1 /* $OpenBSD: sftp-server.c,v 1.146 2023/03/07 05:37:26 djm Exp $ */
3 * Copyright (c) 2000-2004 Markus Friedl. All rights reserved.
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 #include <sys/types.h>
22 #include <sys/resource.h>
23 #ifdef HAVE_SYS_TIME_H
24 # include <sys/time.h>
26 #ifdef HAVE_SYS_MOUNT_H
27 #include <sys/mount.h>
29 #ifdef HAVE_SYS_STATVFS_H
30 #include <sys/statvfs.h>
58 #include "sftp-common.h"
60 char *sftp_realpath(const char *, char *); /* sftp-realpath.c */
62 /* Maximum data read that we are willing to accept */
63 #define SFTP_MAX_READ_LENGTH (SFTP_MAX_MSG_LENGTH - 1024)
66 static LogLevel log_level = SYSLOG_LEVEL_ERROR;
69 static struct passwd *pw = NULL;
70 static char *client_addr = NULL;
72 /* input and output queue */
73 struct sshbuf *iqueue;
74 struct sshbuf *oqueue;
76 /* Version of client */
79 /* SSH2_FXP_INIT received */
85 /* Requests that are allowed/denied */
86 static char *request_allowlist, *request_denylist;
88 /* portable attributes, etc. */
89 typedef struct Stat Stat;
98 static void process_open(u_int32_t id);
99 static void process_close(u_int32_t id);
100 static void process_read(u_int32_t id);
101 static void process_write(u_int32_t id);
102 static void process_stat(u_int32_t id);
103 static void process_lstat(u_int32_t id);
104 static void process_fstat(u_int32_t id);
105 static void process_setstat(u_int32_t id);
106 static void process_fsetstat(u_int32_t id);
107 static void process_opendir(u_int32_t id);
108 static void process_readdir(u_int32_t id);
109 static void process_remove(u_int32_t id);
110 static void process_mkdir(u_int32_t id);
111 static void process_rmdir(u_int32_t id);
112 static void process_realpath(u_int32_t id);
113 static void process_rename(u_int32_t id);
114 static void process_readlink(u_int32_t id);
115 static void process_symlink(u_int32_t id);
116 static void process_extended_posix_rename(u_int32_t id);
117 static void process_extended_statvfs(u_int32_t id);
118 static void process_extended_fstatvfs(u_int32_t id);
119 static void process_extended_hardlink(u_int32_t id);
120 static void process_extended_fsync(u_int32_t id);
121 static void process_extended_lsetstat(u_int32_t id);
122 static void process_extended_limits(u_int32_t id);
123 static void process_extended_expand(u_int32_t id);
124 static void process_extended_copy_data(u_int32_t id);
125 static void process_extended_home_directory(u_int32_t id);
126 static void process_extended_get_users_groups_by_id(u_int32_t id);
127 static void process_extended(u_int32_t id);
129 struct sftp_handler {
130 const char *name; /* user-visible name for fine-grained perms */
131 const char *ext_name; /* extended request name */
132 u_int type; /* packet type, for non extended packets */
133 void (*handler)(u_int32_t);
134 int does_write; /* if nonzero, banned for readonly mode */
137 static const struct sftp_handler handlers[] = {
138 /* NB. SSH2_FXP_OPEN does the readonly check in the handler itself */
139 { "open", NULL, SSH2_FXP_OPEN, process_open, 0 },
140 { "close", NULL, SSH2_FXP_CLOSE, process_close, 0 },
141 { "read", NULL, SSH2_FXP_READ, process_read, 0 },
142 { "write", NULL, SSH2_FXP_WRITE, process_write, 1 },
143 { "lstat", NULL, SSH2_FXP_LSTAT, process_lstat, 0 },
144 { "fstat", NULL, SSH2_FXP_FSTAT, process_fstat, 0 },
145 { "setstat", NULL, SSH2_FXP_SETSTAT, process_setstat, 1 },
146 { "fsetstat", NULL, SSH2_FXP_FSETSTAT, process_fsetstat, 1 },
147 { "opendir", NULL, SSH2_FXP_OPENDIR, process_opendir, 0 },
148 { "readdir", NULL, SSH2_FXP_READDIR, process_readdir, 0 },
149 { "remove", NULL, SSH2_FXP_REMOVE, process_remove, 1 },
150 { "mkdir", NULL, SSH2_FXP_MKDIR, process_mkdir, 1 },
151 { "rmdir", NULL, SSH2_FXP_RMDIR, process_rmdir, 1 },
152 { "realpath", NULL, SSH2_FXP_REALPATH, process_realpath, 0 },
153 { "stat", NULL, SSH2_FXP_STAT, process_stat, 0 },
154 { "rename", NULL, SSH2_FXP_RENAME, process_rename, 1 },
155 { "readlink", NULL, SSH2_FXP_READLINK, process_readlink, 0 },
156 { "symlink", NULL, SSH2_FXP_SYMLINK, process_symlink, 1 },
157 { NULL, NULL, 0, NULL, 0 }
160 /* SSH2_FXP_EXTENDED submessages */
161 static const struct sftp_handler extended_handlers[] = {
162 { "posix-rename", "posix-rename@openssh.com", 0,
163 process_extended_posix_rename, 1 },
164 { "statvfs", "statvfs@openssh.com", 0, process_extended_statvfs, 0 },
165 { "fstatvfs", "fstatvfs@openssh.com", 0, process_extended_fstatvfs, 0 },
166 { "hardlink", "hardlink@openssh.com", 0, process_extended_hardlink, 1 },
167 { "fsync", "fsync@openssh.com", 0, process_extended_fsync, 1 },
168 { "lsetstat", "lsetstat@openssh.com", 0, process_extended_lsetstat, 1 },
169 { "limits", "limits@openssh.com", 0, process_extended_limits, 0 },
170 { "expand-path", "expand-path@openssh.com", 0,
171 process_extended_expand, 0 },
172 { "copy-data", "copy-data", 0, process_extended_copy_data, 1 },
173 { "home-directory", "home-directory", 0,
174 process_extended_home_directory, 0 },
175 { "users-groups-by-id", "users-groups-by-id@openssh.com", 0,
176 process_extended_get_users_groups_by_id, 0 },
177 { NULL, NULL, 0, NULL, 0 }
180 static const struct sftp_handler *
181 extended_handler_byname(const char *name)
185 for (i = 0; extended_handlers[i].handler != NULL; i++) {
186 if (strcmp(name, extended_handlers[i].ext_name) == 0)
187 return &extended_handlers[i];
193 request_permitted(const struct sftp_handler *h)
197 if (readonly && h->does_write) {
198 verbose("Refusing %s request in read-only mode", h->name);
201 if (request_denylist != NULL &&
202 ((result = match_list(h->name, request_denylist, NULL))) != NULL) {
204 verbose("Refusing denylisted %s request", h->name);
207 if (request_allowlist != NULL &&
208 ((result = match_list(h->name, request_allowlist, NULL))) != NULL) {
210 debug2("Permitting allowlisted %s request", h->name);
213 if (request_allowlist != NULL) {
214 verbose("Refusing non-allowlisted %s request", h->name);
221 errno_to_portable(int unixerrno)
233 ret = SSH2_FX_NO_SUCH_FILE;
238 ret = SSH2_FX_PERMISSION_DENIED;
242 ret = SSH2_FX_BAD_MESSAGE;
245 ret = SSH2_FX_OP_UNSUPPORTED;
248 ret = SSH2_FX_FAILURE;
255 flags_from_portable(int pflags)
259 if ((pflags & SSH2_FXF_READ) &&
260 (pflags & SSH2_FXF_WRITE)) {
262 } else if (pflags & SSH2_FXF_READ) {
264 } else if (pflags & SSH2_FXF_WRITE) {
267 if (pflags & SSH2_FXF_APPEND)
269 if (pflags & SSH2_FXF_CREAT)
271 if (pflags & SSH2_FXF_TRUNC)
273 if (pflags & SSH2_FXF_EXCL)
279 string_from_portable(int pflags)
281 static char ret[128];
285 #define PAPPEND(str) { \
287 strlcat(ret, ",", sizeof(ret)); \
288 strlcat(ret, str, sizeof(ret)); \
291 if (pflags & SSH2_FXF_READ)
293 if (pflags & SSH2_FXF_WRITE)
295 if (pflags & SSH2_FXF_APPEND)
297 if (pflags & SSH2_FXF_CREAT)
299 if (pflags & SSH2_FXF_TRUNC)
301 if (pflags & SSH2_FXF_EXCL)
309 typedef struct Handle Handle;
316 u_int64_t bytes_read, bytes_write;
326 static Handle *handles = NULL;
327 static u_int num_handles = 0;
328 static int first_unused_handle = -1;
330 static void handle_unused(int i)
332 handles[i].use = HANDLE_UNUSED;
333 handles[i].next_unused = first_unused_handle;
334 first_unused_handle = i;
338 handle_new(int use, const char *name, int fd, int flags, DIR *dirp)
342 if (first_unused_handle == -1) {
343 if (num_handles + 1 <= num_handles)
346 handles = xreallocarray(handles, num_handles, sizeof(Handle));
347 handle_unused(num_handles - 1);
350 i = first_unused_handle;
351 first_unused_handle = handles[i].next_unused;
353 handles[i].use = use;
354 handles[i].dirp = dirp;
356 handles[i].flags = flags;
357 handles[i].name = xstrdup(name);
358 handles[i].bytes_read = handles[i].bytes_write = 0;
364 handle_is_ok(int i, int type)
366 return i >= 0 && (u_int)i < num_handles && handles[i].use == type;
370 handle_to_string(int handle, u_char **stringp, int *hlenp)
372 if (stringp == NULL || hlenp == NULL)
374 *stringp = xmalloc(sizeof(int32_t));
375 put_u32(*stringp, handle);
376 *hlenp = sizeof(int32_t);
381 handle_from_string(const u_char *handle, u_int hlen)
385 if (hlen != sizeof(int32_t))
387 val = get_u32(handle);
388 if (handle_is_ok(val, HANDLE_FILE) ||
389 handle_is_ok(val, HANDLE_DIR))
395 handle_to_name(int handle)
397 if (handle_is_ok(handle, HANDLE_DIR)||
398 handle_is_ok(handle, HANDLE_FILE))
399 return handles[handle].name;
404 handle_to_dir(int handle)
406 if (handle_is_ok(handle, HANDLE_DIR))
407 return handles[handle].dirp;
412 handle_to_fd(int handle)
414 if (handle_is_ok(handle, HANDLE_FILE))
415 return handles[handle].fd;
420 handle_to_flags(int handle)
422 if (handle_is_ok(handle, HANDLE_FILE))
423 return handles[handle].flags;
428 handle_update_read(int handle, ssize_t bytes)
430 if (handle_is_ok(handle, HANDLE_FILE) && bytes > 0)
431 handles[handle].bytes_read += bytes;
435 handle_update_write(int handle, ssize_t bytes)
437 if (handle_is_ok(handle, HANDLE_FILE) && bytes > 0)
438 handles[handle].bytes_write += bytes;
442 handle_bytes_read(int handle)
444 if (handle_is_ok(handle, HANDLE_FILE))
445 return (handles[handle].bytes_read);
450 handle_bytes_write(int handle)
452 if (handle_is_ok(handle, HANDLE_FILE))
453 return (handles[handle].bytes_write);
458 handle_close(int handle)
462 if (handle_is_ok(handle, HANDLE_FILE)) {
463 ret = close(handles[handle].fd);
464 free(handles[handle].name);
465 handle_unused(handle);
466 } else if (handle_is_ok(handle, HANDLE_DIR)) {
467 ret = closedir(handles[handle].dirp);
468 free(handles[handle].name);
469 handle_unused(handle);
477 handle_log_close(int handle, char *emsg)
479 if (handle_is_ok(handle, HANDLE_FILE)) {
480 logit("%s%sclose \"%s\" bytes read %llu written %llu",
481 emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ",
482 handle_to_name(handle),
483 (unsigned long long)handle_bytes_read(handle),
484 (unsigned long long)handle_bytes_write(handle));
486 logit("%s%sclosedir \"%s\"",
487 emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ",
488 handle_to_name(handle));
493 handle_log_exit(void)
497 for (i = 0; i < num_handles; i++)
498 if (handles[i].use != HANDLE_UNUSED)
499 handle_log_close(i, "forced");
503 get_handle(struct sshbuf *queue, int *hp)
510 if ((r = sshbuf_get_string(queue, &handle, &hlen)) != 0)
513 *hp = handle_from_string(handle, hlen);
521 send_msg(struct sshbuf *m)
525 if ((r = sshbuf_put_stringb(oqueue, m)) != 0)
526 fatal_fr(r, "enqueue");
531 status_to_message(u_int32_t status)
533 static const char * const status_messages[] = {
534 "Success", /* SSH_FX_OK */
535 "End of file", /* SSH_FX_EOF */
536 "No such file", /* SSH_FX_NO_SUCH_FILE */
537 "Permission denied", /* SSH_FX_PERMISSION_DENIED */
538 "Failure", /* SSH_FX_FAILURE */
539 "Bad message", /* SSH_FX_BAD_MESSAGE */
540 "No connection", /* SSH_FX_NO_CONNECTION */
541 "Connection lost", /* SSH_FX_CONNECTION_LOST */
542 "Operation unsupported", /* SSH_FX_OP_UNSUPPORTED */
543 "Unknown error" /* Others */
545 return (status_messages[MINIMUM(status,SSH2_FX_MAX)]);
549 send_status_errmsg(u_int32_t id, u_int32_t status, const char *errmsg)
554 debug3("request %u: sent status %u", id, status);
555 if (log_level > SYSLOG_LEVEL_VERBOSE ||
556 (status != SSH2_FX_OK && status != SSH2_FX_EOF))
557 logit("sent status %s", status_to_message(status));
558 if ((msg = sshbuf_new()) == NULL)
559 fatal_f("sshbuf_new failed");
560 if ((r = sshbuf_put_u8(msg, SSH2_FXP_STATUS)) != 0 ||
561 (r = sshbuf_put_u32(msg, id)) != 0 ||
562 (r = sshbuf_put_u32(msg, status)) != 0)
563 fatal_fr(r, "compose");
565 if ((r = sshbuf_put_cstring(msg, errmsg == NULL ?
566 status_to_message(status) : errmsg)) != 0 ||
567 (r = sshbuf_put_cstring(msg, "")) != 0)
568 fatal_fr(r, "compose message");
575 send_status(u_int32_t id, u_int32_t status)
577 send_status_errmsg(id, status, NULL);
581 send_data_or_handle(char type, u_int32_t id, const u_char *data, int dlen)
586 if ((msg = sshbuf_new()) == NULL)
587 fatal_f("sshbuf_new failed");
588 if ((r = sshbuf_put_u8(msg, type)) != 0 ||
589 (r = sshbuf_put_u32(msg, id)) != 0 ||
590 (r = sshbuf_put_string(msg, data, dlen)) != 0)
591 fatal_fr(r, "compose");
597 send_data(u_int32_t id, const u_char *data, int dlen)
599 debug("request %u: sent data len %d", id, dlen);
600 send_data_or_handle(SSH2_FXP_DATA, id, data, dlen);
604 send_handle(u_int32_t id, int handle)
609 handle_to_string(handle, &string, &hlen);
610 debug("request %u: sent handle handle %d", id, handle);
611 send_data_or_handle(SSH2_FXP_HANDLE, id, string, hlen);
616 send_names(u_int32_t id, int count, const Stat *stats)
621 if ((msg = sshbuf_new()) == NULL)
622 fatal_f("sshbuf_new failed");
623 if ((r = sshbuf_put_u8(msg, SSH2_FXP_NAME)) != 0 ||
624 (r = sshbuf_put_u32(msg, id)) != 0 ||
625 (r = sshbuf_put_u32(msg, count)) != 0)
626 fatal_fr(r, "compose");
627 debug("request %u: sent names count %d", id, count);
628 for (i = 0; i < count; i++) {
629 if ((r = sshbuf_put_cstring(msg, stats[i].name)) != 0 ||
630 (r = sshbuf_put_cstring(msg, stats[i].long_name)) != 0 ||
631 (r = encode_attrib(msg, &stats[i].attrib)) != 0)
632 fatal_fr(r, "compose filenames/attrib");
639 send_attrib(u_int32_t id, const Attrib *a)
644 debug("request %u: sent attrib have 0x%x", id, a->flags);
645 if ((msg = sshbuf_new()) == NULL)
646 fatal_f("sshbuf_new failed");
647 if ((r = sshbuf_put_u8(msg, SSH2_FXP_ATTRS)) != 0 ||
648 (r = sshbuf_put_u32(msg, id)) != 0 ||
649 (r = encode_attrib(msg, a)) != 0)
650 fatal_fr(r, "compose");
656 send_statvfs(u_int32_t id, struct statvfs *st)
662 flag = (st->f_flag & ST_RDONLY) ? SSH2_FXE_STATVFS_ST_RDONLY : 0;
663 flag |= (st->f_flag & ST_NOSUID) ? SSH2_FXE_STATVFS_ST_NOSUID : 0;
665 if ((msg = sshbuf_new()) == NULL)
666 fatal_f("sshbuf_new failed");
667 if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED_REPLY)) != 0 ||
668 (r = sshbuf_put_u32(msg, id)) != 0 ||
669 (r = sshbuf_put_u64(msg, st->f_bsize)) != 0 ||
670 (r = sshbuf_put_u64(msg, st->f_frsize)) != 0 ||
671 (r = sshbuf_put_u64(msg, st->f_blocks)) != 0 ||
672 (r = sshbuf_put_u64(msg, st->f_bfree)) != 0 ||
673 (r = sshbuf_put_u64(msg, st->f_bavail)) != 0 ||
674 (r = sshbuf_put_u64(msg, st->f_files)) != 0 ||
675 (r = sshbuf_put_u64(msg, st->f_ffree)) != 0 ||
676 (r = sshbuf_put_u64(msg, st->f_favail)) != 0 ||
677 (r = sshbuf_put_u64(msg, FSID_TO_ULONG(st->f_fsid))) != 0 ||
678 (r = sshbuf_put_u64(msg, flag)) != 0 ||
679 (r = sshbuf_put_u64(msg, st->f_namemax)) != 0)
680 fatal_fr(r, "compose");
686 * Prepare SSH2_FXP_VERSION extension advertisement for a single extension.
687 * The extension is checked for permission prior to advertisement.
690 compose_extension(struct sshbuf *msg, const char *name, const char *ver)
693 const struct sftp_handler *exthnd;
695 if ((exthnd = extended_handler_byname(name)) == NULL)
696 fatal_f("internal error: no handler for %s", name);
697 if (!request_permitted(exthnd)) {
698 debug2_f("refusing to advertise disallowed extension %s", name);
701 if ((r = sshbuf_put_cstring(msg, name)) != 0 ||
702 (r = sshbuf_put_cstring(msg, ver)) != 0)
703 fatal_fr(r, "compose %s", name);
715 if ((r = sshbuf_get_u32(iqueue, &version)) != 0)
716 fatal_fr(r, "parse");
717 verbose("received client version %u", version);
718 if ((msg = sshbuf_new()) == NULL)
719 fatal_f("sshbuf_new failed");
720 if ((r = sshbuf_put_u8(msg, SSH2_FXP_VERSION)) != 0 ||
721 (r = sshbuf_put_u32(msg, SSH2_FILEXFER_VERSION)) != 0)
722 fatal_fr(r, "compose");
724 /* extension advertisements */
725 compose_extension(msg, "posix-rename@openssh.com", "1");
726 compose_extension(msg, "statvfs@openssh.com", "2");
727 compose_extension(msg, "fstatvfs@openssh.com", "2");
728 compose_extension(msg, "hardlink@openssh.com", "1");
729 compose_extension(msg, "fsync@openssh.com", "1");
730 compose_extension(msg, "lsetstat@openssh.com", "1");
731 compose_extension(msg, "limits@openssh.com", "1");
732 compose_extension(msg, "expand-path@openssh.com", "1");
733 compose_extension(msg, "copy-data", "1");
734 compose_extension(msg, "home-directory", "1");
735 compose_extension(msg, "users-groups-by-id@openssh.com", "1");
742 process_open(u_int32_t id)
747 int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE;
749 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
750 (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
751 (r = decode_attrib(iqueue, &a)) != 0)
752 fatal_fr(r, "parse");
754 debug3("request %u: open flags %d", id, pflags);
755 flags = flags_from_portable(pflags);
756 mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666;
757 logit("open \"%s\" flags %s mode 0%o",
758 name, string_from_portable(pflags), mode);
760 ((flags & O_ACCMODE) != O_RDONLY ||
761 (flags & (O_CREAT|O_TRUNC)) != 0)) {
762 verbose("Refusing open request in read-only mode");
763 status = SSH2_FX_PERMISSION_DENIED;
765 fd = open(name, flags, mode);
767 status = errno_to_portable(errno);
769 handle = handle_new(HANDLE_FILE, name, fd, flags, NULL);
773 send_handle(id, handle);
778 if (status != SSH2_FX_OK)
779 send_status(id, status);
784 process_close(u_int32_t id)
786 int r, handle, ret, status = SSH2_FX_FAILURE;
788 if ((r = get_handle(iqueue, &handle)) != 0)
789 fatal_fr(r, "parse");
791 debug3("request %u: close handle %u", id, handle);
792 handle_log_close(handle, NULL);
793 ret = handle_close(handle);
794 status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
795 send_status(id, status);
799 process_read(u_int32_t id)
802 static size_t buflen;
804 int r, handle, fd, ret, status = SSH2_FX_FAILURE;
807 if ((r = get_handle(iqueue, &handle)) != 0 ||
808 (r = sshbuf_get_u64(iqueue, &off)) != 0 ||
809 (r = sshbuf_get_u32(iqueue, &len)) != 0)
810 fatal_fr(r, "parse");
812 debug("request %u: read \"%s\" (handle %d) off %llu len %u",
813 id, handle_to_name(handle), handle, (unsigned long long)off, len);
814 if ((fd = handle_to_fd(handle)) == -1)
816 if (len > SFTP_MAX_READ_LENGTH) {
817 debug2("read change len %u to %u", len, SFTP_MAX_READ_LENGTH);
818 len = SFTP_MAX_READ_LENGTH;
821 debug3_f("allocate %zu => %u", buflen, len);
822 if ((buf = realloc(buf, len)) == NULL)
823 fatal_f("realloc failed");
826 if (lseek(fd, off, SEEK_SET) == -1) {
827 status = errno_to_portable(errno);
828 error_f("seek \"%.100s\": %s", handle_to_name(handle),
833 /* weird, but not strictly disallowed */
835 } else if ((ret = read(fd, buf, len)) == -1) {
836 status = errno_to_portable(errno);
837 error_f("read \"%.100s\": %s", handle_to_name(handle),
840 } else if (ret == 0) {
841 status = SSH2_FX_EOF;
844 send_data(id, buf, ret);
845 handle_update_read(handle, ret);
849 if (status != SSH2_FX_OK)
850 send_status(id, status);
854 process_write(u_int32_t id)
858 int r, handle, fd, ret, status;
861 if ((r = get_handle(iqueue, &handle)) != 0 ||
862 (r = sshbuf_get_u64(iqueue, &off)) != 0 ||
863 (r = sshbuf_get_string(iqueue, &data, &len)) != 0)
864 fatal_fr(r, "parse");
866 debug("request %u: write \"%s\" (handle %d) off %llu len %zu",
867 id, handle_to_name(handle), handle, (unsigned long long)off, len);
868 fd = handle_to_fd(handle);
871 status = SSH2_FX_FAILURE;
873 if (!(handle_to_flags(handle) & O_APPEND) &&
874 lseek(fd, off, SEEK_SET) == -1) {
875 status = errno_to_portable(errno);
876 error_f("seek \"%.100s\": %s", handle_to_name(handle),
880 ret = write(fd, data, len);
882 status = errno_to_portable(errno);
883 error_f("write \"%.100s\": %s",
884 handle_to_name(handle), strerror(errno));
885 } else if ((size_t)ret == len) {
887 handle_update_write(handle, ret);
889 debug2_f("nothing at all written");
890 status = SSH2_FX_FAILURE;
894 send_status(id, status);
899 process_do_stat(u_int32_t id, int do_lstat)
904 int r, status = SSH2_FX_FAILURE;
906 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
907 fatal_fr(r, "parse");
909 debug3("request %u: %sstat", id, do_lstat ? "l" : "");
910 verbose("%sstat name \"%s\"", do_lstat ? "l" : "", name);
911 r = do_lstat ? lstat(name, &st) : stat(name, &st);
913 status = errno_to_portable(errno);
915 stat_to_attrib(&st, &a);
919 if (status != SSH2_FX_OK)
920 send_status(id, status);
925 process_stat(u_int32_t id)
927 process_do_stat(id, 0);
931 process_lstat(u_int32_t id)
933 process_do_stat(id, 1);
937 process_fstat(u_int32_t id)
941 int fd, r, handle, status = SSH2_FX_FAILURE;
943 if ((r = get_handle(iqueue, &handle)) != 0)
944 fatal_fr(r, "parse");
945 debug("request %u: fstat \"%s\" (handle %u)",
946 id, handle_to_name(handle), handle);
947 fd = handle_to_fd(handle);
951 status = errno_to_portable(errno);
953 stat_to_attrib(&st, &a);
958 if (status != SSH2_FX_OK)
959 send_status(id, status);
962 static struct timeval *
963 attrib_to_tv(const Attrib *a)
965 static struct timeval tv[2];
967 tv[0].tv_sec = a->atime;
969 tv[1].tv_sec = a->mtime;
974 static struct timespec *
975 attrib_to_ts(const Attrib *a)
977 static struct timespec ts[2];
979 ts[0].tv_sec = a->atime;
981 ts[1].tv_sec = a->mtime;
987 process_setstat(u_int32_t id)
991 int r, status = SSH2_FX_OK;
993 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
994 (r = decode_attrib(iqueue, &a)) != 0)
995 fatal_fr(r, "parse");
997 debug("request %u: setstat name \"%s\"", id, name);
998 if (a.flags & SSH2_FILEXFER_ATTR_SIZE) {
999 logit("set \"%s\" size %llu",
1000 name, (unsigned long long)a.size);
1001 r = truncate(name, a.size);
1003 status = errno_to_portable(errno);
1005 if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
1006 logit("set \"%s\" mode %04o", name, a.perm);
1007 r = chmod(name, a.perm & 07777);
1009 status = errno_to_portable(errno);
1011 if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
1015 strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S",
1017 logit("set \"%s\" modtime %s", name, buf);
1018 r = utimes(name, attrib_to_tv(&a));
1020 status = errno_to_portable(errno);
1022 if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) {
1023 logit("set \"%s\" owner %lu group %lu", name,
1024 (u_long)a.uid, (u_long)a.gid);
1025 r = chown(name, a.uid, a.gid);
1027 status = errno_to_portable(errno);
1029 send_status(id, status);
1034 process_fsetstat(u_int32_t id)
1038 int status = SSH2_FX_OK;
1040 if ((r = get_handle(iqueue, &handle)) != 0 ||
1041 (r = decode_attrib(iqueue, &a)) != 0)
1042 fatal_fr(r, "parse");
1044 debug("request %u: fsetstat handle %d", id, handle);
1045 fd = handle_to_fd(handle);
1047 status = SSH2_FX_FAILURE;
1049 char *name = handle_to_name(handle);
1051 if (a.flags & SSH2_FILEXFER_ATTR_SIZE) {
1052 logit("set \"%s\" size %llu",
1053 name, (unsigned long long)a.size);
1054 r = ftruncate(fd, a.size);
1056 status = errno_to_portable(errno);
1058 if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
1059 logit("set \"%s\" mode %04o", name, a.perm);
1061 r = fchmod(fd, a.perm & 07777);
1063 r = chmod(name, a.perm & 07777);
1066 status = errno_to_portable(errno);
1068 if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
1072 strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S",
1074 logit("set \"%s\" modtime %s", name, buf);
1076 r = futimes(fd, attrib_to_tv(&a));
1078 r = utimes(name, attrib_to_tv(&a));
1081 status = errno_to_portable(errno);
1083 if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) {
1084 logit("set \"%s\" owner %lu group %lu", name,
1085 (u_long)a.uid, (u_long)a.gid);
1087 r = fchown(fd, a.uid, a.gid);
1089 r = chown(name, a.uid, a.gid);
1092 status = errno_to_portable(errno);
1095 send_status(id, status);
1099 process_opendir(u_int32_t id)
1103 int r, handle, status = SSH2_FX_FAILURE;
1105 if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
1106 fatal_fr(r, "parse");
1108 debug3("request %u: opendir", id);
1109 logit("opendir \"%s\"", path);
1110 dirp = opendir(path);
1112 status = errno_to_portable(errno);
1114 handle = handle_new(HANDLE_DIR, path, 0, 0, dirp);
1118 send_handle(id, handle);
1119 status = SSH2_FX_OK;
1123 if (status != SSH2_FX_OK)
1124 send_status(id, status);
1129 process_readdir(u_int32_t id)
1136 if ((r = get_handle(iqueue, &handle)) != 0)
1137 fatal_fr(r, "parse");
1139 debug("request %u: readdir \"%s\" (handle %d)", id,
1140 handle_to_name(handle), handle);
1141 dirp = handle_to_dir(handle);
1142 path = handle_to_name(handle);
1143 if (dirp == NULL || path == NULL) {
1144 send_status(id, SSH2_FX_FAILURE);
1147 char pathname[PATH_MAX];
1149 int nstats = 10, count = 0, i;
1151 stats = xcalloc(nstats, sizeof(Stat));
1152 while ((dp = readdir(dirp)) != NULL) {
1153 if (count >= nstats) {
1155 stats = xreallocarray(stats, nstats, sizeof(Stat));
1157 /* XXX OVERFLOW ? */
1158 snprintf(pathname, sizeof pathname, "%s%s%s", path,
1159 strcmp(path, "/") ? "/" : "", dp->d_name);
1160 if (lstat(pathname, &st) == -1)
1162 stat_to_attrib(&st, &(stats[count].attrib));
1163 stats[count].name = xstrdup(dp->d_name);
1164 stats[count].long_name = ls_file(dp->d_name, &st,
1167 /* send up to 100 entries in one message */
1168 /* XXX check packet size instead */
1173 send_names(id, count, stats);
1174 for (i = 0; i < count; i++) {
1175 free(stats[i].name);
1176 free(stats[i].long_name);
1179 send_status(id, SSH2_FX_EOF);
1186 process_remove(u_int32_t id)
1189 int r, status = SSH2_FX_FAILURE;
1191 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
1192 fatal_fr(r, "parse");
1194 debug3("request %u: remove", id);
1195 logit("remove name \"%s\"", name);
1197 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1198 send_status(id, status);
1203 process_mkdir(u_int32_t id)
1207 int r, mode, status = SSH2_FX_FAILURE;
1209 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
1210 (r = decode_attrib(iqueue, &a)) != 0)
1211 fatal_fr(r, "parse");
1213 mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
1214 a.perm & 07777 : 0777;
1215 debug3("request %u: mkdir", id);
1216 logit("mkdir name \"%s\" mode 0%o", name, mode);
1217 r = mkdir(name, mode);
1218 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1219 send_status(id, status);
1224 process_rmdir(u_int32_t id)
1229 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
1230 fatal_fr(r, "parse");
1232 debug3("request %u: rmdir", id);
1233 logit("rmdir name \"%s\"", name);
1235 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1236 send_status(id, status);
1241 process_realpath(u_int32_t id)
1243 char resolvedname[PATH_MAX];
1247 if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
1248 fatal_fr(r, "parse");
1250 if (path[0] == '\0') {
1252 path = xstrdup(".");
1254 debug3("request %u: realpath", id);
1255 verbose("realpath \"%s\"", path);
1256 if (sftp_realpath(path, resolvedname) == NULL) {
1257 send_status(id, errno_to_portable(errno));
1260 attrib_clear(&s.attrib);
1261 s.name = s.long_name = resolvedname;
1262 send_names(id, 1, &s);
1268 process_rename(u_int32_t id)
1270 char *oldpath, *newpath;
1274 if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 ||
1275 (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
1276 fatal_fr(r, "parse");
1278 debug3("request %u: rename", id);
1279 logit("rename old \"%s\" new \"%s\"", oldpath, newpath);
1280 status = SSH2_FX_FAILURE;
1281 if (lstat(oldpath, &sb) == -1)
1282 status = errno_to_portable(errno);
1283 else if (S_ISREG(sb.st_mode)) {
1284 /* Race-free rename of regular files */
1285 if (link(oldpath, newpath) == -1) {
1286 if (errno == EOPNOTSUPP || errno == ENOSYS
1290 #ifdef LINK_OPNOTSUPP_ERRNO
1291 || errno == LINK_OPNOTSUPP_ERRNO
1297 * fs doesn't support links, so fall back to
1298 * stat+rename. This is racy.
1300 if (stat(newpath, &st) == -1) {
1301 if (rename(oldpath, newpath) == -1)
1303 errno_to_portable(errno);
1305 status = SSH2_FX_OK;
1308 status = errno_to_portable(errno);
1310 } else if (unlink(oldpath) == -1) {
1311 status = errno_to_portable(errno);
1312 /* clean spare link */
1315 status = SSH2_FX_OK;
1316 } else if (stat(newpath, &sb) == -1) {
1317 if (rename(oldpath, newpath) == -1)
1318 status = errno_to_portable(errno);
1320 status = SSH2_FX_OK;
1322 send_status(id, status);
1328 process_readlink(u_int32_t id)
1334 if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
1335 fatal_fr(r, "parse");
1337 debug3("request %u: readlink", id);
1338 verbose("readlink \"%s\"", path);
1339 if ((len = readlink(path, buf, sizeof(buf) - 1)) == -1)
1340 send_status(id, errno_to_portable(errno));
1345 attrib_clear(&s.attrib);
1346 s.name = s.long_name = buf;
1347 send_names(id, 1, &s);
1353 process_symlink(u_int32_t id)
1355 char *oldpath, *newpath;
1358 if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 ||
1359 (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
1360 fatal_fr(r, "parse");
1362 debug3("request %u: symlink", id);
1363 logit("symlink old \"%s\" new \"%s\"", oldpath, newpath);
1364 /* this will fail if 'newpath' exists */
1365 r = symlink(oldpath, newpath);
1366 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1367 send_status(id, status);
1373 process_extended_posix_rename(u_int32_t id)
1375 char *oldpath, *newpath;
1378 if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 ||
1379 (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
1380 fatal_fr(r, "parse");
1382 debug3("request %u: posix-rename", id);
1383 logit("posix-rename old \"%s\" new \"%s\"", oldpath, newpath);
1384 r = rename(oldpath, newpath);
1385 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1386 send_status(id, status);
1392 process_extended_statvfs(u_int32_t id)
1398 if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
1399 fatal_fr(r, "parse");
1400 debug3("request %u: statvfs", id);
1401 logit("statvfs \"%s\"", path);
1403 if (statvfs(path, &st) != 0)
1404 send_status(id, errno_to_portable(errno));
1406 send_statvfs(id, &st);
1411 process_extended_fstatvfs(u_int32_t id)
1416 if ((r = get_handle(iqueue, &handle)) != 0)
1417 fatal_fr(r, "parse");
1418 debug("request %u: fstatvfs \"%s\" (handle %u)",
1419 id, handle_to_name(handle), handle);
1420 if ((fd = handle_to_fd(handle)) < 0) {
1421 send_status(id, SSH2_FX_FAILURE);
1424 if (fstatvfs(fd, &st) != 0)
1425 send_status(id, errno_to_portable(errno));
1427 send_statvfs(id, &st);
1431 process_extended_hardlink(u_int32_t id)
1433 char *oldpath, *newpath;
1436 if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 ||
1437 (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
1438 fatal_fr(r, "parse");
1440 debug3("request %u: hardlink", id);
1441 logit("hardlink old \"%s\" new \"%s\"", oldpath, newpath);
1442 r = link(oldpath, newpath);
1443 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1444 send_status(id, status);
1450 process_extended_fsync(u_int32_t id)
1452 int handle, fd, r, status = SSH2_FX_OP_UNSUPPORTED;
1454 if ((r = get_handle(iqueue, &handle)) != 0)
1455 fatal_fr(r, "parse");
1456 debug3("request %u: fsync (handle %u)", id, handle);
1457 verbose("fsync \"%s\"", handle_to_name(handle));
1458 if ((fd = handle_to_fd(handle)) < 0)
1459 status = SSH2_FX_NO_SUCH_FILE;
1460 else if (handle_is_ok(handle, HANDLE_FILE)) {
1462 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1464 send_status(id, status);
1468 process_extended_lsetstat(u_int32_t id)
1472 int r, status = SSH2_FX_OK;
1474 if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
1475 (r = decode_attrib(iqueue, &a)) != 0)
1476 fatal_fr(r, "parse");
1478 debug("request %u: lsetstat name \"%s\"", id, name);
1479 if (a.flags & SSH2_FILEXFER_ATTR_SIZE) {
1480 /* nonsensical for links */
1481 status = SSH2_FX_BAD_MESSAGE;
1484 if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
1485 logit("set \"%s\" mode %04o", name, a.perm);
1486 r = fchmodat(AT_FDCWD, name,
1487 a.perm & 07777, AT_SYMLINK_NOFOLLOW);
1489 status = errno_to_portable(errno);
1491 if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
1495 strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S",
1497 logit("set \"%s\" modtime %s", name, buf);
1498 r = utimensat(AT_FDCWD, name,
1499 attrib_to_ts(&a), AT_SYMLINK_NOFOLLOW);
1501 status = errno_to_portable(errno);
1503 if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) {
1504 logit("set \"%s\" owner %lu group %lu", name,
1505 (u_long)a.uid, (u_long)a.gid);
1506 r = fchownat(AT_FDCWD, name, a.uid, a.gid,
1507 AT_SYMLINK_NOFOLLOW);
1509 status = errno_to_portable(errno);
1512 send_status(id, status);
1517 process_extended_limits(u_int32_t id)
1521 uint64_t nfiles = 0;
1522 #if defined(HAVE_GETRLIMIT) && defined(RLIMIT_NOFILE)
1526 debug("request %u: limits", id);
1528 #if defined(HAVE_GETRLIMIT) && defined(RLIMIT_NOFILE)
1529 if (getrlimit(RLIMIT_NOFILE, &rlim) != -1 && rlim.rlim_cur > 5)
1530 nfiles = rlim.rlim_cur - 5; /* stdio(3) + syslog + spare */
1533 if ((msg = sshbuf_new()) == NULL)
1534 fatal_f("sshbuf_new failed");
1535 if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED_REPLY)) != 0 ||
1536 (r = sshbuf_put_u32(msg, id)) != 0 ||
1537 /* max-packet-length */
1538 (r = sshbuf_put_u64(msg, SFTP_MAX_MSG_LENGTH)) != 0 ||
1539 /* max-read-length */
1540 (r = sshbuf_put_u64(msg, SFTP_MAX_READ_LENGTH)) != 0 ||
1541 /* max-write-length */
1542 (r = sshbuf_put_u64(msg, SFTP_MAX_MSG_LENGTH - 1024)) != 0 ||
1543 /* max-open-handles */
1544 (r = sshbuf_put_u64(msg, nfiles)) != 0)
1545 fatal_fr(r, "compose");
1551 process_extended_expand(u_int32_t id)
1553 char cwd[PATH_MAX], resolvedname[PATH_MAX];
1558 if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
1559 fatal_fr(r, "parse");
1560 if (getcwd(cwd, sizeof(cwd)) == NULL) {
1561 send_status(id, errno_to_portable(errno));
1565 debug3("request %u: expand, original \"%s\"", id, path);
1566 if (path[0] == '\0') {
1569 path = xstrdup(".");
1570 } else if (*path == '~') {
1572 /* Special-case for "~" and "~/" to respect homedir flag */
1573 if (strcmp(path, "~") == 0) {
1575 path = xstrdup(cwd);
1576 } else if (strncmp(path, "~/", 2) == 0) {
1577 npath = xstrdup(path + 2);
1579 xasprintf(&path, "%s/%s", cwd, npath);
1582 /* ~user expansions */
1583 if (tilde_expand(path, pw->pw_uid, &npath) != 0) {
1584 send_status_errmsg(id,
1585 errno_to_portable(ENOENT), "no such user");
1591 } else if (*path != '/') {
1593 xasprintf(&npath, "%s/%s", cwd, path);
1597 verbose("expand \"%s\"", path);
1598 if (sftp_realpath(path, resolvedname) == NULL) {
1599 send_status(id, errno_to_portable(errno));
1602 attrib_clear(&s.attrib);
1603 s.name = s.long_name = resolvedname;
1604 send_names(id, 1, &s);
1610 process_extended_copy_data(u_int32_t id)
1612 u_char buf[64*1024];
1613 int read_handle, read_fd, write_handle, write_fd;
1614 u_int64_t len, read_off, read_len, write_off;
1615 int r, copy_until_eof, status = SSH2_FX_OP_UNSUPPORTED;
1618 if ((r = get_handle(iqueue, &read_handle)) != 0 ||
1619 (r = sshbuf_get_u64(iqueue, &read_off)) != 0 ||
1620 (r = sshbuf_get_u64(iqueue, &read_len)) != 0 ||
1621 (r = get_handle(iqueue, &write_handle)) != 0 ||
1622 (r = sshbuf_get_u64(iqueue, &write_off)) != 0)
1623 fatal("%s: buffer error: %s", __func__, ssh_err(r));
1625 debug("request %u: copy-data from \"%s\" (handle %d) off %llu len %llu "
1626 "to \"%s\" (handle %d) off %llu",
1627 id, handle_to_name(read_handle), read_handle,
1628 (unsigned long long)read_off, (unsigned long long)read_len,
1629 handle_to_name(write_handle), write_handle,
1630 (unsigned long long)write_off);
1632 /* For read length of 0, we read until EOF. */
1633 if (read_len == 0) {
1634 read_len = (u_int64_t)-1 - read_off;
1639 read_fd = handle_to_fd(read_handle);
1640 write_fd = handle_to_fd(write_handle);
1642 /* Disallow reading & writing to the same handle or same path or dirs */
1643 if (read_handle == write_handle || read_fd < 0 || write_fd < 0 ||
1644 !strcmp(handle_to_name(read_handle), handle_to_name(write_handle))) {
1645 status = SSH2_FX_FAILURE;
1649 if (lseek(read_fd, read_off, SEEK_SET) < 0) {
1650 status = errno_to_portable(errno);
1651 error("%s: read_seek failed", __func__);
1655 if ((handle_to_flags(write_handle) & O_APPEND) == 0 &&
1656 lseek(write_fd, write_off, SEEK_SET) < 0) {
1657 status = errno_to_portable(errno);
1658 error("%s: write_seek failed", __func__);
1662 /* Process the request in chunks. */
1663 while (read_len > 0 || copy_until_eof) {
1664 len = MINIMUM(sizeof(buf), read_len);
1667 ret = atomicio(read, read_fd, buf, len);
1668 if (ret == 0 && errno == EPIPE) {
1669 status = copy_until_eof ? SSH2_FX_OK : SSH2_FX_EOF;
1671 } else if (ret == 0) {
1672 status = errno_to_portable(errno);
1673 error("%s: read failed: %s", __func__, strerror(errno));
1677 handle_update_read(read_handle, len);
1679 ret = atomicio(vwrite, write_fd, buf, len);
1681 status = errno_to_portable(errno);
1682 error("%s: write failed: %llu != %llu: %s", __func__,
1683 (unsigned long long)ret, (unsigned long long)len,
1687 handle_update_write(write_handle, len);
1691 status = SSH2_FX_OK;
1694 send_status(id, status);
1698 process_extended_home_directory(u_int32_t id)
1701 struct passwd *user_pw;
1705 if ((r = sshbuf_get_cstring(iqueue, &username, NULL)) != 0)
1706 fatal_fr(r, "parse");
1708 debug3("request %u: home-directory \"%s\"", id, username);
1709 if ((user_pw = getpwnam(username)) == NULL) {
1710 send_status(id, SSH2_FX_FAILURE);
1714 verbose("home-directory \"%s\"", pw->pw_dir);
1715 attrib_clear(&s.attrib);
1716 s.name = s.long_name = pw->pw_dir;
1717 send_names(id, 1, &s);
1723 process_extended_get_users_groups_by_id(u_int32_t id)
1725 struct passwd *user_pw;
1727 struct sshbuf *uids, *gids, *usernames, *groupnames, *msg;
1729 u_int n, nusers = 0, ngroups = 0;
1732 if ((usernames = sshbuf_new()) == NULL ||
1733 (groupnames = sshbuf_new()) == NULL ||
1734 (msg = sshbuf_new()) == NULL)
1735 fatal_f("sshbuf_new failed");
1736 if ((r = sshbuf_froms(iqueue, &uids)) != 0 ||
1737 (r = sshbuf_froms(iqueue, &gids)) != 0)
1738 fatal_fr(r, "parse");
1739 debug_f("uids len = %zu, gids len = %zu",
1740 sshbuf_len(uids), sshbuf_len(gids));
1741 while (sshbuf_len(uids) != 0) {
1742 if ((r = sshbuf_get_u32(uids, &n)) != 0)
1743 fatal_fr(r, "parse inner uid");
1744 user_pw = getpwuid((uid_t)n);
1745 name = user_pw == NULL ? "" : user_pw->pw_name;
1746 debug3_f("uid %u => \"%s\"", n, name);
1747 if ((r = sshbuf_put_cstring(usernames, name)) != 0)
1748 fatal_fr(r, "assemble uid reply");
1751 while (sshbuf_len(gids) != 0) {
1752 if ((r = sshbuf_get_u32(gids, &n)) != 0)
1753 fatal_fr(r, "parse inner gid");
1754 gr = getgrgid((gid_t)n);
1755 name = gr == NULL ? "" : gr->gr_name;
1756 debug3_f("gid %u => \"%s\"", n, name);
1757 if ((r = sshbuf_put_cstring(groupnames, name)) != 0)
1758 fatal_fr(r, "assemble gid reply");
1761 verbose("users-groups-by-id: %u users, %u groups", nusers, ngroups);
1763 if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED_REPLY)) != 0 ||
1764 (r = sshbuf_put_u32(msg, id)) != 0 ||
1765 (r = sshbuf_put_stringb(msg, usernames)) != 0 ||
1766 (r = sshbuf_put_stringb(msg, groupnames)) != 0)
1767 fatal_fr(r, "compose");
1772 sshbuf_free(usernames);
1773 sshbuf_free(groupnames);
1778 process_extended(u_int32_t id)
1782 const struct sftp_handler *exthand;
1784 if ((r = sshbuf_get_cstring(iqueue, &request, NULL)) != 0)
1785 fatal_fr(r, "parse");
1786 if ((exthand = extended_handler_byname(request)) == NULL) {
1787 error("Unknown extended request \"%.100s\"", request);
1788 send_status(id, SSH2_FX_OP_UNSUPPORTED); /* MUST */
1790 if (!request_permitted(exthand))
1791 send_status(id, SSH2_FX_PERMISSION_DENIED);
1793 exthand->handler(id);
1798 /* stolen from ssh-agent */
1811 buf_len = sshbuf_len(iqueue);
1813 return; /* Incomplete message. */
1814 cp = sshbuf_ptr(iqueue);
1815 msg_len = get_u32(cp);
1816 if (msg_len > SFTP_MAX_MSG_LENGTH) {
1817 error("bad message from %s local user %s",
1818 client_addr, pw->pw_name);
1819 sftp_server_cleanup_exit(11);
1821 if (buf_len < msg_len + 4)
1823 if ((r = sshbuf_consume(iqueue, 4)) != 0)
1824 fatal_fr(r, "consume");
1826 if ((r = sshbuf_get_u8(iqueue, &type)) != 0)
1827 fatal_fr(r, "parse type");
1834 case SSH2_FXP_EXTENDED:
1836 fatal("Received extended request before init");
1837 if ((r = sshbuf_get_u32(iqueue, &id)) != 0)
1838 fatal_fr(r, "parse extended ID");
1839 process_extended(id);
1843 fatal("Received %u request before init", type);
1844 if ((r = sshbuf_get_u32(iqueue, &id)) != 0)
1845 fatal_fr(r, "parse ID");
1846 for (i = 0; handlers[i].handler != NULL; i++) {
1847 if (type == handlers[i].type) {
1848 if (!request_permitted(&handlers[i])) {
1850 SSH2_FX_PERMISSION_DENIED);
1852 handlers[i].handler(id);
1857 if (handlers[i].handler == NULL)
1858 error("Unknown message %u", type);
1860 /* discard the remaining bytes from the current packet */
1861 if (buf_len < sshbuf_len(iqueue)) {
1862 error("iqueue grew unexpectedly");
1863 sftp_server_cleanup_exit(255);
1865 consumed = buf_len - sshbuf_len(iqueue);
1866 if (msg_len < consumed) {
1867 error("msg_len %u < consumed %u", msg_len, consumed);
1868 sftp_server_cleanup_exit(255);
1870 if (msg_len > consumed &&
1871 (r = sshbuf_consume(iqueue, msg_len - consumed)) != 0)
1872 fatal_fr(r, "consume");
1875 /* Cleanup handler that logs active handles upon normal exit */
1877 sftp_server_cleanup_exit(int i)
1879 if (pw != NULL && client_addr != NULL) {
1881 logit("session closed for local user %s from [%s]",
1882 pw->pw_name, client_addr);
1888 sftp_server_usage(void)
1890 extern char *__progname;
1893 "usage: %s [-ehR] [-d start_directory] [-f log_facility] "
1894 "[-l log_level]\n\t[-P denied_requests] "
1895 "[-p allowed_requests] [-u umask]\n"
1896 " %s -Q protocol_feature\n",
1897 __progname, __progname);
1902 sftp_server_main(int argc, char **argv, struct passwd *user_pw)
1904 int i, r, in, out, ch, skipargs = 0, log_stderr = 0;
1906 SyslogFacility log_facility = SYSLOG_FACILITY_AUTH;
1907 char *cp, *homedir = NULL, uidstr[32], buf[4*4096];
1910 extern char *optarg;
1911 extern char *__progname;
1913 __progname = ssh_get_progname(argv[0]);
1914 log_init(__progname, log_level, log_facility, log_stderr);
1916 pw = pwcopy(user_pw);
1918 while (!skipargs && (ch = getopt(argc, argv,
1919 "d:f:l:P:p:Q:u:cehR")) != -1) {
1922 if (strcasecmp(optarg, "requests") != 0) {
1923 fprintf(stderr, "Invalid query type\n");
1926 for (i = 0; handlers[i].handler != NULL; i++)
1927 printf("%s\n", handlers[i].name);
1928 for (i = 0; extended_handlers[i].handler != NULL; i++)
1929 printf("%s\n", extended_handlers[i].name);
1937 * Ignore all arguments if we are invoked as a
1938 * shell using "sftp-server -c command"
1946 log_level = log_level_number(optarg);
1947 if (log_level == SYSLOG_LEVEL_NOT_SET)
1948 error("Invalid log level \"%s\"", optarg);
1951 log_facility = log_facility_number(optarg);
1952 if (log_facility == SYSLOG_FACILITY_NOT_SET)
1953 error("Invalid log facility \"%s\"", optarg);
1956 cp = tilde_expand_filename(optarg, user_pw->pw_uid);
1957 snprintf(uidstr, sizeof(uidstr), "%llu",
1958 (unsigned long long)pw->pw_uid);
1959 homedir = percent_expand(cp, "d", user_pw->pw_dir,
1960 "u", user_pw->pw_name, "U", uidstr, (char *)NULL);
1964 if (request_allowlist != NULL)
1965 fatal("Permitted requests already set");
1966 request_allowlist = xstrdup(optarg);
1969 if (request_denylist != NULL)
1970 fatal("Refused requests already set");
1971 request_denylist = xstrdup(optarg);
1975 mask = strtol(optarg, &cp, 8);
1976 if (mask < 0 || mask > 0777 || *cp != '\0' ||
1977 cp == optarg || (mask == 0 && errno != 0))
1978 fatal("Invalid umask \"%s\"", optarg);
1979 (void)umask((mode_t)mask);
1983 sftp_server_usage();
1987 log_init(__progname, log_level, log_facility, log_stderr);
1990 * On platforms where we can, avoid making /proc/self/{mem,maps}
1991 * available to the user so that sftp access doesn't automatically
1992 * imply arbitrary code execution access that will break
1993 * restricted configurations.
1995 platform_disable_tracing(1); /* strict */
1997 /* Drop any fine-grained privileges we don't need */
1998 platform_pledge_sftp_server();
2000 if ((cp = getenv("SSH_CONNECTION")) != NULL) {
2001 client_addr = xstrdup(cp);
2002 if ((cp = strchr(client_addr, ' ')) == NULL) {
2003 error("Malformed SSH_CONNECTION variable: \"%s\"",
2004 getenv("SSH_CONNECTION"));
2005 sftp_server_cleanup_exit(255);
2009 client_addr = xstrdup("UNKNOWN");
2011 logit("session opened for local user %s from [%s]",
2012 pw->pw_name, client_addr);
2015 out = STDOUT_FILENO;
2018 setmode(in, O_BINARY);
2019 setmode(out, O_BINARY);
2022 if ((iqueue = sshbuf_new()) == NULL)
2023 fatal_f("sshbuf_new failed");
2024 if ((oqueue = sshbuf_new()) == NULL)
2025 fatal_f("sshbuf_new failed");
2027 if (homedir != NULL) {
2028 if (chdir(homedir) != 0) {
2029 error("chdir to \"%s\" failed: %s", homedir,
2035 struct pollfd pfd[2];
2037 memset(pfd, 0, sizeof pfd);
2038 pfd[0].fd = pfd[1].fd = -1;
2041 * Ensure that we can read a full buffer and handle
2042 * the worst-case length packet it can generate,
2043 * otherwise apply backpressure by stopping reads.
2045 if ((r = sshbuf_check_reserve(iqueue, sizeof(buf))) == 0 &&
2046 (r = sshbuf_check_reserve(oqueue,
2047 SFTP_MAX_MSG_LENGTH)) == 0) {
2049 pfd[0].events = POLLIN;
2051 else if (r != SSH_ERR_NO_BUFFER_SPACE)
2052 fatal_fr(r, "reserve");
2054 olen = sshbuf_len(oqueue);
2057 pfd[1].events = POLLOUT;
2060 if (poll(pfd, 2, -1) == -1) {
2063 error("poll: %s", strerror(errno));
2064 sftp_server_cleanup_exit(2);
2067 /* copy stdin to iqueue */
2068 if (pfd[0].revents & (POLLIN|POLLHUP)) {
2069 len = read(in, buf, sizeof buf);
2072 sftp_server_cleanup_exit(0);
2073 } else if (len == -1) {
2074 if (errno != EAGAIN && errno != EINTR) {
2075 error("read: %s", strerror(errno));
2076 sftp_server_cleanup_exit(1);
2078 } else if ((r = sshbuf_put(iqueue, buf, len)) != 0)
2079 fatal_fr(r, "sshbuf_put");
2081 /* send oqueue to stdout */
2082 if (pfd[1].revents & (POLLOUT|POLLHUP)) {
2083 len = write(out, sshbuf_ptr(oqueue), olen);
2084 if (len == 0 || (len == -1 && errno == EPIPE)) {
2086 sftp_server_cleanup_exit(0);
2087 } else if (len == -1) {
2088 sftp_server_cleanup_exit(1);
2089 if (errno != EAGAIN && errno != EINTR) {
2090 error("write: %s", strerror(errno));
2091 sftp_server_cleanup_exit(1);
2093 } else if ((r = sshbuf_consume(oqueue, len)) != 0)
2094 fatal_fr(r, "consume");
2098 * Process requests from client if we can fit the results
2099 * into the output buffer, otherwise stop processing input
2100 * and let the output queue drain.
2102 r = sshbuf_check_reserve(oqueue, SFTP_MAX_MSG_LENGTH);
2105 else if (r != SSH_ERR_NO_BUFFER_SPACE)
2106 fatal_fr(r, "reserve");