crypto/dist/ssh/nchan.c

   1 /*      $NetBSD: nchan.c,v 1.5 2006/09/28 21:22:14 christos Exp $       */
   2 /* $OpenBSD: nchan.c,v 1.60 2008/06/30 12:16:02 djm Exp $ */
   3 /*
   4  * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  25  */
  26
  27 #include "includes.h"
  28 __RCSID("$NetBSD: nchan.c,v 1.5 2006/09/28 21:22:14 christos Exp $");
  29 #include <sys/types.h>
  30 #include <sys/socket.h>
  31 #include <sys/queue.h>
  32
  33 #include <errno.h>
  34 #include <string.h>
  35 #include <stdarg.h>
  36
  37 #include "ssh1.h"
  38 #include "ssh2.h"
  39 #include "buffer.h"
  40 #include "packet.h"
  41 #include "channels.h"
  42 #include "compat.h"
  43 #include "log.h"
  44
  45 /*
  46  * SSH Protocol 1.5 aka New Channel Protocol
  47  * Thanks to Martina, Axel and everyone who left Erlangen, leaving me bored.
  48  * Written by Markus Friedl in October 1999
  49  *
  50  * Protocol versions 1.3 and 1.5 differ in the handshake protocol used for the
  51  * tear down of channels:
  52  *
  53  * 1.3: strict request-ack-protocol:
  54  *      CLOSE   ->
  55  *              <-  CLOSE_CONFIRM
  56  *
  57  * 1.5: uses variations of:
  58  *      IEOF    ->
  59  *              <-  OCLOSE
  60  *              <-  IEOF
  61  *      OCLOSE  ->
  62  *      i.e. both sides have to close the channel
  63  *
  64  * 2.0: the EOF messages are optional
  65  *
  66  * See the debugging output from 'ssh -v' and 'sshd -d' of
  67  * ssh-1.2.27 as an example.
  68  *
  69  */
  70
  71 /* functions manipulating channel states */
  72 /*
  73  * EVENTS update channel input/output states execute ACTIONS
  74  */
  75 /*
  76  * ACTIONS: should never update the channel states
  77  */
  78 static void     chan_send_ieof1(Channel *);
  79 static void     chan_send_oclose1(Channel *);
  80 static void     chan_send_close2(Channel *);
  81 static void     chan_send_eof2(Channel *);
  82 static void     chan_send_eow2(Channel *);
  83
  84 /* helper */
  85 static void     chan_shutdown_write(Channel *);
  86 static void     chan_shutdown_read(Channel *);
  87
  88 static char *ostates[] = { "open", "drain", "wait_ieof", "closed" };
  89 static char *istates[] = { "open", "drain", "wait_oclose", "closed" };
  90
  91 static void
  92 chan_set_istate(Channel *c, u_int next)
  93 {
  94         if (c->istate > CHAN_INPUT_CLOSED || next > CHAN_INPUT_CLOSED)
  95                 fatal("chan_set_istate: bad state %d -> %d", c->istate, next);
  96         debug2("channel %d: input %s -> %s", c->self, istates[c->istate],
  97             istates[next]);
  98         c->istate = next;
  99 }
 100 static void
 101 chan_set_ostate(Channel *c, u_int next)
 102 {
 103         if (c->ostate > CHAN_OUTPUT_CLOSED || next > CHAN_OUTPUT_CLOSED)
 104                 fatal("chan_set_ostate: bad state %d -> %d", c->ostate, next);
 105         debug2("channel %d: output %s -> %s", c->self, ostates[c->ostate],
 106             ostates[next]);
 107         c->ostate = next;
 108 }
 109
 110 /*
 111  * SSH1 specific implementation of event functions
 112  */
 113
 114 static void
 115 chan_rcvd_oclose1(Channel *c)
 116 {
 117         debug2("channel %d: rcvd oclose", c->self);
 118         switch (c->istate) {
 119         case CHAN_INPUT_WAIT_OCLOSE:
 120                 chan_set_istate(c, CHAN_INPUT_CLOSED);
 121                 break;
 122         case CHAN_INPUT_OPEN:
 123                 chan_shutdown_read(c);
 124                 chan_send_ieof1(c);
 125                 chan_set_istate(c, CHAN_INPUT_CLOSED);
 126                 break;
 127         case CHAN_INPUT_WAIT_DRAIN:
 128                 /* both local read_failed and remote write_failed  */
 129                 chan_send_ieof1(c);
 130                 chan_set_istate(c, CHAN_INPUT_CLOSED);
 131                 break;
 132         default:
 133                 error("channel %d: protocol error: rcvd_oclose for istate %d",
 134                     c->self, c->istate);
 135                 return;
 136         }
 137 }
 138 void
 139 chan_read_failed(Channel *c)
 140 {
 141         debug2("channel %d: read failed", c->self);
 142         switch (c->istate) {
 143         case CHAN_INPUT_OPEN:
 144                 chan_shutdown_read(c);
 145                 chan_set_istate(c, CHAN_INPUT_WAIT_DRAIN);
 146                 break;
 147         default:
 148                 error("channel %d: chan_read_failed for istate %d",
 149                     c->self, c->istate);
 150                 break;
 151         }
 152 }
 153 void
 154 chan_ibuf_empty(Channel *c)
 155 {
 156         debug2("channel %d: ibuf empty", c->self);
 157         if (buffer_len(&c->input)) {
 158                 error("channel %d: chan_ibuf_empty for non empty buffer",
 159                     c->self);
 160                 return;
 161         }
 162         switch (c->istate) {
 163         case CHAN_INPUT_WAIT_DRAIN:
 164                 if (compat20) {
 165                         if (!(c->flags & CHAN_CLOSE_SENT))
 166                                 chan_send_eof2(c);
 167                         chan_set_istate(c, CHAN_INPUT_CLOSED);
 168                 } else {
 169                         chan_send_ieof1(c);
 170                         chan_set_istate(c, CHAN_INPUT_WAIT_OCLOSE);
 171                 }
 172                 break;
 173         default:
 174                 error("channel %d: chan_ibuf_empty for istate %d",
 175                     c->self, c->istate);
 176                 break;
 177         }
 178 }
 179 static void
 180 chan_rcvd_ieof1(Channel *c)
 181 {
 182         debug2("channel %d: rcvd ieof", c->self);
 183         switch (c->ostate) {
 184         case CHAN_OUTPUT_OPEN:
 185                 chan_set_ostate(c, CHAN_OUTPUT_WAIT_DRAIN);
 186                 break;
 187         case CHAN_OUTPUT_WAIT_IEOF:
 188                 chan_set_ostate(c, CHAN_OUTPUT_CLOSED);
 189                 break;
 190         default:
 191                 error("channel %d: protocol error: rcvd_ieof for ostate %d",
 192                     c->self, c->ostate);
 193                 break;
 194         }
 195 }
 196 static void
 197 chan_write_failed1(Channel *c)
 198 {
 199         debug2("channel %d: write failed", c->self);
 200         switch (c->ostate) {
 201         case CHAN_OUTPUT_OPEN:
 202                 chan_shutdown_write(c);
 203                 chan_send_oclose1(c);
 204                 chan_set_ostate(c, CHAN_OUTPUT_WAIT_IEOF);
 205                 break;
 206         case CHAN_OUTPUT_WAIT_DRAIN:
 207                 chan_shutdown_write(c);
 208                 chan_send_oclose1(c);
 209                 chan_set_ostate(c, CHAN_OUTPUT_CLOSED);
 210                 break;
 211         default:
 212                 error("channel %d: chan_write_failed for ostate %d",
 213                     c->self, c->ostate);
 214                 break;
 215         }
 216 }
 217 void
 218 chan_obuf_empty(Channel *c)
 219 {
 220         debug2("channel %d: obuf empty", c->self);
 221         if (buffer_len(&c->output)) {
 222                 error("channel %d: chan_obuf_empty for non empty buffer",
 223                     c->self);
 224                 return;
 225         }
 226         switch (c->ostate) {
 227         case CHAN_OUTPUT_WAIT_DRAIN:
 228                 chan_shutdown_write(c);
 229                 if (!compat20)
 230                         chan_send_oclose1(c);
 231                 chan_set_ostate(c, CHAN_OUTPUT_CLOSED);
 232                 break;
 233         default:
 234                 error("channel %d: internal error: obuf_empty for ostate %d",
 235                     c->self, c->ostate);
 236                 break;
 237         }
 238 }
 239 static void
 240 chan_send_ieof1(Channel *c)
 241 {
 242         debug2("channel %d: send ieof", c->self);
 243         switch (c->istate) {
 244         case CHAN_INPUT_OPEN:
 245         case CHAN_INPUT_WAIT_DRAIN:
 246                 packet_start(SSH_MSG_CHANNEL_INPUT_EOF);
 247                 packet_put_int(c->remote_id);
 248                 packet_send();
 249                 break;
 250         default:
 251                 error("channel %d: cannot send ieof for istate %d",
 252                     c->self, c->istate);
 253                 break;
 254         }
 255 }
 256 static void
 257 chan_send_oclose1(Channel *c)
 258 {
 259         debug2("channel %d: send oclose", c->self);
 260         switch (c->ostate) {
 261         case CHAN_OUTPUT_OPEN:
 262         case CHAN_OUTPUT_WAIT_DRAIN:
 263                 buffer_clear(&c->output);
 264                 packet_start(SSH_MSG_CHANNEL_OUTPUT_CLOSE);
 265                 packet_put_int(c->remote_id);
 266                 packet_send();
 267                 break;
 268         default:
 269                 error("channel %d: cannot send oclose for ostate %d",
 270                     c->self, c->ostate);
 271                 break;
 272         }
 273 }
 274
 275 /*
 276  * the same for SSH2
 277  */
 278 static void
 279 chan_rcvd_close2(Channel *c)
 280 {
 281         debug2("channel %d: rcvd close", c->self);
 282         if (c->flags & CHAN_CLOSE_RCVD)
 283                 error("channel %d: protocol error: close rcvd twice", c->self);
 284         c->flags |= CHAN_CLOSE_RCVD;
 285         if (c->type == SSH_CHANNEL_LARVAL) {
 286                 /* tear down larval channels immediately */
 287                 chan_set_ostate(c, CHAN_OUTPUT_CLOSED);
 288                 chan_set_istate(c, CHAN_INPUT_CLOSED);
 289                 return;
 290         }
 291         switch (c->ostate) {
 292         case CHAN_OUTPUT_OPEN:
 293                 /*
 294                  * wait until a data from the channel is consumed if a CLOSE
 295                  * is received
 296                  */
 297                 chan_set_ostate(c, CHAN_OUTPUT_WAIT_DRAIN);
 298                 break;
 299         }
 300         switch (c->istate) {
 301         case CHAN_INPUT_OPEN:
 302                 chan_shutdown_read(c);
 303                 chan_set_istate(c, CHAN_INPUT_CLOSED);
 304                 break;
 305         case CHAN_INPUT_WAIT_DRAIN:
 306                 chan_send_eof2(c);
 307                 chan_set_istate(c, CHAN_INPUT_CLOSED);
 308                 break;
 309         }
 310 }
 311 void
 312 chan_rcvd_eow(Channel *c)
 313 {
 314         debug2("channel %d: rcvd eow", c->self);
 315         switch (c->istate) {
 316         case CHAN_INPUT_OPEN:
 317                 chan_shutdown_read(c);
 318                 chan_set_istate(c, CHAN_INPUT_CLOSED);
 319                 break;
 320         }
 321 }
 322 static void
 323 chan_rcvd_eof2(Channel *c)
 324 {
 325         debug2("channel %d: rcvd eof", c->self);
 326         c->flags |= CHAN_EOF_RCVD;
 327         if (c->ostate == CHAN_OUTPUT_OPEN)
 328                 chan_set_ostate(c, CHAN_OUTPUT_WAIT_DRAIN);
 329 }
 330 static void
 331 chan_write_failed2(Channel *c)
 332 {
 333         debug2("channel %d: write failed", c->self);
 334         switch (c->ostate) {
 335         case CHAN_OUTPUT_OPEN:
 336         case CHAN_OUTPUT_WAIT_DRAIN:
 337                 chan_shutdown_write(c);
 338                 if (strcmp(c->ctype, "session") == 0)
 339                         chan_send_eow2(c);
 340                 chan_set_ostate(c, CHAN_OUTPUT_CLOSED);
 341                 break;
 342         default:
 343                 error("channel %d: chan_write_failed for ostate %d",
 344                     c->self, c->ostate);
 345                 break;
 346         }
 347 }
 348 static void
 349 chan_send_eof2(Channel *c)
 350 {
 351         debug2("channel %d: send eof", c->self);
 352         switch (c->istate) {
 353         case CHAN_INPUT_WAIT_DRAIN:
 354                 packet_start(SSH2_MSG_CHANNEL_EOF);
 355                 packet_put_int(c->remote_id);
 356                 packet_send();
 357                 c->flags |= CHAN_EOF_SENT;
 358                 break;
 359         default:
 360                 error("channel %d: cannot send eof for istate %d",
 361                     c->self, c->istate);
 362                 break;
 363         }
 364 }
 365 static void
 366 chan_send_close2(Channel *c)
 367 {
 368         debug2("channel %d: send close", c->self);
 369         if (c->ostate != CHAN_OUTPUT_CLOSED ||
 370             c->istate != CHAN_INPUT_CLOSED) {
 371                 error("channel %d: cannot send close for istate/ostate %d/%d",
 372                     c->self, c->istate, c->ostate);
 373         } else if (c->flags & CHAN_CLOSE_SENT) {
 374                 error("channel %d: already sent close", c->self);
 375         } else {
 376                 packet_start(SSH2_MSG_CHANNEL_CLOSE);
 377                 packet_put_int(c->remote_id);
 378                 packet_send();
 379                 c->flags |= CHAN_CLOSE_SENT;
 380         }
 381 }
 382 static void
 383 chan_send_eow2(Channel *c)
 384 {
 385         debug2("channel %d: send eow", c->self);
 386         if (c->ostate == CHAN_OUTPUT_CLOSED) {
 387                 error("channel %d: must not sent eow on closed output",
 388                     c->self);
 389                 return;
 390         }
 391         packet_start(SSH2_MSG_CHANNEL_REQUEST);
 392         packet_put_int(c->remote_id);
 393         packet_put_cstring("eow@openssh.com");
 394         packet_put_char(0);
 395         packet_send();
 396 }
 397
 398 /* shared */
 399
 400 void
 401 chan_rcvd_ieof(Channel *c)
 402 {
 403         if (compat20)
 404                 chan_rcvd_eof2(c);
 405         else
 406                 chan_rcvd_ieof1(c);
 407         if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN &&
 408             buffer_len(&c->output) == 0 &&
 409             !CHANNEL_EFD_OUTPUT_ACTIVE(c))
 410                 chan_obuf_empty(c);
 411 }
 412 void
 413 chan_rcvd_oclose(Channel *c)
 414 {
 415         if (compat20)
 416                 chan_rcvd_close2(c);
 417         else
 418                 chan_rcvd_oclose1(c);
 419 }
 420 void
 421 chan_write_failed(Channel *c)
 422 {
 423         if (compat20)
 424                 chan_write_failed2(c);
 425         else
 426                 chan_write_failed1(c);
 427 }
 428
 429 void
 430 chan_mark_dead(Channel *c)
 431 {
 432         c->type = SSH_CHANNEL_ZOMBIE;
 433 }
 434
 435 int
 436 chan_is_dead(Channel *c, int do_send)
 437 {
 438         if (c->type == SSH_CHANNEL_ZOMBIE) {
 439                 debug2("channel %d: zombie", c->self);
 440                 return 1;
 441         }
 442         if (c->istate != CHAN_INPUT_CLOSED || c->ostate != CHAN_OUTPUT_CLOSED)
 443                 return 0;
 444         if (!compat20) {
 445                 debug2("channel %d: is dead", c->self);
 446                 return 1;
 447         }
 448         if ((datafellows & SSH_BUG_EXTEOF) &&
 449             c->extended_usage == CHAN_EXTENDED_WRITE &&
 450             c->efd != -1 &&
 451             buffer_len(&c->extended) > 0) {
 452                 debug2("channel %d: active efd: %d len %d",
 453                     c->self, c->efd, buffer_len(&c->extended));
 454                 return 0;
 455         }
 456         if (!(c->flags & CHAN_CLOSE_SENT)) {
 457                 if (do_send) {
 458                         chan_send_close2(c);
 459                 } else {
 460                         /* channel would be dead if we sent a close */
 461                         if (c->flags & CHAN_CLOSE_RCVD) {
 462                                 debug2("channel %d: almost dead",
 463                                     c->self);
 464                                 return 1;
 465                         }
 466                 }
 467         }
 468         if ((c->flags & CHAN_CLOSE_SENT) &&
 469             (c->flags & CHAN_CLOSE_RCVD)) {
 470                 debug2("channel %d: is dead", c->self);
 471                 return 1;
 472         }
 473         return 0;
 474 }
 475
 476 /* helper */
 477 static void
 478 chan_shutdown_write(Channel *c)
 479 {
 480         buffer_clear(&c->output);
 481         if (compat20 && c->type == SSH_CHANNEL_LARVAL)
 482                 return;
 483         /* shutdown failure is allowed if write failed already */
 484         debug2("channel %d: close_write", c->self);
 485         if (c->sock != -1) {
 486                 if (shutdown(c->sock, SHUT_WR) < 0)
 487                         debug2("channel %d: chan_shutdown_write: "
 488                             "shutdown() failed for fd%d: %.100s",
 489                             c->self, c->sock, strerror(errno));
 490         } else {
 491                 if (channel_close_fd(&c->wfd) < 0)
 492                         logit("channel %d: chan_shutdown_write: "
 493                             "close() failed for fd%d: %.100s",
 494                             c->self, c->wfd, strerror(errno));
 495         }
 496 }
 497 static void
 498 chan_shutdown_read(Channel *c)
 499 {
 500         if (compat20 && c->type == SSH_CHANNEL_LARVAL)
 501                 return;
 502         debug2("channel %d: close_read", c->self);
 503         if (c->sock != -1) {
 504                 if (shutdown(c->sock, SHUT_RD) < 0)
 505                         error("channel %d: chan_shutdown_read: "
 506                             "shutdown() failed for fd%d [i%d o%d]: %.100s",
 507                             c->self, c->sock, c->istate, c->ostate,
 508                             strerror(errno));
 509         } else {
 510                 if (channel_close_fd(&c->rfd) < 0)
 511                         logit("channel %d: chan_shutdown_read: "
 512                             "close() failed for fd%d: %.100s",
 513                             c->self, c->rfd, strerror(errno));
 514         }
 515 }