULL; 239 struct addrinfo hints, *res; 240 int gaierr; 241 LogLevel loglevel = SYSLOG_LEVEL_DEBUG1; 242 243 if (port <= 0) 244 port = default_ssh_port(); 245 if (cname != NULL) 246 *cname = '\0'; 247 debug3_f("lookup %s:%d", name, port); 248 249 snprintf(strport, sizeof strport, "%d", port); 250 memset(&hints, 0, sizeof(hints)); 251 hints.ai_family = options.address_family == -1 ? 252 AF_UNSPEC : options.address_family; 253 hints.ai_socktype = SOCK_STREAM; 254 if (cname != NULL) 255 hints.ai_flags = AI_CANONNAME; 256 if ((gaierr = getaddrinfo(name, strport, &hints, &res)) != 0) { 257 if (logerr || (gaierr != EAI_NONAME && gaierr != EAI_NODATA)) 258 loglevel = SYSLOG_LEVEL_ERROR; 259 do_log2(loglevel, "%s: Could not resolve hostname %.100s: %s", 260 __progname, name, ssh_gai_strerror(gaierr)); 261 return NULL; 262 } 263 if (cname != NULL && res->ai_canonname != NULL) { 264 if (!valid_domain(res->ai_canonname, 0, &errstr)) { 265 error("ignoring bad CNAME \"%s\" for host \"%s\": %s", 266 res->ai_canonname, name, errstr); 267 } else if (strlcpy(cname, res->ai_canonname, clen) >= clen) { 268 error_f("host \"%s\" cname \"%s\" too long (max %lu)", 269 name, res->ai_canonname, (u_long)clen); 270 if (clen > 0) 271 *cname = '\0'; 272 } 273 } 274 return res; 275 } 276 277 /* Returns non-zero if name can only be an address and not a hostname */ 278 static int 279 is_addr_fast(const char *name) 280 { 281 return (strchr(name, '%') != NULL || strchr(name, ':') != NULL || 282 strspn(name, "0123456789.") == strlen(name)); 283 } 284 285 /* Returns non-zero if name represents a valid, single address */ 286 static int 287 is_addr(const char *name) 288 { 289 char strport[NI_MAXSERV]; 290 struct addrinfo hints, *res; 291 292 if (is_addr_fast(name)) 293 return 1; 294 295 snprintf(strport, sizeof strport, "%u", default_ssh_port()); 296 memset(&hints, 0, sizeof(hints)); 297 hints.ai_family = options.address_family == -1 ? 298 AF_UNSPEC : options.address_family; 299 hints.ai_socktype = SOCK_STREAM; 300 hints.ai_flags = AI_NUMERICHOST|AI_NUMERICSERV; 301 if (getaddrinfo(name, strport, &hints, &res) != 0) 302 return 0; 303 if (res == NULL || res->ai_next != NULL) { 304 freeaddrinfo(res); 305 return 0; 306 } 307 freeaddrinfo(res); 308 return 1; 309 } 310 311 /* 312 * Attempt to resolve a numeric host address / port to a single address. 313 * Returns a canonical address string. 314 * Returns NULL on failure. 315 * NB. this function must operate with a options having undefined members. 316 */ 317 static struct addrinfo * 318 resolve_addr(const char *name, int port, char *caddr, size_t clen) 319 { 320 char addr[NI_MAXHOST], strport[NI_MAXSERV]; 321 struct addrinfo hints, *res; 322 int gaierr; 323 324 if (port <= 0) 325 port = default_ssh_port(); 326 snprintf(strport, sizeof strport, "%u", port); 327 memset(&hints, 0, sizeof(hints)); 328 hints.ai_family = options.address_family == -1 ? 329 AF_UNSPEC : options.address_family; 330 hints.ai_socktype = SOCK_STREAM; 331 hints.ai_flags = AI_NUMERICHOST|AI_NUMERICSERV; 332 if ((gaierr = getaddrinfo(name, strport, &hints, &res)) != 0) { 333 debug2_f("could not resolve name %.100s as address: %s", 334 name, ssh_gai_strerror(gaierr)); 335 return NULL; 336 } 337 if (res == NULL) { 338 debug_f("getaddrinfo %.100s returned no addresses", name); 339 return NULL; 340 } 341 if (res->ai_next != NULL) { 342 debug_f("getaddrinfo %.100s returned multiple addresses", name); 343 goto fail; 344 } 345 if ((gaierr = getnameinfo(res->ai_addr, res->ai_addrlen, 346 addr, sizeof(addr), NULL, 0, NI_NUMERICHOST)) != 0) { 347 debug_f("Could not format address for name %.100s: %s", 348 name, ssh_gai_strerror(gaierr)); 349 goto fail; 350 } 351 if (strlcpy(caddr, addr, clen) >= clen) { 352 error_f("host \"%s\" addr \"%s\" too long (max %lu)", 353 name, addr, (u_long)clen); 354 if (clen > 0) 355 *caddr = '\0'; 356 fail: 357 freeaddrinfo(res); 358 return NULL; 359 } 360 return res; 361 } 362 363 /* 364 * Check whether the cname is a permitted replacement for the hostname 365 * and perform the replacement if it is. 366 * NB. this function must operate with a options having undefined members. 367 */ 368 static int 369 check_follow_cname(int direct, char **namep, const char *cname) 370 { 371 int i; 372 struct allowed_cname *rule; 373 374 if (*cname == '\0' || !config_has_permitted_cnames(&options) || 375 strcmp(*namep, cname) == 0) 376 return 0; 377 if (options.canonicalize_hostname == SSH_CANONICALISE_NO) 378 return 0; 379 /* 380 * Don't attempt to canonicalize names that will be interpreted by 381 * a proxy or jump host unless the user specifically requests so. 382 */ 383 if (!direct && 384 options.canonicalize_hostname != SSH_CANONICALISE_ALWAYS) 385 return 0; 386 debug3_f("check \"%s\" CNAME \"%s\"", *namep, cname); 387 for (i = 0; i < options.num_permitted_cnames; i++) { 388 rule = options.permitted_cnames + i; 389 if (match_pattern_list(*namep, rule->source_list, 1) != 1 || 390 match_pattern_list(cname, rule->target_list, 1) != 1) 391 continue; 392 verbose("Canonicalized DNS aliased hostname " 393 "\"%s\" => \"%s\"", *namep, cname); 394 free(*namep); 395 *namep = xstrdup(cname); 396 return 1; 397 } 398 return 0; 399 } 400 401 /* 402 * Attempt to resolve the supplied hostname after applying the user's 403 * canonicalization rules. Returns the address list for the host or NULL 404 * if no name was found after canonicalization. 405 * NB. this function must operate with a options having undefined members. 406 */ 407 static struct addrinfo * 408 resolve_canonicalize(char **hostp, int port) 409 { 410 int i, direct, ndots; 411 char *cp, *fullhost, newname[NI_MAXHOST]; 412 struct addrinfo *addrs; 413 414 /* 415 * Attempt to canonicalise addresses, regardless of 416 * whether hostname canonicalisation was requested 417 */ 418 if ((addrs = resolve_addr(*hostp, port, 419 newname, sizeof(newname))) != NULL) { 420 debug2_f("hostname %.100s is address", *hostp); 421 if (strcasecmp(*hostp, newname) != 0) { 422 debug2_f("canonicalised address \"%s\" => \"%s\"", 423 *hostp, newname); 424 free(*hostp); 425 *hostp = xstrdup(newname); 426 } 427 return addrs; 428 } 429 430 /* 431 * If this looks like an address but didn't parse as one, it might 432 * be an address with an invalid interface scope. Skip further 433 * attempts at canonicalisation. 434 */ 435 if (is_addr_fast(*hostp)) { 436 debug_f("hostname %.100s is an unrecognised address", *hostp); 437 return NULL; 438 } 439 440 if (options.canonicalize_hostname == SSH_CANONICALISE_NO) 441 return NULL; 442 443 /* 444 * Don't attempt to canonicalize names that will be interpreted by 445 * a proxy unless the user specifically requests so. 446 */ 447 direct = option_clear_or_none(options.proxy_command) && 448 options.jump_host == NULL; 449 if (!direct && 450 options.canonicalize_hostname != SSH_CANONICALISE_ALWAYS) 451 return NULL; 452 453 /* If domain name is anchored, then resolve it now */ 454 if ((*hostp)[strlen(*hostp) - 1] == '.') { 455 debug3_f("name is fully qualified"); 456 fullhost = xstrdup(*hostp); 457 if ((addrs = resolve_host(fullhost, port, 0, 458 newname, sizeof(newname))) != NULL) 459 goto found; 460 free(fullhost); 461 goto notfound; 462 } 463 464 /* Don't apply canonicalization to sufficiently-qualified hostnames */ 465 ndots = 0; 466 for (cp = *hostp; *cp != '\0'; cp++) { 467 if (*cp == '.') 468 ndots++; 469 } 470 if (ndots > options.canonicalize_max_dots) { 471 debug3_f("not canonicalizing hostname \"%s\" (max dots %d)", 472 *hostp, options.canonicalize_max_dots); 473 return NULL; 474 } 475 /* Attempt each supplied suffix */ 476 for (i = 0; i < options.num_canonical_domains; i++) { 477 if (strcasecmp(options.canonical_domains[i], "none") == 0) 478 break; 479 xasprintf(&fullhost, "%s.%s.", *hostp, 480 options.canonical_domains[i]); 481 debug3_f("attempting \"%s\" => \"%s\"", *hostp, fullhost); 482 if ((addrs = resolve_host(fullhost, port, 0, 483 newname, sizeof(newname))) == NULL) { 484 free(fullhost); 485 continue; 486 } 487 found: 488 /* Remove trailing '.' */ 489 fullhost[strlen(fullhost) - 1] = '\0'; 490 /* Follow CNAME if requested */ 491 if (!check_follow_cname(direct, &fullhost, newname)) { 492 debug("Canonicalized hostname \"%s\" => \"%s\"", 493 *hostp, fullhost); 494 } 495 free(*hostp); 496 *hostp = fullhost; 497 return addrs; 498 } 499 notfound: 500 if (!options.canonicalize_fallback_local) 501 fatal("%s: Could not resolve host \"%s\"", __progname, *hostp); 502 debug2_f("host %s not found in any suffix", *hostp); 503 return NULL; 504 } 505 506 /* 507 * Check the result of hostkey loading, ignoring some errors and either 508 * discarding the key or fatal()ing for others. 509 */ 510 static void 511 check_load(int r, struct sshkey **k, const char *path, const char *message) 512 { 513 switch (r) { 514 case 0: 515 /* Check RSA keys size and discard if undersized */ 516 if (k != NULL && *k != NULL && 517 (r = sshkey_check_rsa_length(*k, 518 options.required_rsa_size)) != 0) { 519 error_r(r, "load %s \"%s\"", message, path); 520 free(*k); 521 *k = NULL; 522 } 523 break; 524 case SSH_ERR_INTERNAL_ERROR: 525 case SSH_ERR_ALLOC_FAIL: 526 fatal_r(r, "load %s \"%s\"", message, path); 527 case SSH_ERR_SYSTEM_ERROR: 528 /* Ignore missing files */ 529 if (errno == ENOENT) 530 break; 531 /* FALLTHROUGH */ 532 default: 533 error_r(r, "load %s \"%s\"", message, path); 534 break; 535 } 536 } 537 538 /* 539 * Read per-user configuration file. Ignore the system wide config 540 * file if the user specifies a config file on the command line. 541 */ 542 static void 543 process_config_files(const char *host_name, struct passwd *pw, int final_pass, 544 int *want_final_pass) 545 { 546 char buf[PATH_MAX]; 547 int r; 548 549 if (config != NULL) { 550 if (strcasecmp(config, "none") != 0 && 551 !read_config_file(config, pw, host, host_name, &options, 552 SSHCONF_USERCONF | (final_pass ? SSHCONF_FINAL : 0), 553 want_final_pass)) 554 fatal("Can't open user config file %.100s: " 555 "%.100s", config, strerror(errno)); 556 } else { 557 r = snprintf(buf, sizeof buf, "%s/%s", pw->pw_dir, 558 _PATH_SSH_USER_CONFFILE); 559 if (r > 0 && (size_t)r < sizeof(buf)) 560 (void)read_config_file(buf, pw, host, host_name, 561 &options, SSHCONF_CHECKPERM | SSHCONF_USERCONF | 562 (final_pass ? SSHCONF_FINAL : 0), want_final_pass); 563 564 /* Read systemwide configuration file after user config. */ 565 (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, 566 host, host_name, &options, 567 final_pass ? SSHCONF_FINAL : 0, want_final_pass); 568 } 569 } 570 571 /* Rewrite the port number in an addrinfo list of addresses */ 572 static void 573 set_addrinfo_port(struct addrinfo *addrs, int port) 574 { 575 struct addrinfo *addr; 576 577 for (addr = addrs; addr != NULL; addr = addr->ai_next) { 578 switch (addr->ai_family) { 579 case AF_INET: 580 ((struct sockaddr_in *)addr->ai_addr)-> 581 sin_port = htons(port); 582 break; 583 case AF_INET6: 584 ((struct sockaddr_in6 *)addr->ai_addr)-> 585 sin6_port = htons(port); 586 break; 587 } 588 } 589 } 590 591 static void 592 ssh_conn_info_free(struct ssh_conn_info *cinfo) 593 { 594 if (cinfo == NULL) 595 return; 596 free(cinfo->conn_hash_hex); 597 free(cinfo->shorthost); 598 free(cinfo->uidstr); 599 free(cinfo->keyalias); 600 free(cinfo->thishost); 601 free(cinfo->host_arg); 602 free(cinfo->portstr); 603 free(cinfo->remhost); 604 free(cinfo->remuser); 605 free(cinfo->homedir); 606 free(cinfo->locuser); 607 free(cinfo); 608 } 609 610 /* 611 * Main program for the ssh client. 612 */ 613 int 614 main(int ac, char **av) 615 { 616 struct ssh *ssh = NULL; 617 int i, r, opt, exit_status, use_syslog, direct, timeout_ms; 618 int was_addr, config_test = 0, opt_terminated = 0, want_final_pass = 0; 619 char *p, *cp, *line, *argv0, *logfile, *host_arg; 620 char cname[NI_MAXHOST], thishost[NI_MAXHOST]; 621 struct stat st; 622 struct passwd *pw; 623 extern int optind, optreset; 624 extern char *optarg; 625 struct Forward fwd; 626 struct addrinfo *addrs = NULL; 627 size_t n, len; 628 u_int j; 629 struct ssh_conn_info *cinfo = NULL; 630 631 /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ 632 sanitise_stdfd(); 633 634 /* 635 * Discard other fds that are hanging around. These can cause problem 636 * with backgrounded ssh processes started by ControlPersist. 637 */ 638 closefrom(STDERR_FILENO + 1); 639 640 if (getuid() != geteuid()) 641 fatal("ssh setuid not supported."); 642 if (getgid() != getegid()) 643 fatal("ssh setgid not supported."); 644 645 /* Get user data. */ 646 pw = getpwuid(getuid()); 647 if (!pw) { 648 logit("No user exists for uid %lu", (u_long)getuid()); 649 exit(255); 650 } 651 /* Take a copy of the returned structure. */ 652 pw = pwcopy(pw); 653 654 /* 655 * Set our umask to something reasonable, as some files are created 656 * with the default umask. This will make them world-readable but 657 * writable only by the owner, which is ok for all files for which we 658 * don't set the modes explicitly. 659 */ 660 umask(022 | umask(077)); 661 662 setlocale(LC_CTYPE, ""); 663 664 /* 665 * Initialize option structure to indicate that no values have been 666 * set. 667 */ 668 initialize_options(&options); 669 670 /* 671 * Prepare main ssh transport/connection structures 672 */ 673 if ((ssh = ssh_alloc_session_state()) == NULL) 674 fatal("Couldn't allocate session state"); 675 channel_init_channels(ssh); 676 677 /* Parse command-line arguments. */ 678 host = NULL; 679 use_syslog = 0; 680 logfile = NULL; 681 argv0 = av[0]; 682 683 again: 684 while ((opt = getopt(ac, av, "1246ab:c:e:fgi:kl:m:no:p:qstvx" 685 "AB:CD:E:F:GI:J:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) { /* HUZdhjruz */ 686 switch (opt) { 687 case '1': 688 fatal("SSH protocol v.1 is no longer supported"); 689 break; 690 case '2': 691 /* Ignored */ 692 break; 693 case '4': 694 options.address_family = AF_INET; 695 break; 696 case '6': 697 options.address_family = AF_INET6; 698 break; 699 case 'n': 700 options.stdin_null = 1; 701 break; 702 case 'f': 703 options.fork_after_authentication = 1; 704 options.stdin_null = 1; 705 break; 706 case 'x': 707 options.forward_x11 = 0; 708 break; 709 case 'X': 710 options.forward_x11 = 1; 711 break; 712 case 'y': 713 use_syslog = 1; 714 break; 715 case 'E': 716 logfile = optarg; 717 break; 718 case 'G': 719 config_test = 1; 720 break; 721 case 'Y': 722 options.forward_x11 = 1; 723 options.forward_x11_trusted = 1; 724 break; 725 case 'g': 726 options.fwd_opts.gateway_ports = 1; 727 break; 728 case 'O': 729 if (options.stdio_forward_host != NULL) 730 fatal("Cannot specify multiplexing " 731 "command with -W"); 732 else if (muxclient_command != 0) 733 fatal("Multiplexing command already specified"); 734 if (strcmp(optarg, "check") == 0) 735 muxclient_command = SSHMUX_COMMAND_ALIVE_CHECK; 736 else if (strcmp(optarg, "forward") == 0) 737 muxclient_command = SSHMUX_COMMAND_FORWARD; 738 else if (strcmp(optarg, "exit") == 0) 739 muxclient_command = SSHMUX_COMMAND_TERMINATE; 740 else if (strcmp(optarg, "stop") == 0) 741 muxclient_command = SSHMUX_COMMAND_STOP; 742 else if (strcmp(optarg, "cancel") == 0) 743 muxclient_command = SSHMUX_COMMAND_CANCEL_FWD; 744 else if (strcmp(optarg, "proxy") == 0) 745 muxclient_command = SSHMUX_COMMAND_PROXY; 746 else 747 fatal("Invalid multiplex command."); 748 break; 749 case 'P': /* deprecated */ 750 break; 751 case 'Q': 752 cp = NULL; 753 if (strcmp(optarg, "cipher") == 0 || 754 strcasecmp(optarg, "Ciphers") == 0) 755 cp = cipher_alg_list('\n', 0); 756 else if (strcmp(optarg, "cipher-auth") == 0) 757 cp = cipher_alg_list('\n', 1); 758 else if (strcmp(optarg, "mac") == 0 || 759 strcasecmp(optarg, "MACs") == 0) 760 cp = mac_alg_list('\n'); 761 else if (strcmp(optarg, "kex") == 0 || 762 strcasecmp(optarg, "KexAlgorithms") == 0) 763 cp = kex_alg_list('\n'); 764 else if (strcmp(optarg, "key") == 0) 765 cp = sshkey_alg_list(0, 0, 0, '\n'); 766 else if (strcmp(optarg, "key-cert") == 0) 767 cp = sshkey_alg_list(1, 0, 0, '\n'); 768 else if (strcmp(optarg, "key-plain") == 0) 769 cp = sshkey_alg_list(0, 1, 0, '\n'); 770 else if (strcmp(optarg, "key-sig") == 0 || 771 strcasecmp(optarg, "PubkeyAcceptedKeyTypes") == 0 || /* deprecated name */ 772 strcasecmp(optarg, "PubkeyAcceptedAlgorithms") == 0 || 773 strcasecmp(optarg, "HostKeyAlgorithms") == 0 || 774 strcasecmp(optarg, "HostbasedKeyTypes") == 0 || /* deprecated name */ 775 strcasecmp(optarg, "HostbasedAcceptedKeyTypes") == 0 || /* deprecated name */ 776 strcasecmp(optarg, "HostbasedAcceptedAlgorithms") == 0) 777 cp = sshkey_alg_list(0, 0, 1, '\n'); 778 else if (strcmp(optarg, "sig") == 0) 779 cp = sshkey_alg_list(0, 1, 1, '\n'); 780 else if (strcmp(optarg, "protocol-version") == 0) 781 cp = xstrdup("2"); 782 else if (strcmp(optarg, "compression") == 0) { 783 cp = xstrdup(compression_alg_list(0)); 784 len = strlen(cp); 785 for (n = 0; n < len; n++) 786 if (cp[n] == ',') 787 cp[n] = '\n'; 788 } else if (strcmp(optarg, "help") == 0) { 789 cp = xstrdup( 790 "cipher\ncipher-auth\ncompression\nkex\n" 791 "key\nkey-cert\nkey-plain\nkey-sig\nmac\n" 792 "protocol-version\nsig"); 793 } 794 if (cp == NULL) 795 fatal("Unsupported query \"%s\"", optarg); 796 printf("%s\n", cp); 797 free(cp); 798 exit(0); 799 break; 800 case 'a': 801 options.forward_agent = 0; 802 break; 803 case 'A': 804 options.forward_agent = 1; 805 break; 806 case 'k': 807 options.gss_deleg_creds = 0; 808 break; 809 case 'K': 810 options.gss_authentication = 1; 811 options.gss_deleg_creds = 1; 812 break; 813 case 'i': 814 p = tilde_expand_filename(optarg, getuid()); 815 if (stat(p, &st) == -1) 816 fprintf(stderr, "Warning: Identity file %s " 817 "not accessible: %s.\n", p, 818 strerror(errno)); 819 else 820 add_identity_file(&options, NULL, p, 1); 821 free(p); 822 break; 823 case 'I': 824 #ifdef ENABLE_PKCS11 825 free(options.pkcs11_provider); 826 options.pkcs11_provider = xstrdup(optarg); 827 #else 828 fprintf(stderr, "no support for PKCS#11.\n"); 829 #endif 830 break; 831 case 'J': 832 if (options.jump_host != NULL) { 833 fatal("Only a single -J option is permitted " 834 "(use commas to separate multiple " 835 "jump hops)"); 836 } 837 if (options.proxy_command != NULL) 838 fatal("Cannot specify -J with ProxyCommand"); 839 if (parse_jump(optarg, &options, 1) == -1) 840 fatal("Invalid -J argument"); 841 options.proxy_command = xstrdup("none"); 842 break; 843 case 't': 844 if (options.request_tty == REQUEST_TTY_YES) 845 options.request_tty = REQUEST_TTY_FORCE; 846 else 847 options.request_tty = REQUEST_TTY_YES; 848 break; 849 case 'v': 850 if (debug_flag == 0) { 851 debug_flag = 1; 852 options.log_level = SYSLOG_LEVEL_DEBUG1; 853 } else { 854 if (options.log_level < SYSLOG_LEVEL_DEBUG3) { 855 debug_flag++; 856 options.log_level++; 857 } 858 } 859 break; 860 case 'V': 861 fprintf(stderr, "%s, %s\n", 862 SSH_VERSION, SSH_OPENSSL_VERSION); 863 if (opt == 'V') 864 exit(0); 865 break; 866 case 'w': 867 if (options.tun_open == -1) 868 options.tun_open = SSH_TUNMODE_DEFAULT; 869 options.tun_local = a2tun(optarg, &options.tun_remote); 870 if (options.tun_local == SSH_TUNID_ERR) { 871 fprintf(stderr, 872 "Bad tun device '%s'\n", optarg); 873 exit(255); 874 } 875 break; 876 case 'W': 877 if (options.stdio_forward_host != NULL) 878 fatal("stdio forward already specified"); 879 if (muxclient_command != 0) 880 fatal("Cannot specify stdio forward with -O"); 881 if (parse_forward(&fwd, optarg, 1, 0)) { 882 options.stdio_forward_host = fwd.listen_host; 883 options.stdio_forward_port = fwd.listen_port; 884 free(fwd.connect_host); 885 } else { 886 fprintf(stderr, 887 "Bad stdio forwarding specification '%s'\n", 888 optarg); 889 exit(255); 890 } 891 options.request_tty = REQUEST_TTY_NO; 892 options.session_type = SESSION_TYPE_NONE; 893 break; 894 case 'q': 895 options.log_level = SYSLOG_LEVEL_QUIET; 896 break; 897 case 'e': 898 if (optarg[0] == '^' && optarg[2] == 0 && 899 (u_char) optarg[1] >= 64 && 900 (u_char) optarg[1] < 128) 901 options.escape_char = (u_char) optarg[1] & 31; 902 else if (strlen(optarg) == 1) 903 options.escape_char = (u_char) optarg[0]; 904 else if (strcmp(optarg, "none") == 0) 905 options.escape_char = SSH_ESCAPECHAR_NONE; 906 else { 907 fprintf(stderr, "Bad escape character '%s'.\n", 908 optarg); 909 exit(255); 910 } 911 break; 912 case 'c': 913 if (!ciphers_valid(*optarg == '+' || *optarg == '^' ? 914 optarg + 1 : optarg)) { 915 fprintf(stderr, "Unknown cipher type '%s'\n", 916 optarg); 917 exit(255); 918 } 919 free(options.ciphers); 920 options.ciphers = xstrdup(optarg); 921 break; 922 case 'm': 923 if (mac_valid(optarg)) { 924 free(options.macs); 925 options.macs = xstrdup(optarg); 926 } else { 927 fprintf(stderr, "Unknown mac type '%s'\n", 928 optarg); 929 exit(255); 930 } 931 break; 932 case 'M': 933 if (options.control_master == SSHCTL_MASTER_YES) 934 options.control_master = SSHCTL_MASTER_ASK; 935 else 936 options.control_master = SSHCTL_MASTER_YES; 937 break; 938 case 'p': 939 if (options.port == -1) { 940 options.port = a2port(optarg); 941 if (options.port <= 0) { 942 fprintf(stderr, "Bad port '%s'\n", 943 optarg); 944 exit(255); 945 } 946 } 947 break; 948 case 'l': 949 if (options.user == NULL) 950 options.user = optarg; 951 break; 952 953 case 'L': 954 if (parse_forward(&fwd, optarg, 0, 0)) 955 add_local_forward(&options, &fwd); 956 else { 957 fprintf(stderr, 958 "Bad local forwarding specification '%s'\n", 959 optarg); 960 exit(255); 961 } 962 break; 963 964 case 'R': 965 if (parse_forward(&fwd, optarg, 0, 1) || 966 parse_forward(&fwd, optarg, 1, 1)) { 967 add_remote_forward(&options, &fwd); 968 } else { 969 fprintf(stderr, 970 "Bad remote forwarding specification " 971 "'%s'\n", optarg); 972 exit(255); 973 } 974 break; 975 976 case 'D': 977 if (parse_forward(&fwd, optarg, 1, 0)) { 978 add_local_forward(&options, &fwd); 979 } else { 980 fprintf(stderr, 981 "Bad dynamic forwarding specification " 982 "'%s'\n", optarg); 983 exit(255); 984 } 985 break; 986 987 case 'C': 988 #ifdef WITH_ZLIB 989 options.compression = 1; 990 #else 991 error("Compression not supported, disabling."); 992 #endif 993 break; 994 case 'N': 995 if (options.session_type != -1 && 996 options.session_type != SESSION_TYPE_NONE) 997 fatal("Cannot specify -N with -s/SessionType"); 998 options.session_type = SESSION_TYPE_NONE; 999 options.request_tty = REQUEST_TTY_NO; 1000 break; 1001 case 'T': 1002 options.request_tty = REQUEST_TTY_NO; 1003 break; 1004 case 'o': 1005 line = xstrdup(optarg); 1006 if (process_config_line(&options, pw, 1007 host ? host : "", host ? host : "", line, 1008 "command-line", 0, NULL, SSHCONF_USERCONF) != 0) 1009 exit(255); 1010 free(line); 1011 break; 1012 case 's': 1013 if (options.session_type != -1 && 1014 options.session_type != SESSION_TYPE_SUBSYSTEM) 1015 fatal("Cannot specify -s with -N/SessionType"); 1016 options.session_type = SESSION_TYPE_SUBSYSTEM; 1017 break; 1018 case 'S': 1019 free(options.control_path); 1020 options.control_path = xstrdup(optarg); 1021 break; 1022 case 'b': 1023 options.bind_address = optarg; 1024 break; 1025 case 'B': 1026 options.bind_interface = optarg; 1027 break; 1028 case 'F': 1029 config = optarg; 1030 break; 1031 default: 1032 usage(); 1033 } 1034 } 1035 1036 if (optind > 1 && strcmp(av[optind - 1], "--") == 0) 1037 opt_terminated = 1; 1038 1039 ac -= optind; 1040 av += optind; 1041 1042 if (ac > 0 && !host) { 1043 int tport; 1044 char *tuser; 1045 switch (parse_ssh_uri(*av, &tuser, &host, &tport)) { 1046 case -1: 1047 usage(); 1048 break; 1049 case 0: 1050 if (options.user == NULL) { 1051 options.user = tuser; 1052 tuser = NULL; 1053 } 1054 free(tuser); 1055 if (options.port == -1 && tport != -1) 1056 options.port = tport; 1057 break; 1058 default: 1059 p = xstrdup(*av); 1060 cp = strrchr(p, '@'); 1061 if (cp != NULL) { 1062 if (cp == p) 1063 usage(); 1064 if (options.user == NULL) { 1065 options.user = p; 1066 p = NULL; 1067 } 1068 *cp++ = '\0'; 1069 host = xstrdup(cp); 1070 free(p); 1071 } else 1072 host = p; 1073 break; 1074 } 1075 if (ac > 1 && !opt_terminated) { 1076 optind = optreset = 1; 1077 goto again; 1078 } 1079 ac--, av++; 1080 } 1081 1082 /* Check that we got a host name. */ 1083 if (!host) 1084 usage(); 1085 1086 host_arg = xstrdup(host); 1087 1088 #ifdef WITH_OPENSSL 1089 OpenSSL_add_all_algorithms(); 1090 ERR_load_crypto_strings(); 1091 #endif 1092 1093 /* Initialize the command to execute on remote host. */ 1094 if ((command = sshbuf_new()) == NULL) 1095 fatal("sshbuf_new failed"); 1096 1097 /* 1098 * Save the command to execute on the remote host in a buffer. There 1099 * is no limit on the length of the command, except by the maximum 1100 * packet size. Also sets the tty flag if there is no command. 1101 */ 1102 if (!ac) { 1103 /* No command specified - execute shell on a tty. */ 1104 if (options.session_type == SESSION_TYPE_SUBSYSTEM) { 1105 fprintf(stderr, 1106 "You must specify a subsystem to invoke.\n"); 1107 usage(); 1108 } 1109 } else { 1110 /* A command has been specified. Store it into the buffer. */ 1111 for (i = 0; i < ac; i++) { 1112 if ((r = sshbuf_putf(command, "%s%s", 1113 i ? " " : "", av[i])) != 0) 1114 fatal_fr(r, "buffer error"); 1115 } 1116 } 1117 1118 ssh_signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */ 1119 1120 /* 1121 * Initialize "log" output. Since we are the client all output 1122 * goes to stderr unless otherwise specified by -y or -E. 1123 */ 1124 if (use_syslog && logfile != NULL) 1125 fatal("Can't specify both -y and -E"); 1126 if (logfile != NULL) 1127 log_redirect_stderr_to(logfile); 1128 log_init(argv0, 1129 options.log_level == SYSLOG_LEVEL_NOT_SET ? 1130 SYSLOG_LEVEL_INFO : options.log_level, 1131 options.log_facility == SYSLOG_FACILITY_NOT_SET ? 1132 SYSLOG_FACILITY_USER : options.log_facility, 1133 !use_syslog); 1134 1135 if (debug_flag) 1136 logit("%s, %s", SSH_VERSION, SSH_OPENSSL_VERSION); 1137 1138 /* Parse the configuration files */ 1139 process_config_files(host_arg, pw, 0, &want_final_pass); 1140 if (want_final_pass) 1141 debug("configuration requests final Match pass"); 1142 1143 /* Hostname canonicalisation needs a few options filled. */ 1144 fill_default_options_for_canonicalization(&options); 1145 1146 /* If the user has replaced the hostname then take it into use now */ 1147 if (options.hostname != NULL) { 1148 /* NB. Please keep in sync with readconf.c:match_cfg_line() */ 1149 cp = percent_expand(options.hostname, 1150 "h", host, (char *)NULL); 1151 free(host); 1152 host = cp; 1153 free(options.hostname); 1154 options.hostname = xstrdup(host); 1155 } 1156 1157 /* Don't lowercase addresses, they will be explicitly canonicalised */ 1158 if ((was_addr = is_addr(host)) == 0) 1159 lowercase(host); 1160 1161 /* 1162 * Try to canonicalize if requested by configuration or the 1163 * hostname is an address. 1164 */ 1165 if (options.canonicalize_hostname != SSH_CANONICALISE_NO || was_addr) 1166 addrs = resolve_canonicalize(&host, options.port); 1167 1168 /* 1169 * If CanonicalizePermittedCNAMEs have been specified but 1170 * other canonicalization did not happen (by not being requested 1171 * or by failing with fallback) then the hostname may still be changed 1172 * as a result of CNAME following. 1173 * 1174 * Try to resolve the bare hostname name using the system resolver's 1175 * usual search rules and then apply the CNAME follow rules. 1176 * 1177 * Skip the lookup if a ProxyCommand is being used unless the user 1178 * has specifically requested canonicalisation for this case via 1179 * CanonicalizeHostname=always 1180 */ 1181 direct = option_clear_or_none(options.proxy_command) && 1182 options.jump_host == NULL; 1183 if (addrs == NULL && config_has_permitted_cnames(&options) && (direct || 1184 options.canonicalize_hostname == SSH_CANONICALISE_ALWAYS)) { 1185 if ((addrs = resolve_host(host, options.port, 1186 direct, cname, sizeof(cname))) == NULL) { 1187 /* Don't fatal proxied host names not in the DNS */ 1188 if (direct) 1189 cleanup_exit(255); /* logged in resolve_host */ 1190 } else 1191 check_follow_cname(direct, &host, cname); 1192 } 1193 1194 /* 1195 * If canonicalisation is enabled then re-parse the configuration 1196 * files as new stanzas may match. 1197 */ 1198 if (options.canonicalize_hostname != 0 && !want_final_pass) { 1199 debug("hostname canonicalisation enabled, " 1200 "will re-parse configuration"); 1201 want_final_pass = 1; 1202 } 1203 1204 if (want_final_pass) { 1205 debug("re-parsing configuration"); 1206 free(options.hostname); 1207 options.hostname = xstrdup(host); 1208 process_config_files(host_arg, pw, 1, NULL); 1209 /* 1210 * Address resolution happens early with canonicalisation 1211 * enabled and the port number may have changed since, so 1212 * reset it in address list 1213 */ 1214 if (addrs != NULL && options.port > 0) 1215 set_addrinfo_port(addrs, options.port); 1216 } 1217 1218 /* Fill configuration defaults. */ 1219 if (fill_default_options(&options) != 0) 1220 cleanup_exit(255); 1221 1222 if (options.user == NULL) 1223 options.user = xstrdup(pw->pw_name); 1224 1225 /* 1226 * If ProxyJump option specified, then construct a ProxyCommand now. 1227 */ 1228 if (options.jump_host != NULL) { 1229 char port_s[8]; 1230 const char *jumpuser = options.jump_user, *sshbin = argv0; 1231 int port = options.port, jumpport = options.jump_port; 1232 1233 if (port <= 0) 1234 port = default_ssh_port(); 1235 if (jumpport <= 0) 1236 jumpport = default_ssh_port(); 1237 if (jumpuser == NULL) 1238 jumpuser = options.user; 1239 if (strcmp(options.jump_host, host) == 0 && port == jumpport && 1240 strcmp(options.user, jumpuser) == 0) 1241 fatal("jumphost loop via %s", options.jump_host); 1242 1243 /* 1244 * Try to use SSH indicated by argv[0], but fall back to 1245 * "ssh" if it appears unavailable. 1246 */ 1247 if (strchr(argv0, '/') != NULL && access(argv0, X_OK) != 0) 1248 sshbin = "ssh"; 1249 1250 /* Consistency check */ 1251 if (options.proxy_command != NULL) 1252 fatal("inconsistent options: ProxyCommand+ProxyJump"); 1253 /* Never use FD passing for ProxyJump */ 1254 options.proxy_use_fdpass = 0; 1255 snprintf(port_s, sizeof(port_s), "%d", options.jump_port); 1256 xasprintf(&options.proxy_command, 1257 "%s%s%s%s%s%s%s%s%s%s%.*s -W '[%%h]:%%p' %s", 1258 sshbin, 1259 /* Optional "-l user" argument if jump_user set */ 1260 options.jump_user == NULL ? "" : " -l ", 1261 options.jump_user == NULL ? "" : options.jump_user, 1262 /* Optional "-p port" argument if jump_port set */ 1263 options.jump_port <= 0 ? "" : " -p ", 1264 options.jump_port <= 0 ? "" : port_s, 1265 /* Optional additional jump hosts ",..." */ 1266 options.jump_extra == NULL ? "" : " -J ", 1267 options.jump_extra == NULL ? "" : options.jump_extra, 1268 /* Optional "-F" argument if -F specified */ 1269 config == NULL ? "" : " -F ", 1270 config == NULL ? "" : config, 1271 /* Optional "-v" arguments if -v set */ 1272 debug_flag ? " -" : "", 1273 debug_flag, "vvv", 1274 /* Mandatory hostname */ 1275 options.jump_host); 1276 debug("Setting implicit ProxyCommand from ProxyJump: %s", 1277 options.proxy_command); 1278 } 1279 1280 if (options.port == 0) 1281 options.port = default_ssh_port(); 1282 channel_set_af(ssh, options.address_family); 1283 1284 /* Tidy and check options */ 1285 if (options.host_key_alias != NULL) 1286 lowercase(options.host_key_alias); 1287 if (options.proxy_command != NULL && 1288 strcmp(options.proxy_command, "-") == 0 && 1289 options.proxy_use_fdpass) 1290 fatal("ProxyCommand=- and ProxyUseFDPass are incompatible"); 1291 if (options.update_hostkeys == SSH_UPDATE_HOSTKEYS_ASK) { 1292 if (options.control_persist && options.control_path != NULL) { 1293 debug("UpdateHostKeys=ask is incompatible with " 1294 "ControlPersist; disabling"); 1295 options.update_hostkeys = 0; 1296 } else if (sshbuf_len(command) != 0 || 1297 options.remote_command != NULL || 1298 options.request_tty == REQUEST_TTY_NO) { 1299 debug("UpdateHostKeys=ask is incompatible with " 1300 "remote command execution; disabling"); 1301 options.update_hostkeys = 0; 1302 } else if (options.log_level < SYSLOG_LEVEL_INFO) { 1303 /* no point logging anything; user won't see it */ 1304 options.update_hostkeys = 0; 1305 } 1306 } 1307 if (options.connection_attempts <= 0) 1308 fatal("Invalid number of ConnectionAttempts"); 1309 1310 if (sshbuf_len(command) != 0 && options.remote_command != NULL) 1311 fatal("Cannot execute command-line and remote command."); 1312 1313 /* Cannot fork to background if no command. */ 1314 if (options.fork_after_authentication && sshbuf_len(command) == 0 && 1315 options.remote_command == NULL && 1316 options.session_type != SESSION_TYPE_NONE) 1317 fatal("Cannot fork into background without a command " 1318 "to execute."); 1319 1320 /* reinit */ 1321 log_init(argv0, options.log_level, options.log_facility, !use_syslog); 1322 for (j = 0; j < options.num_log_verbose; j++) { 1323 if (strcasecmp(options.log_verbose[j], "none") == 0) 1324 break; 1325 log_verbose_add(options.log_verbose[j]); 1326 } 1327 1328 if (options.request_tty == REQUEST_TTY_YES || 1329 options.request_tty == REQUEST_TTY_FORCE) 1330 tty_flag = 1; 1331 1332 /* Allocate a tty by default if no command specified. */ 1333 if (sshbuf_len(command) == 0 && options.remote_command == NULL) 1334 tty_flag = options.request_tty != REQUEST_TTY_NO; 1335 1336 /* Force no tty */ 1337 if (options.request_tty == REQUEST_TTY_NO || 1338 (muxclient_command && muxclient_command != SSHMUX_COMMAND_PROXY) || 1339 options.session_type == SESSION_TYPE_NONE) 1340 tty_flag = 0; 1341 /* Do not allocate a tty if stdin is not a tty. */ 1342 if ((!isatty(fileno(stdin)) || options.stdin_null) && 1343 options.request_tty != REQUEST_TTY_FORCE) { 1344 if (tty_flag) 1345 logit("Pseudo-terminal will not be allocated because " 1346 "stdin is not a terminal."); 1347 tty_flag = 0; 1348 } 1349 1350 /* Set up strings used to percent_expand() arguments */ 1351 cinfo = xcalloc(1, sizeof(*cinfo)); 1352 if (gethostname(thishost, sizeof(thishost)) == -1) 1353 fatal("gethostname: %s", strerror(errno)); 1354 cinfo->thishost = xstrdup(thishost); 1355 thishost[strcspn(thishost, ".")] = '\0'; 1356 cinfo->shorthost = xstrdup(thishost); 1357 xasprintf(&cinfo->portstr, "%d", options.port); 1358 xasprintf(&cinfo->uidstr, "%llu", 1359 (unsigned long long)pw->pw_uid); 1360 cinfo->keyalias = xstrdup(options.host_key_alias ? 1361 options.host_key_alias : host_arg); 1362 cinfo->conn_hash_hex = ssh_connection_hash(cinfo->thishost, host, 1363 cinfo->portstr, options.user); 1364 cinfo->host_arg = xstrdup(host_arg); 1365 cinfo->remhost = xstrdup(host); 1366 cinfo->remuser = xstrdup(options.user); 1367 cinfo->homedir = xstrdup(pw->pw_dir); 1368 cinfo->locuser = xstrdup(pw->pw_name); 1369 1370 /* 1371 * Expand tokens in arguments. NB. LocalCommand is expanded later, 1372 * after port-forwarding is set up, so it may pick up any local 1373 * tunnel interface name allocated. 1374 */ 1375 if (options.remote_command != NULL) { 1376 debug3("expanding RemoteCommand: %s", options.remote_command); 1377 cp = options.remote_command; 1378 options.remote_command = default_client_percent_expand(cp, 1379 cinfo); 1380 debug3("expanded RemoteCommand: %s", options.remote_command); 1381 free(cp); 1382 if ((r = sshbuf_put(command, options.remote_command, 1383 strlen(options.remote_command))) != 0) 1384 fatal_fr(r, "buffer error"); 1385 } 1386 1387 if (options.control_path != NULL) { 1388 cp = tilde_expand_filename(options.control_path, getuid()); 1389 free(options.control_path); 1390 options.control_path = default_client_percent_dollar_expand(cp, 1391 cinfo); 1392 free(cp); 1393 } 1394 1395 if (options.identity_agent != NULL) { 1396 p = tilde_expand_filename(options.identity_agent, getuid()); 1397 cp = default_client_percent_dollar_expand(p, cinfo); 1398 free(p); 1399 free(options.identity_agent); 1400 options.identity_agent = cp; 1401 } 1402 1403 if (options.forward_agent_sock_path != NULL) { 1404 p = tilde_expand_filename(options.forward_agent_sock_path, 1405 getuid()); 1406 cp = default_client_percent_dollar_expand(p, cinfo); 1407 free(p); 1408 free(options.forward_agent_sock_path); 1409 options.forward_agent_sock_path = cp; 1410 if (stat(options.forward_agent_sock_path, &st) != 0) { 1411 error("Cannot forward agent socket path \"%s\": %s", 1412 options.forward_agent_sock_path, strerror(errno)); 1413 if (options.exit_on_forward_failure) 1414 cleanup_exit(255); 1415 } 1416 } 1417 1418 if (options.num_system_hostfiles > 0 && 1419 strcasecmp(options.system_hostfiles[0], "none") == 0) { 1420 if (options.num_system_hostfiles > 1) 1421 fatal("Invalid GlobalKnownHostsFiles: \"none\" " 1422 "appears with other entries"); 1423 free(options.system_hostfiles[0]); 1424 options.system_hostfiles[0] = NULL; 1425 options.num_system_hostfiles = 0; 1426 } 1427 1428 if (options.num_user_hostfiles > 0 && 1429 strcasecmp(options.user_hostfiles[0], "none") == 0) { 1430 if (options.num_user_hostfiles > 1) 1431 fatal("Invalid UserKnownHostsFiles: \"none\" " 1432 "appears with other entries"); 1433 free(options.user_hostfiles[0]); 1434 options.user_hostfiles[0] = NULL; 1435 options.num_user_hostfiles = 0; 1436 } 1437 for (j = 0; j < options.num_user_hostfiles; j++) { 1438 if (options.user_hostfiles[j] == NULL) 1439 continue; 1440 cp = tilde_expand_filename(options.user_hostfiles[j], getuid()); 1441 p = default_client_percent_dollar_expand(cp, cinfo); 1442 if (strcmp(options.user_hostfiles[j], p) != 0) 1443 debug3("expanded UserKnownHostsFile '%s' -> " 1444 "'%s'", options.user_hostfiles[j], p); 1445 free(options.user_hostfiles[j]); 1446 free(cp); 1447 options.user_hostfiles[j] = p; 1448 } 1449 1450 for (i = 0; i < options.num_local_forwards; i++) { 1451 if (options.local_forwards[i].listen_path != NULL) { 1452 cp = options.local_forwards[i].listen_path; 1453 p = options.local_forwards[i].listen_path = 1454 default_client_percent_expand(cp, cinfo); 1455 if (strcmp(cp, p) != 0) 1456 debug3("expanded LocalForward listen path " 1457 "'%s' -> '%s'", cp, p); 1458 free(cp); 1459 } 1460 if (options.local_forwards[i].connect_path != NULL) { 1461 cp = options.local_forwards[i].connect_path; 1462 p = options.local_forwards[i].connect_path = 1463 default_client_percent_expand(cp, cinfo); 1464 if (strcmp(cp, p) != 0) 1465 debug3("expanded LocalForward connect path " 1466 "'%s' -> '%s'", cp, p); 1467 free(cp); 1468 } 1469 } 1470 1471 for (i = 0; i < options.num_remote_forwards; i++) { 1472 if (options.remote_forwards[i].listen_path != NULL) { 1473 cp = options.remote_forwards[i].listen_path; 1474 p = options.remote_forwards[i].listen_path = 1475 default_client_percent_expand(cp, cinfo); 1476 if (strcmp(cp, p) != 0) 1477 debug3("expanded RemoteForward listen path " 1478 "'%s' -> '%s'", cp, p); 1479 free(cp); 1480 } 1481 if (options.remote_forwards[i].connect_path != NULL) { 1482 cp = options.remote_forwards[i].connect_path; 1483 p = options.remote_forwards[i].connect_path = 1484 default_client_percent_expand(cp, cinfo); 1485 if (strcmp(cp, p) != 0) 1486 debug3("expanded RemoteForward connect path " 1487 "'%s' -> '%s'", cp, p); 1488 free(cp); 1489 } 1490 } 1491 1492 if (config_test) { 1493 dump_client_config(&options, host); 1494 exit(0); 1495 } 1496 1497 /* Expand SecurityKeyProvider if it refers to an environment variable */ 1498 if (options.sk_provider != NULL && *options.sk_provider == '$' && 1499 strlen(options.sk_provider) > 1) { 1500 if ((cp = getenv(options.sk_provider + 1)) == NULL) { 1501 debug("Authenticator provider %s did not resolve; " 1502 "disabling", options.sk_provider); 1503 free(options.sk_provider); 1504 options.sk_provider = NULL; 1505 } else { 1506 debug2("resolved SecurityKeyProvider %s => %s", 1507 options.sk_provider, cp); 1508 free(options.sk_provider); 1509 options.sk_provider = xstrdup(cp); 1510 } 1511 } 1512 1513 if (muxclient_command != 0 && options.control_path == NULL) 1514 fatal("No ControlPath specified for \"-O\" command"); 1515 if (options.control_path != NULL) { 1516 int sock; 1517 if ((sock = muxclient(options.control_path)) >= 0) { 1518 ssh_packet_set_connection(ssh, sock, sock); 1519 ssh_packet_set_mux(ssh); 1520 goto skip_connect; 1521 } 1522 } 1523 1524 /* 1525 * If hostname canonicalisation was not enabled, then we may not 1526 * have yet resolved the hostname. Do so now. 1527 */ 1528 if (addrs == NULL && options.proxy_command == NULL) { 1529 debug2("resolving \"%s\" port %d", host, options.port); 1530 if ((addrs = resolve_host(host, options.port, 1, 1531 cname, sizeof(cname))) == NULL) 1532 cleanup_exit(255); /* resolve_host logs the error */ 1533 } 1534 1535 if (options.connection_timeout >= INT_MAX/1000) 1536 timeout_ms = INT_MAX; 1537 else 1538 timeout_ms = options.connection_timeout * 1000; 1539 1540 /* Open a connection to the remote host. */ 1541 if (ssh_connect(ssh, host, host_arg, addrs, &hostaddr, options.port, 1542 options.connection_attempts, 1543 &timeout_ms, options.tcp_keep_alive) != 0) 1544 exit(255); 1545 1546 if (addrs != NULL) 1547 freeaddrinfo(addrs); 1548 1549 ssh_packet_set_timeout(ssh, options.server_alive_interval, 1550 options.server_alive_count_max); 1551 1552 if (timeout_ms > 0) 1553 debug3("timeout: %d ms remain after connect", timeout_ms); 1554 1555 /* 1556 * If we successfully made the connection and we have hostbased auth 1557 * enabled, load the public keys so we can later use the ssh-keysign 1558 * helper to sign challenges. 1559 */ 1560 sensitive_data.nkeys = 0; 1561 sensitive_data.keys = NULL; 1562 if (options.hostbased_authentication) { 1563 int loaded = 0; 1564 1565 sensitive_data.nkeys = 10; 1566 sensitive_data.keys = xcalloc(sensitive_data.nkeys, 1567 sizeof(*sensitive_data.keys)); 1568 1569 /* XXX check errors? */ 1570 #define L_PUBKEY(p,o) do { \ 1571 if ((o) >= sensitive_data.nkeys) \ 1572 fatal_f("pubkey out of array bounds"); \ 1573 check_load(sshkey_load_public(p, &(sensitive_data.keys[o]), NULL), \ 1574 &(sensitive_data.keys[o]), p, "pubkey"); \ 1575 if (sensitive_data.keys[o] != NULL) { \ 1576 debug2("hostbased key %d: %s key from \"%s\"", o, \ 1577 sshkey_ssh_name(sensitive_data.keys[o]), p); \ 1578 loaded++; \ 1579 } \ 1580 } while (0) 1581 #define L_CERT(p,o) do { \ 1582 if ((o) >= sensitive_data.nkeys) \ 1583 fatal_f("cert out of array bounds"); \ 1584 check_load(sshkey_load_cert(p, &(sensitive_data.keys[o])), \ 1585 &(sensitive_data.keys[o]), p, "cert"); \ 1586 if (sensitive_data.keys[o] != NULL) { \ 1587 debug2("hostbased key %d: %s cert from \"%s\"", o, \ 1588 sshkey_ssh_name(sensitive_data.keys[o]), p); \ 1589 loaded++; \ 1590 } \ 1591 } while (0) 1592 1593 if (options.hostbased_authentication == 1) { 1594 L_CERT(_PATH_HOST_ECDSA_KEY_FILE, 0); 1595 L_CERT(_PATH_HOST_ED25519_KEY_FILE, 1); 1596 L_CERT(_PATH_HOST_RSA_KEY_FILE, 2); 1597 L_CERT(_PATH_HOST_DSA_KEY_FILE, 3); 1598 L_PUBKEY(_PATH_HOST_ECDSA_KEY_FILE, 4); 1599 L_PUBKEY(_PATH_HOST_ED25519_KEY_FILE, 5); 1600 L_PUBKEY(_PATH_HOST_RSA_KEY_FILE, 6); 1601 L_PUBKEY(_PATH_HOST_DSA_KEY_FILE, 7); 1602 L_CERT(_PATH_HOST_XMSS_KEY_FILE, 8); 1603 L_PUBKEY(_PATH_HOST_XMSS_KEY_FILE, 9); 1604 if (loaded == 0) 1605 debug("HostbasedAuthentication enabled but no " 1606 "local public host keys could be loaded."); 1607 } 1608 } 1609 1610 /* load options.identity_files */ 1611 load_public_identity_files(cinfo); 1612 1613 /* optionally set the SSH_AUTHSOCKET_ENV_NAME variable */ 1614 if (options.identity_agent && 1615 strcmp(options.identity_agent, SSH_AUTHSOCKET_ENV_NAME) != 0) { 1616 if (strcmp(options.identity_agent, "none") == 0) { 1617 unsetenv(SSH_AUTHSOCKET_ENV_NAME); 1618 } else { 1619 cp = options.identity_agent; 1620 /* legacy (limited) format */ 1621 if (cp[0] == '$' && cp[1] != '{') { 1622 if (!valid_env_name(cp + 1)) { 1623 fatal("Invalid IdentityAgent " 1624 "environment variable name %s", cp); 1625 } 1626 if ((p = getenv(cp + 1)) == NULL) 1627 unsetenv(SSH_AUTHSOCKET_ENV_NAME); 1628 else 1629 setenv(SSH_AUTHSOCKET_ENV_NAME, p, 1); 1630 } else { 1631 /* identity_agent specifies a path directly */ 1632 setenv(SSH_AUTHSOCKET_ENV_NAME, cp, 1); 1633 } 1634 } 1635 } 1636 1637 if (options.forward_agent && options.forward_agent_sock_path != NULL) { 1638 cp = options.forward_agent_sock_path; 1639 if (cp[0] == '$') { 1640 if (!valid_env_name(cp + 1)) { 1641 fatal("Invalid ForwardAgent environment variable name %s", cp); 1642 } 1643 if ((p = getenv(cp + 1)) != NULL) 1644 forward_agent_sock_path = xstrdup(p); 1645 else 1646 options.forward_agent = 0; 1647 free(cp); 1648 } else { 1649 forward_agent_sock_path = cp; 1650 } 1651 } 1652 1653 /* Expand ~ in known host file names. */ 1654 tilde_expand_paths(options.system_hostfiles, 1655 options.num_system_hostfiles); 1656 tilde_expand_paths(options.user_hostfiles, options.num_user_hostfiles); 1657 1658 ssh_signal(SIGCHLD, main_sigchld_handler); 1659 1660 /* Log into the remote system. Never returns if the login fails. */ 1661 ssh_login(ssh, &sensitive_data, host, (struct sockaddr *)&hostaddr, 1662 options.port, pw, timeout_ms, cinfo); 1663 1664 /* We no longer need the private host keys. Clear them now. */ 1665 if (sensitive_data.nkeys != 0) { 1666 for (i = 0; i < sensitive_data.nkeys; i++) { 1667 if (sensitive_data.keys[i] != NULL) { 1668 /* Destroys contents safely */ 1669 debug3("clear hostkey %d", i); 1670 sshkey_free(sensitive_data.keys[i]); 1671 sensitive_data.keys[i] = NULL; 1672 } 1673 } 1674 free(sensitive_data.keys); 1675 } 1676 for (i = 0; i < options.num_identity_files; i++) { 1677 free(options.identity_files[i]); 1678 options.identity_files[i] = NULL; 1679 if (options.identity_keys[i]) { 1680 sshkey_free(options.identity_keys[i]); 1681 options.identity_keys[i] = NULL; 1682 } 1683 } 1684 for (i = 0; i < options.num_certificate_files; i++) { 1685 free(options.certificate_files[i]); 1686 options.certificate_files[i] = NULL; 1687 } 1688 1689 #ifdef ENABLE_PKCS11 1690 (void)pkcs11_del_provider(options.pkcs11_provider); 1691 #endif 1692 1693 skip_connect: 1694 exit_status = ssh_session2(ssh, cinfo); 1695 ssh_conn_info_free(cinfo); 1696 ssh_packet_close(ssh); 1697 1698 if (options.control_path != NULL && muxserver_sock != -1) 1699 unlink(options.control_path); 1700 1701 /* Kill ProxyCommand if it is running. */ 1702 ssh_kill_proxy_command(); 1703 1704 return exit_status; 1705 } 1706 1707 static void 1708 control_persist_detach(void) 1709 { 1710 pid_t pid; 1711 1712 debug_f("backgrounding master process"); 1713 1714 /* 1715 * master (current process) into the background, and make the 1716 * foreground process a client of the backgrounded master. 1717 */ 1718 switch ((pid = fork())) { 1719 case -1: 1720 fatal_f("fork: %s", strerror(errno)); 1721 case 0: 1722 /* Child: master process continues mainloop */ 1723 break; 1724 default: 1725 /* Parent: set up mux client to connect to backgrounded master */ 1726 debug2_f("background process is %ld", (long)pid); 1727 options.stdin_null = ostdin_null_flag; 1728 options.request_tty = orequest_tty; 1729 tty_flag = otty_flag; 1730 options.session_type = osession_type; 1731 close(muxserver_sock); 1732 muxserver_sock = -1; 1733 options.control_master = SSHCTL_MASTER_NO; 1734 muxclient(options.control_path); 1735 /* muxclient() doesn't return on success. */ 1736 fatal("Failed to connect to new control master"); 1737 } 1738 if (stdfd_devnull(1, 1, !(log_is_on_stderr() && debug_flag)) == -1) 1739 error_f("stdfd_devnull failed"); 1740 daemon(1, 1); 1741 setproctitle("%s [mux]", options.control_path); 1742 } 1743 1744 /* Do fork() after authentication. Used by "ssh -f" */ 1745 static void 1746 fork_postauth(void) 1747 { 1748 if (need_controlpersist_detach) 1749 control_persist_detach(); 1750 debug("forking to background"); 1751 options.fork_after_authentication = 0; 1752 if (daemon(1, 1) == -1) 1753 fatal("daemon() failed: %.200s", strerror(errno)); 1754 if (stdfd_devnull(1, 1, !(log_is_on_stderr() && debug_flag)) == -1) 1755 error_f("stdfd_devnull failed"); 1756 } 1757 1758 static void 1759 forwarding_success(void) 1760 { 1761 if (forward_confirms_pending == -1) 1762 return; 1763 if (--forward_confirms_pending == 0) { 1764 debug_f("all expected forwarding replies received"); 1765 if (options.fork_after_authentication) 1766 fork_postauth(); 1767 } else { 1768 debug2_f("%d expected forwarding replies remaining", 1769 forward_confirms_pending); 1770 } 1771 } 1772 1773 /* Callback for remote forward global requests */ 1774 static void 1775 ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt) 1776 { 1777 struct Forward *rfwd = (struct Forward *)ctxt; 1778 u_int port; 1779 int r; 1780 1781 /* XXX verbose() on failure? */ 1782 debug("remote forward %s for: listen %s%s%d, connect %s:%d", 1783 type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure", 1784 rfwd->listen_path ? rfwd->listen_path : 1785 rfwd->listen_host ? rfwd->listen_host : "", 1786 (rfwd->listen_path || rfwd->listen_host) ? ":" : "", 1787 rfwd->listen_port, rfwd->connect_path ? rfwd->connect_path : 1788 rfwd->connect_host, rfwd->connect_port); 1789 if (rfwd->listen_path == NULL && rfwd->listen_port == 0) { 1790 if (type == SSH2_MSG_REQUEST_SUCCESS) { 1791 if ((r = sshpkt_get_u32(ssh, &port)) != 0) 1792 fatal_fr(r, "parse packet"); 1793 if (port > 65535) { 1794 error("Invalid allocated port %u for remote " 1795 "forward to %s:%d", port, 1796 rfwd->connect_host, rfwd->connect_port); 1797 /* Ensure failure processing runs below */ 1798 type = SSH2_MSG_REQUEST_FAILURE; 1799 channel_update_permission(ssh, 1800 rfwd->handle, -1); 1801 } else { 1802 rfwd->allocated_port = (int)port; 1803 logit("Allocated port %u for remote " 1804 "forward to %s:%d", 1805 rfwd->allocated_port, rfwd->connect_path ? 1806 rfwd->connect_path : rfwd->connect_host, 1807 rfwd->connect_port); 1808 channel_update_permission(ssh, 1809 rfwd->handle, rfwd->allocated_port); 1810 } 1811 } else { 1812 channel_update_permission(ssh, rfwd->handle, -1); 1813 } 1814 } 1815 1816 if (type == SSH2_MSG_REQUEST_FAILURE) { 1817 if (options.exit_on_forward_failure) { 1818 if (rfwd->listen_path != NULL) 1819 fatal("Error: remote port forwarding failed " 1820 "for listen path %s", rfwd->listen_path); 1821 else 1822 fatal("Error: remote port forwarding failed " 1823 "for listen port %d", rfwd->listen_port); 1824 } else { 1825 if (rfwd->listen_path != NULL) 1826 logit("Warning: remote port forwarding failed " 1827 "for listen path %s", rfwd->listen_path); 1828 else 1829 logit("Warning: remote port forwarding failed " 1830 "for listen port %d", rfwd->listen_port); 1831 } 1832 } 1833 forwarding_success(); 1834 } 1835 1836 static void 1837 client_cleanup_stdio_fwd(struct ssh *ssh, int id, int force, void *arg) 1838 { 1839 debug("stdio forwarding: done"); 1840 cleanup_exit(0); 1841 } 1842 1843 static void 1844 ssh_stdio_confirm(struct ssh *ssh, int id, int success, void *arg) 1845 { 1846 if (!success) 1847 fatal("stdio forwarding failed"); 1848 } 1849 1850 static void 1851 ssh_tun_confirm(struct ssh *ssh, int id, int success, void *arg) 1852 { 1853 if (!success) { 1854 error("Tunnel forwarding failed"); 1855 if (options.exit_on_forward_failure) 1856 cleanup_exit(255); 1857 } 1858 1859 debug_f("tunnel forward established, id=%d", id); 1860 forwarding_success(); 1861 } 1862 1863 static void 1864 ssh_init_stdio_forwarding(struct ssh *ssh) 1865 { 1866 Channel *c; 1867 int in, out; 1868 1869 if (options.stdio_forward_host == NULL) 1870 return; 1871 1872 debug3_f("%s:%d", options.stdio_forward_host, 1873 options.stdio_forward_port); 1874 1875 if ((in = dup(STDIN_FILENO)) == -1 || 1876 (out = dup(STDOUT_FILENO)) == -1) 1877 fatal_f("dup() in/out failed"); 1878 if ((c = channel_connect_stdio_fwd(ssh, options.stdio_forward_host, 1879 options.stdio_forward_port, in, out, 1880 CHANNEL_NONBLOCK_STDIO)) == NULL) 1881 fatal_f("channel_connect_stdio_fwd failed"); 1882 channel_register_cleanup(ssh, c->self, client_cleanup_stdio_fwd, 0); 1883 channel_register_open_confirm(ssh, c->self, ssh_stdio_confirm, NULL); 1884 } 1885 1886 static void 1887 ssh_init_forward_permissions(struct ssh *ssh, const char *what, char **opens, 1888 u_int num_opens) 1889 { 1890 u_int i; 1891 int port; 1892 char *addr, *arg, *oarg; 1893 int where = FORWARD_LOCAL; 1894 1895 channel_clear_permission(ssh, FORWARD_ADM, where); 1896 if (num_opens == 0) 1897 return; /* permit any */ 1898 1899 /* handle keywords: "any" / "none" */ 1900 if (num_opens == 1 && strcmp(opens[0], "any") == 0) 1901 return; 1902 if (num_opens == 1 && strcmp(opens[0], "none") == 0) { 1903 channel_disable_admin(ssh, where); 1904 return; 1905 } 1906 /* Otherwise treat it as a list of permitted host:port */ 1907 for (i = 0; i < num_opens; i++) { 1908 oarg = arg = xstrdup(opens[i]); 1909 addr = hpdelim(&arg); 1910 if (addr == NULL) 1911 fatal_f("missing host in %s", what); 1912 addr = cleanhostname(addr); 1913 if (arg == NULL || ((port = permitopen_port(arg)) < 0)) 1914 fatal_f("bad port number in %s", what); 1915 /* Send it to channels layer */ 1916 channel_add_permission(ssh, FORWARD_ADM, 1917 where, addr, port); 1918 free(oarg); 1919 } 1920 } 1921 1922 static void 1923 ssh_init_forwarding(struct ssh *ssh, char **ifname) 1924 { 1925 int success = 0; 1926 int i; 1927 1928 ssh_init_forward_permissions(ssh, "permitremoteopen", 1929 options.permitted_remote_opens, 1930 options.num_permitted_remote_opens); 1931 1932 if (options.exit_on_forward_failure) 1933 forward_confirms_pending = 0; /* track pending requests */ 1934 /* Initiate local TCP/IP port forwardings. */ 1935 for (i = 0; i < options.num_local_forwards; i++) { 1936 debug("Local connections to %.200s:%d forwarded to remote " 1937 "address %.200s:%d", 1938 (options.local_forwards[i].listen_path != NULL) ? 1939 options.local_forwards[i].listen_path : 1940 (options.local_forwards[i].listen_host == NULL) ? 1941 (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") : 1942 options.local_forwards[i].listen_host, 1943 options.local_forwards[i].listen_port, 1944 (options.local_forwards[i].connect_path != NULL) ? 1945 options.local_forwards[i].connect_path : 1946 options.local_forwards[i].connect_host, 1947 options.local_forwards[i].connect_port); 1948 success += channel_setup_local_fwd_listener(ssh, 1949 &options.local_forwards[i], &options.fwd_opts); 1950 } 1951 if (i > 0 && success != i && options.exit_on_forward_failure) 1952 fatal("Could not request local forwarding."); 1953 if (i > 0 && success == 0) 1954 error("Could not request local forwarding."); 1955 1956 /* Initiate remote TCP/IP port forwardings. */ 1957 for (i = 0; i < options.num_remote_forwards; i++) { 1958 debug("Remote connections from %.200s:%d forwarded to " 1959 "local address %.200s:%d", 1960 (options.remote_forwards[i].listen_path != NULL) ? 1961 options.remote_forwards[i].listen_path : 1962 (options.remote_forwards[i].listen_host == NULL) ? 1963 "LOCALHOST" : options.remote_forwards[i].listen_host, 1964 options.remote_forwards[i].listen_port, 1965 (options.remote_forwards[i].connect_path != NULL) ? 1966 options.remote_forwards[i].connect_path : 1967 options.remote_forwards[i].connect_host, 1968 options.remote_forwards[i].connect_port); 1969 if ((options.remote_forwards[i].handle = 1970 channel_request_remote_forwarding(ssh, 1971 &options.remote_forwards[i])) >= 0) { 1972 client_register_global_confirm( 1973 ssh_confirm_remote_forward, 1974 &options.remote_forwards[i]); 1975 forward_confirms_pending++; 1976 } else if (options.exit_on_forward_failure) 1977 fatal("Could not request remote forwarding."); 1978 else 1979 logit("Warning: Could not request remote forwarding."); 1980 } 1981 1982 /* Initiate tunnel forwarding. */ 1983 if (options.tun_open != SSH_TUNMODE_NO) { 1984 if ((*ifname = client_request_tun_fwd(ssh, 1985 options.tun_open, options.tun_local, 1986 options.tun_remote, ssh_tun_confirm, NULL)) != NULL) 1987 forward_confirms_pending++; 1988 else if (options.exit_on_forward_failure) 1989 fatal("Could not request tunnel forwarding."); 1990 else 1991 error("Could not request tunnel forwarding."); 1992 } 1993 if (forward_confirms_pending > 0) { 1994 debug_f("expecting replies for %d forwards", 1995 forward_confirms_pending); 1996 } 1997 } 1998 1999 static void 2000 check_agent_present(void) 2001 { 2002 int r; 2003 2004 if (options.forward_agent) { 2005 /* Clear agent forwarding if we don't have an agent. */ 2006 if ((r = ssh_get_authentication_socket(NULL)) != 0) { 2007 options.forward_agent = 0; 2008 if (r != SSH_ERR_AGENT_NOT_PRESENT) 2009 debug_r(r, "ssh_get_authentication_socket"); 2010 } 2011 } 2012 } 2013 2014 static void 2015 ssh_session2_setup(struct ssh *ssh, int id, int success, void *arg) 2016 { 2017 extern char **environ; 2018 const char *display, *term; 2019 int r, interactive = tty_flag; 2020 char *proto = NULL, *data = NULL; 2021 2022 if (!success) 2023 return; /* No need for error message, channels code sends one */ 2024 2025 display = getenv("DISPLAY"); 2026 if (display == NULL && options.forward_x11) 2027 debug("X11 forwarding requested but DISPLAY not set"); 2028 if (options.forward_x11 && client_x11_get_proto(ssh, display, 2029 options.xauth_location, options.forward_x11_trusted, 2030 options.forward_x11_timeout, &proto, &data) == 0) { 2031 /* Request forwarding with authentication spoofing. */ 2032 debug("Requesting X11 forwarding with authentication " 2033 "spoofing."); 2034 x11_request_forwarding_with_spoofing(ssh, id, display, proto, 2035 data, 1); 2036 client_expect_confirm(ssh, id, "X11 forwarding", CONFIRM_WARN); 2037 /* XXX exit_on_forward_failure */ 2038 interactive = 1; 2039 } 2040 2041 check_agent_present(); 2042 if (options.forward_agent) { 2043 debug("Requesting authentication agent forwarding."); 2044 channel_request_start(ssh, id, "auth-agent-req@openssh.com", 0); 2045 if ((r = sshpkt_send(ssh)) != 0) 2046 fatal_fr(r, "send packet"); 2047 } 2048 2049 /* Tell the packet module whether this is an interactive session. */ 2050 ssh_packet_set_interactive(ssh, interactive, 2051 options.ip_qos_interactive, options.ip_qos_bulk); 2052 2053 if ((term = lookup_env_in_list("TERM", options.setenv, 2054 options.num_setenv)) == NULL || *term == '\0') 2055 term = getenv("TERM"); 2056 client_session2_setup(ssh, id, tty_flag, 2057 options.session_type == SESSION_TYPE_SUBSYSTEM, term, 2058 NULL, fileno(stdin), command, environ); 2059 } 2060 2061 /* open new channel for a session */ 2062 static int 2063 ssh_session2_open(struct ssh *ssh) 2064 { 2065 Channel *c; 2066 int window, packetmax, in, out, err; 2067 2068 if (options.stdin_null) { 2069 in = open(_PATH_DEVNULL, O_RDONLY); 2070 } else { 2071 in = dup(STDIN_FILENO); 2072 } 2073 out = dup(STDOUT_FILENO); 2074 err = dup(STDERR_FILENO); 2075 2076 if (in == -1 || out == -1 || err == -1) 2077 fatal("dup() in/out/err failed"); 2078 2079 window = CHAN_SES_WINDOW_DEFAULT; 2080 packetmax = CHAN_SES_PACKET_DEFAULT; 2081 if (tty_flag) { 2082 window >>= 1; 2083 packetmax >>= 1; 2084 } 2085 c = channel_new(ssh, 2086 "session", SSH_CHANNEL_OPENING, in, out, err, 2087 window, packetmax, CHAN_EXTENDED_WRITE, 2088 "client-session", CHANNEL_NONBLOCK_STDIO); 2089 2090 debug3_f("channel_new: %d", c->self); 2091 2092 channel_send_open(ssh, c->self); 2093 if (options.session_type != SESSION_TYPE_NONE) 2094 channel_register_open_confirm(ssh, c->self, 2095 ssh_session2_setup, NULL); 2096 2097 return c->self; 2098 } 2099 2100 static int 2101 ssh_session2(struct ssh *ssh, const struct ssh_conn_info *cinfo) 2102 { 2103 int r, id = -1; 2104 char *cp, *tun_fwd_ifname = NULL; 2105 2106 /* XXX should be pre-session */ 2107 if (!options.control_persist) 2108 ssh_init_stdio_forwarding(ssh); 2109 2110 ssh_init_forwarding(ssh, &tun_fwd_ifname); 2111 2112 if (options.local_command != NULL) { 2113 debug3("expanding LocalCommand: %s", options.local_command); 2114 cp = options.local_command; 2115 options.local_command = percent_expand(cp, 2116 DEFAULT_CLIENT_PERCENT_EXPAND_ARGS(cinfo), 2117 "T", tun_fwd_ifname == NULL ? "NONE" : tun_fwd_ifname, 2118 (char *)NULL); 2119 debug3("expanded LocalCommand: %s", options.local_command); 2120 free(cp); 2121 } 2122 2123 /* Start listening for multiplex clients */ 2124 if (!ssh_packet_get_mux(ssh)) 2125 muxserver_listen(ssh); 2126 2127 /* 2128 * If we are in control persist mode and have a working mux listen 2129 * socket, then prepare to background ourselves and have a foreground 2130 * client attach as a control client. 2131 * NB. we must save copies of the flags that we override for 2132 * the backgrounding, since we defer attachment of the client until 2133 * after the connection is fully established (in particular, 2134 * async rfwd replies have been received for ExitOnForwardFailure). 2135 */ 2136 if (options.control_persist && muxserver_sock != -1) { 2137 ostdin_null_flag = options.stdin_null; 2138 osession_type = options.session_type; 2139 orequest_tty = options.request_tty; 2140 otty_flag = tty_flag; 2141 options.stdin_null = 1; 2142 options.session_type = SESSION_TYPE_NONE; 2143 tty_flag = 0; 2144 if (!options.fork_after_authentication && 2145 (osession_type != SESSION_TYPE_NONE || 2146 options.stdio_forward_host != NULL)) 2147 need_controlpersist_detach = 1; 2148 options.fork_after_authentication = 1; 2149 } 2150 /* 2151 * ControlPersist mux listen socket setup failed, attempt the 2152 * stdio forward setup that we skipped earlier. 2153 */ 2154 if (options.control_persist && muxserver_sock == -1) 2155 ssh_init_stdio_forwarding(ssh); 2156 2157 if (options.session_type != SESSION_TYPE_NONE) 2158 id = ssh_session2_open(ssh); 2159 else { 2160 ssh_packet_set_interactive(ssh, 2161 options.control_master == SSHCTL_MASTER_NO, 2162 options.ip_qos_interactive, options.ip_qos_bulk); 2163 } 2164 2165 /* If we don't expect to open a new session, then disallow it */ 2166 if (options.control_master == SSHCTL_MASTER_NO && 2167 (ssh->compat & SSH_NEW_OPENSSH)) { 2168 debug("Requesting no-more-sessions@openssh.com"); 2169 if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 || 2170 (r = sshpkt_put_cstring(ssh, 2171 "no-more-sessions@openssh.com")) != 0 || 2172 (r = sshpkt_put_u8(ssh, 0)) != 0 || 2173 (r = sshpkt_send(ssh)) != 0) 2174 fatal_fr(r, "send packet"); 2175 } 2176 2177 /* Execute a local command */ 2178 if (options.local_command != NULL && 2179 options.permit_local_command) 2180 ssh_local_cmd(options.local_command); 2181 2182 /* 2183 * stdout is now owned by the session channel; clobber it here 2184 * so future channel closes are propagated to the local fd. 2185 * NB. this can only happen after LocalCommand has completed, 2186 * as it may want to write to stdout. 2187 */ 2188 if (!need_controlpersist_detach && stdfd_devnull(0, 1, 0) == -1) 2189 error_f("stdfd_devnull failed"); 2190 2191 /* 2192 * If requested and we are not interested in replies to remote 2193 * forwarding requests, then let ssh continue in the background. 2194 */ 2195 if (options.fork_after_authentication) { 2196 if (options.exit_on_forward_failure && 2197 options.num_remote_forwards > 0) { 2198 debug("deferring postauth fork until remote forward " 2199 "confirmation received"); 2200 } else 2201 fork_postauth(); 2202 } 2203 2204 return client_loop(ssh, tty_flag, tty_flag ? 2205 options.escape_char : SSH_ESCAPECHAR_NONE, id); 2206 } 2207 2208 /* Loads all IdentityFile and CertificateFile keys */ 2209 static void 2210 load_public_identity_files(const struct ssh_conn_info *cinfo) 2211 { 2212 char *filename, *cp; 2213 struct sshkey *public; 2214 int i; 2215 u_int n_ids, n_certs; 2216 char *identity_files[SSH_MAX_IDENTITY_FILES]; 2217 struct sshkey *identity_keys[SSH_MAX_IDENTITY_FILES]; 2218 int identity_file_userprovided[SSH_MAX_IDENTITY_FILES]; 2219 char *certificate_files[SSH_MAX_CERTIFICATE_FILES]; 2220 struct sshkey *certificates[SSH_MAX_CERTIFICATE_FILES]; 2221 int certificate_file_userprovided[SSH_MAX_CERTIFICATE_FILES]; 2222 #ifdef ENABLE_PKCS11 2223 struct sshkey **keys = NULL; 2224 char **comments = NULL; 2225 int nkeys; 2226 #endif /* PKCS11 */ 2227 2228 n_ids = n_certs = 0; 2229 memset(identity_files, 0, sizeof(identity_files)); 2230 memset(identity_keys, 0, sizeof(identity_keys)); 2231 memset(identity_file_userprovided, 0, 2232 sizeof(identity_file_userprovided)); 2233 memset(certificate_files, 0, sizeof(certificate_files)); 2234 memset(certificates, 0, sizeof(certificates)); 2235 memset(certificate_file_userprovided, 0, 2236 sizeof(certificate_file_userprovided)); 2237 2238 #ifdef ENABLE_PKCS11 2239 if (options.pkcs11_provider != NULL && 2240 options.num_identity_files < SSH_MAX_IDENTITY_FILES && 2241 (pkcs11_init(!options.batch_mode) == 0) && 2242 (nkeys = pkcs11_add_provider(options.pkcs11_provider, NULL, 2243 &keys, &comments)) > 0) { 2244 for (i = 0; i < nkeys; i++) { 2245 if (n_ids >= SSH_MAX_IDENTITY_FILES) { 2246 sshkey_free(keys[i]); 2247 free(comments[i]); 2248 continue; 2249 } 2250 identity_keys[n_ids] = keys[i]; 2251 identity_files[n_ids] = comments[i]; /* transferred */ 2252 n_ids++; 2253 } 2254 free(keys); 2255 free(comments); 2256 } 2257 #endif /* ENABLE_PKCS11 */ 2258 for (i = 0; i < options.num_identity_files; i++) { 2259 if (n_ids >= SSH_MAX_IDENTITY_FILES || 2260 strcasecmp(options.identity_files[i], "none") == 0) { 2261 free(options.identity_files[i]); 2262 options.identity_files[i] = NULL; 2263 continue; 2264 } 2265 cp = tilde_expand_filename(options.identity_files[i], getuid()); 2266 filename = default_client_percent_dollar_expand(cp, cinfo); 2267 free(cp); 2268 check_load(sshkey_load_public(filename, &public, NULL), 2269 &public, filename, "pubkey"); 2270 debug("identity file %s type %d", filename, 2271 public ? public->type : -1); 2272 free(options.identity_files[i]); 2273 identity_files[n_ids] = filename; 2274 identity_keys[n_ids] = public; 2275 identity_file_userprovided[n_ids] = 2276 options.identity_file_userprovided[i]; 2277 if (++n_ids >= SSH_MAX_IDENTITY_FILES) 2278 continue; 2279 2280 /* 2281 * If no certificates have been explicitly listed then try 2282 * to add the default certificate variant too. 2283 */ 2284 if (options.num_certificate_files != 0) 2285 continue; 2286 xasprintf(&cp, "%s-cert", filename); 2287 check_load(sshkey_load_public(cp, &public, NULL), 2288 &public, filename, "pubkey"); 2289 debug("identity file %s type %d", cp, 2290 public ? public->type : -1); 2291 if (public == NULL) { 2292 free(cp); 2293 continue; 2294 } 2295 if (!sshkey_is_cert(public)) { 2296 debug_f("key %s type %s is not a certificate", 2297 cp, sshkey_type(public)); 2298 sshkey_free(public); 2299 free(cp); 2300 continue; 2301 } 2302 /* NB. leave filename pointing to private key */ 2303 identity_files[n_ids] = xstrdup(filename); 2304 identity_keys[n_ids] = public; 2305 identity_file_userprovided[n_ids] = 2306 options.identity_file_userprovided[i]; 2307 n_ids++; 2308 } 2309 2310 if (options.num_certificate_files > SSH_MAX_CERTIFICATE_FILES) 2311 fatal_f("too many certificates"); 2312 for (i = 0; i < options.num_certificate_files; i++) { 2313 cp = tilde_expand_filename(options.certificate_files[i], 2314 getuid()); 2315 filename = default_client_percent_dollar_expand(cp, cinfo); 2316 free(cp); 2317 2318 check_load(sshkey_load_public(filename, &public, NULL), 2319 &public, filename, "certificate"); 2320 debug("certificate file %s type %d", filename, 2321 public ? public->type : -1); 2322 free(options.certificate_files[i]); 2323 options.certificate_files[i] = NULL; 2324 if (public == NULL) { 2325 free(filename); 2326 continue; 2327 } 2328 if (!sshkey_is_cert(public)) { 2329 debug_f("key %s type %s is not a certificate", 2330 filename, sshkey_type(public)); 2331 sshkey_free(public); 2332 free(filename); 2333 continue; 2334 } 2335 certificate_files[n_certs] = filename; 2336 certificates[n_certs] = public; 2337 certificate_file_userprovided[n_certs] = 2338 options.certificate_file_userprovided[i]; 2339 ++n_certs; 2340 } 2341 2342 options.num_identity_files = n_ids; 2343 memcpy(options.identity_files, identity_files, sizeof(identity_files)); 2344 memcpy(options.identity_keys, identity_keys, sizeof(identity_keys)); 2345 memcpy(options.identity_file_userprovided, 2346 identity_file_userprovided, sizeof(identity_file_userprovided)); 2347 2348 options.num_certificate_files = n_certs; 2349 memcpy(options.certificate_files, 2350 certificate_files, sizeof(certificate_files)); 2351 memcpy(options.certificates, certificates, sizeof(certificates)); 2352 memcpy(options.certificate_file_userprovided, 2353 certificate_file_userprovided, 2354 sizeof(certificate_file_userprovided)); 2355 } 2356 2357 static void 2358 main_sigchld_handler(int sig) 2359 { 2360 int save_errno = errno; 2361 pid_t pid; 2362 int status; 2363 2364 while ((pid = waitpid(-1, &status, WNOHANG)) > 0 || 2365 (pid == -1 && errno == EINTR)) 2366 ; 2367 errno = save_errno; 2368 } 2369