nchan.c revision 1.17
1 /* $NetBSD: nchan.c,v 1.17 2026/04/08 18:58:41 christos Exp $ */ 2 /* $OpenBSD: nchan.c,v 1.77 2026/02/14 00:18:34 jsg Exp $ */ 3 4 /* 5 * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include "includes.h" 29 __RCSID("$NetBSD: nchan.c,v 1.17 2026/04/08 18:58:41 christos Exp $"); 30 #include <sys/types.h> 31 #include <sys/socket.h> 32 33 #include <errno.h> 34 #include <string.h> 35 #include <stdarg.h> 36 37 #include "ssh2.h" 38 #include "sshbuf.h" 39 #include "packet.h" 40 #include "channels.h" 41 #include "compat.h" 42 #include "log.h" 43 44 /* 45 * SSH Protocol 1.5 aka New Channel Protocol 46 * Thanks to Martina, Axel and everyone who left Erlangen, leaving me bored. 47 * Written by Markus Friedl in October 1999 48 * 49 * Protocol versions 1.3 and 1.5 differ in the handshake protocol used for the 50 * tear down of channels: 51 * 52 * 1.3: strict request-ack-protocol: 53 * CLOSE -> 54 * <- CLOSE_CONFIRM 55 * 56 * 1.5: uses variations of: 57 * IEOF -> 58 * <- OCLOSE 59 * <- IEOF 60 * OCLOSE -> 61 * i.e. both sides have to close the channel 62 * 63 * 2.0: the EOF messages are optional 64 * 65 * See the debugging output from 'ssh -v' and 'sshd -d' of 66 * ssh-1.2.27 as an example. 67 * 68 */ 69 70 /* functions manipulating channel states */ 71 /* 72 * EVENTS update channel input/output states execute ACTIONS 73 */ 74 /* 75 * ACTIONS: should never update the channel states 76 */ 77 static void chan_send_eof2(struct ssh *, Channel *); 78 static void chan_send_eow2(struct ssh *, Channel *); 79 80 /* helper */ 81 static void chan_shutdown_write(struct ssh *, Channel *); 82 static void chan_shutdown_read(struct ssh *, Channel *); 83 static void chan_shutdown_extended_read(struct ssh *, Channel *); 84 85 static const char * const ostates[] = { 86 "open", "drain", "wait_ieof", "closed", 87 }; 88 static const char * const istates[] = { 89 "open", "drain", "wait_oclose", "closed", 90 }; 91 92 static void 93 chan_set_istate(Channel *c, u_int next) 94 { 95 if (c->istate > CHAN_INPUT_CLOSED || next > CHAN_INPUT_CLOSED) 96 fatal("chan_set_istate: bad state %d -> %d", c->istate, next); 97 debug2("channel %d: input %s -> %s", c->self, istates[c->istate], 98 istates[next]); 99 c->istate = next; 100 } 101 102 static void 103 chan_set_ostate(Channel *c, u_int next) 104 { 105 if (c->ostate > CHAN_OUTPUT_CLOSED || next > CHAN_OUTPUT_CLOSED) 106 fatal("chan_set_ostate: bad state %d -> %d", c->ostate, next); 107 debug2("channel %d: output %s -> %s", c->self, ostates[c->ostate], 108 ostates[next]); 109 c->ostate = next; 110 } 111 112 void 113 chan_read_failed(struct ssh *ssh, Channel *c) 114 { 115 debug2("channel %d: read failed", c->self); 116 switch (c->istate) { 117 case CHAN_INPUT_OPEN: 118 chan_shutdown_read(ssh, c); 119 chan_set_istate(c, CHAN_INPUT_WAIT_DRAIN); 120 break; 121 default: 122 error("channel %d: chan_read_failed for istate %d", 123 c->self, c->istate); 124 break; 125 } 126 } 127 128 void 129 chan_ibuf_empty(struct ssh *ssh, Channel *c) 130 { 131 debug2("channel %d: ibuf empty", c->self); 132 if (sshbuf_len(c->input)) { 133 error("channel %d: chan_ibuf_empty for non empty buffer", 134 c->self); 135 return; 136 } 137 switch (c->istate) { 138 case CHAN_INPUT_WAIT_DRAIN: 139 if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_LOCAL))) 140 chan_send_eof2(ssh, c); 141 chan_set_istate(c, CHAN_INPUT_CLOSED); 142 break; 143 default: 144 error("channel %d: chan_ibuf_empty for istate %d", 145 c->self, c->istate); 146 break; 147 } 148 } 149 150 void 151 chan_obuf_empty(struct ssh *ssh, Channel *c) 152 { 153 debug2("channel %d: obuf empty", c->self); 154 if (sshbuf_len(c->output)) { 155 error("channel %d: chan_obuf_empty for non empty buffer", 156 c->self); 157 return; 158 } 159 switch (c->ostate) { 160 case CHAN_OUTPUT_WAIT_DRAIN: 161 chan_shutdown_write(ssh, c); 162 chan_set_ostate(c, CHAN_OUTPUT_CLOSED); 163 break; 164 default: 165 error("channel %d: internal error: obuf_empty for ostate %d", 166 c->self, c->ostate); 167 break; 168 } 169 } 170 171 void 172 chan_rcvd_eow(struct ssh *ssh, Channel *c) 173 { 174 debug2("channel %d: rcvd eow", c->self); 175 switch (c->istate) { 176 case CHAN_INPUT_OPEN: 177 chan_shutdown_read(ssh, c); 178 chan_set_istate(c, CHAN_INPUT_CLOSED); 179 break; 180 } 181 } 182 183 static void 184 chan_send_eof2(struct ssh *ssh, Channel *c) 185 { 186 int r; 187 188 debug2("channel %d: send eof", c->self); 189 switch (c->istate) { 190 case CHAN_INPUT_WAIT_DRAIN: 191 if (!c->have_remote_id) 192 fatal_f("channel %d: no remote_id", c->self); 193 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_EOF)) != 0 || 194 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 195 (r = sshpkt_send(ssh)) != 0) 196 fatal_fr(r, "send CHANNEL_EOF"); 197 c->flags |= CHAN_EOF_SENT; 198 break; 199 default: 200 error("channel %d: cannot send eof for istate %d", 201 c->self, c->istate); 202 break; 203 } 204 } 205 206 static void 207 chan_send_close2(struct ssh *ssh, Channel *c) 208 { 209 int r; 210 211 debug2("channel %d: send_close2", c->self); 212 if (c->ostate != CHAN_OUTPUT_CLOSED || 213 c->istate != CHAN_INPUT_CLOSED) { 214 error("channel %d: cannot send close for istate/ostate %d/%d", 215 c->self, c->istate, c->ostate); 216 } else if (c->flags & CHAN_CLOSE_SENT) { 217 error("channel %d: already sent close", c->self); 218 } else { 219 if (!c->have_remote_id) 220 fatal_f("channel %d: no remote_id", c->self); 221 debug2("channel %d: send close for remote id %u", c->self, 222 c->remote_id); 223 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_CLOSE)) != 0 || 224 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 225 (r = sshpkt_send(ssh)) != 0) 226 fatal_fr(r, "send CHANNEL_EOF"); 227 c->flags |= CHAN_CLOSE_SENT; 228 } 229 } 230 231 static void 232 chan_send_eow2(struct ssh *ssh, Channel *c) 233 { 234 int r; 235 236 debug2("channel %d: send eow", c->self); 237 if (c->ostate == CHAN_OUTPUT_CLOSED) { 238 error("channel %d: must not sent eow on closed output", 239 c->self); 240 return; 241 } 242 if (!(ssh->compat & SSH_NEW_OPENSSH)) 243 return; 244 if (!c->have_remote_id) 245 fatal_f("channel %d: no remote_id", c->self); 246 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_REQUEST)) != 0 || 247 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 248 (r = sshpkt_put_cstring(ssh, "eow (at) openssh.com")) != 0 || 249 (r = sshpkt_put_u8(ssh, 0)) != 0 || 250 (r = sshpkt_send(ssh)) != 0) 251 fatal_fr(r, "send CHANNEL_EOF"); 252 } 253 254 /* shared */ 255 256 void 257 chan_rcvd_ieof(struct ssh *ssh, Channel *c) 258 { 259 debug2("channel %d: rcvd eof", c->self); 260 c->flags |= CHAN_EOF_RCVD; 261 if (c->ostate == CHAN_OUTPUT_OPEN) 262 chan_set_ostate(c, CHAN_OUTPUT_WAIT_DRAIN); 263 if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN && 264 sshbuf_len(c->output) == 0 && 265 !CHANNEL_EFD_OUTPUT_ACTIVE(c)) 266 chan_obuf_empty(ssh, c); 267 } 268 269 void 270 chan_rcvd_oclose(struct ssh *ssh, Channel *c) 271 { 272 debug2("channel %d: rcvd close", c->self); 273 if (!(c->flags & CHAN_LOCAL)) { 274 if (c->flags & CHAN_CLOSE_RCVD) 275 error("channel %d: protocol error: close rcvd twice", 276 c->self); 277 c->flags |= CHAN_CLOSE_RCVD; 278 } 279 if (c->type == SSH_CHANNEL_LARVAL) { 280 /* tear down larval channels immediately */ 281 chan_set_ostate(c, CHAN_OUTPUT_CLOSED); 282 chan_set_istate(c, CHAN_INPUT_CLOSED); 283 return; 284 } 285 switch (c->ostate) { 286 case CHAN_OUTPUT_OPEN: 287 /* 288 * wait until a data from the channel is consumed if a CLOSE 289 * is received 290 */ 291 chan_set_ostate(c, CHAN_OUTPUT_WAIT_DRAIN); 292 break; 293 } 294 switch (c->istate) { 295 case CHAN_INPUT_OPEN: 296 chan_shutdown_read(ssh, c); 297 chan_shutdown_extended_read(ssh, c); 298 chan_set_istate(c, CHAN_INPUT_CLOSED); 299 break; 300 case CHAN_INPUT_WAIT_DRAIN: 301 if (!(c->flags & CHAN_LOCAL)) 302 chan_send_eof2(ssh, c); 303 chan_shutdown_extended_read(ssh, c); 304 chan_set_istate(c, CHAN_INPUT_CLOSED); 305 break; 306 } 307 } 308 309 void 310 chan_write_failed(struct ssh *ssh, Channel *c) 311 { 312 debug2("channel %d: write failed", c->self); 313 switch (c->ostate) { 314 case CHAN_OUTPUT_OPEN: 315 case CHAN_OUTPUT_WAIT_DRAIN: 316 chan_shutdown_write(ssh, c); 317 if (strcmp(c->ctype, "session") == 0) 318 chan_send_eow2(ssh, c); 319 chan_set_ostate(c, CHAN_OUTPUT_CLOSED); 320 break; 321 default: 322 error("channel %d: chan_write_failed for ostate %d", 323 c->self, c->ostate); 324 break; 325 } 326 } 327 328 void 329 chan_mark_dead(struct ssh *ssh, Channel *c) 330 { 331 c->type = SSH_CHANNEL_ZOMBIE; 332 } 333 334 int 335 chan_is_dead(struct ssh *ssh, Channel *c, int do_send) 336 { 337 if (c->type == SSH_CHANNEL_ZOMBIE) { 338 debug2("channel %d: zombie", c->self); 339 return 1; 340 } 341 if (c->istate != CHAN_INPUT_CLOSED || c->ostate != CHAN_OUTPUT_CLOSED) 342 return 0; 343 if ((ssh->compat & SSH_BUG_EXTEOF) && 344 c->extended_usage == CHAN_EXTENDED_WRITE && 345 c->efd != -1 && 346 sshbuf_len(c->extended) > 0) { 347 debug2("channel %d: active efd: %d len %zu", 348 c->self, c->efd, sshbuf_len(c->extended)); 349 return 0; 350 } 351 if (c->flags & CHAN_LOCAL) { 352 debug2("channel %d: is dead (local)", c->self); 353 return 1; 354 } 355 if (!(c->flags & CHAN_CLOSE_SENT)) { 356 if (do_send) { 357 chan_send_close2(ssh, c); 358 } else { 359 /* channel would be dead if we sent a close */ 360 if (c->flags & CHAN_CLOSE_RCVD) { 361 debug2("channel %d: almost dead", 362 c->self); 363 return 1; 364 } 365 } 366 } 367 if ((c->flags & CHAN_CLOSE_SENT) && 368 (c->flags & CHAN_CLOSE_RCVD)) { 369 debug2("channel %d: is dead", c->self); 370 return 1; 371 } 372 return 0; 373 } 374 375 /* helper */ 376 static void 377 chan_shutdown_write(struct ssh *ssh, Channel *c) 378 { 379 sshbuf_reset(c->output); 380 if (c->type == SSH_CHANNEL_LARVAL) 381 return; 382 /* shutdown failure is allowed if write failed already */ 383 debug2_f("channel %d: (i%d o%d sock %d wfd %d efd %d [%s])", 384 c->self, c->istate, c->ostate, c->sock, c->wfd, c->efd, 385 channel_format_extended_usage(c)); 386 if (c->sock != -1) { 387 if (shutdown(c->sock, SHUT_WR) == -1) { 388 debug2_f("channel %d: shutdown() failed for " 389 "fd %d [i%d o%d]: %.100s", c->self, c->sock, 390 c->istate, c->ostate, strerror(errno)); 391 } 392 } else { 393 if (channel_close_fd(ssh, c, &c->wfd) < 0) { 394 logit_f("channel %d: close() failed for " 395 "fd %d [i%d o%d]: %.100s", c->self, c->wfd, 396 c->istate, c->ostate, strerror(errno)); 397 } 398 } 399 } 400 401 static void 402 chan_shutdown_read(struct ssh *ssh, Channel *c) 403 { 404 if (c->type == SSH_CHANNEL_LARVAL) 405 return; 406 debug2_f("channel %d: (i%d o%d sock %d wfd %d efd %d [%s])", 407 c->self, c->istate, c->ostate, c->sock, c->rfd, c->efd, 408 channel_format_extended_usage(c)); 409 if (c->sock != -1) { 410 if (shutdown(c->sock, SHUT_RD) == -1) { 411 error_f("channel %d: shutdown() failed for " 412 "fd %d [i%d o%d]: %.100s", c->self, c->sock, 413 c->istate, c->ostate, strerror(errno)); 414 } 415 } else { 416 if (channel_close_fd(ssh, c, &c->rfd) < 0) { 417 logit_f("channel %d: close() failed for " 418 "fd %d [i%d o%d]: %.100s", c->self, c->rfd, 419 c->istate, c->ostate, strerror(errno)); 420 } 421 } 422 } 423 424 static void 425 chan_shutdown_extended_read(struct ssh *ssh, Channel *c) 426 { 427 if (c->type == SSH_CHANNEL_LARVAL || c->efd == -1) 428 return; 429 if (c->extended_usage != CHAN_EXTENDED_READ && 430 c->extended_usage != CHAN_EXTENDED_IGNORE) 431 return; 432 debug_f("channel %d: (i%d o%d sock %d wfd %d efd %d [%s])", 433 c->self, c->istate, c->ostate, c->sock, c->rfd, c->efd, 434 channel_format_extended_usage(c)); 435 if (channel_close_fd(ssh, c, &c->efd) < 0) { 436 logit_f("channel %d: close() failed for " 437 "extended fd %d [i%d o%d]: %.100s", c->self, c->efd, 438 c->istate, c->ostate, strerror(errno)); 439 } 440 } 441
Indexes created Sat Apr 25 00:22:52 UTC 2026