1 /* $OpenBSD: mux.c,v 1.82 2020/04/30 17:12:20 markus Exp $ */
2 /*
3  * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 /* ssh session multiplexing support */
19 
20 #include "includes.h"
21 
22 #include <sys/types.h>
23 #include <sys/stat.h>
24 #include <sys/socket.h>
25 #include <sys/un.h>
26 
27 #include <errno.h>
28 #include <fcntl.h>
29 #include <signal.h>
30 #include <stdarg.h>
31 #include <stddef.h>
32 #include <stdlib.h>
33 #include <stdio.h>
34 #include <string.h>
35 #include <unistd.h>
36 #ifdef HAVE_PATHS_H
37 #include <paths.h>
38 #endif
39 
40 #ifdef HAVE_POLL_H
41 #include <poll.h>
42 #else
43 # ifdef HAVE_SYS_POLL_H
44 #  include <sys/poll.h>
45 # endif
46 #endif
47 
48 #ifdef HAVE_UTIL_H
49 # include <util.h>
50 #endif
51 
52 #include "openbsd-compat/sys-queue.h"
53 #include "xmalloc.h"
54 #include "log.h"
55 #include "ssh.h"
56 #include "ssh2.h"
57 #include "pathnames.h"
58 #include "misc.h"
59 #include "match.h"
60 #include "sshbuf.h"
61 #include "channels.h"
62 #include "msg.h"
63 #include "packet.h"
64 #include "monitor_fdpass.h"
65 #include "sshpty.h"
66 #include "sshkey.h"
67 #include "readconf.h"
68 #include "clientloop.h"
69 #include "ssherr.h"
70 
71 /* from ssh.c */
72 extern int tty_flag;
73 extern Options options;
74 extern int stdin_null_flag;
75 extern char *host;
76 extern int subsystem_flag;
77 extern struct sshbuf *command;
78 extern volatile sig_atomic_t quit_pending;
79 
80 /* Context for session open confirmation callback */
81 struct mux_session_confirm_ctx {
82 	u_int want_tty;
83 	u_int want_subsys;
84 	u_int want_x_fwd;
85 	u_int want_agent_fwd;
86 	struct sshbuf *cmd;
87 	char *term;
88 	struct termios tio;
89 	char **env;
90 	u_int rid;
91 };
92 
93 /* Context for stdio fwd open confirmation callback */
94 struct mux_stdio_confirm_ctx {
95 	u_int rid;
96 };
97 
98 /* Context for global channel callback */
99 struct mux_channel_confirm_ctx {
100 	u_int cid;	/* channel id */
101 	u_int rid;	/* request id */
102 	int fid;	/* forward id */
103 };
104 
105 /* fd to control socket */
106 int muxserver_sock = -1;
107 
108 /* client request id */
109 u_int muxclient_request_id = 0;
110 
111 /* Multiplexing control command */
112 u_int muxclient_command = 0;
113 
114 /* Set when signalled. */
115 static volatile sig_atomic_t muxclient_terminate = 0;
116 
117 /* PID of multiplex server */
118 static u_int muxserver_pid = 0;
119 
120 static Channel *mux_listener_channel = NULL;
121 
122 struct mux_master_state {
123 	int hello_rcvd;
124 };
125 
126 /* mux protocol messages */
127 #define MUX_MSG_HELLO		0x00000001
128 #define MUX_C_NEW_SESSION	0x10000002
129 #define MUX_C_ALIVE_CHECK	0x10000004
130 #define MUX_C_TERMINATE		0x10000005
131 #define MUX_C_OPEN_FWD		0x10000006
132 #define MUX_C_CLOSE_FWD		0x10000007
133 #define MUX_C_NEW_STDIO_FWD	0x10000008
134 #define MUX_C_STOP_LISTENING	0x10000009
135 #define MUX_C_PROXY		0x1000000f
136 #define MUX_S_OK		0x80000001
137 #define MUX_S_PERMISSION_DENIED	0x80000002
138 #define MUX_S_FAILURE		0x80000003
139 #define MUX_S_EXIT_MESSAGE	0x80000004
140 #define MUX_S_ALIVE		0x80000005
141 #define MUX_S_SESSION_OPENED	0x80000006
142 #define MUX_S_REMOTE_PORT	0x80000007
143 #define MUX_S_TTY_ALLOC_FAIL	0x80000008
144 #define MUX_S_PROXY		0x8000000f
145 
146 /* type codes for MUX_C_OPEN_FWD and MUX_C_CLOSE_FWD */
147 #define MUX_FWD_LOCAL   1
148 #define MUX_FWD_REMOTE  2
149 #define MUX_FWD_DYNAMIC 3
150 
151 static void mux_session_confirm(struct ssh *, int, int, void *);
152 static void mux_stdio_confirm(struct ssh *, int, int, void *);
153 
154 static int mux_master_process_hello(struct ssh *, u_int,
155 	    Channel *, struct sshbuf *, struct sshbuf *);
156 static int mux_master_process_new_session(struct ssh *, u_int,
157 	    Channel *, struct sshbuf *, struct sshbuf *);
158 static int mux_master_process_alive_check(struct ssh *, u_int,
159 	    Channel *, struct sshbuf *, struct sshbuf *);
160 static int mux_master_process_terminate(struct ssh *, u_int,
161 	    Channel *, struct sshbuf *, struct sshbuf *);
162 static int mux_master_process_open_fwd(struct ssh *, u_int,
163 	    Channel *, struct sshbuf *, struct sshbuf *);
164 static int mux_master_process_close_fwd(struct ssh *, u_int,
165 	    Channel *, struct sshbuf *, struct sshbuf *);
166 static int mux_master_process_stdio_fwd(struct ssh *, u_int,
167 	    Channel *, struct sshbuf *, struct sshbuf *);
168 static int mux_master_process_stop_listening(struct ssh *, u_int,
169 	    Channel *, struct sshbuf *, struct sshbuf *);
170 static int mux_master_process_proxy(struct ssh *, u_int,
171 	    Channel *, struct sshbuf *, struct sshbuf *);
172 
173 static const struct {
174 	u_int type;
175 	int (*handler)(struct ssh *, u_int, Channel *,
176 	    struct sshbuf *, struct sshbuf *);
177 } mux_master_handlers[] = {
178 	{ MUX_MSG_HELLO, mux_master_process_hello },
179 	{ MUX_C_NEW_SESSION, mux_master_process_new_session },
180 	{ MUX_C_ALIVE_CHECK, mux_master_process_alive_check },
181 	{ MUX_C_TERMINATE, mux_master_process_terminate },
182 	{ MUX_C_OPEN_FWD, mux_master_process_open_fwd },
183 	{ MUX_C_CLOSE_FWD, mux_master_process_close_fwd },
184 	{ MUX_C_NEW_STDIO_FWD, mux_master_process_stdio_fwd },
185 	{ MUX_C_STOP_LISTENING, mux_master_process_stop_listening },
186 	{ MUX_C_PROXY, mux_master_process_proxy },
187 	{ 0, NULL }
188 };
189 
190 /* Cleanup callback fired on closure of mux slave _session_ channel */
191 /* ARGSUSED */
192 static void
mux_master_session_cleanup_cb(struct ssh * ssh,int cid,void * unused)193 mux_master_session_cleanup_cb(struct ssh *ssh, int cid, void *unused)
194 {
195 	Channel *cc, *c = channel_by_id(ssh, cid);
196 
197 	debug3("%s: entering for channel %d", __func__, cid);
198 	if (c == NULL)
199 		fatal("%s: channel_by_id(%i) == NULL", __func__, cid);
200 	if (c->ctl_chan != -1) {
201 		if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
202 			fatal("%s: channel %d missing control channel %d",
203 			    __func__, c->self, c->ctl_chan);
204 		c->ctl_chan = -1;
205 		cc->remote_id = 0;
206 		cc->have_remote_id = 0;
207 		chan_rcvd_oclose(ssh, cc);
208 	}
209 	channel_cancel_cleanup(ssh, c->self);
210 }
211 
212 /* Cleanup callback fired on closure of mux slave _control_ channel */
213 /* ARGSUSED */
214 static void
mux_master_control_cleanup_cb(struct ssh * ssh,int cid,void * unused)215 mux_master_control_cleanup_cb(struct ssh *ssh, int cid, void *unused)
216 {
217 	Channel *sc, *c = channel_by_id(ssh, cid);
218 
219 	debug3("%s: entering for channel %d", __func__, cid);
220 	if (c == NULL)
221 		fatal("%s: channel_by_id(%i) == NULL", __func__, cid);
222 	if (c->have_remote_id) {
223 		if ((sc = channel_by_id(ssh, c->remote_id)) == NULL)
224 			fatal("%s: channel %d missing session channel %u",
225 			    __func__, c->self, c->remote_id);
226 		c->remote_id = 0;
227 		c->have_remote_id = 0;
228 		sc->ctl_chan = -1;
229 		if (sc->type != SSH_CHANNEL_OPEN &&
230 		    sc->type != SSH_CHANNEL_OPENING) {
231 			debug2("%s: channel %d: not open", __func__, sc->self);
232 			chan_mark_dead(ssh, sc);
233 		} else {
234 			if (sc->istate == CHAN_INPUT_OPEN)
235 				chan_read_failed(ssh, sc);
236 			if (sc->ostate == CHAN_OUTPUT_OPEN)
237 				chan_write_failed(ssh, sc);
238 		}
239 	}
240 	channel_cancel_cleanup(ssh, c->self);
241 }
242 
243 /* Check mux client environment variables before passing them to mux master. */
244 static int
env_permitted(char * env)245 env_permitted(char *env)
246 {
247 	int i, ret;
248 	char name[1024], *cp;
249 
250 	if ((cp = strchr(env, '=')) == NULL || cp == env)
251 		return 0;
252 	ret = snprintf(name, sizeof(name), "%.*s", (int)(cp - env), env);
253 	if (ret <= 0 || (size_t)ret >= sizeof(name)) {
254 		error("%s: name '%.100s...' too long", __func__, env);
255 		return 0;
256 	}
257 
258 	for (i = 0; i < options.num_send_env; i++)
259 		if (match_pattern(name, options.send_env[i]))
260 			return 1;
261 
262 	return 0;
263 }
264 
265 /* Mux master protocol message handlers */
266 
267 static int
mux_master_process_hello(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)268 mux_master_process_hello(struct ssh *ssh, u_int rid,
269     Channel *c, struct sshbuf *m, struct sshbuf *reply)
270 {
271 	u_int ver;
272 	struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx;
273 	int r;
274 
275 	if (state == NULL)
276 		fatal("%s: channel %d: c->mux_ctx == NULL", __func__, c->self);
277 	if (state->hello_rcvd) {
278 		error("%s: HELLO received twice", __func__);
279 		return -1;
280 	}
281 	if ((r = sshbuf_get_u32(m, &ver)) != 0) {
282 		error("%s: malformed message: %s", __func__, ssh_err(r));
283 		return -1;
284 	}
285 	if (ver != SSHMUX_VER) {
286 		error("%s: unsupported multiplexing protocol version %u "
287 		    "(expected %u)", __func__, ver, SSHMUX_VER);
288 		return -1;
289 	}
290 	debug2("%s: channel %d slave version %u", __func__, c->self, ver);
291 
292 	/* No extensions are presently defined */
293 	while (sshbuf_len(m) > 0) {
294 		char *name = NULL;
295 		size_t value_len = 0;
296 
297 		if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 ||
298 		    (r = sshbuf_get_string_direct(m, NULL, &value_len)) != 0) {
299 			error("%s: malformed extension: %s",
300 			    __func__, ssh_err(r));
301 			return -1;
302 		}
303 		debug2("%s: Unrecognised extension \"%s\" length %zu",
304 		    __func__, name, value_len);
305 		free(name);
306 	}
307 	state->hello_rcvd = 1;
308 	return 0;
309 }
310 
311 /* Enqueue a "ok" response to the reply buffer */
312 static void
reply_ok(struct sshbuf * reply,u_int rid)313 reply_ok(struct sshbuf *reply, u_int rid)
314 {
315 	int r;
316 
317 	if ((r = sshbuf_put_u32(reply, MUX_S_OK)) != 0 ||
318 	    (r = sshbuf_put_u32(reply, rid)) != 0)
319 		fatal("%s: reply: %s", __func__, ssh_err(r));
320 }
321 
322 /* Enqueue an error response to the reply buffer */
323 static void
reply_error(struct sshbuf * reply,u_int type,u_int rid,const char * msg)324 reply_error(struct sshbuf *reply, u_int type, u_int rid, const char *msg)
325 {
326 	int r;
327 
328 	if ((r = sshbuf_put_u32(reply, type)) != 0 ||
329 	    (r = sshbuf_put_u32(reply, rid)) != 0 ||
330 	    (r = sshbuf_put_cstring(reply, msg)) != 0)
331 		fatal("%s: reply: %s", __func__, ssh_err(r));
332 }
333 
334 static int
mux_master_process_new_session(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)335 mux_master_process_new_session(struct ssh *ssh, u_int rid,
336     Channel *c, struct sshbuf *m, struct sshbuf *reply)
337 {
338 	Channel *nc;
339 	struct mux_session_confirm_ctx *cctx;
340 	char *cmd, *cp;
341 	u_int i, j, env_len, escape_char, window, packetmax;
342 	int r, new_fd[3];
343 
344 	/* Reply for SSHMUX_COMMAND_OPEN */
345 	cctx = xcalloc(1, sizeof(*cctx));
346 	cctx->term = NULL;
347 	cctx->rid = rid;
348 	cmd = NULL;
349 	cctx->env = NULL;
350 	env_len = 0;
351 	if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */
352 	    (r = sshbuf_get_u32(m, &cctx->want_tty)) != 0 ||
353 	    (r = sshbuf_get_u32(m, &cctx->want_x_fwd)) != 0 ||
354 	    (r = sshbuf_get_u32(m, &cctx->want_agent_fwd)) != 0 ||
355 	    (r = sshbuf_get_u32(m, &cctx->want_subsys)) != 0 ||
356 	    (r = sshbuf_get_u32(m, &escape_char)) != 0 ||
357 	    (r = sshbuf_get_cstring(m, &cctx->term, NULL)) != 0 ||
358 	    (r = sshbuf_get_cstring(m, &cmd, NULL)) != 0) {
359  malf:
360 		free(cmd);
361 		for (j = 0; j < env_len; j++)
362 			free(cctx->env[j]);
363 		free(cctx->env);
364 		free(cctx->term);
365 		free(cctx);
366 		error("%s: malformed message", __func__);
367 		return -1;
368 	}
369 
370 #define MUX_MAX_ENV_VARS	4096
371 	while (sshbuf_len(m) > 0) {
372 		if ((r = sshbuf_get_cstring(m, &cp, NULL)) != 0)
373 			goto malf;
374 		if (!env_permitted(cp)) {
375 			free(cp);
376 			continue;
377 		}
378 		cctx->env = xreallocarray(cctx->env, env_len + 2,
379 		    sizeof(*cctx->env));
380 		cctx->env[env_len++] = cp;
381 		cctx->env[env_len] = NULL;
382 		if (env_len > MUX_MAX_ENV_VARS) {
383 			error("%s: >%d environment variables received, "
384 			    "ignoring additional", __func__, MUX_MAX_ENV_VARS);
385 			break;
386 		}
387 	}
388 
389 	debug2("%s: channel %d: request tty %d, X %d, agent %d, subsys %d, "
390 	    "term \"%s\", cmd \"%s\", env %u", __func__, c->self,
391 	    cctx->want_tty, cctx->want_x_fwd, cctx->want_agent_fwd,
392 	    cctx->want_subsys, cctx->term, cmd, env_len);
393 
394 	if ((cctx->cmd = sshbuf_new()) == NULL)
395 		fatal("%s: sshbuf_new", __func__);
396 	if ((r = sshbuf_put(cctx->cmd, cmd, strlen(cmd))) != 0)
397 		fatal("%s: sshbuf_put: %s", __func__, ssh_err(r));
398 	free(cmd);
399 	cmd = NULL;
400 
401 	/* Gather fds from client */
402 	for(i = 0; i < 3; i++) {
403 		if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) {
404 			error("%s: failed to receive fd %d from slave",
405 			    __func__, i);
406 			for (j = 0; j < i; j++)
407 				close(new_fd[j]);
408 			for (j = 0; j < env_len; j++)
409 				free(cctx->env[j]);
410 			free(cctx->env);
411 			free(cctx->term);
412 			sshbuf_free(cctx->cmd);
413 			free(cctx);
414 			reply_error(reply, MUX_S_FAILURE, rid,
415 			    "did not receive file descriptors");
416 			return -1;
417 		}
418 	}
419 
420 	debug3("%s: got fds stdin %d, stdout %d, stderr %d", __func__,
421 	    new_fd[0], new_fd[1], new_fd[2]);
422 
423 	/* XXX support multiple child sessions in future */
424 	if (c->have_remote_id) {
425 		debug2("%s: session already open", __func__);
426 		reply_error(reply, MUX_S_FAILURE, rid,
427 		    "Multiple sessions not supported");
428  cleanup:
429 		close(new_fd[0]);
430 		close(new_fd[1]);
431 		close(new_fd[2]);
432 		free(cctx->term);
433 		if (env_len != 0) {
434 			for (i = 0; i < env_len; i++)
435 				free(cctx->env[i]);
436 			free(cctx->env);
437 		}
438 		sshbuf_free(cctx->cmd);
439 		free(cctx);
440 		return 0;
441 	}
442 
443 	if (options.control_master == SSHCTL_MASTER_ASK ||
444 	    options.control_master == SSHCTL_MASTER_AUTO_ASK) {
445 		if (!ask_permission("Allow shared connection to %s? ", host)) {
446 			debug2("%s: session refused by user", __func__);
447 			reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
448 			    "Permission denied");
449 			goto cleanup;
450 		}
451 	}
452 
453 	/* Try to pick up ttymodes from client before it goes raw */
454 	if (cctx->want_tty && tcgetattr(new_fd[0], &cctx->tio) == -1)
455 		error("%s: tcgetattr: %s", __func__, strerror(errno));
456 
457 	/* enable nonblocking unless tty */
458 	if (!isatty(new_fd[0]))
459 		set_nonblock(new_fd[0]);
460 	if (!isatty(new_fd[1]))
461 		set_nonblock(new_fd[1]);
462 	if (!isatty(new_fd[2]))
463 		set_nonblock(new_fd[2]);
464 
465 	window = CHAN_SES_WINDOW_DEFAULT;
466 	packetmax = CHAN_SES_PACKET_DEFAULT;
467 	if (cctx->want_tty) {
468 		window >>= 1;
469 		packetmax >>= 1;
470 	}
471 
472 	nc = channel_new(ssh, "session", SSH_CHANNEL_OPENING,
473 	    new_fd[0], new_fd[1], new_fd[2], window, packetmax,
474 	    CHAN_EXTENDED_WRITE, "client-session", /*nonblock*/0);
475 
476 	nc->ctl_chan = c->self;		/* link session -> control channel */
477 	c->remote_id = nc->self; 	/* link control -> session channel */
478 	c->have_remote_id = 1;
479 
480 	if (cctx->want_tty && escape_char != 0xffffffff) {
481 		channel_register_filter(ssh, nc->self,
482 		    client_simple_escape_filter, NULL,
483 		    client_filter_cleanup,
484 		    client_new_escape_filter_ctx((int)escape_char));
485 	}
486 
487 	debug2("%s: channel_new: %d linked to control channel %d",
488 	    __func__, nc->self, nc->ctl_chan);
489 
490 	channel_send_open(ssh, nc->self);
491 	channel_register_open_confirm(ssh, nc->self, mux_session_confirm, cctx);
492 	c->mux_pause = 1; /* stop handling messages until open_confirm done */
493 	channel_register_cleanup(ssh, nc->self,
494 	    mux_master_session_cleanup_cb, 1);
495 
496 	/* reply is deferred, sent by mux_session_confirm */
497 	return 0;
498 }
499 
500 static int
mux_master_process_alive_check(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)501 mux_master_process_alive_check(struct ssh *ssh, u_int rid,
502     Channel *c, struct sshbuf *m, struct sshbuf *reply)
503 {
504 	int r;
505 
506 	debug2("%s: channel %d: alive check", __func__, c->self);
507 
508 	/* prepare reply */
509 	if ((r = sshbuf_put_u32(reply, MUX_S_ALIVE)) != 0 ||
510 	    (r = sshbuf_put_u32(reply, rid)) != 0 ||
511 	    (r = sshbuf_put_u32(reply, (u_int)getpid())) != 0)
512 		fatal("%s: reply: %s", __func__, ssh_err(r));
513 
514 	return 0;
515 }
516 
517 static int
mux_master_process_terminate(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)518 mux_master_process_terminate(struct ssh *ssh, u_int rid,
519     Channel *c, struct sshbuf *m, struct sshbuf *reply)
520 {
521 	debug2("%s: channel %d: terminate request", __func__, c->self);
522 
523 	if (options.control_master == SSHCTL_MASTER_ASK ||
524 	    options.control_master == SSHCTL_MASTER_AUTO_ASK) {
525 		if (!ask_permission("Terminate shared connection to %s? ",
526 		    host)) {
527 			debug2("%s: termination refused by user", __func__);
528 			reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
529 			    "Permission denied");
530 			return 0;
531 		}
532 	}
533 
534 	quit_pending = 1;
535 	reply_ok(reply, rid);
536 	/* XXX exit happens too soon - message never makes it to client */
537 	return 0;
538 }
539 
540 static char *
format_forward(u_int ftype,struct Forward * fwd)541 format_forward(u_int ftype, struct Forward *fwd)
542 {
543 	char *ret;
544 
545 	switch (ftype) {
546 	case MUX_FWD_LOCAL:
547 		xasprintf(&ret, "local forward %.200s:%d -> %.200s:%d",
548 		    (fwd->listen_path != NULL) ? fwd->listen_path :
549 		    (fwd->listen_host == NULL) ?
550 		    (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
551 		    fwd->listen_host, fwd->listen_port,
552 		    (fwd->connect_path != NULL) ? fwd->connect_path :
553 		    fwd->connect_host, fwd->connect_port);
554 		break;
555 	case MUX_FWD_DYNAMIC:
556 		xasprintf(&ret, "dynamic forward %.200s:%d -> *",
557 		    (fwd->listen_host == NULL) ?
558 		    (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
559 		     fwd->listen_host, fwd->listen_port);
560 		break;
561 	case MUX_FWD_REMOTE:
562 		xasprintf(&ret, "remote forward %.200s:%d -> %.200s:%d",
563 		    (fwd->listen_path != NULL) ? fwd->listen_path :
564 		    (fwd->listen_host == NULL) ?
565 		    "LOCALHOST" : fwd->listen_host,
566 		    fwd->listen_port,
567 		    (fwd->connect_path != NULL) ? fwd->connect_path :
568 		    fwd->connect_host, fwd->connect_port);
569 		break;
570 	default:
571 		fatal("%s: unknown forward type %u", __func__, ftype);
572 	}
573 	return ret;
574 }
575 
576 static int
compare_host(const char * a,const char * b)577 compare_host(const char *a, const char *b)
578 {
579 	if (a == NULL && b == NULL)
580 		return 1;
581 	if (a == NULL || b == NULL)
582 		return 0;
583 	return strcmp(a, b) == 0;
584 }
585 
586 static int
compare_forward(struct Forward * a,struct Forward * b)587 compare_forward(struct Forward *a, struct Forward *b)
588 {
589 	if (!compare_host(a->listen_host, b->listen_host))
590 		return 0;
591 	if (!compare_host(a->listen_path, b->listen_path))
592 		return 0;
593 	if (a->listen_port != b->listen_port)
594 		return 0;
595 	if (!compare_host(a->connect_host, b->connect_host))
596 		return 0;
597 	if (!compare_host(a->connect_path, b->connect_path))
598 		return 0;
599 	if (a->connect_port != b->connect_port)
600 		return 0;
601 
602 	return 1;
603 }
604 
605 static void
mux_confirm_remote_forward(struct ssh * ssh,int type,u_int32_t seq,void * ctxt)606 mux_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
607 {
608 	struct mux_channel_confirm_ctx *fctx = ctxt;
609 	char *failmsg = NULL;
610 	struct Forward *rfwd;
611 	Channel *c;
612 	struct sshbuf *out;
613 	u_int port;
614 	int r;
615 
616 	if ((c = channel_by_id(ssh, fctx->cid)) == NULL) {
617 		/* no channel for reply */
618 		error("%s: unknown channel", __func__);
619 		return;
620 	}
621 	if ((out = sshbuf_new()) == NULL)
622 		fatal("%s: sshbuf_new", __func__);
623 	if (fctx->fid >= options.num_remote_forwards ||
624 	    (options.remote_forwards[fctx->fid].connect_path == NULL &&
625 	    options.remote_forwards[fctx->fid].connect_host == NULL)) {
626 		xasprintf(&failmsg, "unknown forwarding id %d", fctx->fid);
627 		goto fail;
628 	}
629 	rfwd = &options.remote_forwards[fctx->fid];
630 	debug("%s: %s for: listen %d, connect %s:%d", __func__,
631 	    type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
632 	    rfwd->listen_port, rfwd->connect_path ? rfwd->connect_path :
633 	    rfwd->connect_host, rfwd->connect_port);
634 	if (type == SSH2_MSG_REQUEST_SUCCESS) {
635 		if (rfwd->listen_port == 0) {
636 			if ((r = sshpkt_get_u32(ssh, &port)) != 0)
637 				fatal("%s: packet error: %s",
638 				    __func__, ssh_err(r));
639 			if (port > 65535) {
640 				fatal("Invalid allocated port %u for "
641 				    "mux remote forward to %s:%d", port,
642 				    rfwd->connect_host, rfwd->connect_port);
643 			}
644 			rfwd->allocated_port = (int)port;
645 			debug("Allocated port %u for mux remote forward"
646 			    " to %s:%d", rfwd->allocated_port,
647 			    rfwd->connect_host, rfwd->connect_port);
648 			if ((r = sshbuf_put_u32(out,
649 			    MUX_S_REMOTE_PORT)) != 0 ||
650 			    (r = sshbuf_put_u32(out, fctx->rid)) != 0 ||
651 			    (r = sshbuf_put_u32(out,
652 			    rfwd->allocated_port)) != 0)
653 				fatal("%s: reply: %s", __func__, ssh_err(r));
654 			channel_update_permission(ssh, rfwd->handle,
655 			   rfwd->allocated_port);
656 		} else {
657 			reply_ok(out, fctx->rid);
658 		}
659 		goto out;
660 	} else {
661 		if (rfwd->listen_port == 0)
662 			channel_update_permission(ssh, rfwd->handle, -1);
663 		if (rfwd->listen_path != NULL)
664 			xasprintf(&failmsg, "remote port forwarding failed for "
665 			    "listen path %s", rfwd->listen_path);
666 		else
667 			xasprintf(&failmsg, "remote port forwarding failed for "
668 			    "listen port %d", rfwd->listen_port);
669 
670                 debug2("%s: clearing registered forwarding for listen %d, "
671 		    "connect %s:%d", __func__, rfwd->listen_port,
672 		    rfwd->connect_path ? rfwd->connect_path :
673 		    rfwd->connect_host, rfwd->connect_port);
674 
675 		free(rfwd->listen_host);
676 		free(rfwd->listen_path);
677 		free(rfwd->connect_host);
678 		free(rfwd->connect_path);
679 		memset(rfwd, 0, sizeof(*rfwd));
680 	}
681  fail:
682 	error("%s: %s", __func__, failmsg);
683 	reply_error(out, MUX_S_FAILURE, fctx->rid, failmsg);
684 	free(failmsg);
685  out:
686 	if ((r = sshbuf_put_stringb(c->output, out)) != 0)
687 		fatal("%s: sshbuf_put_stringb: %s", __func__, ssh_err(r));
688 	sshbuf_free(out);
689 	if (c->mux_pause <= 0)
690 		fatal("%s: mux_pause %d", __func__, c->mux_pause);
691 	c->mux_pause = 0; /* start processing messages again */
692 }
693 
694 static int
mux_master_process_open_fwd(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)695 mux_master_process_open_fwd(struct ssh *ssh, u_int rid,
696     Channel *c, struct sshbuf *m, struct sshbuf *reply)
697 {
698 	struct Forward fwd;
699 	char *fwd_desc = NULL;
700 	char *listen_addr, *connect_addr;
701 	u_int ftype;
702 	u_int lport, cport;
703 	int r, i, ret = 0, freefwd = 1;
704 
705 	memset(&fwd, 0, sizeof(fwd));
706 
707 	/* XXX - lport/cport check redundant */
708 	if ((r = sshbuf_get_u32(m, &ftype)) != 0 ||
709 	    (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 ||
710 	    (r = sshbuf_get_u32(m, &lport)) != 0 ||
711 	    (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 ||
712 	    (r = sshbuf_get_u32(m, &cport)) != 0 ||
713 	    (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
714 	    (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
715 		error("%s: malformed message", __func__);
716 		ret = -1;
717 		goto out;
718 	}
719 	if (*listen_addr == '\0') {
720 		free(listen_addr);
721 		listen_addr = NULL;
722 	}
723 	if (*connect_addr == '\0') {
724 		free(connect_addr);
725 		connect_addr = NULL;
726 	}
727 
728 	memset(&fwd, 0, sizeof(fwd));
729 	fwd.listen_port = lport;
730 	if (fwd.listen_port == PORT_STREAMLOCAL)
731 		fwd.listen_path = listen_addr;
732 	else
733 		fwd.listen_host = listen_addr;
734 	fwd.connect_port = cport;
735 	if (fwd.connect_port == PORT_STREAMLOCAL)
736 		fwd.connect_path = connect_addr;
737 	else
738 		fwd.connect_host = connect_addr;
739 
740 	debug2("%s: channel %d: request %s", __func__, c->self,
741 	    (fwd_desc = format_forward(ftype, &fwd)));
742 
743 	if (ftype != MUX_FWD_LOCAL && ftype != MUX_FWD_REMOTE &&
744 	    ftype != MUX_FWD_DYNAMIC) {
745 		logit("%s: invalid forwarding type %u", __func__, ftype);
746  invalid:
747 		free(listen_addr);
748 		free(connect_addr);
749 		reply_error(reply, MUX_S_FAILURE, rid,
750 		    "Invalid forwarding request");
751 		return 0;
752 	}
753 	if (ftype == MUX_FWD_DYNAMIC && fwd.listen_path) {
754 		logit("%s: streamlocal and dynamic forwards "
755 		    "are mutually exclusive", __func__);
756 		goto invalid;
757 	}
758 	if (fwd.listen_port != PORT_STREAMLOCAL && fwd.listen_port >= 65536) {
759 		logit("%s: invalid listen port %u", __func__,
760 		    fwd.listen_port);
761 		goto invalid;
762 	}
763 	if ((fwd.connect_port != PORT_STREAMLOCAL &&
764 	    fwd.connect_port >= 65536) ||
765 	    (ftype != MUX_FWD_DYNAMIC && ftype != MUX_FWD_REMOTE &&
766 	    fwd.connect_port == 0)) {
767 		logit("%s: invalid connect port %u", __func__,
768 		    fwd.connect_port);
769 		goto invalid;
770 	}
771 	if (ftype != MUX_FWD_DYNAMIC && fwd.connect_host == NULL &&
772 	    fwd.connect_path == NULL) {
773 		logit("%s: missing connect host", __func__);
774 		goto invalid;
775 	}
776 
777 	/* Skip forwards that have already been requested */
778 	switch (ftype) {
779 	case MUX_FWD_LOCAL:
780 	case MUX_FWD_DYNAMIC:
781 		for (i = 0; i < options.num_local_forwards; i++) {
782 			if (compare_forward(&fwd,
783 			    options.local_forwards + i)) {
784  exists:
785 				debug2("%s: found existing forwarding",
786 				    __func__);
787 				reply_ok(reply, rid);
788 				goto out;
789 			}
790 		}
791 		break;
792 	case MUX_FWD_REMOTE:
793 		for (i = 0; i < options.num_remote_forwards; i++) {
794 			if (!compare_forward(&fwd, options.remote_forwards + i))
795 				continue;
796 			if (fwd.listen_port != 0)
797 				goto exists;
798 			debug2("%s: found allocated port", __func__);
799 			if ((r = sshbuf_put_u32(reply,
800 			    MUX_S_REMOTE_PORT)) != 0 ||
801 			    (r = sshbuf_put_u32(reply, rid)) != 0 ||
802 			    (r = sshbuf_put_u32(reply,
803 			    options.remote_forwards[i].allocated_port)) != 0)
804 				fatal("%s: reply: %s", __func__, ssh_err(r));
805 			goto out;
806 		}
807 		break;
808 	}
809 
810 	if (options.control_master == SSHCTL_MASTER_ASK ||
811 	    options.control_master == SSHCTL_MASTER_AUTO_ASK) {
812 		if (!ask_permission("Open %s on %s?", fwd_desc, host)) {
813 			debug2("%s: forwarding refused by user", __func__);
814 			reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
815 			    "Permission denied");
816 			goto out;
817 		}
818 	}
819 
820 	if (ftype == MUX_FWD_LOCAL || ftype == MUX_FWD_DYNAMIC) {
821 		if (!channel_setup_local_fwd_listener(ssh, &fwd,
822 		    &options.fwd_opts)) {
823  fail:
824 			logit("%s: requested %s failed", __func__, fwd_desc);
825 			reply_error(reply, MUX_S_FAILURE, rid,
826 			    "Port forwarding failed");
827 			goto out;
828 		}
829 		add_local_forward(&options, &fwd);
830 		freefwd = 0;
831 	} else {
832 		struct mux_channel_confirm_ctx *fctx;
833 
834 		fwd.handle = channel_request_remote_forwarding(ssh, &fwd);
835 		if (fwd.handle < 0)
836 			goto fail;
837 		add_remote_forward(&options, &fwd);
838 		fctx = xcalloc(1, sizeof(*fctx));
839 		fctx->cid = c->self;
840 		fctx->rid = rid;
841 		fctx->fid = options.num_remote_forwards - 1;
842 		client_register_global_confirm(mux_confirm_remote_forward,
843 		    fctx);
844 		freefwd = 0;
845 		c->mux_pause = 1; /* wait for mux_confirm_remote_forward */
846 		/* delayed reply in mux_confirm_remote_forward */
847 		goto out;
848 	}
849 	reply_ok(reply, rid);
850  out:
851 	free(fwd_desc);
852 	if (freefwd) {
853 		free(fwd.listen_host);
854 		free(fwd.listen_path);
855 		free(fwd.connect_host);
856 		free(fwd.connect_path);
857 	}
858 	return ret;
859 }
860 
861 static int
mux_master_process_close_fwd(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)862 mux_master_process_close_fwd(struct ssh *ssh, u_int rid,
863     Channel *c, struct sshbuf *m, struct sshbuf *reply)
864 {
865 	struct Forward fwd, *found_fwd;
866 	char *fwd_desc = NULL;
867 	const char *error_reason = NULL;
868 	char *listen_addr = NULL, *connect_addr = NULL;
869 	u_int ftype;
870 	int r, i, ret = 0;
871 	u_int lport, cport;
872 
873 	memset(&fwd, 0, sizeof(fwd));
874 
875 	if ((r = sshbuf_get_u32(m, &ftype)) != 0 ||
876 	    (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 ||
877 	    (r = sshbuf_get_u32(m, &lport)) != 0 ||
878 	    (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 ||
879 	    (r = sshbuf_get_u32(m, &cport)) != 0 ||
880 	    (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
881 	    (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
882 		error("%s: malformed message", __func__);
883 		ret = -1;
884 		goto out;
885 	}
886 
887 	if (*listen_addr == '\0') {
888 		free(listen_addr);
889 		listen_addr = NULL;
890 	}
891 	if (*connect_addr == '\0') {
892 		free(connect_addr);
893 		connect_addr = NULL;
894 	}
895 
896 	memset(&fwd, 0, sizeof(fwd));
897 	fwd.listen_port = lport;
898 	if (fwd.listen_port == PORT_STREAMLOCAL)
899 		fwd.listen_path = listen_addr;
900 	else
901 		fwd.listen_host = listen_addr;
902 	fwd.connect_port = cport;
903 	if (fwd.connect_port == PORT_STREAMLOCAL)
904 		fwd.connect_path = connect_addr;
905 	else
906 		fwd.connect_host = connect_addr;
907 
908 	debug2("%s: channel %d: request cancel %s", __func__, c->self,
909 	    (fwd_desc = format_forward(ftype, &fwd)));
910 
911 	/* make sure this has been requested */
912 	found_fwd = NULL;
913 	switch (ftype) {
914 	case MUX_FWD_LOCAL:
915 	case MUX_FWD_DYNAMIC:
916 		for (i = 0; i < options.num_local_forwards; i++) {
917 			if (compare_forward(&fwd,
918 			    options.local_forwards + i)) {
919 				found_fwd = options.local_forwards + i;
920 				break;
921 			}
922 		}
923 		break;
924 	case MUX_FWD_REMOTE:
925 		for (i = 0; i < options.num_remote_forwards; i++) {
926 			if (compare_forward(&fwd,
927 			    options.remote_forwards + i)) {
928 				found_fwd = options.remote_forwards + i;
929 				break;
930 			}
931 		}
932 		break;
933 	}
934 
935 	if (found_fwd == NULL)
936 		error_reason = "port not forwarded";
937 	else if (ftype == MUX_FWD_REMOTE) {
938 		/*
939 		 * This shouldn't fail unless we confused the host/port
940 		 * between options.remote_forwards and permitted_opens.
941 		 * However, for dynamic allocated listen ports we need
942 		 * to use the actual listen port.
943 		 */
944 		if (channel_request_rforward_cancel(ssh, found_fwd) == -1)
945 			error_reason = "port not in permitted opens";
946 	} else {	/* local and dynamic forwards */
947 		/* Ditto */
948 		if (channel_cancel_lport_listener(ssh, &fwd, fwd.connect_port,
949 		    &options.fwd_opts) == -1)
950 			error_reason = "port not found";
951 	}
952 
953 	if (error_reason != NULL)
954 		reply_error(reply, MUX_S_FAILURE, rid, error_reason);
955 	else {
956 		reply_ok(reply, rid);
957 		free(found_fwd->listen_host);
958 		free(found_fwd->listen_path);
959 		free(found_fwd->connect_host);
960 		free(found_fwd->connect_path);
961 		found_fwd->listen_host = found_fwd->connect_host = NULL;
962 		found_fwd->listen_path = found_fwd->connect_path = NULL;
963 		found_fwd->listen_port = found_fwd->connect_port = 0;
964 	}
965  out:
966 	free(fwd_desc);
967 	free(listen_addr);
968 	free(connect_addr);
969 
970 	return ret;
971 }
972 
973 static int
mux_master_process_stdio_fwd(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)974 mux_master_process_stdio_fwd(struct ssh *ssh, u_int rid,
975     Channel *c, struct sshbuf *m, struct sshbuf *reply)
976 {
977 	Channel *nc;
978 	char *chost = NULL;
979 	u_int cport, i, j;
980 	int r, new_fd[2];
981 	struct mux_stdio_confirm_ctx *cctx;
982 
983 	if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */
984 	    (r = sshbuf_get_cstring(m, &chost, NULL)) != 0 ||
985 	    (r = sshbuf_get_u32(m, &cport)) != 0) {
986 		free(chost);
987 		error("%s: malformed message", __func__);
988 		return -1;
989 	}
990 
991 	debug2("%s: channel %d: request stdio fwd to %s:%u",
992 	    __func__, c->self, chost, cport);
993 
994 	/* Gather fds from client */
995 	for(i = 0; i < 2; i++) {
996 		if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) {
997 			error("%s: failed to receive fd %d from slave",
998 			    __func__, i);
999 			for (j = 0; j < i; j++)
1000 				close(new_fd[j]);
1001 			free(chost);
1002 
1003 			/* prepare reply */
1004 			reply_error(reply, MUX_S_FAILURE, rid,
1005 			    "did not receive file descriptors");
1006 			return -1;
1007 		}
1008 	}
1009 
1010 	debug3("%s: got fds stdin %d, stdout %d", __func__,
1011 	    new_fd[0], new_fd[1]);
1012 
1013 	/* XXX support multiple child sessions in future */
1014 	if (c->have_remote_id) {
1015 		debug2("%s: session already open", __func__);
1016 		reply_error(reply, MUX_S_FAILURE, rid,
1017 		    "Multiple sessions not supported");
1018  cleanup:
1019 		close(new_fd[0]);
1020 		close(new_fd[1]);
1021 		free(chost);
1022 		return 0;
1023 	}
1024 
1025 	if (options.control_master == SSHCTL_MASTER_ASK ||
1026 	    options.control_master == SSHCTL_MASTER_AUTO_ASK) {
1027 		if (!ask_permission("Allow forward to %s:%u? ",
1028 		    chost, cport)) {
1029 			debug2("%s: stdio fwd refused by user", __func__);
1030 			reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
1031 			    "Permission denied");
1032 			goto cleanup;
1033 		}
1034 	}
1035 
1036 	/* enable nonblocking unless tty */
1037 	if (!isatty(new_fd[0]))
1038 		set_nonblock(new_fd[0]);
1039 	if (!isatty(new_fd[1]))
1040 		set_nonblock(new_fd[1]);
1041 
1042 	nc = channel_connect_stdio_fwd(ssh, chost, cport, new_fd[0], new_fd[1]);
1043 	free(chost);
1044 
1045 	nc->ctl_chan = c->self;		/* link session -> control channel */
1046 	c->remote_id = nc->self; 	/* link control -> session channel */
1047 	c->have_remote_id = 1;
1048 
1049 	debug2("%s: channel_new: %d linked to control channel %d",
1050 	    __func__, nc->self, nc->ctl_chan);
1051 
1052 	channel_register_cleanup(ssh, nc->self,
1053 	    mux_master_session_cleanup_cb, 1);
1054 
1055 	cctx = xcalloc(1, sizeof(*cctx));
1056 	cctx->rid = rid;
1057 	channel_register_open_confirm(ssh, nc->self, mux_stdio_confirm, cctx);
1058 	c->mux_pause = 1; /* stop handling messages until open_confirm done */
1059 
1060 	/* reply is deferred, sent by mux_session_confirm */
1061 	return 0;
1062 }
1063 
1064 /* Callback on open confirmation in mux master for a mux stdio fwd session. */
1065 static void
mux_stdio_confirm(struct ssh * ssh,int id,int success,void * arg)1066 mux_stdio_confirm(struct ssh *ssh, int id, int success, void *arg)
1067 {
1068 	struct mux_stdio_confirm_ctx *cctx = arg;
1069 	Channel *c, *cc;
1070 	struct sshbuf *reply;
1071 	int r;
1072 
1073 	if (cctx == NULL)
1074 		fatal("%s: cctx == NULL", __func__);
1075 	if ((c = channel_by_id(ssh, id)) == NULL)
1076 		fatal("%s: no channel for id %d", __func__, id);
1077 	if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1078 		fatal("%s: channel %d lacks control channel %d", __func__,
1079 		    id, c->ctl_chan);
1080 	if ((reply = sshbuf_new()) == NULL)
1081 		fatal("%s: sshbuf_new", __func__);
1082 
1083 	if (!success) {
1084 		debug3("%s: sending failure reply", __func__);
1085 		reply_error(reply, MUX_S_FAILURE, cctx->rid,
1086 		    "Session open refused by peer");
1087 		/* prepare reply */
1088 		goto done;
1089 	}
1090 
1091 	debug3("%s: sending success reply", __func__);
1092 	/* prepare reply */
1093 	if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 ||
1094 	    (r = sshbuf_put_u32(reply, cctx->rid)) != 0 ||
1095 	    (r = sshbuf_put_u32(reply, c->self)) != 0)
1096 		fatal("%s: reply: %s", __func__, ssh_err(r));
1097 
1098  done:
1099 	/* Send reply */
1100 	if ((r = sshbuf_put_stringb(cc->output, reply)) != 0)
1101 		fatal("%s: sshbuf_put_stringb: %s", __func__, ssh_err(r));
1102 	sshbuf_free(reply);
1103 
1104 	if (cc->mux_pause <= 0)
1105 		fatal("%s: mux_pause %d", __func__, cc->mux_pause);
1106 	cc->mux_pause = 0; /* start processing messages again */
1107 	c->open_confirm_ctx = NULL;
1108 	free(cctx);
1109 }
1110 
1111 static int
mux_master_process_stop_listening(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)1112 mux_master_process_stop_listening(struct ssh *ssh, u_int rid,
1113     Channel *c, struct sshbuf *m, struct sshbuf *reply)
1114 {
1115 	debug("%s: channel %d: stop listening", __func__, c->self);
1116 
1117 	if (options.control_master == SSHCTL_MASTER_ASK ||
1118 	    options.control_master == SSHCTL_MASTER_AUTO_ASK) {
1119 		if (!ask_permission("Disable further multiplexing on shared "
1120 		    "connection to %s? ", host)) {
1121 			debug2("%s: stop listen refused by user", __func__);
1122 			reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
1123 			    "Permission denied");
1124 			return 0;
1125 		}
1126 	}
1127 
1128 	if (mux_listener_channel != NULL) {
1129 		channel_free(ssh, mux_listener_channel);
1130 		client_stop_mux();
1131 		free(options.control_path);
1132 		options.control_path = NULL;
1133 		mux_listener_channel = NULL;
1134 		muxserver_sock = -1;
1135 	}
1136 
1137 	reply_ok(reply, rid);
1138 	return 0;
1139 }
1140 
1141 static int
mux_master_process_proxy(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)1142 mux_master_process_proxy(struct ssh *ssh, u_int rid,
1143     Channel *c, struct sshbuf *m, struct sshbuf *reply)
1144 {
1145 	int r;
1146 
1147 	debug("%s: channel %d: proxy request", __func__, c->self);
1148 
1149 	c->mux_rcb = channel_proxy_downstream;
1150 	if ((r = sshbuf_put_u32(reply, MUX_S_PROXY)) != 0 ||
1151 	    (r = sshbuf_put_u32(reply, rid)) != 0)
1152 		fatal("%s: reply: %s", __func__, ssh_err(r));
1153 
1154 	return 0;
1155 }
1156 
1157 /* Channel callbacks fired on read/write from mux slave fd */
1158 static int
mux_master_read_cb(struct ssh * ssh,Channel * c)1159 mux_master_read_cb(struct ssh *ssh, Channel *c)
1160 {
1161 	struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx;
1162 	struct sshbuf *in = NULL, *out = NULL;
1163 	u_int type, rid, i;
1164 	int r, ret = -1;
1165 
1166 	if ((out = sshbuf_new()) == NULL)
1167 		fatal("%s: sshbuf_new", __func__);
1168 
1169 	/* Setup ctx and  */
1170 	if (c->mux_ctx == NULL) {
1171 		state = xcalloc(1, sizeof(*state));
1172 		c->mux_ctx = state;
1173 		channel_register_cleanup(ssh, c->self,
1174 		    mux_master_control_cleanup_cb, 0);
1175 
1176 		/* Send hello */
1177 		if ((r = sshbuf_put_u32(out, MUX_MSG_HELLO)) != 0 ||
1178 		    (r = sshbuf_put_u32(out, SSHMUX_VER)) != 0)
1179 			fatal("%s: reply: %s", __func__, ssh_err(r));
1180 		/* no extensions */
1181 		if ((r = sshbuf_put_stringb(c->output, out)) != 0)
1182 			fatal("%s: sshbuf_put_stringb: %s",
1183 			    __func__, ssh_err(r));
1184 		debug3("%s: channel %d: hello sent", __func__, c->self);
1185 		ret = 0;
1186 		goto out;
1187 	}
1188 
1189 	/* Channel code ensures that we receive whole packets */
1190 	if ((r = sshbuf_froms(c->input, &in)) != 0) {
1191  malf:
1192 		error("%s: malformed message", __func__);
1193 		goto out;
1194 	}
1195 
1196 	if ((r = sshbuf_get_u32(in, &type)) != 0)
1197 		goto malf;
1198 	debug3("%s: channel %d packet type 0x%08x len %zu",
1199 	    __func__, c->self, type, sshbuf_len(in));
1200 
1201 	if (type == MUX_MSG_HELLO)
1202 		rid = 0;
1203 	else {
1204 		if (!state->hello_rcvd) {
1205 			error("%s: expected MUX_MSG_HELLO(0x%08x), "
1206 			    "received 0x%08x", __func__, MUX_MSG_HELLO, type);
1207 			goto out;
1208 		}
1209 		if ((r = sshbuf_get_u32(in, &rid)) != 0)
1210 			goto malf;
1211 	}
1212 
1213 	for (i = 0; mux_master_handlers[i].handler != NULL; i++) {
1214 		if (type == mux_master_handlers[i].type) {
1215 			ret = mux_master_handlers[i].handler(ssh, rid,
1216 			    c, in, out);
1217 			break;
1218 		}
1219 	}
1220 	if (mux_master_handlers[i].handler == NULL) {
1221 		error("%s: unsupported mux message 0x%08x", __func__, type);
1222 		reply_error(out, MUX_S_FAILURE, rid, "unsupported request");
1223 		ret = 0;
1224 	}
1225 	/* Enqueue reply packet */
1226 	if (sshbuf_len(out) != 0) {
1227 		if ((r = sshbuf_put_stringb(c->output, out)) != 0)
1228 			fatal("%s: sshbuf_put_stringb: %s",
1229 			    __func__, ssh_err(r));
1230 	}
1231  out:
1232 	sshbuf_free(in);
1233 	sshbuf_free(out);
1234 	return ret;
1235 }
1236 
1237 void
mux_exit_message(struct ssh * ssh,Channel * c,int exitval)1238 mux_exit_message(struct ssh *ssh, Channel *c, int exitval)
1239 {
1240 	struct sshbuf *m;
1241 	Channel *mux_chan;
1242 	int r;
1243 
1244 	debug3("%s: channel %d: exit message, exitval %d", __func__, c->self,
1245 	    exitval);
1246 
1247 	if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL)
1248 		fatal("%s: channel %d missing mux channel %d",
1249 		    __func__, c->self, c->ctl_chan);
1250 
1251 	/* Append exit message packet to control socket output queue */
1252 	if ((m = sshbuf_new()) == NULL)
1253 		fatal("%s: sshbuf_new", __func__);
1254 	if ((r = sshbuf_put_u32(m, MUX_S_EXIT_MESSAGE)) != 0 ||
1255 	    (r = sshbuf_put_u32(m, c->self)) != 0 ||
1256 	    (r = sshbuf_put_u32(m, exitval)) != 0 ||
1257 	    (r = sshbuf_put_stringb(mux_chan->output, m)) != 0)
1258 		fatal("%s: reply: %s", __func__, ssh_err(r));
1259 	sshbuf_free(m);
1260 }
1261 
1262 void
mux_tty_alloc_failed(struct ssh * ssh,Channel * c)1263 mux_tty_alloc_failed(struct ssh *ssh, Channel *c)
1264 {
1265 	struct sshbuf *m;
1266 	Channel *mux_chan;
1267 	int r;
1268 
1269 	debug3("%s: channel %d: TTY alloc failed", __func__, c->self);
1270 
1271 	if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL)
1272 		fatal("%s: channel %d missing mux channel %d",
1273 		    __func__, c->self, c->ctl_chan);
1274 
1275 	/* Append exit message packet to control socket output queue */
1276 	if ((m = sshbuf_new()) == NULL)
1277 		fatal("%s: sshbuf_new", __func__);
1278 	if ((r = sshbuf_put_u32(m, MUX_S_TTY_ALLOC_FAIL)) != 0 ||
1279 	    (r = sshbuf_put_u32(m, c->self)) != 0 ||
1280 	    (r = sshbuf_put_stringb(mux_chan->output, m)) != 0)
1281 		fatal("%s: reply: %s", __func__, ssh_err(r));
1282 	sshbuf_free(m);
1283 }
1284 
1285 /* Prepare a mux master to listen on a Unix domain socket. */
1286 void
muxserver_listen(struct ssh * ssh)1287 muxserver_listen(struct ssh *ssh)
1288 {
1289 	mode_t old_umask;
1290 	char *orig_control_path = options.control_path;
1291 	char rbuf[16+1];
1292 	u_int i, r;
1293 	int oerrno;
1294 
1295 	if (options.control_path == NULL ||
1296 	    options.control_master == SSHCTL_MASTER_NO)
1297 		return;
1298 
1299 	debug("setting up multiplex master socket");
1300 
1301 	/*
1302 	 * Use a temporary path before listen so we can pseudo-atomically
1303 	 * establish the listening socket in its final location to avoid
1304 	 * other processes racing in between bind() and listen() and hitting
1305 	 * an unready socket.
1306 	 */
1307 	for (i = 0; i < sizeof(rbuf) - 1; i++) {
1308 		r = arc4random_uniform(26+26+10);
1309 		rbuf[i] = (r < 26) ? 'a' + r :
1310 		    (r < 26*2) ? 'A' + r - 26 :
1311 		    '0' + r - 26 - 26;
1312 	}
1313 	rbuf[sizeof(rbuf) - 1] = '\0';
1314 	options.control_path = NULL;
1315 	xasprintf(&options.control_path, "%s.%s", orig_control_path, rbuf);
1316 	debug3("%s: temporary control path %s", __func__, options.control_path);
1317 
1318 	old_umask = umask(0177);
1319 	muxserver_sock = unix_listener(options.control_path, 64, 0);
1320 	oerrno = errno;
1321 	umask(old_umask);
1322 	if (muxserver_sock < 0) {
1323 		if (oerrno == EINVAL || oerrno == EADDRINUSE) {
1324 			error("ControlSocket %s already exists, "
1325 			    "disabling multiplexing", options.control_path);
1326  disable_mux_master:
1327 			if (muxserver_sock != -1) {
1328 				close(muxserver_sock);
1329 				muxserver_sock = -1;
1330 			}
1331 			free(orig_control_path);
1332 			free(options.control_path);
1333 			options.control_path = NULL;
1334 			options.control_master = SSHCTL_MASTER_NO;
1335 			return;
1336 		} else {
1337 			/* unix_listener() logs the error */
1338 			cleanup_exit(255);
1339 		}
1340 	}
1341 
1342 	/* Now atomically "move" the mux socket into position */
1343 	if (link(options.control_path, orig_control_path) != 0) {
1344 		if (errno != EEXIST) {
1345 			fatal("%s: link mux listener %s => %s: %s", __func__,
1346 			    options.control_path, orig_control_path,
1347 			    strerror(errno));
1348 		}
1349 		error("ControlSocket %s already exists, disabling multiplexing",
1350 		    orig_control_path);
1351 		unlink(options.control_path);
1352 		goto disable_mux_master;
1353 	}
1354 	unlink(options.control_path);
1355 	free(options.control_path);
1356 	options.control_path = orig_control_path;
1357 
1358 	set_nonblock(muxserver_sock);
1359 
1360 	mux_listener_channel = channel_new(ssh, "mux listener",
1361 	    SSH_CHANNEL_MUX_LISTENER, muxserver_sock, muxserver_sock, -1,
1362 	    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1363 	    0, options.control_path, 1);
1364 	mux_listener_channel->mux_rcb = mux_master_read_cb;
1365 	debug3("%s: mux listener channel %d fd %d", __func__,
1366 	    mux_listener_channel->self, mux_listener_channel->sock);
1367 }
1368 
1369 /* Callback on open confirmation in mux master for a mux client session. */
1370 static void
mux_session_confirm(struct ssh * ssh,int id,int success,void * arg)1371 mux_session_confirm(struct ssh *ssh, int id, int success, void *arg)
1372 {
1373 	struct mux_session_confirm_ctx *cctx = arg;
1374 	const char *display;
1375 	Channel *c, *cc;
1376 	int i, r;
1377 	struct sshbuf *reply;
1378 
1379 	if (cctx == NULL)
1380 		fatal("%s: cctx == NULL", __func__);
1381 	if ((c = channel_by_id(ssh, id)) == NULL)
1382 		fatal("%s: no channel for id %d", __func__, id);
1383 	if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1384 		fatal("%s: channel %d lacks control channel %d", __func__,
1385 		    id, c->ctl_chan);
1386 	if ((reply = sshbuf_new()) == NULL)
1387 		fatal("%s: sshbuf_new", __func__);
1388 
1389 	if (!success) {
1390 		debug3("%s: sending failure reply", __func__);
1391 		reply_error(reply, MUX_S_FAILURE, cctx->rid,
1392 		    "Session open refused by peer");
1393 		goto done;
1394 	}
1395 
1396 	display = getenv("DISPLAY");
1397 	if (cctx->want_x_fwd && options.forward_x11 && display != NULL) {
1398 		char *proto, *data;
1399 
1400 		/* Get reasonable local authentication information. */
1401 		if (client_x11_get_proto(ssh, display, options.xauth_location,
1402 		    options.forward_x11_trusted, options.forward_x11_timeout,
1403 		    &proto, &data) == 0) {
1404 			/* Request forwarding with authentication spoofing. */
1405 			debug("Requesting X11 forwarding with authentication "
1406 			    "spoofing.");
1407 			x11_request_forwarding_with_spoofing(ssh, id,
1408 			    display, proto, data, 1);
1409 			/* XXX exit_on_forward_failure */
1410 			client_expect_confirm(ssh, id, "X11 forwarding",
1411 			    CONFIRM_WARN);
1412 		}
1413 	}
1414 
1415 	if (cctx->want_agent_fwd && options.forward_agent) {
1416 		debug("Requesting authentication agent forwarding.");
1417 		channel_request_start(ssh, id, "auth-agent-req@openssh.com", 0);
1418 		if ((r = sshpkt_send(ssh)) != 0)
1419 			fatal("%s: packet error: %s", __func__, ssh_err(r));
1420 	}
1421 
1422 	client_session2_setup(ssh, id, cctx->want_tty, cctx->want_subsys,
1423 	    cctx->term, &cctx->tio, c->rfd, cctx->cmd, cctx->env);
1424 
1425 	debug3("%s: sending success reply", __func__);
1426 	/* prepare reply */
1427 	if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 ||
1428 	    (r = sshbuf_put_u32(reply, cctx->rid)) != 0 ||
1429 	    (r = sshbuf_put_u32(reply, c->self)) != 0)
1430 		fatal("%s: reply: %s", __func__, ssh_err(r));
1431 
1432  done:
1433 	/* Send reply */
1434 	if ((r = sshbuf_put_stringb(cc->output, reply)) != 0)
1435 		fatal("%s: sshbuf_put_stringb: %s", __func__, ssh_err(r));
1436 	sshbuf_free(reply);
1437 
1438 	if (cc->mux_pause <= 0)
1439 		fatal("%s: mux_pause %d", __func__, cc->mux_pause);
1440 	cc->mux_pause = 0; /* start processing messages again */
1441 	c->open_confirm_ctx = NULL;
1442 	sshbuf_free(cctx->cmd);
1443 	free(cctx->term);
1444 	if (cctx->env != NULL) {
1445 		for (i = 0; cctx->env[i] != NULL; i++)
1446 			free(cctx->env[i]);
1447 		free(cctx->env);
1448 	}
1449 	free(cctx);
1450 }
1451 
1452 /* ** Multiplexing client support */
1453 
1454 /* Exit signal handler */
1455 static void
control_client_sighandler(int signo)1456 control_client_sighandler(int signo)
1457 {
1458 	muxclient_terminate = signo;
1459 }
1460 
1461 /*
1462  * Relay signal handler - used to pass some signals from mux client to
1463  * mux master.
1464  */
1465 static void
control_client_sigrelay(int signo)1466 control_client_sigrelay(int signo)
1467 {
1468 	int save_errno = errno;
1469 
1470 	if (muxserver_pid > 1)
1471 		kill(muxserver_pid, signo);
1472 
1473 	errno = save_errno;
1474 }
1475 
1476 static int
mux_client_read(int fd,struct sshbuf * b,size_t need)1477 mux_client_read(int fd, struct sshbuf *b, size_t need)
1478 {
1479 	size_t have;
1480 	ssize_t len;
1481 	u_char *p;
1482 	struct pollfd pfd;
1483 	int r;
1484 
1485 	pfd.fd = fd;
1486 	pfd.events = POLLIN;
1487 	if ((r = sshbuf_reserve(b, need, &p)) != 0)
1488 		fatal("%s: reserve: %s", __func__, ssh_err(r));
1489 	for (have = 0; have < need; ) {
1490 		if (muxclient_terminate) {
1491 			errno = EINTR;
1492 			return -1;
1493 		}
1494 		len = read(fd, p + have, need - have);
1495 		if (len == -1) {
1496 			switch (errno) {
1497 #if defined(EWOULDBLOCK) && (EWOULDBLOCK != EAGAIN)
1498 			case EWOULDBLOCK:
1499 #endif
1500 			case EAGAIN:
1501 				(void)poll(&pfd, 1, -1);
1502 				/* FALLTHROUGH */
1503 			case EINTR:
1504 				continue;
1505 			default:
1506 				return -1;
1507 			}
1508 		}
1509 		if (len == 0) {
1510 			errno = EPIPE;
1511 			return -1;
1512 		}
1513 		have += (size_t)len;
1514 	}
1515 	return 0;
1516 }
1517 
1518 static int
mux_client_write_packet(int fd,struct sshbuf * m)1519 mux_client_write_packet(int fd, struct sshbuf *m)
1520 {
1521 	struct sshbuf *queue;
1522 	u_int have, need;
1523 	int r, oerrno, len;
1524 	const u_char *ptr;
1525 	struct pollfd pfd;
1526 
1527 	pfd.fd = fd;
1528 	pfd.events = POLLOUT;
1529 	if ((queue = sshbuf_new()) == NULL)
1530 		fatal("%s: sshbuf_new", __func__);
1531 	if ((r = sshbuf_put_stringb(queue, m)) != 0)
1532 		fatal("%s: sshbuf_put_stringb: %s", __func__, ssh_err(r));
1533 
1534 	need = sshbuf_len(queue);
1535 	ptr = sshbuf_ptr(queue);
1536 
1537 	for (have = 0; have < need; ) {
1538 		if (muxclient_terminate) {
1539 			sshbuf_free(queue);
1540 			errno = EINTR;
1541 			return -1;
1542 		}
1543 		len = write(fd, ptr + have, need - have);
1544 		if (len == -1) {
1545 			switch (errno) {
1546 #if defined(EWOULDBLOCK) && (EWOULDBLOCK != EAGAIN)
1547 			case EWOULDBLOCK:
1548 #endif
1549 			case EAGAIN:
1550 				(void)poll(&pfd, 1, -1);
1551 				/* FALLTHROUGH */
1552 			case EINTR:
1553 				continue;
1554 			default:
1555 				oerrno = errno;
1556 				sshbuf_free(queue);
1557 				errno = oerrno;
1558 				return -1;
1559 			}
1560 		}
1561 		if (len == 0) {
1562 			sshbuf_free(queue);
1563 			errno = EPIPE;
1564 			return -1;
1565 		}
1566 		have += (u_int)len;
1567 	}
1568 	sshbuf_free(queue);
1569 	return 0;
1570 }
1571 
1572 static int
mux_client_read_packet(int fd,struct sshbuf * m)1573 mux_client_read_packet(int fd, struct sshbuf *m)
1574 {
1575 	struct sshbuf *queue;
1576 	size_t need, have;
1577 	const u_char *ptr;
1578 	int r, oerrno;
1579 
1580 	if ((queue = sshbuf_new()) == NULL)
1581 		fatal("%s: sshbuf_new", __func__);
1582 	if (mux_client_read(fd, queue, 4) != 0) {
1583 		if ((oerrno = errno) == EPIPE)
1584 			debug3("%s: read header failed: %s", __func__,
1585 			    strerror(errno));
1586 		sshbuf_free(queue);
1587 		errno = oerrno;
1588 		return -1;
1589 	}
1590 	need = PEEK_U32(sshbuf_ptr(queue));
1591 	if (mux_client_read(fd, queue, need) != 0) {
1592 		oerrno = errno;
1593 		debug3("%s: read body failed: %s", __func__, strerror(errno));
1594 		sshbuf_free(queue);
1595 		errno = oerrno;
1596 		return -1;
1597 	}
1598 	if ((r = sshbuf_get_string_direct(queue, &ptr, &have)) != 0 ||
1599 	    (r = sshbuf_put(m, ptr, have)) != 0)
1600 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
1601 	sshbuf_free(queue);
1602 	return 0;
1603 }
1604 
1605 static int
mux_client_hello_exchange(int fd)1606 mux_client_hello_exchange(int fd)
1607 {
1608 	struct sshbuf *m;
1609 	u_int type, ver;
1610 	int r, ret = -1;
1611 
1612 	if ((m = sshbuf_new()) == NULL)
1613 		fatal("%s: sshbuf_new", __func__);
1614 	if ((r = sshbuf_put_u32(m, MUX_MSG_HELLO)) != 0 ||
1615 	    (r = sshbuf_put_u32(m, SSHMUX_VER)) != 0)
1616 		fatal("%s: hello: %s", __func__, ssh_err(r));
1617 	/* no extensions */
1618 
1619 	if (mux_client_write_packet(fd, m) != 0) {
1620 		debug("%s: write packet: %s", __func__, strerror(errno));
1621 		goto out;
1622 	}
1623 
1624 	sshbuf_reset(m);
1625 
1626 	/* Read their HELLO */
1627 	if (mux_client_read_packet(fd, m) != 0) {
1628 		debug("%s: read packet failed", __func__);
1629 		goto out;
1630 	}
1631 
1632 	if ((r = sshbuf_get_u32(m, &type)) != 0)
1633 		fatal("%s: decode type: %s", __func__, ssh_err(r));
1634 	if (type != MUX_MSG_HELLO) {
1635 		error("%s: expected HELLO (%u) received %u",
1636 		    __func__, MUX_MSG_HELLO, type);
1637 		goto out;
1638 	}
1639 	if ((r = sshbuf_get_u32(m, &ver)) != 0)
1640 		fatal("%s: decode version: %s", __func__, ssh_err(r));
1641 	if (ver != SSHMUX_VER) {
1642 		error("Unsupported multiplexing protocol version %d "
1643 		    "(expected %d)", ver, SSHMUX_VER);
1644 		goto out;
1645 	}
1646 	debug2("%s: master version %u", __func__, ver);
1647 	/* No extensions are presently defined */
1648 	while (sshbuf_len(m) > 0) {
1649 		char *name = NULL;
1650 
1651 		if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 ||
1652 		    (r = sshbuf_skip_string(m)) != 0) { /* value */
1653 			error("%s: malformed extension: %s",
1654 			    __func__, ssh_err(r));
1655 			goto out;
1656 		}
1657 		debug2("Unrecognised master extension \"%s\"", name);
1658 		free(name);
1659 	}
1660 	/* success */
1661 	ret = 0;
1662  out:
1663 	sshbuf_free(m);
1664 	return ret;
1665 }
1666 
1667 static u_int
mux_client_request_alive(int fd)1668 mux_client_request_alive(int fd)
1669 {
1670 	struct sshbuf *m;
1671 	char *e;
1672 	u_int pid, type, rid;
1673 	int r;
1674 
1675 	debug3("%s: entering", __func__);
1676 
1677 	if ((m = sshbuf_new()) == NULL)
1678 		fatal("%s: sshbuf_new", __func__);
1679 	if ((r = sshbuf_put_u32(m, MUX_C_ALIVE_CHECK)) != 0 ||
1680 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1681 		fatal("%s: request: %s", __func__, ssh_err(r));
1682 
1683 	if (mux_client_write_packet(fd, m) != 0)
1684 		fatal("%s: write packet: %s", __func__, strerror(errno));
1685 
1686 	sshbuf_reset(m);
1687 
1688 	/* Read their reply */
1689 	if (mux_client_read_packet(fd, m) != 0) {
1690 		sshbuf_free(m);
1691 		return 0;
1692 	}
1693 
1694 	if ((r = sshbuf_get_u32(m, &type)) != 0)
1695 		fatal("%s: decode type: %s", __func__, ssh_err(r));
1696 	if (type != MUX_S_ALIVE) {
1697 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1698 			fatal("%s: decode error: %s", __func__, ssh_err(r));
1699 		fatal("%s: master returned error: %s", __func__, e);
1700 	}
1701 
1702 	if ((r = sshbuf_get_u32(m, &rid)) != 0)
1703 		fatal("%s: decode remote ID: %s", __func__, ssh_err(r));
1704 	if (rid != muxclient_request_id)
1705 		fatal("%s: out of sequence reply: my id %u theirs %u",
1706 		    __func__, muxclient_request_id, rid);
1707 	if ((r = sshbuf_get_u32(m, &pid)) != 0)
1708 		fatal("%s: decode PID: %s", __func__, ssh_err(r));
1709 	sshbuf_free(m);
1710 
1711 	debug3("%s: done pid = %u", __func__, pid);
1712 
1713 	muxclient_request_id++;
1714 
1715 	return pid;
1716 }
1717 
1718 static void
mux_client_request_terminate(int fd)1719 mux_client_request_terminate(int fd)
1720 {
1721 	struct sshbuf *m;
1722 	char *e;
1723 	u_int type, rid;
1724 	int r;
1725 
1726 	debug3("%s: entering", __func__);
1727 
1728 	if ((m = sshbuf_new()) == NULL)
1729 		fatal("%s: sshbuf_new", __func__);
1730 	if ((r = sshbuf_put_u32(m, MUX_C_TERMINATE)) != 0 ||
1731 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1732 		fatal("%s: request: %s", __func__, ssh_err(r));
1733 
1734 	if (mux_client_write_packet(fd, m) != 0)
1735 		fatal("%s: write packet: %s", __func__, strerror(errno));
1736 
1737 	sshbuf_reset(m);
1738 
1739 	/* Read their reply */
1740 	if (mux_client_read_packet(fd, m) != 0) {
1741 		/* Remote end exited already */
1742 		if (errno == EPIPE) {
1743 			sshbuf_free(m);
1744 			return;
1745 		}
1746 		fatal("%s: read from master failed: %s",
1747 		    __func__, strerror(errno));
1748 	}
1749 
1750 	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1751 	    (r = sshbuf_get_u32(m, &rid)) != 0)
1752 		fatal("%s: decode: %s", __func__, ssh_err(r));
1753 	if (rid != muxclient_request_id)
1754 		fatal("%s: out of sequence reply: my id %u theirs %u",
1755 		    __func__, muxclient_request_id, rid);
1756 	switch (type) {
1757 	case MUX_S_OK:
1758 		break;
1759 	case MUX_S_PERMISSION_DENIED:
1760 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1761 			fatal("%s: decode error: %s", __func__, ssh_err(r));
1762 		fatal("Master refused termination request: %s", e);
1763 	case MUX_S_FAILURE:
1764 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1765 			fatal("%s: decode error: %s", __func__, ssh_err(r));
1766 		fatal("%s: termination request failed: %s", __func__, e);
1767 	default:
1768 		fatal("%s: unexpected response from master 0x%08x",
1769 		    __func__, type);
1770 	}
1771 	sshbuf_free(m);
1772 	muxclient_request_id++;
1773 }
1774 
1775 static int
mux_client_forward(int fd,int cancel_flag,u_int ftype,struct Forward * fwd)1776 mux_client_forward(int fd, int cancel_flag, u_int ftype, struct Forward *fwd)
1777 {
1778 	struct sshbuf *m;
1779 	char *e, *fwd_desc;
1780 	const char *lhost, *chost;
1781 	u_int type, rid;
1782 	int r;
1783 
1784 	fwd_desc = format_forward(ftype, fwd);
1785 	debug("Requesting %s %s",
1786 	    cancel_flag ? "cancellation of" : "forwarding of", fwd_desc);
1787 	free(fwd_desc);
1788 
1789 	type = cancel_flag ? MUX_C_CLOSE_FWD : MUX_C_OPEN_FWD;
1790 	if (fwd->listen_path != NULL)
1791 		lhost = fwd->listen_path;
1792 	else if (fwd->listen_host == NULL)
1793 		lhost = "";
1794 	else if (*fwd->listen_host == '\0')
1795 		lhost = "*";
1796 	else
1797 		lhost = fwd->listen_host;
1798 
1799 	if (fwd->connect_path != NULL)
1800 		chost = fwd->connect_path;
1801 	else if (fwd->connect_host == NULL)
1802 		chost = "";
1803 	else
1804 		chost = fwd->connect_host;
1805 
1806 	if ((m = sshbuf_new()) == NULL)
1807 		fatal("%s: sshbuf_new", __func__);
1808 	if ((r = sshbuf_put_u32(m, type)) != 0 ||
1809 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
1810 	    (r = sshbuf_put_u32(m, ftype)) != 0 ||
1811 	    (r = sshbuf_put_cstring(m, lhost)) != 0 ||
1812 	    (r = sshbuf_put_u32(m, fwd->listen_port)) != 0 ||
1813 	    (r = sshbuf_put_cstring(m, chost)) != 0 ||
1814 	    (r = sshbuf_put_u32(m, fwd->connect_port)) != 0)
1815 		fatal("%s: request: %s", __func__, ssh_err(r));
1816 
1817 	if (mux_client_write_packet(fd, m) != 0)
1818 		fatal("%s: write packet: %s", __func__, strerror(errno));
1819 
1820 	sshbuf_reset(m);
1821 
1822 	/* Read their reply */
1823 	if (mux_client_read_packet(fd, m) != 0) {
1824 		sshbuf_free(m);
1825 		return -1;
1826 	}
1827 
1828 	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1829 	    (r = sshbuf_get_u32(m, &rid)) != 0)
1830 		fatal("%s: decode: %s", __func__, ssh_err(r));
1831 	if (rid != muxclient_request_id)
1832 		fatal("%s: out of sequence reply: my id %u theirs %u",
1833 		    __func__, muxclient_request_id, rid);
1834 
1835 	switch (type) {
1836 	case MUX_S_OK:
1837 		break;
1838 	case MUX_S_REMOTE_PORT:
1839 		if (cancel_flag)
1840 			fatal("%s: got MUX_S_REMOTE_PORT for cancel", __func__);
1841 		if ((r = sshbuf_get_u32(m, &fwd->allocated_port)) != 0)
1842 			fatal("%s: decode port: %s", __func__, ssh_err(r));
1843 		verbose("Allocated port %u for remote forward to %s:%d",
1844 		    fwd->allocated_port,
1845 		    fwd->connect_host ? fwd->connect_host : "",
1846 		    fwd->connect_port);
1847 		if (muxclient_command == SSHMUX_COMMAND_FORWARD)
1848 			fprintf(stdout, "%i\n", fwd->allocated_port);
1849 		break;
1850 	case MUX_S_PERMISSION_DENIED:
1851 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1852 			fatal("%s: decode error: %s", __func__, ssh_err(r));
1853 		sshbuf_free(m);
1854 		error("Master refused forwarding request: %s", e);
1855 		return -1;
1856 	case MUX_S_FAILURE:
1857 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1858 			fatal("%s: decode error: %s", __func__, ssh_err(r));
1859 		sshbuf_free(m);
1860 		error("%s: forwarding request failed: %s", __func__, e);
1861 		return -1;
1862 	default:
1863 		fatal("%s: unexpected response from master 0x%08x",
1864 		    __func__, type);
1865 	}
1866 	sshbuf_free(m);
1867 
1868 	muxclient_request_id++;
1869 	return 0;
1870 }
1871 
1872 static int
mux_client_forwards(int fd,int cancel_flag)1873 mux_client_forwards(int fd, int cancel_flag)
1874 {
1875 	int i, ret = 0;
1876 
1877 	debug3("%s: %s forwardings: %d local, %d remote", __func__,
1878 	    cancel_flag ? "cancel" : "request",
1879 	    options.num_local_forwards, options.num_remote_forwards);
1880 
1881 	/* XXX ExitOnForwardingFailure */
1882 	for (i = 0; i < options.num_local_forwards; i++) {
1883 		if (mux_client_forward(fd, cancel_flag,
1884 		    options.local_forwards[i].connect_port == 0 ?
1885 		    MUX_FWD_DYNAMIC : MUX_FWD_LOCAL,
1886 		    options.local_forwards + i) != 0)
1887 			ret = -1;
1888 	}
1889 	for (i = 0; i < options.num_remote_forwards; i++) {
1890 		if (mux_client_forward(fd, cancel_flag, MUX_FWD_REMOTE,
1891 		    options.remote_forwards + i) != 0)
1892 			ret = -1;
1893 	}
1894 	return ret;
1895 }
1896 
1897 static int
mux_client_request_session(int fd)1898 mux_client_request_session(int fd)
1899 {
1900 	struct sshbuf *m;
1901 	char *e;
1902 	const char *term;
1903 	u_int echar, rid, sid, esid, exitval, type, exitval_seen;
1904 	extern char **environ;
1905 	int r, i, devnull, rawmode;
1906 
1907 	debug3("%s: entering", __func__);
1908 
1909 	if ((muxserver_pid = mux_client_request_alive(fd)) == 0) {
1910 		error("%s: master alive request failed", __func__);
1911 		return -1;
1912 	}
1913 
1914 	ssh_signal(SIGPIPE, SIG_IGN);
1915 
1916 	if (stdin_null_flag) {
1917 		if ((devnull = open(_PATH_DEVNULL, O_RDONLY)) == -1)
1918 			fatal("open(/dev/null): %s", strerror(errno));
1919 		if (dup2(devnull, STDIN_FILENO) == -1)
1920 			fatal("dup2: %s", strerror(errno));
1921 		if (devnull > STDERR_FILENO)
1922 			close(devnull);
1923 	}
1924 
1925 	if ((term = getenv("TERM")) == NULL)
1926 		term = "";
1927 	echar = 0xffffffff;
1928 	if (options.escape_char != SSH_ESCAPECHAR_NONE)
1929 	    echar = (u_int)options.escape_char;
1930 
1931 	if ((m = sshbuf_new()) == NULL)
1932 		fatal("%s: sshbuf_new", __func__);
1933 	if ((r = sshbuf_put_u32(m, MUX_C_NEW_SESSION)) != 0 ||
1934 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
1935 	    (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */
1936 	    (r = sshbuf_put_u32(m, tty_flag)) != 0 ||
1937 	    (r = sshbuf_put_u32(m, options.forward_x11)) != 0 ||
1938 	    (r = sshbuf_put_u32(m, options.forward_agent)) != 0 ||
1939 	    (r = sshbuf_put_u32(m, subsystem_flag)) != 0 ||
1940 	    (r = sshbuf_put_u32(m, echar)) != 0 ||
1941 	    (r = sshbuf_put_cstring(m, term)) != 0 ||
1942 	    (r = sshbuf_put_stringb(m, command)) != 0)
1943 		fatal("%s: request: %s", __func__, ssh_err(r));
1944 
1945 	/* Pass environment */
1946 	if (options.num_send_env > 0 && environ != NULL) {
1947 		for (i = 0; environ[i] != NULL; i++) {
1948 			if (!env_permitted(environ[i]))
1949 				continue;
1950 			if ((r = sshbuf_put_cstring(m, environ[i])) != 0)
1951 				fatal("%s: request: %s", __func__, ssh_err(r));
1952 		}
1953 	}
1954 	for (i = 0; i < options.num_setenv; i++) {
1955 		if ((r = sshbuf_put_cstring(m, options.setenv[i])) != 0)
1956 			fatal("%s: request: %s", __func__, ssh_err(r));
1957 	}
1958 
1959 	if (mux_client_write_packet(fd, m) != 0)
1960 		fatal("%s: write packet: %s", __func__, strerror(errno));
1961 
1962 	/* Send the stdio file descriptors */
1963 	if (mm_send_fd(fd, STDIN_FILENO) == -1 ||
1964 	    mm_send_fd(fd, STDOUT_FILENO) == -1 ||
1965 	    mm_send_fd(fd, STDERR_FILENO) == -1)
1966 		fatal("%s: send fds failed", __func__);
1967 
1968 	debug3("%s: session request sent", __func__);
1969 
1970 	/* Read their reply */
1971 	sshbuf_reset(m);
1972 	if (mux_client_read_packet(fd, m) != 0) {
1973 		error("%s: read from master failed: %s",
1974 		    __func__, strerror(errno));
1975 		sshbuf_free(m);
1976 		return -1;
1977 	}
1978 
1979 	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1980 	    (r = sshbuf_get_u32(m, &rid)) != 0)
1981 		fatal("%s: decode: %s", __func__, ssh_err(r));
1982 	if (rid != muxclient_request_id)
1983 		fatal("%s: out of sequence reply: my id %u theirs %u",
1984 		    __func__, muxclient_request_id, rid);
1985 
1986 	switch (type) {
1987 	case MUX_S_SESSION_OPENED:
1988 		if ((r = sshbuf_get_u32(m, &sid)) != 0)
1989 			fatal("%s: decode ID: %s", __func__, ssh_err(r));
1990 		debug("%s: master session id: %u", __func__, sid);
1991 		break;
1992 	case MUX_S_PERMISSION_DENIED:
1993 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1994 			fatal("%s: decode error: %s", __func__, ssh_err(r));
1995 		error("Master refused session request: %s", e);
1996 		sshbuf_free(m);
1997 		return -1;
1998 	case MUX_S_FAILURE:
1999 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2000 			fatal("%s: decode error: %s", __func__, ssh_err(r));
2001 		error("%s: session request failed: %s", __func__, e);
2002 		sshbuf_free(m);
2003 		return -1;
2004 	default:
2005 		sshbuf_free(m);
2006 		error("%s: unexpected response from master 0x%08x",
2007 		    __func__, type);
2008 		return -1;
2009 	}
2010 	muxclient_request_id++;
2011 
2012 	if (pledge("stdio proc tty", NULL) == -1)
2013 		fatal("%s pledge(): %s", __func__, strerror(errno));
2014 	platform_pledge_mux();
2015 
2016 	ssh_signal(SIGHUP, control_client_sighandler);
2017 	ssh_signal(SIGINT, control_client_sighandler);
2018 	ssh_signal(SIGTERM, control_client_sighandler);
2019 	ssh_signal(SIGWINCH, control_client_sigrelay);
2020 
2021 	rawmode = tty_flag;
2022 	if (tty_flag)
2023 		enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
2024 
2025 	/*
2026 	 * Stick around until the controlee closes the client_fd.
2027 	 * Before it does, it is expected to write an exit message.
2028 	 * This process must read the value and wait for the closure of
2029 	 * the client_fd; if this one closes early, the multiplex master will
2030 	 * terminate early too (possibly losing data).
2031 	 */
2032 	for (exitval = 255, exitval_seen = 0;;) {
2033 		sshbuf_reset(m);
2034 		if (mux_client_read_packet(fd, m) != 0)
2035 			break;
2036 		if ((r = sshbuf_get_u32(m, &type)) != 0)
2037 			fatal("%s: decode type: %s", __func__, ssh_err(r));
2038 		switch (type) {
2039 		case MUX_S_TTY_ALLOC_FAIL:
2040 			if ((r = sshbuf_get_u32(m, &esid)) != 0)
2041 				fatal("%s: decode ID: %s",
2042 				    __func__, ssh_err(r));
2043 			if (esid != sid)
2044 				fatal("%s: tty alloc fail on unknown session: "
2045 				    "my id %u theirs %u",
2046 				    __func__, sid, esid);
2047 			leave_raw_mode(options.request_tty ==
2048 			    REQUEST_TTY_FORCE);
2049 			rawmode = 0;
2050 			continue;
2051 		case MUX_S_EXIT_MESSAGE:
2052 			if ((r = sshbuf_get_u32(m, &esid)) != 0)
2053 				fatal("%s: decode ID: %s",
2054 				    __func__, ssh_err(r));
2055 			if (esid != sid)
2056 				fatal("%s: exit on unknown session: "
2057 				    "my id %u theirs %u",
2058 				    __func__, sid, esid);
2059 			if (exitval_seen)
2060 				fatal("%s: exitval sent twice", __func__);
2061 			if ((r = sshbuf_get_u32(m, &exitval)) != 0)
2062 				fatal("%s: decode exit value: %s",
2063 				    __func__, ssh_err(r));
2064 			exitval_seen = 1;
2065 			continue;
2066 		default:
2067 			if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2068 				fatal("%s: decode error: %s",
2069 				    __func__, ssh_err(r));
2070 			fatal("%s: master returned error: %s", __func__, e);
2071 		}
2072 	}
2073 
2074 	close(fd);
2075 	if (rawmode)
2076 		leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
2077 
2078 	if (muxclient_terminate) {
2079 		debug2("Exiting on signal: %s", strsignal(muxclient_terminate));
2080 		exitval = 255;
2081 	} else if (!exitval_seen) {
2082 		debug2("Control master terminated unexpectedly");
2083 		exitval = 255;
2084 	} else
2085 		debug2("Received exit status from master %d", exitval);
2086 
2087 	if (tty_flag && options.log_level != SYSLOG_LEVEL_QUIET)
2088 		fprintf(stderr, "Shared connection to %s closed.\r\n", host);
2089 
2090 	exit(exitval);
2091 }
2092 
2093 static int
mux_client_proxy(int fd)2094 mux_client_proxy(int fd)
2095 {
2096 	struct sshbuf *m;
2097 	char *e;
2098 	u_int type, rid;
2099 	int r;
2100 
2101 	if ((m = sshbuf_new()) == NULL)
2102 		fatal("%s: sshbuf_new", __func__);
2103 	if ((r = sshbuf_put_u32(m, MUX_C_PROXY)) != 0 ||
2104 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
2105 		fatal("%s: request: %s", __func__, ssh_err(r));
2106 	if (mux_client_write_packet(fd, m) != 0)
2107 		fatal("%s: write packet: %s", __func__, strerror(errno));
2108 
2109 	sshbuf_reset(m);
2110 
2111 	/* Read their reply */
2112 	if (mux_client_read_packet(fd, m) != 0) {
2113 		sshbuf_free(m);
2114 		return 0;
2115 	}
2116 	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2117 	    (r = sshbuf_get_u32(m, &rid)) != 0)
2118 		fatal("%s: decode: %s", __func__, ssh_err(r));
2119 	if (rid != muxclient_request_id)
2120 		fatal("%s: out of sequence reply: my id %u theirs %u",
2121 		    __func__, muxclient_request_id, rid);
2122 	if (type != MUX_S_PROXY) {
2123 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2124 			fatal("%s: decode error: %s", __func__, ssh_err(r));
2125 		fatal("%s: master returned error: %s", __func__, e);
2126 	}
2127 	sshbuf_free(m);
2128 
2129 	debug3("%s: done", __func__);
2130 	muxclient_request_id++;
2131 	return 0;
2132 }
2133 
2134 static int
mux_client_request_stdio_fwd(int fd)2135 mux_client_request_stdio_fwd(int fd)
2136 {
2137 	struct sshbuf *m;
2138 	char *e;
2139 	u_int type, rid, sid;
2140 	int r, devnull;
2141 
2142 	debug3("%s: entering", __func__);
2143 
2144 	if ((muxserver_pid = mux_client_request_alive(fd)) == 0) {
2145 		error("%s: master alive request failed", __func__);
2146 		return -1;
2147 	}
2148 
2149 	ssh_signal(SIGPIPE, SIG_IGN);
2150 
2151 	if (stdin_null_flag) {
2152 		if ((devnull = open(_PATH_DEVNULL, O_RDONLY)) == -1)
2153 			fatal("open(/dev/null): %s", strerror(errno));
2154 		if (dup2(devnull, STDIN_FILENO) == -1)
2155 			fatal("dup2: %s", strerror(errno));
2156 		if (devnull > STDERR_FILENO)
2157 			close(devnull);
2158 	}
2159 
2160 	if ((m = sshbuf_new()) == NULL)
2161 		fatal("%s: sshbuf_new", __func__);
2162 	if ((r = sshbuf_put_u32(m, MUX_C_NEW_STDIO_FWD)) != 0 ||
2163 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
2164 	    (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */
2165 	    (r = sshbuf_put_cstring(m, options.stdio_forward_host)) != 0 ||
2166 	    (r = sshbuf_put_u32(m, options.stdio_forward_port)) != 0)
2167 		fatal("%s: request: %s", __func__, ssh_err(r));
2168 
2169 	if (mux_client_write_packet(fd, m) != 0)
2170 		fatal("%s: write packet: %s", __func__, strerror(errno));
2171 
2172 	/* Send the stdio file descriptors */
2173 	if (mm_send_fd(fd, STDIN_FILENO) == -1 ||
2174 	    mm_send_fd(fd, STDOUT_FILENO) == -1)
2175 		fatal("%s: send fds failed", __func__);
2176 
2177 	if (pledge("stdio proc tty", NULL) == -1)
2178 		fatal("%s pledge(): %s", __func__, strerror(errno));
2179 	platform_pledge_mux();
2180 
2181 	debug3("%s: stdio forward request sent", __func__);
2182 
2183 	/* Read their reply */
2184 	sshbuf_reset(m);
2185 
2186 	if (mux_client_read_packet(fd, m) != 0) {
2187 		error("%s: read from master failed: %s",
2188 		    __func__, strerror(errno));
2189 		sshbuf_free(m);
2190 		return -1;
2191 	}
2192 
2193 	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2194 	    (r = sshbuf_get_u32(m, &rid)) != 0)
2195 		fatal("%s: decode: %s", __func__, ssh_err(r));
2196 	if (rid != muxclient_request_id)
2197 		fatal("%s: out of sequence reply: my id %u theirs %u",
2198 		    __func__, muxclient_request_id, rid);
2199 	switch (type) {
2200 	case MUX_S_SESSION_OPENED:
2201 		if ((r = sshbuf_get_u32(m, &sid)) != 0)
2202 			fatal("%s: decode ID: %s", __func__, ssh_err(r));
2203 		debug("%s: master session id: %u", __func__, sid);
2204 		break;
2205 	case MUX_S_PERMISSION_DENIED:
2206 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2207 			fatal("%s: decode error: %s", __func__, ssh_err(r));
2208 		sshbuf_free(m);
2209 		fatal("Master refused stdio forwarding request: %s", e);
2210 	case MUX_S_FAILURE:
2211 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2212 			fatal("%s: decode error: %s", __func__, ssh_err(r));
2213 		sshbuf_free(m);
2214 		fatal("Stdio forwarding request failed: %s", e);
2215 	default:
2216 		sshbuf_free(m);
2217 		error("%s: unexpected response from master 0x%08x",
2218 		    __func__, type);
2219 		return -1;
2220 	}
2221 	muxclient_request_id++;
2222 
2223 	ssh_signal(SIGHUP, control_client_sighandler);
2224 	ssh_signal(SIGINT, control_client_sighandler);
2225 	ssh_signal(SIGTERM, control_client_sighandler);
2226 	ssh_signal(SIGWINCH, control_client_sigrelay);
2227 
2228 	/*
2229 	 * Stick around until the controlee closes the client_fd.
2230 	 */
2231 	sshbuf_reset(m);
2232 	if (mux_client_read_packet(fd, m) != 0) {
2233 		if (errno == EPIPE ||
2234 		    (errno == EINTR && muxclient_terminate != 0))
2235 			return 0;
2236 		fatal("%s: mux_client_read_packet: %s",
2237 		    __func__, strerror(errno));
2238 	}
2239 	fatal("%s: master returned unexpected message %u", __func__, type);
2240 }
2241 
2242 static void
mux_client_request_stop_listening(int fd)2243 mux_client_request_stop_listening(int fd)
2244 {
2245 	struct sshbuf *m;
2246 	char *e;
2247 	u_int type, rid;
2248 	int r;
2249 
2250 	debug3("%s: entering", __func__);
2251 
2252 	if ((m = sshbuf_new()) == NULL)
2253 		fatal("%s: sshbuf_new", __func__);
2254 	if ((r = sshbuf_put_u32(m, MUX_C_STOP_LISTENING)) != 0 ||
2255 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
2256 		fatal("%s: request: %s", __func__, ssh_err(r));
2257 
2258 	if (mux_client_write_packet(fd, m) != 0)
2259 		fatal("%s: write packet: %s", __func__, strerror(errno));
2260 
2261 	sshbuf_reset(m);
2262 
2263 	/* Read their reply */
2264 	if (mux_client_read_packet(fd, m) != 0)
2265 		fatal("%s: read from master failed: %s",
2266 		    __func__, strerror(errno));
2267 
2268 	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2269 	    (r = sshbuf_get_u32(m, &rid)) != 0)
2270 		fatal("%s: decode: %s", __func__, ssh_err(r));
2271 	if (rid != muxclient_request_id)
2272 		fatal("%s: out of sequence reply: my id %u theirs %u",
2273 		    __func__, muxclient_request_id, rid);
2274 
2275 	switch (type) {
2276 	case MUX_S_OK:
2277 		break;
2278 	case MUX_S_PERMISSION_DENIED:
2279 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2280 			fatal("%s: decode error: %s", __func__, ssh_err(r));
2281 		fatal("Master refused stop listening request: %s", e);
2282 	case MUX_S_FAILURE:
2283 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2284 			fatal("%s: decode error: %s", __func__, ssh_err(r));
2285 		fatal("%s: stop listening request failed: %s", __func__, e);
2286 	default:
2287 		fatal("%s: unexpected response from master 0x%08x",
2288 		    __func__, type);
2289 	}
2290 	sshbuf_free(m);
2291 	muxclient_request_id++;
2292 }
2293 
2294 /* Multiplex client main loop. */
2295 int
muxclient(const char * path)2296 muxclient(const char *path)
2297 {
2298 	struct sockaddr_un addr;
2299 	int sock;
2300 	u_int pid;
2301 
2302 	if (muxclient_command == 0) {
2303 		if (options.stdio_forward_host != NULL)
2304 			muxclient_command = SSHMUX_COMMAND_STDIO_FWD;
2305 		else
2306 			muxclient_command = SSHMUX_COMMAND_OPEN;
2307 	}
2308 
2309 	switch (options.control_master) {
2310 	case SSHCTL_MASTER_AUTO:
2311 	case SSHCTL_MASTER_AUTO_ASK:
2312 		debug("auto-mux: Trying existing master");
2313 		/* FALLTHROUGH */
2314 	case SSHCTL_MASTER_NO:
2315 		break;
2316 	default:
2317 		return -1;
2318 	}
2319 
2320 	memset(&addr, '\0', sizeof(addr));
2321 	addr.sun_family = AF_UNIX;
2322 
2323 	if (strlcpy(addr.sun_path, path,
2324 	    sizeof(addr.sun_path)) >= sizeof(addr.sun_path))
2325 		fatal("ControlPath too long ('%s' >= %u bytes)", path,
2326 		     (unsigned int)sizeof(addr.sun_path));
2327 
2328 	if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
2329 		fatal("%s socket(): %s", __func__, strerror(errno));
2330 
2331 	if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
2332 		switch (muxclient_command) {
2333 		case SSHMUX_COMMAND_OPEN:
2334 		case SSHMUX_COMMAND_STDIO_FWD:
2335 			break;
2336 		default:
2337 			fatal("Control socket connect(%.100s): %s", path,
2338 			    strerror(errno));
2339 		}
2340 		if (errno == ECONNREFUSED &&
2341 		    options.control_master != SSHCTL_MASTER_NO) {
2342 			debug("Stale control socket %.100s, unlinking", path);
2343 			unlink(path);
2344 		} else if (errno == ENOENT) {
2345 			debug("Control socket \"%.100s\" does not exist", path);
2346 		} else {
2347 			error("Control socket connect(%.100s): %s", path,
2348 			    strerror(errno));
2349 		}
2350 		close(sock);
2351 		return -1;
2352 	}
2353 	set_nonblock(sock);
2354 
2355 	if (mux_client_hello_exchange(sock) != 0) {
2356 		error("%s: master hello exchange failed", __func__);
2357 		close(sock);
2358 		return -1;
2359 	}
2360 
2361 	switch (muxclient_command) {
2362 	case SSHMUX_COMMAND_ALIVE_CHECK:
2363 		if ((pid = mux_client_request_alive(sock)) == 0)
2364 			fatal("%s: master alive check failed", __func__);
2365 		fprintf(stderr, "Master running (pid=%u)\r\n", pid);
2366 		exit(0);
2367 	case SSHMUX_COMMAND_TERMINATE:
2368 		mux_client_request_terminate(sock);
2369 		if (options.log_level != SYSLOG_LEVEL_QUIET)
2370 			fprintf(stderr, "Exit request sent.\r\n");
2371 		exit(0);
2372 	case SSHMUX_COMMAND_FORWARD:
2373 		if (mux_client_forwards(sock, 0) != 0)
2374 			fatal("%s: master forward request failed", __func__);
2375 		exit(0);
2376 	case SSHMUX_COMMAND_OPEN:
2377 		if (mux_client_forwards(sock, 0) != 0) {
2378 			error("%s: master forward request failed", __func__);
2379 			return -1;
2380 		}
2381 		mux_client_request_session(sock);
2382 		return -1;
2383 	case SSHMUX_COMMAND_STDIO_FWD:
2384 		mux_client_request_stdio_fwd(sock);
2385 		exit(0);
2386 	case SSHMUX_COMMAND_STOP:
2387 		mux_client_request_stop_listening(sock);
2388 		if (options.log_level != SYSLOG_LEVEL_QUIET)
2389 			fprintf(stderr, "Stop listening request sent.\r\n");
2390 		exit(0);
2391 	case SSHMUX_COMMAND_CANCEL_FWD:
2392 		if (mux_client_forwards(sock, 1) != 0)
2393 			error("%s: master cancel forward request failed",
2394 			    __func__);
2395 		exit(0);
2396 	case SSHMUX_COMMAND_PROXY:
2397 		mux_client_proxy(sock);
2398 		return (sock);
2399 	default:
2400 		fatal("unrecognised muxclient_command %d", muxclient_command);
2401 	}
2402 }
2403