Mercurial > dropbear
view cli-session.c @ 1872:6b25cdad4783
Fix regression in non-symlink dropbearmulti
Introduced in recent commit for re-exec
author | Matt Johnston <matt@ucc.asn.au> |
---|---|
date | Tue, 01 Feb 2022 23:15:53 +0800 |
parents | 1d86a58fb52d |
children | 62e4baa059c3 |
line wrap: on
line source
/* * Dropbear SSH * * Copyright (c) 2002,2003 Matt Johnston * Copyright (c) 2004 by Mihnea Stoenescu * All rights reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy * of this software and associated documentation files (the "Software"), to deal * in the Software without restriction, including without limitation the rights * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell * copies of the Software, and to permit persons to whom the Software is * furnished to do so, subject to the following conditions: * * The above copyright notice and this permission notice shall be included in * all copies or substantial portions of the Software. * * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE * SOFTWARE. */ #include "includes.h" #include "session.h" #include "dbutil.h" #include "kex.h" #include "ssh.h" #include "packet.h" #include "tcpfwd.h" #include "channel.h" #include "dbrandom.h" #include "service.h" #include "runopts.h" #include "chansession.h" #include "agentfwd.h" #include "crypto_desc.h" #include "netio.h" static void cli_remoteclosed(void) ATTRIB_NORETURN; static void cli_sessionloop(void); static void cli_session_init(pid_t proxy_cmd_pid); static void cli_finished(void) ATTRIB_NORETURN; static void recv_msg_service_accept(void); static void cli_session_cleanup(void); static void recv_msg_global_request_cli(void); struct clientsession cli_ses; /* GLOBAL */ /* Sorted in decreasing frequency will be more efficient - data and window * should be first */ static const packettype cli_packettypes[] = { /* TYPE, FUNCTION */ {SSH_MSG_CHANNEL_DATA, recv_msg_channel_data}, {SSH_MSG_CHANNEL_EXTENDED_DATA, recv_msg_channel_extended_data}, {SSH_MSG_CHANNEL_WINDOW_ADJUST, recv_msg_channel_window_adjust}, {SSH_MSG_USERAUTH_FAILURE, recv_msg_userauth_failure}, /* client */ {SSH_MSG_USERAUTH_SUCCESS, recv_msg_userauth_success}, /* client */ {SSH_MSG_KEXINIT, recv_msg_kexinit}, {SSH_MSG_KEXDH_REPLY, recv_msg_kexdh_reply}, /* client */ {SSH_MSG_NEWKEYS, recv_msg_newkeys}, {SSH_MSG_SERVICE_ACCEPT, recv_msg_service_accept}, /* client */ {SSH_MSG_CHANNEL_REQUEST, recv_msg_channel_request}, {SSH_MSG_CHANNEL_OPEN, recv_msg_channel_open}, {SSH_MSG_CHANNEL_EOF, recv_msg_channel_eof}, {SSH_MSG_CHANNEL_CLOSE, recv_msg_channel_close}, {SSH_MSG_CHANNEL_OPEN_CONFIRMATION, recv_msg_channel_open_confirmation}, {SSH_MSG_CHANNEL_OPEN_FAILURE, recv_msg_channel_open_failure}, {SSH_MSG_USERAUTH_BANNER, recv_msg_userauth_banner}, /* client */ {SSH_MSG_USERAUTH_SPECIFIC_60, recv_msg_userauth_specific_60}, /* client */ {SSH_MSG_GLOBAL_REQUEST, recv_msg_global_request_cli}, {SSH_MSG_CHANNEL_SUCCESS, ignore_recv_response}, {SSH_MSG_CHANNEL_FAILURE, ignore_recv_response}, #if DROPBEAR_CLI_REMOTETCPFWD {SSH_MSG_REQUEST_SUCCESS, cli_recv_msg_request_success}, /* client */ {SSH_MSG_REQUEST_FAILURE, cli_recv_msg_request_failure}, /* client */ #else /* For keepalive */ {SSH_MSG_REQUEST_SUCCESS, ignore_recv_response}, {SSH_MSG_REQUEST_FAILURE, ignore_recv_response}, #endif {SSH_MSG_EXT_INFO, recv_msg_ext_info}, {0, NULL} /* End */ }; static const struct ChanType *cli_chantypes[] = { #if DROPBEAR_CLI_REMOTETCPFWD &cli_chan_tcpremote, #endif #if DROPBEAR_CLI_AGENTFWD &cli_chan_agent, #endif NULL /* Null termination */ }; void cli_connected(int result, int sock, void* userdata, const char *errstring) { struct sshsession *myses = userdata; if (result == DROPBEAR_FAILURE) { dropbear_exit("Connect failed: %s", errstring); } myses->sock_in = myses->sock_out = sock; TRACE(("cli_connected")) ses.socket_prio = DROPBEAR_PRIO_NORMAL; /* switches to lowdelay */ update_channel_prio(); } void cli_session(int sock_in, int sock_out, struct dropbear_progress_connection *progress, pid_t proxy_cmd_pid) { common_session_init(sock_in, sock_out); if (progress) { connect_set_writequeue(progress, &ses.writequeue); } chaninitialise(cli_chantypes); /* Set up cli_ses vars */ cli_session_init(proxy_cmd_pid); /* Ready to go */ ses.init_done = 1; /* Exchange identification */ send_session_identification(); kexfirstinitialise(); /* initialise the kex state */ send_msg_kexinit(); session_loop(cli_sessionloop); /* Not reached */ } #if DROPBEAR_KEX_FIRST_FOLLOWS static void cli_send_kex_first_guess() { send_msg_kexdh_init(); } #endif static void cli_session_init(pid_t proxy_cmd_pid) { cli_ses.state = STATE_NOTHING; cli_ses.kex_state = KEX_NOTHING; cli_ses.tty_raw_mode = 0; cli_ses.winchange = 0; /* We store std{in,out,err}'s flags, so we can set them back on exit * (otherwise busybox's ash isn't happy */ cli_ses.stdincopy = dup(STDIN_FILENO); cli_ses.stdinflags = fcntl(STDIN_FILENO, F_GETFL, 0); cli_ses.stdoutcopy = dup(STDOUT_FILENO); cli_ses.stdoutflags = fcntl(STDOUT_FILENO, F_GETFL, 0); cli_ses.stderrcopy = dup(STDERR_FILENO); cli_ses.stderrflags = fcntl(STDERR_FILENO, F_GETFL, 0); cli_ses.retval = EXIT_SUCCESS; /* Assume it's clean if we don't get a specific exit status */ cli_ses.proxy_cmd_pid = proxy_cmd_pid; TRACE(("proxy command PID='%d'", proxy_cmd_pid)); /* Auth */ cli_ses.lastprivkey = NULL; cli_ses.lastauthtype = 0; cli_ses.is_trivial_auth = 1; /* For printing "remote host closed" for the user */ ses.remoteclosed = cli_remoteclosed; ses.extra_session_cleanup = cli_session_cleanup; /* packet handlers */ ses.packettypes = cli_packettypes; ses.isserver = 0; #if DROPBEAR_KEX_FIRST_FOLLOWS ses.send_kex_first_guess = cli_send_kex_first_guess; #endif } static void send_msg_service_request(const char* servicename) { TRACE(("enter send_msg_service_request: servicename='%s'", servicename)) CHECKCLEARTOWRITE(); buf_putbyte(ses.writepayload, SSH_MSG_SERVICE_REQUEST); buf_putstring(ses.writepayload, servicename, strlen(servicename)); encrypt_packet(); TRACE(("leave send_msg_service_request")) } static void recv_msg_service_accept(void) { /* do nothing, if it failed then the server MUST have disconnected */ } /* This function drives the progress of the session - it initiates KEX, * service, userauth and channel requests */ static void cli_sessionloop() { TRACE2(("enter cli_sessionloop")) if (ses.lastpacket == 0) { TRACE2(("exit cli_sessionloop: no real packets yet")) return; } if (ses.lastpacket == SSH_MSG_KEXINIT && cli_ses.kex_state == KEX_NOTHING) { /* We initiate the KEXDH. If DH wasn't the correct type, the KEXINIT * negotiation would have failed. */ if (!ses.kexstate.our_first_follows_matches) { send_msg_kexdh_init(); } cli_ses.kex_state = KEXDH_INIT_SENT; TRACE(("leave cli_sessionloop: done with KEXINIT_RCVD")) return; } /* A KEX has finished, so we should go back to our KEX_NOTHING state */ if (cli_ses.kex_state != KEX_NOTHING && ses.kexstate.sentnewkeys) { cli_ses.kex_state = KEX_NOTHING; } /* We shouldn't do anything else if a KEX is in progress */ if (cli_ses.kex_state != KEX_NOTHING) { TRACE(("leave cli_sessionloop: kex_state != KEX_NOTHING")) return; } if (ses.kexstate.donefirstkex == 0) { /* We might reach here if we have partial packet reads or have * received SSG_MSG_IGNORE etc. Just skip it */ TRACE2(("donefirstkex false\n")) return; } switch (cli_ses.state) { case STATE_NOTHING: /* We've got the transport layer sorted, we now need to request * userauth */ send_msg_service_request(SSH_SERVICE_USERAUTH); /* We aren't using any "implicit server authentication" methods, so don't need to wait for a response for SSH_SERVICE_USERAUTH before sending the auth messages (rfc4253 10) */ cli_auth_getmethods(); cli_ses.state = USERAUTH_REQ_SENT; TRACE(("leave cli_sessionloop: sent userauth methods req")) return; case USERAUTH_REQ_SENT: TRACE(("leave cli_sessionloop: waiting, req_sent")) return; case USERAUTH_FAIL_RCVD: if (cli_auth_try() == DROPBEAR_FAILURE) { dropbear_exit("No auth methods could be used."); } cli_ses.state = USERAUTH_REQ_SENT; TRACE(("leave cli_sessionloop: cli_auth_try")) return; case USERAUTH_SUCCESS_RCVD: #ifndef DISABLE_SYSLOG if (opts.usingsyslog) { dropbear_log(LOG_INFO, "Authentication succeeded."); } #endif if (cli_opts.backgrounded) { int devnull; /* keeping stdin open steals input from the terminal and is confusing, though stdout/stderr could be useful. */ devnull = open(DROPBEAR_PATH_DEVNULL, O_RDONLY); if (devnull < 0) { dropbear_exit("Opening /dev/null: %d %s", errno, strerror(errno)); } dup2(devnull, STDIN_FILENO); if (daemon(0, 1) < 0) { dropbear_exit("Backgrounding failed: %d %s", errno, strerror(errno)); } } #if DROPBEAR_CLI_NETCAT if (cli_opts.netcat_host) { cli_send_netcat_request(); } else #endif if (!cli_opts.no_cmd) { cli_send_chansess_request(); } #if DROPBEAR_CLI_LOCALTCPFWD setup_localtcp(); #endif #if DROPBEAR_CLI_REMOTETCPFWD setup_remotetcp(); #endif TRACE(("leave cli_sessionloop: running")) cli_ses.state = SESSION_RUNNING; return; case SESSION_RUNNING: if (ses.chancount < 1 && !cli_opts.no_cmd) { cli_finished(); } if (cli_ses.winchange) { cli_chansess_winchange(); } return; /* XXX more here needed */ default: break; } TRACE2(("leave cli_sessionloop: fell out")) } void kill_proxy_command(void) { /* * Send SIGHUP to proxy command if used. We don't wait() in * case it hangs and instead rely on init to reap the child */ if (cli_ses.proxy_cmd_pid > 1) { TRACE(("killing proxy command with PID='%d'", cli_ses.proxy_cmd_pid)); kill(cli_ses.proxy_cmd_pid, SIGHUP); } } static void cli_session_cleanup(void) { if (!ses.init_done) { return; } kill_proxy_command(); /* Set std{in,out,err} back to non-blocking - busybox ash dies nastily if * we don't revert the flags */ /* Ignore return value since there's nothing we can do */ (void)fcntl(cli_ses.stdincopy, F_SETFL, cli_ses.stdinflags); (void)fcntl(cli_ses.stdoutcopy, F_SETFL, cli_ses.stdoutflags); (void)fcntl(cli_ses.stderrcopy, F_SETFL, cli_ses.stderrflags); /* Don't leak */ m_close(cli_ses.stdincopy); m_close(cli_ses.stdoutcopy); m_close(cli_ses.stderrcopy); cli_tty_cleanup(); if (cli_ses.server_sig_algs) { buf_free(cli_ses.server_sig_algs); } } static void cli_finished() { TRACE(("cli_finished()")) session_cleanup(); fprintf(stderr, "Connection to %s@%s:%s closed.\n", cli_opts.username, cli_opts.remotehost, cli_opts.remoteport); exit(cli_ses.retval); } /* called when the remote side closes the connection */ static void cli_remoteclosed() { /* XXX TODO perhaps print a friendlier message if we get this but have * already sent/received disconnect message(s) ??? */ m_close(ses.sock_in); m_close(ses.sock_out); ses.sock_in = -1; ses.sock_out = -1; dropbear_exit("Remote closed the connection"); } /* Operates in-place turning dirty (untrusted potentially containing control * characters) text into clean text. * Note: this is safe only with ascii - other charsets could have problems. */ void cleantext(char* dirtytext) { unsigned int i, j; char c; j = 0; for (i = 0; dirtytext[i] != '\0'; i++) { c = dirtytext[i]; /* We can ignore '\r's */ if ( (c >= ' ' && c <= '~') || c == '\n' || c == '\t') { dirtytext[j] = c; j++; } } /* Null terminate */ dirtytext[j] = '\0'; } static void recv_msg_global_request_cli(void) { unsigned int wantreply = 0; buf_eatstring(ses.payload); wantreply = buf_getbool(ses.payload); TRACE(("recv_msg_global_request_cli: want_reply: %u", wantreply)); if (wantreply) { /* Send a proper rejection */ send_msg_request_failure(); } } void cli_dropbear_exit(int exitcode, const char* format, va_list param) { char exitmsg[150]; char fullmsg[300]; /* Note that exit message must be rendered before session cleanup */ /* Render the formatted exit message */ vsnprintf(exitmsg, sizeof(exitmsg), format, param); TRACE(("Exited, cleaning up: %s", exitmsg)) /* Add the prefix depending on session/auth state */ if (!ses.init_done) { snprintf(fullmsg, sizeof(fullmsg), "Exited: %s", exitmsg); } else { snprintf(fullmsg, sizeof(fullmsg), "Connection to %s@%s:%s exited: %s", cli_opts.username, cli_opts.remotehost, cli_opts.remoteport, exitmsg); } /* Do the cleanup first, since then the terminal will be reset */ session_cleanup(); #if DROPBEAR_FUZZ if (fuzz.do_jmp) { longjmp(fuzz.jmp, 1); } #endif /* Avoid printing onwards from terminal cruft */ fprintf(stderr, "\n"); dropbear_log(LOG_INFO, "%s", fullmsg); exit(exitcode); } void cli_dropbear_log(int priority, const char* format, va_list param) { char printbuf[1024]; const char *name; name = cli_opts.progname; if (!name) { name = "dbclient"; } vsnprintf(printbuf, sizeof(printbuf), format, param); #ifndef DISABLE_SYSLOG if (opts.usingsyslog) { syslog(priority, "%s", printbuf); } #endif fprintf(stderr, "%s: %s\n", name, printbuf); fflush(stderr); }