?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Changes to update Tomato RAF.
[tomato.git] / release / src / router / dropbear / svr-chansession.c
blob9fd49c112074bf0dac54f3bd69e221470d653f2b
1 /*
2 * Dropbear - a SSH2 server
3 *
4 * Copyright (c) 2002,2003 Matt Johnston
5 * All rights reserved.
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
23 * SOFTWARE. */
24
25 #include "includes.h"
26 #include "packet.h"
27 #include "buffer.h"
28 #include "session.h"
29 #include "dbutil.h"
30 #include "channel.h"
31 #include "chansession.h"
32 #include "sshpty.h"
33 #include "termcodes.h"
34 #include "ssh.h"
35 #include "random.h"
36 #include "x11fwd.h"
37 #include "agentfwd.h"
38 #include "runopts.h"
39 #include "auth.h"
40
41 /* Handles sessions (either shells or programs) requested by the client */
42
43 static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
44 int iscmd, int issubsys);
45 static int sessionpty(struct ChanSess * chansess);
46 static int sessionsignal(struct ChanSess *chansess);
47 static int noptycommand(struct Channel *channel, struct ChanSess *chansess);
48 static int ptycommand(struct Channel *channel, struct ChanSess *chansess);
49 static int sessionwinchange(struct ChanSess *chansess);
50 static void execchild(void *user_data_chansess);
51 static void addchildpid(struct ChanSess *chansess, pid_t pid);
52 static void sesssigchild_handler(int val);
53 static void closechansess(struct Channel *channel);
54 static int newchansess(struct Channel *channel);
55 static void chansessionrequest(struct Channel *channel);
56
57 static void send_exitsignalstatus(struct Channel *channel);
58 static void send_msg_chansess_exitstatus(struct Channel * channel,
59 struct ChanSess * chansess);
60 static void send_msg_chansess_exitsignal(struct Channel * channel,
61 struct ChanSess * chansess);
62 static void get_termmodes(struct ChanSess *chansess);
63
64
65 /* required to clear environment */
66 extern char** environ;
67
68 static int sesscheckclose(struct Channel *channel) {
69 struct ChanSess *chansess = (struct ChanSess*)channel->typedata;
70 TRACE(("sesscheckclose, pid is %d", chansess->exit.exitpid))
71 return chansess->exit.exitpid != -1;
72 }
73
74 /* Handler for childs exiting, store the state for return to the client */
75
76 /* There's a particular race we have to watch out for: if the forked child
77 * executes, exits, and this signal-handler is called, all before the parent
78 * gets to run, then the childpids[] array won't have the pid in it. Hence we
79 * use the svr_ses.lastexit struct to hold the exit, which is then compared by
80 * the parent when it runs. This work correctly at least in the case of a
81 * single shell spawned (ie the usual case) */
82 static void sesssigchild_handler(int UNUSED(dummy)) {
83
84 int status;
85 pid_t pid;
86 unsigned int i;
87 struct sigaction sa_chld;
88 struct exitinfo *exit = NULL;
89
90 TRACE(("enter sigchld handler"))
91 while ((pid = waitpid(-1, &status, WNOHANG)) > 0) {
92 TRACE(("sigchld handler: pid %d", pid))
93
94 exit = NULL;
95 /* find the corresponding chansess */
96 for (i = 0; i < svr_ses.childpidsize; i++) {
97 if (svr_ses.childpids[i].pid == pid) {
98 TRACE(("found match session"));
99 exit = &svr_ses.childpids[i].chansess->exit;
100 break;
101 }
102 }
103
104 /* If the pid wasn't matched, then we might have hit the race mentioned
105 * above. So we just store the info for the parent to deal with */
106 if (exit == NULL) {
107 TRACE(("using lastexit"));
108 exit = &svr_ses.lastexit;
109 }
110
111 exit->exitpid = pid;
112 if (WIFEXITED(status)) {
113 exit->exitstatus = WEXITSTATUS(status);
114 }
115 if (WIFSIGNALED(status)) {
116 exit->exitsignal = WTERMSIG(status);
117 #if !defined(AIX) && defined(WCOREDUMP)
118 exit->exitcore = WCOREDUMP(status);
119 #else
120 exit->exitcore = 0;
121 #endif
122 } else {
123 /* we use this to determine how pid exited */
124 exit->exitsignal = -1;
125 }
126
127 /* Make sure that the main select() loop wakes up */
128 while (1) {
129 /* isserver is just a random byte to write. We can't do anything
130 about an error so should just ignore it */
131 if (write(ses.signal_pipe[1], &ses.isserver, 1) == 1
132 || errno != EINTR) {
133 break;
134 }
135 }
136 }
137
138 sa_chld.sa_handler = sesssigchild_handler;
139 sa_chld.sa_flags = SA_NOCLDSTOP;
140 sigemptyset(&sa_chld.sa_mask);
141 sigaction(SIGCHLD, &sa_chld, NULL);
142 TRACE(("leave sigchld handler"))
143 }
144
145 /* send the exit status or the signal causing termination for a session */
146 static void send_exitsignalstatus(struct Channel *channel) {
147
148 struct ChanSess *chansess = (struct ChanSess*)channel->typedata;
149
150 if (chansess->exit.exitpid >= 0) {
151 if (chansess->exit.exitsignal > 0) {
152 send_msg_chansess_exitsignal(channel, chansess);
153 } else {
154 send_msg_chansess_exitstatus(channel, chansess);
155 }
156 }
157 }
158
159 /* send the exitstatus to the client */
160 static void send_msg_chansess_exitstatus(struct Channel * channel,
161 struct ChanSess * chansess) {
162
163 dropbear_assert(chansess->exit.exitpid != -1);
164 dropbear_assert(chansess->exit.exitsignal == -1);
165
166 CHECKCLEARTOWRITE();
167
168 buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_REQUEST);
169 buf_putint(ses.writepayload, channel->remotechan);
170 buf_putstring(ses.writepayload, "exit-status", 11);
171 buf_putbyte(ses.writepayload, 0); /* boolean FALSE */
172 buf_putint(ses.writepayload, chansess->exit.exitstatus);
173
174 encrypt_packet();
175
176 }
177
178 /* send the signal causing the exit to the client */
179 static void send_msg_chansess_exitsignal(struct Channel * channel,
180 struct ChanSess * chansess) {
181
182 int i;
183 char* signame = NULL;
184 dropbear_assert(chansess->exit.exitpid != -1);
185 dropbear_assert(chansess->exit.exitsignal > 0);
186
187 TRACE(("send_msg_chansess_exitsignal %d", chansess->exit.exitsignal))
188
189 CHECKCLEARTOWRITE();
190
191 /* we check that we can match a signal name, otherwise
192 * don't send anything */
193 for (i = 0; signames[i].name != NULL; i++) {
194 if (signames[i].signal == chansess->exit.exitsignal) {
195 signame = signames[i].name;
196 break;
197 }
198 }
199
200 if (signame == NULL) {
201 return;
202 }
203
204 buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_REQUEST);
205 buf_putint(ses.writepayload, channel->remotechan);
206 buf_putstring(ses.writepayload, "exit-signal", 11);
207 buf_putbyte(ses.writepayload, 0); /* boolean FALSE */
208 buf_putstring(ses.writepayload, signame, strlen(signame));
209 buf_putbyte(ses.writepayload, chansess->exit.exitcore);
210 buf_putstring(ses.writepayload, "", 0); /* error msg */
211 buf_putstring(ses.writepayload, "", 0); /* lang */
212
213 encrypt_packet();
214 }
215
216 /* set up a session channel */
217 static int newchansess(struct Channel *channel) {
218
219 struct ChanSess *chansess;
220
221 TRACE(("new chansess %p", channel))
222
223 dropbear_assert(channel->typedata == NULL);
224
225 chansess = (struct ChanSess*)m_malloc(sizeof(struct ChanSess));
226 chansess->cmd = NULL;
227 chansess->connection_string = NULL;
228 chansess->pid = 0;
229
230 /* pty details */
231 chansess->master = -1;
232 chansess->slave = -1;
233 chansess->tty = NULL;
234 chansess->term = NULL;
235
236 chansess->exit.exitpid = -1;
237
238 channel->typedata = chansess;
239
240 #ifndef DISABLE_X11FWD
241 chansess->x11listener = NULL;
242 chansess->x11authprot = NULL;
243 chansess->x11authcookie = NULL;
244 #endif
245
246 #ifdef ENABLE_AGENTFWD
247 chansess->agentlistener = NULL;
248 chansess->agentfile = NULL;
249 chansess->agentdir = NULL;
250 #endif
251
252 return 0;
253
254 }
255
256 static struct logininfo*
257 chansess_login_alloc(struct ChanSess *chansess) {
258 struct logininfo * li;
259 li = login_alloc_entry(chansess->pid, ses.authstate.username,
260 svr_ses.remotehost, chansess->tty);
261 return li;
262 }
263
264 /* clean a session channel */
265 static void closechansess(struct Channel *channel) {
266
267 struct ChanSess *chansess;
268 unsigned int i;
269 struct logininfo *li;
270
271 TRACE(("enter closechansess"))
272
273 chansess = (struct ChanSess*)channel->typedata;
274
275 if (chansess == NULL) {
276 TRACE(("leave closechansess: chansess == NULL"))
277 return;
278 }
279
280 send_exitsignalstatus(channel);
281
282 m_free(chansess->cmd);
283 m_free(chansess->term);
284
285 #ifdef ENABLE_SVR_PUBKEY_OPTIONS
286 m_free(chansess->original_command);
287 #endif
288
289 if (chansess->tty) {
290 /* write the utmp/wtmp login record */
291 li = chansess_login_alloc(chansess);
292 login_logout(li);
293 login_free_entry(li);
294
295 pty_release(chansess->tty);
296 m_free(chansess->tty);
297 }
298
299 #ifndef DISABLE_X11FWD
300 x11cleanup(chansess);
301 #endif
302
303 #ifdef ENABLE_AGENTFWD
304 svr_agentcleanup(chansess);
305 #endif
306
307 /* clear child pid entries */
308 for (i = 0; i < svr_ses.childpidsize; i++) {
309 if (svr_ses.childpids[i].chansess == chansess) {
310 dropbear_assert(svr_ses.childpids[i].pid > 0);
311 TRACE(("closing pid %d", svr_ses.childpids[i].pid))
312 TRACE(("exitpid is %d", chansess->exit.exitpid))
313 svr_ses.childpids[i].pid = -1;
314 svr_ses.childpids[i].chansess = NULL;
315 }
316 }
317
318 m_free(chansess);
319
320 TRACE(("leave closechansess"))
321 }
322
323 /* Handle requests for a channel. These can be execution requests,
324 * or x11/authagent forwarding. These are passed to appropriate handlers */
325 static void chansessionrequest(struct Channel *channel) {
326
327 unsigned char * type = NULL;
328 unsigned int typelen;
329 unsigned char wantreply;
330 int ret = 1;
331 struct ChanSess *chansess;
332
333 TRACE(("enter chansessionrequest"))
334
335 type = buf_getstring(ses.payload, &typelen);
336 wantreply = buf_getbool(ses.payload);
337
338 if (typelen > MAX_NAME_LEN) {
339 TRACE(("leave chansessionrequest: type too long")) /* XXX send error?*/
340 goto out;
341 }
342
343 chansess = (struct ChanSess*)channel->typedata;
344 dropbear_assert(chansess != NULL);
345 TRACE(("type is %s", type))
346
347 if (strcmp(type, "window-change") == 0) {
348 ret = sessionwinchange(chansess);
349 } else if (strcmp(type, "shell") == 0) {
350 ret = sessioncommand(channel, chansess, 0, 0);
351 } else if (strcmp(type, "pty-req") == 0) {
352 ret = sessionpty(chansess);
353 } else if (strcmp(type, "exec") == 0) {
354 ret = sessioncommand(channel, chansess, 1, 0);
355 } else if (strcmp(type, "subsystem") == 0) {
356 ret = sessioncommand(channel, chansess, 1, 1);
357 #ifndef DISABLE_X11FWD
358 } else if (strcmp(type, "x11-req") == 0) {
359 ret = x11req(chansess);
360 #endif
361 #ifdef ENABLE_AGENTFWD
362 } else if (strcmp(type, "auth-agent-req@openssh.com") == 0) {
363 ret = svr_agentreq(chansess);
364 #endif
365 } else if (strcmp(type, "signal") == 0) {
366 ret = sessionsignal(chansess);
367 } else {
368 /* etc, todo "env", "subsystem" */
369 }
370
371 out:
372
373 if (wantreply) {
374 if (ret == DROPBEAR_SUCCESS) {
375 send_msg_channel_success(channel);
376 } else {
377 send_msg_channel_failure(channel);
378 }
379 }
380
381 m_free(type);
382 TRACE(("leave chansessionrequest"))
383 }
384
385
386 /* Send a signal to a session's process as requested by the client*/
387 static int sessionsignal(struct ChanSess *chansess) {
388
389 int sig = 0;
390 unsigned char* signame = NULL;
391 int i;
392
393 if (chansess->pid == 0) {
394 /* haven't got a process pid yet */
395 return DROPBEAR_FAILURE;
396 }
397
398 signame = buf_getstring(ses.payload, NULL);
399
400 i = 0;
401 while (signames[i].name != 0) {
402 if (strcmp(signames[i].name, signame) == 0) {
403 sig = signames[i].signal;
404 break;
405 }
406 i++;
407 }
408
409 m_free(signame);
410
411 if (sig == 0) {
412 /* failed */
413 return DROPBEAR_FAILURE;
414 }
415
416 if (kill(chansess->pid, sig) < 0) {
417 return DROPBEAR_FAILURE;
418 }
419
420 return DROPBEAR_SUCCESS;
421 }
422
423 /* Let the process know that the window size has changed, as notified from the
424 * client. Returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
425 static int sessionwinchange(struct ChanSess *chansess) {
426
427 int termc, termr, termw, termh;
428
429 if (chansess->master < 0) {
430 /* haven't got a pty yet */
431 return DROPBEAR_FAILURE;
432 }
433
434 termc = buf_getint(ses.payload);
435 termr = buf_getint(ses.payload);
436 termw = buf_getint(ses.payload);
437 termh = buf_getint(ses.payload);
438
439 pty_change_window_size(chansess->master, termr, termc, termw, termh);
440
441 return DROPBEAR_SUCCESS;
442 }
443
444 static void get_termmodes(struct ChanSess *chansess) {
445
446 struct termios termio;
447 unsigned char opcode;
448 unsigned int value;
449 const struct TermCode * termcode;
450 unsigned int len;
451
452 TRACE(("enter get_termmodes"))
453
454 /* Term modes */
455 /* We'll ignore errors and continue if we can't set modes.
456 * We're ignoring baud rates since they seem evil */
457 if (tcgetattr(chansess->master, &termio) == -1) {
458 return;
459 }
460
461 len = buf_getint(ses.payload);
462 TRACE(("term mode str %d p->l %d p->p %d",
463 len, ses.payload->len , ses.payload->pos));
464 if (len != ses.payload->len - ses.payload->pos) {
465 dropbear_exit("Bad term mode string");
466 }
467
468 if (len == 0) {
469 TRACE(("leave get_termmodes: empty terminal modes string"))
470 return;
471 }
472
473 while (((opcode = buf_getbyte(ses.payload)) != 0x00) && opcode <= 159) {
474
475 /* must be before checking type, so that value is consumed even if
476 * we don't use it */
477 value = buf_getint(ses.payload);
478
479 /* handle types of code */
480 if (opcode > MAX_TERMCODE) {
481 continue;
482 }
483 termcode = &termcodes[(unsigned int)opcode];
484
485
486 switch (termcode->type) {
487
488 case TERMCODE_NONE:
489 break;
490
491 case TERMCODE_CONTROLCHAR:
492 termio.c_cc[termcode->mapcode] = value;
493 break;
494
495 case TERMCODE_INPUT:
496 if (value) {
497 termio.c_iflag |= termcode->mapcode;
498 } else {
499 termio.c_iflag &= ~(termcode->mapcode);
500 }
501 break;
502
503 case TERMCODE_OUTPUT:
504 if (value) {
505 termio.c_oflag |= termcode->mapcode;
506 } else {
507 termio.c_oflag &= ~(termcode->mapcode);
508 }
509 break;
510
511 case TERMCODE_LOCAL:
512 if (value) {
513 termio.c_lflag |= termcode->mapcode;
514 } else {
515 termio.c_lflag &= ~(termcode->mapcode);
516 }
517 break;
518
519 case TERMCODE_CONTROL:
520 if (value) {
521 termio.c_cflag |= termcode->mapcode;
522 } else {
523 termio.c_cflag &= ~(termcode->mapcode);
524 }
525 break;
526
527 }
528 }
529 if (tcsetattr(chansess->master, TCSANOW, &termio) < 0) {
530 dropbear_log(LOG_INFO, "Error setting terminal attributes");
531 }
532 TRACE(("leave get_termmodes"))
533 }
534
535 /* Set up a session pty which will be used to execute the shell or program.
536 * The pty is allocated now, and kept for when the shell/program executes.
537 * Returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
538 static int sessionpty(struct ChanSess * chansess) {
539
540 unsigned int termlen;
541 unsigned char namebuf[65];
542 struct passwd * pw = NULL;
543
544 TRACE(("enter sessionpty"))
545
546 if (!svr_pubkey_allows_pty()) {
547 TRACE(("leave sessionpty : pty forbidden by public key option"))
548 return DROPBEAR_FAILURE;
549 }
550
551 chansess->term = buf_getstring(ses.payload, &termlen);
552 if (termlen > MAX_TERM_LEN) {
553 /* TODO send disconnect ? */
554 TRACE(("leave sessionpty: term len too long"))
555 return DROPBEAR_FAILURE;
556 }
557
558 /* allocate the pty */
559 if (chansess->master != -1) {
560 dropbear_exit("Multiple pty requests");
561 }
562 if (pty_allocate(&chansess->master, &chansess->slave, namebuf, 64) == 0) {
563 TRACE(("leave sessionpty: failed to allocate pty"))
564 return DROPBEAR_FAILURE;
565 }
566
567 chansess->tty = (char*)m_strdup(namebuf);
568 if (!chansess->tty) {
569 dropbear_exit("Out of memory"); /* TODO disconnect */
570 }
571
572 pw = getpwnam(ses.authstate.pw_name);
573 if (!pw)
574 dropbear_exit("getpwnam failed after succeeding previously");
575 pty_setowner(pw, chansess->tty);
576
577 /* Set up the rows/col counts */
578 sessionwinchange(chansess);
579
580 /* Read the terminal modes */
581 get_termmodes(chansess);
582
583 TRACE(("leave sessionpty"))
584 return DROPBEAR_SUCCESS;
585 }
586
587 static char* make_connection_string() {
588 char *local_ip, *local_port, *remote_ip, *remote_port;
589 size_t len;
590 char *ret;
591 get_socket_address(ses.sock_in, &local_ip, &local_port, &remote_ip, &remote_port, 0);
592 len = strlen(local_ip) + strlen(local_port) + strlen(remote_ip) + strlen(remote_port) + 4;
593 ret = m_malloc(len);
594 snprintf(ret, len, "%s %s %s %s", remote_ip, remote_port, local_ip, local_port);
595 m_free(local_ip);
596 m_free(local_port);
597 m_free(remote_ip);
598 m_free(remote_port);
599 return ret;
600 }
601
602 /* Handle a command request from the client. This is used for both shell
603 * and command-execution requests, and passes the command to
604 * noptycommand or ptycommand as appropriate.
605 * Returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
606 static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
607 int iscmd, int issubsys) {
608
609 unsigned int cmdlen;
610 int ret;
611
612 TRACE(("enter sessioncommand"))
613
614 if (chansess->cmd != NULL) {
615 /* Note that only one command can _succeed_. The client might try
616 * one command (which fails), then try another. Ie fallback
617 * from sftp to scp */
618 return DROPBEAR_FAILURE;
619 }
620
621 if (iscmd) {
622 /* "exec" */
623 if (chansess->cmd == NULL) {
624 chansess->cmd = buf_getstring(ses.payload, &cmdlen);
625
626 if (cmdlen > MAX_CMD_LEN) {
627 m_free(chansess->cmd);
628 /* TODO - send error - too long ? */
629 return DROPBEAR_FAILURE;
630 }
631 }
632 if (issubsys) {
633 #ifdef SFTPSERVER_PATH
634 if ((cmdlen == 4) && strncmp(chansess->cmd, "sftp", 4) == 0) {
635 m_free(chansess->cmd);
636 chansess->cmd = m_strdup(SFTPSERVER_PATH);
637 } else
638 #endif
639 {
640 m_free(chansess->cmd);
641 return DROPBEAR_FAILURE;
642 }
643 }
644 }
645
646 /* take public key option 'command' into account */
647 svr_pubkey_set_forced_command(chansess);
648
649 #ifdef LOG_COMMANDS
650 if (chansess->cmd) {
651 dropbear_log(LOG_INFO, "User %s executing '%s'",
652 ses.authstate.pw_name, chansess->cmd);
653 } else {
654 dropbear_log(LOG_INFO, "User %s executing login shell",
655 ses.authstate.pw_name);
656 }
657 #endif
658
659 /* uClinux will vfork(), so there'll be a race as
660 connection_string is freed below. */
661 #ifndef __uClinux__
662 chansess->connection_string = make_connection_string();
663 #endif
664
665 if (chansess->term == NULL) {
666 /* no pty */
667 ret = noptycommand(channel, chansess);
668 } else {
669 /* want pty */
670 ret = ptycommand(channel, chansess);
671 }
672
673 #ifndef __uClinux__
674 m_free(chansess->connection_string);
675 #endif
676
677 if (ret == DROPBEAR_FAILURE) {
678 m_free(chansess->cmd);
679 }
680 return ret;
681 }
682
683 /* Execute a command and set up redirection of stdin/stdout/stderr without a
684 * pty.
685 * Returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
686 static int noptycommand(struct Channel *channel, struct ChanSess *chansess) {
687 int ret;
688
689 TRACE(("enter noptycommand"))
690 ret = spawn_command(execchild, chansess,
691 &channel->writefd, &channel->readfd, &channel->errfd,
692 &chansess->pid);
693
694 if (ret == DROPBEAR_FAILURE) {
695 return ret;
696 }
697
698 ses.maxfd = MAX(ses.maxfd, channel->writefd);
699 ses.maxfd = MAX(ses.maxfd, channel->readfd);
700 ses.maxfd = MAX(ses.maxfd, channel->errfd);
701
702 sleep(1);
703
704 addchildpid(chansess, chansess->pid);
705
706 if (svr_ses.lastexit.exitpid != -1) {
707 unsigned int i;
708 TRACE(("parent side: lastexitpid is %d", svr_ses.lastexit.exitpid))
709 /* The child probably exited and the signal handler triggered
710 * possibly before we got around to adding the childpid. So we fill
711 * out its data manually */
712 for (i = 0; i < svr_ses.childpidsize; i++) {
713 if (svr_ses.childpids[i].pid == svr_ses.lastexit.exitpid) {
714 TRACE(("found match for lastexitpid"))
715 svr_ses.childpids[i].chansess->exit = svr_ses.lastexit;
716 svr_ses.lastexit.exitpid = -1;
717 break;
718 }
719 }
720 }
721
722 TRACE(("leave noptycommand"))
723 return DROPBEAR_SUCCESS;
724 }
725
726 /* Execute a command or shell within a pty environment, and set up
727 * redirection as appropriate.
728 * Returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
729 static int ptycommand(struct Channel *channel, struct ChanSess *chansess) {
730
731 pid_t pid;
732 struct logininfo *li = NULL;
733 #ifdef DO_MOTD
734 buffer * motdbuf = NULL;
735 int len;
736 struct stat sb;
737 char *hushpath = NULL;
738 #endif
739
740 TRACE(("enter ptycommand"))
741
742 /* we need to have a pty allocated */
743 if (chansess->master == -1 || chansess->tty == NULL) {
744 dropbear_log(LOG_WARNING, "No pty was allocated, couldn't execute");
745 return DROPBEAR_FAILURE;
746 }
747
748 #ifdef __uClinux__
749 pid = vfork();
750 #else
751 pid = fork();
752 #endif
753 if (pid < 0)
754 return DROPBEAR_FAILURE;
755
756 if (pid == 0) {
757 /* child */
758
759 TRACE(("back to normal sigchld"))
760 /* Revert to normal sigchld handling */
761 if (signal(SIGCHLD, SIG_DFL) == SIG_ERR) {
762 dropbear_exit("signal() error");
763 }
764
765 /* redirect stdin/stdout/stderr */
766 close(chansess->master);
767
768 pty_make_controlling_tty(&chansess->slave, chansess->tty);
769
770 if ((dup2(chansess->slave, STDIN_FILENO) < 0) ||
771 (dup2(chansess->slave, STDERR_FILENO) < 0) ||
772 (dup2(chansess->slave, STDOUT_FILENO) < 0)) {
773 TRACE(("leave ptycommand: error redirecting filedesc"))
774 return DROPBEAR_FAILURE;
775 }
776
777 close(chansess->slave);
778
779 /* write the utmp/wtmp login record - must be after changing the
780 * terminal used for stdout with the dup2 above */
781 li = chansess_login_alloc(chansess);
782 login_login(li);
783 login_free_entry(li);
784
785 #ifdef DO_MOTD
786 if (svr_opts.domotd) {
787 /* don't show the motd if ~/.hushlogin exists */
788
789 /* 12 == strlen("/.hushlogin\0") */
790 len = strlen(ses.authstate.pw_dir) + 12;
791
792 hushpath = m_malloc(len);
793 snprintf(hushpath, len, "%s/.hushlogin", ses.authstate.pw_dir);
794
795 if (stat(hushpath, &sb) < 0) {
796 /* more than a screenful is stupid IMHO */
797 motdbuf = buf_new(80 * 25);
798 if (buf_readfile(motdbuf, MOTD_FILENAME) == DROPBEAR_SUCCESS) {
799 buf_setpos(motdbuf, 0);
800 while (motdbuf->pos != motdbuf->len) {
801 len = motdbuf->len - motdbuf->pos;
802 len = write(STDOUT_FILENO,
803 buf_getptr(motdbuf, len), len);
804 buf_incrpos(motdbuf, len);
805 }
806 }
807 buf_free(motdbuf);
808 }
809 m_free(hushpath);
810 }
811 #endif /* DO_MOTD */
812
813 execchild(chansess);
814 /* not reached */
815
816 } else {
817 /* parent */
818 TRACE(("continue ptycommand: parent"))
819 chansess->pid = pid;
820
821 /* add a child pid */
822 addchildpid(chansess, pid);
823
824 close(chansess->slave);
825 channel->writefd = chansess->master;
826 channel->readfd = chansess->master;
827 /* don't need to set stderr here */
828 ses.maxfd = MAX(ses.maxfd, chansess->master);
829
830 setnonblocking(chansess->master);
831
832 }
833
834 TRACE(("leave ptycommand"))
835 return DROPBEAR_SUCCESS;
836 }
837
838 /* Add the pid of a child to the list for exit-handling */
839 static void addchildpid(struct ChanSess *chansess, pid_t pid) {
840
841 unsigned int i;
842 for (i = 0; i < svr_ses.childpidsize; i++) {
843 if (svr_ses.childpids[i].pid == -1) {
844 break;
845 }
846 }
847
848 /* need to increase size */
849 if (i == svr_ses.childpidsize) {
850 svr_ses.childpids = (struct ChildPid*)m_realloc(svr_ses.childpids,
851 sizeof(struct ChildPid) * (svr_ses.childpidsize+1));
852 svr_ses.childpidsize++;
853 }
854
855 svr_ses.childpids[i].pid = pid;
856 svr_ses.childpids[i].chansess = chansess;
857
858 }
859
860 /* Clean up, drop to user privileges, set up the environment and execute
861 * the command/shell. This function does not return. */
862 static void execchild(void *user_data) {
863 struct ChanSess *chansess = user_data;
864 char *usershell = NULL;
865
866 /* with uClinux we'll have vfork()ed, so don't want to overwrite the
867 * hostkey. can't think of a workaround to clear it */
868 #ifndef __uClinux__
869 /* wipe the hostkey */
870 sign_key_free(svr_opts.hostkey);
871 svr_opts.hostkey = NULL;
872
873 /* overwrite the prng state */
874 reseedrandom();
875 #endif
876
877 /* clear environment */
878 /* if we're debugging using valgrind etc, we need to keep the LD_PRELOAD
879 * etc. This is hazardous, so should only be used for debugging. */
880 #ifndef DEBUG_VALGRIND
881 #ifdef HAVE_CLEARENV
882 clearenv();
883 #else /* don't HAVE_CLEARENV */
884 /* Yay for posix. */
885 if (environ) {
886 environ[0] = NULL;
887 }
888 #endif /* HAVE_CLEARENV */
889 #endif /* DEBUG_VALGRIND */
890
891 /* We can only change uid/gid as root ... */
892 if (getuid() == 0) {
893
894 if ((setgid(ses.authstate.pw_gid) < 0) ||
895 (initgroups(ses.authstate.pw_name,
896 ses.authstate.pw_gid) < 0)) {
897 dropbear_exit("Error changing user group");
898 }
899 if (setuid(ses.authstate.pw_uid) < 0) {
900 dropbear_exit("Error changing user");
901 }
902 } else {
903 /* ... but if the daemon is the same uid as the requested uid, we don't
904 * need to */
905
906 /* XXX - there is a minor issue here, in that if there are multiple
907 * usernames with the same uid, but differing groups, then the
908 * differing groups won't be set (as with initgroups()). The solution
909 * is for the sysadmin not to give out the UID twice */
910 if (getuid() != ses.authstate.pw_uid) {
911 dropbear_exit("Couldn't change user as non-root");
912 }
913 }
914
915 /* set env vars */
916 addnewvar("USER", ses.authstate.pw_name);
917 addnewvar("LOGNAME", ses.authstate.pw_name);
918 addnewvar("HOME", ses.authstate.pw_dir);
919 addnewvar("SHELL", get_user_shell());
920 addnewvar("PATH", DEFAULT_PATH);
921 if (chansess->term != NULL) {
922 addnewvar("TERM", chansess->term);
923 }
924
925 if (chansess->tty) {
926 addnewvar("SSH_TTY", chansess->tty);
927 }
928
929 if (chansess->connection_string) {
930 addnewvar("SSH_CONNECTION", chansess->connection_string);
931 }
932
933 #ifdef ENABLE_SVR_PUBKEY_OPTIONS
934 if (chansess->original_command) {
935 addnewvar("SSH_ORIGINAL_COMMAND", chansess->original_command);
936 }
937 #endif
938
939 /* change directory */
940 if (chdir(ses.authstate.pw_dir) < 0) {
941 dropbear_exit("Error changing directory");
942 }
943
944 #ifndef DISABLE_X11FWD
945 /* set up X11 forwarding if enabled */
946 x11setauth(chansess);
947 #endif
948 #ifdef ENABLE_AGENTFWD
949 /* set up agent env variable */
950 svr_agentset(chansess);
951 #endif
952
953 usershell = m_strdup(get_user_shell());
954 run_shell_command(chansess->cmd, ses.maxfd, usershell);
955
956 /* only reached on error */
957 dropbear_exit("Child failed");
958 }
959
960 const struct ChanType svrchansess = {
961 0, /* sepfds */
962 "session", /* name */
963 newchansess, /* inithandler */
964 sesscheckclose, /* checkclosehandler */
965 chansessionrequest, /* reqhandler */
966 closechansess, /* closehandler */
967 };
968
969
970 /* Set up the general chansession environment, in particular child-exit
971 * handling */
972 void svr_chansessinitialise() {
973
974 struct sigaction sa_chld;
975
976 /* single child process intially */
977 svr_ses.childpids = (struct ChildPid*)m_malloc(sizeof(struct ChildPid));
978 svr_ses.childpids[0].pid = -1; /* unused */
979 svr_ses.childpids[0].chansess = NULL;
980 svr_ses.childpidsize = 1;
981 svr_ses.lastexit.exitpid = -1; /* Nothing has exited yet */
982 sa_chld.sa_handler = sesssigchild_handler;
983 sa_chld.sa_flags = SA_NOCLDSTOP;
984 sigemptyset(&sa_chld.sa_mask);
985 if (sigaction(SIGCHLD, &sa_chld, NULL) < 0) {
986 dropbear_exit("signal() error");
987 }
988
989 }
990
991 /* add a new environment variable, allocating space for the entry */
992 void addnewvar(const char* param, const char* var) {
993
994 char* newvar = NULL;
995 int plen, vlen;
996
997 plen = strlen(param);
998 vlen = strlen(var);
999
1000 newvar = m_malloc(plen + vlen + 2); /* 2 is for '=' and '\0' */
1001 memcpy(newvar, param, plen);
1002 newvar[plen] = '=';
1003 memcpy(&newvar[plen+1], var, vlen);
1004 newvar[plen+vlen+1] = '\0';
1005 /* newvar is leaked here, but that's part of putenv()'s semantics */
1006 if (putenv(newvar) < 0) {
1007 dropbear_exit("environ error");
1008 }
1009 }
Tomato firmware and modifications.