crypto/openssh/sftp-server.c

   1 /* $OpenBSD: sftp-server.c,v 1.140 2022/03/31 03:05:49 djm Exp $ */
   2 /*
   3  * Copyright (c) 2000-2004 Markus Friedl.  All rights reserved.
   4  *
   5  * Permission to use, copy, modify, and distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 #include "includes.h"
  19
  20 #include <sys/types.h>
  21 #include <sys/stat.h>
  22 #include <sys/resource.h>
  23 #ifdef HAVE_SYS_TIME_H
  24 # include <sys/time.h>
  25 #endif
  26 #ifdef HAVE_SYS_MOUNT_H
  27 #include <sys/mount.h>
  28 #endif
  29 #ifdef HAVE_SYS_STATVFS_H
  30 #include <sys/statvfs.h>
  31 #endif
  32
  33 #include <dirent.h>
  34 #include <errno.h>
  35 #include <fcntl.h>
  36 #ifdef HAVE_POLL_H
  37 #include <poll.h>
  38 #endif
  39 #include <pwd.h>
  40 #include <stdlib.h>
  41 #include <stdio.h>
  42 #include <string.h>
  43 #include <time.h>
  44 #include <unistd.h>
  45 #include <stdarg.h>
  46
  47 #include "atomicio.h"
  48 #include "xmalloc.h"
  49 #include "sshbuf.h"
  50 #include "ssherr.h"
  51 #include "log.h"
  52 #include "misc.h"
  53 #include "match.h"
  54 #include "uidswap.h"
  55
  56 #include "sftp.h"
  57 #include "sftp-common.h"
  58
  59 char *sftp_realpath(const char *, char *); /* sftp-realpath.c */
  60
  61 /* Maximum data read that we are willing to accept */
  62 #define SFTP_MAX_READ_LENGTH (SFTP_MAX_MSG_LENGTH - 1024)
  63
  64 /* Our verbosity */
  65 static LogLevel log_level = SYSLOG_LEVEL_ERROR;
  66
  67 /* Our client */
  68 static struct passwd *pw = NULL;
  69 static char *client_addr = NULL;
  70
  71 /* input and output queue */
  72 struct sshbuf *iqueue;
  73 struct sshbuf *oqueue;
  74
  75 /* Version of client */
  76 static u_int version;
  77
  78 /* SSH2_FXP_INIT received */
  79 static int init_done;
  80
  81 /* Disable writes */
  82 static int readonly;
  83
  84 /* Requests that are allowed/denied */
  85 static char *request_allowlist, *request_denylist;
  86
  87 /* portable attributes, etc. */
  88 typedef struct Stat Stat;
  89
  90 struct Stat {
  91         char *name;
  92         char *long_name;
  93         Attrib attrib;
  94 };
  95
  96 /* Packet handlers */
  97 static void process_open(u_int32_t id);
  98 static void process_close(u_int32_t id);
  99 static void process_read(u_int32_t id);
 100 static void process_write(u_int32_t id);
 101 static void process_stat(u_int32_t id);
 102 static void process_lstat(u_int32_t id);
 103 static void process_fstat(u_int32_t id);
 104 static void process_setstat(u_int32_t id);
 105 static void process_fsetstat(u_int32_t id);
 106 static void process_opendir(u_int32_t id);
 107 static void process_readdir(u_int32_t id);
 108 static void process_remove(u_int32_t id);
 109 static void process_mkdir(u_int32_t id);
 110 static void process_rmdir(u_int32_t id);
 111 static void process_realpath(u_int32_t id);
 112 static void process_rename(u_int32_t id);
 113 static void process_readlink(u_int32_t id);
 114 static void process_symlink(u_int32_t id);
 115 static void process_extended_posix_rename(u_int32_t id);
 116 static void process_extended_statvfs(u_int32_t id);
 117 static void process_extended_fstatvfs(u_int32_t id);
 118 static void process_extended_hardlink(u_int32_t id);
 119 static void process_extended_fsync(u_int32_t id);
 120 static void process_extended_lsetstat(u_int32_t id);
 121 static void process_extended_limits(u_int32_t id);
 122 static void process_extended_expand(u_int32_t id);
 123 static void process_extended_copy_data(u_int32_t id);
 124 static void process_extended(u_int32_t id);
 125
 126 struct sftp_handler {
 127         const char *name;       /* user-visible name for fine-grained perms */
 128         const char *ext_name;   /* extended request name */
 129         u_int type;             /* packet type, for non extended packets */
 130         void (*handler)(u_int32_t);
 131         int does_write;         /* if nonzero, banned for readonly mode */
 132 };
 133
 134 static const struct sftp_handler handlers[] = {
 135         /* NB. SSH2_FXP_OPEN does the readonly check in the handler itself */
 136         { "open", NULL, SSH2_FXP_OPEN, process_open, 0 },
 137         { "close", NULL, SSH2_FXP_CLOSE, process_close, 0 },
 138         { "read", NULL, SSH2_FXP_READ, process_read, 0 },
 139         { "write", NULL, SSH2_FXP_WRITE, process_write, 1 },
 140         { "lstat", NULL, SSH2_FXP_LSTAT, process_lstat, 0 },
 141         { "fstat", NULL, SSH2_FXP_FSTAT, process_fstat, 0 },
 142         { "setstat", NULL, SSH2_FXP_SETSTAT, process_setstat, 1 },
 143         { "fsetstat", NULL, SSH2_FXP_FSETSTAT, process_fsetstat, 1 },
 144         { "opendir", NULL, SSH2_FXP_OPENDIR, process_opendir, 0 },
 145         { "readdir", NULL, SSH2_FXP_READDIR, process_readdir, 0 },
 146         { "remove", NULL, SSH2_FXP_REMOVE, process_remove, 1 },
 147         { "mkdir", NULL, SSH2_FXP_MKDIR, process_mkdir, 1 },
 148         { "rmdir", NULL, SSH2_FXP_RMDIR, process_rmdir, 1 },
 149         { "realpath", NULL, SSH2_FXP_REALPATH, process_realpath, 0 },
 150         { "stat", NULL, SSH2_FXP_STAT, process_stat, 0 },
 151         { "rename", NULL, SSH2_FXP_RENAME, process_rename, 1 },
 152         { "readlink", NULL, SSH2_FXP_READLINK, process_readlink, 0 },
 153         { "symlink", NULL, SSH2_FXP_SYMLINK, process_symlink, 1 },
 154         { NULL, NULL, 0, NULL, 0 }
 155 };
 156
 157 /* SSH2_FXP_EXTENDED submessages */
 158 static const struct sftp_handler extended_handlers[] = {
 159         { "posix-rename", "posix-rename@openssh.com", 0,
 160             process_extended_posix_rename, 1 },
 161         { "statvfs", "statvfs@openssh.com", 0, process_extended_statvfs, 0 },
 162         { "fstatvfs", "fstatvfs@openssh.com", 0, process_extended_fstatvfs, 0 },
 163         { "hardlink", "hardlink@openssh.com", 0, process_extended_hardlink, 1 },
 164         { "fsync", "fsync@openssh.com", 0, process_extended_fsync, 1 },
 165         { "lsetstat", "lsetstat@openssh.com", 0, process_extended_lsetstat, 1 },
 166         { "limits", "limits@openssh.com", 0, process_extended_limits, 0 },
 167         { "expand-path", "expand-path@openssh.com", 0,
 168             process_extended_expand, 0 },
 169         { "copy-data", "copy-data", 0, process_extended_copy_data, 1 },
 170         { NULL, NULL, 0, NULL, 0 }
 171 };
 172
 173 static const struct sftp_handler *
 174 extended_handler_byname(const char *name)
 175 {
 176         int i;
 177
 178         for (i = 0; extended_handlers[i].handler != NULL; i++) {
 179                 if (strcmp(name, extended_handlers[i].ext_name) == 0)
 180                         return &extended_handlers[i];
 181         }
 182         return NULL;
 183 }
 184
 185 static int
 186 request_permitted(const struct sftp_handler *h)
 187 {
 188         char *result;
 189
 190         if (readonly && h->does_write) {
 191                 verbose("Refusing %s request in read-only mode", h->name);
 192                 return 0;
 193         }
 194         if (request_denylist != NULL &&
 195             ((result = match_list(h->name, request_denylist, NULL))) != NULL) {
 196                 free(result);
 197                 verbose("Refusing denylisted %s request", h->name);
 198                 return 0;
 199         }
 200         if (request_allowlist != NULL &&
 201             ((result = match_list(h->name, request_allowlist, NULL))) != NULL) {
 202                 free(result);
 203                 debug2("Permitting allowlisted %s request", h->name);
 204                 return 1;
 205         }
 206         if (request_allowlist != NULL) {
 207                 verbose("Refusing non-allowlisted %s request", h->name);
 208                 return 0;
 209         }
 210         return 1;
 211 }
 212
 213 static int
 214 errno_to_portable(int unixerrno)
 215 {
 216         int ret = 0;
 217
 218         switch (unixerrno) {
 219         case 0:
 220                 ret = SSH2_FX_OK;
 221                 break;
 222         case ENOENT:
 223         case ENOTDIR:
 224         case EBADF:
 225         case ELOOP:
 226                 ret = SSH2_FX_NO_SUCH_FILE;
 227                 break;
 228         case EPERM:
 229         case EACCES:
 230         case EFAULT:
 231                 ret = SSH2_FX_PERMISSION_DENIED;
 232                 break;
 233         case ENAMETOOLONG:
 234         case EINVAL:
 235                 ret = SSH2_FX_BAD_MESSAGE;
 236                 break;
 237         case ENOSYS:
 238                 ret = SSH2_FX_OP_UNSUPPORTED;
 239                 break;
 240         default:
 241                 ret = SSH2_FX_FAILURE;
 242                 break;
 243         }
 244         return ret;
 245 }
 246
 247 static int
 248 flags_from_portable(int pflags)
 249 {
 250         int flags = 0;
 251
 252         if ((pflags & SSH2_FXF_READ) &&
 253             (pflags & SSH2_FXF_WRITE)) {
 254                 flags = O_RDWR;
 255         } else if (pflags & SSH2_FXF_READ) {
 256                 flags = O_RDONLY;
 257         } else if (pflags & SSH2_FXF_WRITE) {
 258                 flags = O_WRONLY;
 259         }
 260         if (pflags & SSH2_FXF_APPEND)
 261                 flags |= O_APPEND;
 262         if (pflags & SSH2_FXF_CREAT)
 263                 flags |= O_CREAT;
 264         if (pflags & SSH2_FXF_TRUNC)
 265                 flags |= O_TRUNC;
 266         if (pflags & SSH2_FXF_EXCL)
 267                 flags |= O_EXCL;
 268         return flags;
 269 }
 270
 271 static const char *
 272 string_from_portable(int pflags)
 273 {
 274         static char ret[128];
 275
 276         *ret = '\0';
 277
 278 #define PAPPEND(str)    {                               \
 279                 if (*ret != '\0')                       \
 280                         strlcat(ret, ",", sizeof(ret)); \
 281                 strlcat(ret, str, sizeof(ret));         \
 282         }
 283
 284         if (pflags & SSH2_FXF_READ)
 285                 PAPPEND("READ")
 286         if (pflags & SSH2_FXF_WRITE)
 287                 PAPPEND("WRITE")
 288         if (pflags & SSH2_FXF_APPEND)
 289                 PAPPEND("APPEND")
 290         if (pflags & SSH2_FXF_CREAT)
 291                 PAPPEND("CREATE")
 292         if (pflags & SSH2_FXF_TRUNC)
 293                 PAPPEND("TRUNCATE")
 294         if (pflags & SSH2_FXF_EXCL)
 295                 PAPPEND("EXCL")
 296
 297         return ret;
 298 }
 299
 300 /* handle handles */
 301
 302 typedef struct Handle Handle;
 303 struct Handle {
 304         int use;
 305         DIR *dirp;
 306         int fd;
 307         int flags;
 308         char *name;
 309         u_int64_t bytes_read, bytes_write;
 310         int next_unused;
 311 };
 312
 313 enum {
 314         HANDLE_UNUSED,
 315         HANDLE_DIR,
 316         HANDLE_FILE
 317 };
 318
 319 static Handle *handles = NULL;
 320 static u_int num_handles = 0;
 321 static int first_unused_handle = -1;
 322
 323 static void handle_unused(int i)
 324 {
 325         handles[i].use = HANDLE_UNUSED;
 326         handles[i].next_unused = first_unused_handle;
 327         first_unused_handle = i;
 328 }
 329
 330 static int
 331 handle_new(int use, const char *name, int fd, int flags, DIR *dirp)
 332 {
 333         int i;
 334
 335         if (first_unused_handle == -1) {
 336                 if (num_handles + 1 <= num_handles)
 337                         return -1;
 338                 num_handles++;
 339                 handles = xreallocarray(handles, num_handles, sizeof(Handle));
 340                 handle_unused(num_handles - 1);
 341         }
 342
 343         i = first_unused_handle;
 344         first_unused_handle = handles[i].next_unused;
 345
 346         handles[i].use = use;
 347         handles[i].dirp = dirp;
 348         handles[i].fd = fd;
 349         handles[i].flags = flags;
 350         handles[i].name = xstrdup(name);
 351         handles[i].bytes_read = handles[i].bytes_write = 0;
 352
 353         return i;
 354 }
 355
 356 static int
 357 handle_is_ok(int i, int type)
 358 {
 359         return i >= 0 && (u_int)i < num_handles && handles[i].use == type;
 360 }
 361
 362 static int
 363 handle_to_string(int handle, u_char **stringp, int *hlenp)
 364 {
 365         if (stringp == NULL || hlenp == NULL)
 366                 return -1;
 367         *stringp = xmalloc(sizeof(int32_t));
 368         put_u32(*stringp, handle);
 369         *hlenp = sizeof(int32_t);
 370         return 0;
 371 }
 372
 373 static int
 374 handle_from_string(const u_char *handle, u_int hlen)
 375 {
 376         int val;
 377
 378         if (hlen != sizeof(int32_t))
 379                 return -1;
 380         val = get_u32(handle);
 381         if (handle_is_ok(val, HANDLE_FILE) ||
 382             handle_is_ok(val, HANDLE_DIR))
 383                 return val;
 384         return -1;
 385 }
 386
 387 static char *
 388 handle_to_name(int handle)
 389 {
 390         if (handle_is_ok(handle, HANDLE_DIR)||
 391             handle_is_ok(handle, HANDLE_FILE))
 392                 return handles[handle].name;
 393         return NULL;
 394 }
 395
 396 static DIR *
 397 handle_to_dir(int handle)
 398 {
 399         if (handle_is_ok(handle, HANDLE_DIR))
 400                 return handles[handle].dirp;
 401         return NULL;
 402 }
 403
 404 static int
 405 handle_to_fd(int handle)
 406 {
 407         if (handle_is_ok(handle, HANDLE_FILE))
 408                 return handles[handle].fd;
 409         return -1;
 410 }
 411
 412 static int
 413 handle_to_flags(int handle)
 414 {
 415         if (handle_is_ok(handle, HANDLE_FILE))
 416                 return handles[handle].flags;
 417         return 0;
 418 }
 419
 420 static void
 421 handle_update_read(int handle, ssize_t bytes)
 422 {
 423         if (handle_is_ok(handle, HANDLE_FILE) && bytes > 0)
 424                 handles[handle].bytes_read += bytes;
 425 }
 426
 427 static void
 428 handle_update_write(int handle, ssize_t bytes)
 429 {
 430         if (handle_is_ok(handle, HANDLE_FILE) && bytes > 0)
 431                 handles[handle].bytes_write += bytes;
 432 }
 433
 434 static u_int64_t
 435 handle_bytes_read(int handle)
 436 {
 437         if (handle_is_ok(handle, HANDLE_FILE))
 438                 return (handles[handle].bytes_read);
 439         return 0;
 440 }
 441
 442 static u_int64_t
 443 handle_bytes_write(int handle)
 444 {
 445         if (handle_is_ok(handle, HANDLE_FILE))
 446                 return (handles[handle].bytes_write);
 447         return 0;
 448 }
 449
 450 static int
 451 handle_close(int handle)
 452 {
 453         int ret = -1;
 454
 455         if (handle_is_ok(handle, HANDLE_FILE)) {
 456                 ret = close(handles[handle].fd);
 457                 free(handles[handle].name);
 458                 handle_unused(handle);
 459         } else if (handle_is_ok(handle, HANDLE_DIR)) {
 460                 ret = closedir(handles[handle].dirp);
 461                 free(handles[handle].name);
 462                 handle_unused(handle);
 463         } else {
 464                 errno = ENOENT;
 465         }
 466         return ret;
 467 }
 468
 469 static void
 470 handle_log_close(int handle, char *emsg)
 471 {
 472         if (handle_is_ok(handle, HANDLE_FILE)) {
 473                 logit("%s%sclose \"%s\" bytes read %llu written %llu",
 474                     emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ",
 475                     handle_to_name(handle),
 476                     (unsigned long long)handle_bytes_read(handle),
 477                     (unsigned long long)handle_bytes_write(handle));
 478         } else {
 479                 logit("%s%sclosedir \"%s\"",
 480                     emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ",
 481                     handle_to_name(handle));
 482         }
 483 }
 484
 485 static void
 486 handle_log_exit(void)
 487 {
 488         u_int i;
 489
 490         for (i = 0; i < num_handles; i++)
 491                 if (handles[i].use != HANDLE_UNUSED)
 492                         handle_log_close(i, "forced");
 493 }
 494
 495 static int
 496 get_handle(struct sshbuf *queue, int *hp)
 497 {
 498         u_char *handle;
 499         int r;
 500         size_t hlen;
 501
 502         *hp = -1;
 503         if ((r = sshbuf_get_string(queue, &handle, &hlen)) != 0)
 504                 return r;
 505         if (hlen < 256)
 506                 *hp = handle_from_string(handle, hlen);
 507         free(handle);
 508         return 0;
 509 }
 510
 511 /* send replies */
 512
 513 static void
 514 send_msg(struct sshbuf *m)
 515 {
 516         int r;
 517
 518         if ((r = sshbuf_put_stringb(oqueue, m)) != 0)
 519                 fatal_fr(r, "enqueue");
 520         sshbuf_reset(m);
 521 }
 522
 523 static const char *
 524 status_to_message(u_int32_t status)
 525 {
 526         static const char * const status_messages[] = {
 527                 "Success",                      /* SSH_FX_OK */
 528                 "End of file",                  /* SSH_FX_EOF */
 529                 "No such file",                 /* SSH_FX_NO_SUCH_FILE */
 530                 "Permission denied",            /* SSH_FX_PERMISSION_DENIED */
 531                 "Failure",                      /* SSH_FX_FAILURE */
 532                 "Bad message",                  /* SSH_FX_BAD_MESSAGE */
 533                 "No connection",                /* SSH_FX_NO_CONNECTION */
 534                 "Connection lost",              /* SSH_FX_CONNECTION_LOST */
 535                 "Operation unsupported",        /* SSH_FX_OP_UNSUPPORTED */
 536                 "Unknown error"                 /* Others */
 537         };
 538         return (status_messages[MINIMUM(status,SSH2_FX_MAX)]);
 539 }
 540
 541 static void
 542 send_status_errmsg(u_int32_t id, u_int32_t status, const char *errmsg)
 543 {
 544         struct sshbuf *msg;
 545         int r;
 546
 547         debug3("request %u: sent status %u", id, status);
 548         if (log_level > SYSLOG_LEVEL_VERBOSE ||
 549             (status != SSH2_FX_OK && status != SSH2_FX_EOF))
 550                 logit("sent status %s", status_to_message(status));
 551         if ((msg = sshbuf_new()) == NULL)
 552                 fatal_f("sshbuf_new failed");
 553         if ((r = sshbuf_put_u8(msg, SSH2_FXP_STATUS)) != 0 ||
 554             (r = sshbuf_put_u32(msg, id)) != 0 ||
 555             (r = sshbuf_put_u32(msg, status)) != 0)
 556                 fatal_fr(r, "compose");
 557         if (version >= 3) {
 558                 if ((r = sshbuf_put_cstring(msg, errmsg == NULL ?
 559                     status_to_message(status) : errmsg)) != 0 ||
 560                     (r = sshbuf_put_cstring(msg, "")) != 0)
 561                         fatal_fr(r, "compose message");
 562         }
 563         send_msg(msg);
 564         sshbuf_free(msg);
 565 }
 566
 567 static void
 568 send_status(u_int32_t id, u_int32_t status)
 569 {
 570         send_status_errmsg(id, status, NULL);
 571 }
 572
 573 static void
 574 send_data_or_handle(char type, u_int32_t id, const u_char *data, int dlen)
 575 {
 576         struct sshbuf *msg;
 577         int r;
 578
 579         if ((msg = sshbuf_new()) == NULL)
 580                 fatal_f("sshbuf_new failed");
 581         if ((r = sshbuf_put_u8(msg, type)) != 0 ||
 582             (r = sshbuf_put_u32(msg, id)) != 0 ||
 583             (r = sshbuf_put_string(msg, data, dlen)) != 0)
 584                 fatal_fr(r, "compose");
 585         send_msg(msg);
 586         sshbuf_free(msg);
 587 }
 588
 589 static void
 590 send_data(u_int32_t id, const u_char *data, int dlen)
 591 {
 592         debug("request %u: sent data len %d", id, dlen);
 593         send_data_or_handle(SSH2_FXP_DATA, id, data, dlen);
 594 }
 595
 596 static void
 597 send_handle(u_int32_t id, int handle)
 598 {
 599         u_char *string;
 600         int hlen;
 601
 602         handle_to_string(handle, &string, &hlen);
 603         debug("request %u: sent handle handle %d", id, handle);
 604         send_data_or_handle(SSH2_FXP_HANDLE, id, string, hlen);
 605         free(string);
 606 }
 607
 608 static void
 609 send_names(u_int32_t id, int count, const Stat *stats)
 610 {
 611         struct sshbuf *msg;
 612         int i, r;
 613
 614         if ((msg = sshbuf_new()) == NULL)
 615                 fatal_f("sshbuf_new failed");
 616         if ((r = sshbuf_put_u8(msg, SSH2_FXP_NAME)) != 0 ||
 617             (r = sshbuf_put_u32(msg, id)) != 0 ||
 618             (r = sshbuf_put_u32(msg, count)) != 0)
 619                 fatal_fr(r, "compose");
 620         debug("request %u: sent names count %d", id, count);
 621         for (i = 0; i < count; i++) {
 622                 if ((r = sshbuf_put_cstring(msg, stats[i].name)) != 0 ||
 623                     (r = sshbuf_put_cstring(msg, stats[i].long_name)) != 0 ||
 624                     (r = encode_attrib(msg, &stats[i].attrib)) != 0)
 625                         fatal_fr(r, "compose filenames/attrib");
 626         }
 627         send_msg(msg);
 628         sshbuf_free(msg);
 629 }
 630
 631 static void
 632 send_attrib(u_int32_t id, const Attrib *a)
 633 {
 634         struct sshbuf *msg;
 635         int r;
 636
 637         debug("request %u: sent attrib have 0x%x", id, a->flags);
 638         if ((msg = sshbuf_new()) == NULL)
 639                 fatal_f("sshbuf_new failed");
 640         if ((r = sshbuf_put_u8(msg, SSH2_FXP_ATTRS)) != 0 ||
 641             (r = sshbuf_put_u32(msg, id)) != 0 ||
 642             (r = encode_attrib(msg, a)) != 0)
 643                 fatal_fr(r, "compose");
 644         send_msg(msg);
 645         sshbuf_free(msg);
 646 }
 647
 648 static void
 649 send_statvfs(u_int32_t id, struct statvfs *st)
 650 {
 651         struct sshbuf *msg;
 652         u_int64_t flag;
 653         int r;
 654
 655         flag = (st->f_flag & ST_RDONLY) ? SSH2_FXE_STATVFS_ST_RDONLY : 0;
 656         flag |= (st->f_flag & ST_NOSUID) ? SSH2_FXE_STATVFS_ST_NOSUID : 0;
 657
 658         if ((msg = sshbuf_new()) == NULL)
 659                 fatal_f("sshbuf_new failed");
 660         if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED_REPLY)) != 0 ||
 661             (r = sshbuf_put_u32(msg, id)) != 0 ||
 662             (r = sshbuf_put_u64(msg, st->f_bsize)) != 0 ||
 663             (r = sshbuf_put_u64(msg, st->f_frsize)) != 0 ||
 664             (r = sshbuf_put_u64(msg, st->f_blocks)) != 0 ||
 665             (r = sshbuf_put_u64(msg, st->f_bfree)) != 0 ||
 666             (r = sshbuf_put_u64(msg, st->f_bavail)) != 0 ||
 667             (r = sshbuf_put_u64(msg, st->f_files)) != 0 ||
 668             (r = sshbuf_put_u64(msg, st->f_ffree)) != 0 ||
 669             (r = sshbuf_put_u64(msg, st->f_favail)) != 0 ||
 670             (r = sshbuf_put_u64(msg, FSID_TO_ULONG(st->f_fsid))) != 0 ||
 671             (r = sshbuf_put_u64(msg, flag)) != 0 ||
 672             (r = sshbuf_put_u64(msg, st->f_namemax)) != 0)
 673                 fatal_fr(r, "compose");
 674         send_msg(msg);
 675         sshbuf_free(msg);
 676 }
 677
 678 /*
 679  * Prepare SSH2_FXP_VERSION extension advertisement for a single extension.
 680  * The extension is checked for permission prior to advertisement.
 681  */
 682 static int
 683 compose_extension(struct sshbuf *msg, const char *name, const char *ver)
 684 {
 685         int r;
 686         const struct sftp_handler *exthnd;
 687
 688         if ((exthnd = extended_handler_byname(name)) == NULL)
 689                 fatal_f("internal error: no handler for %s", name);
 690         if (!request_permitted(exthnd)) {
 691                 debug2_f("refusing to advertise disallowed extension %s", name);
 692                 return 0;
 693         }
 694         if ((r = sshbuf_put_cstring(msg, name)) != 0 ||
 695             (r = sshbuf_put_cstring(msg, ver)) != 0)
 696                 fatal_fr(r, "compose %s", name);
 697         return 0;
 698 }
 699
 700 /* parse incoming */
 701
 702 static void
 703 process_init(void)
 704 {
 705         struct sshbuf *msg;
 706         int r;
 707
 708         if ((r = sshbuf_get_u32(iqueue, &version)) != 0)
 709                 fatal_fr(r, "parse");
 710         verbose("received client version %u", version);
 711         if ((msg = sshbuf_new()) == NULL)
 712                 fatal_f("sshbuf_new failed");
 713         if ((r = sshbuf_put_u8(msg, SSH2_FXP_VERSION)) != 0 ||
 714             (r = sshbuf_put_u32(msg, SSH2_FILEXFER_VERSION)) != 0)
 715                 fatal_fr(r, "compose");
 716
 717          /* extension advertisements */
 718         compose_extension(msg, "posix-rename@openssh.com", "1");
 719         compose_extension(msg, "statvfs@openssh.com", "2");
 720         compose_extension(msg, "fstatvfs@openssh.com", "2");
 721         compose_extension(msg, "hardlink@openssh.com", "1");
 722         compose_extension(msg, "fsync@openssh.com", "1");
 723         compose_extension(msg, "lsetstat@openssh.com", "1");
 724         compose_extension(msg, "limits@openssh.com", "1");
 725         compose_extension(msg, "expand-path@openssh.com", "1");
 726         compose_extension(msg, "copy-data", "1");
 727
 728         send_msg(msg);
 729         sshbuf_free(msg);
 730 }
 731
 732 static void
 733 process_open(u_int32_t id)
 734 {
 735         u_int32_t pflags;
 736         Attrib a;
 737         char *name;
 738         int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE;
 739
 740         if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
 741             (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
 742             (r = decode_attrib(iqueue, &a)) != 0)
 743                 fatal_fr(r, "parse");
 744
 745         debug3("request %u: open flags %d", id, pflags);
 746         flags = flags_from_portable(pflags);
 747         mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666;
 748         logit("open \"%s\" flags %s mode 0%o",
 749             name, string_from_portable(pflags), mode);
 750         if (readonly &&
 751             ((flags & O_ACCMODE) != O_RDONLY ||
 752             (flags & (O_CREAT|O_TRUNC)) != 0)) {
 753                 verbose("Refusing open request in read-only mode");
 754                 status = SSH2_FX_PERMISSION_DENIED;
 755         } else {
 756                 fd = open(name, flags, mode);
 757                 if (fd == -1) {
 758                         status = errno_to_portable(errno);
 759                 } else {
 760                         handle = handle_new(HANDLE_FILE, name, fd, flags, NULL);
 761                         if (handle < 0) {
 762                                 close(fd);
 763                         } else {
 764                                 send_handle(id, handle);
 765                                 status = SSH2_FX_OK;
 766                         }
 767                 }
 768         }
 769         if (status != SSH2_FX_OK)
 770                 send_status(id, status);
 771         free(name);
 772 }
 773
 774 static void
 775 process_close(u_int32_t id)
 776 {
 777         int r, handle, ret, status = SSH2_FX_FAILURE;
 778
 779         if ((r = get_handle(iqueue, &handle)) != 0)
 780                 fatal_fr(r, "parse");
 781
 782         debug3("request %u: close handle %u", id, handle);
 783         handle_log_close(handle, NULL);
 784         ret = handle_close(handle);
 785         status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
 786         send_status(id, status);
 787 }
 788
 789 static void
 790 process_read(u_int32_t id)
 791 {
 792         static u_char *buf;
 793         static size_t buflen;
 794         u_int32_t len;
 795         int r, handle, fd, ret, status = SSH2_FX_FAILURE;
 796         u_int64_t off;
 797
 798         if ((r = get_handle(iqueue, &handle)) != 0 ||
 799             (r = sshbuf_get_u64(iqueue, &off)) != 0 ||
 800             (r = sshbuf_get_u32(iqueue, &len)) != 0)
 801                 fatal_fr(r, "parse");
 802
 803         debug("request %u: read \"%s\" (handle %d) off %llu len %u",
 804             id, handle_to_name(handle), handle, (unsigned long long)off, len);
 805         if ((fd = handle_to_fd(handle)) == -1)
 806                 goto out;
 807         if (len > SFTP_MAX_READ_LENGTH) {
 808                 debug2("read change len %u to %u", len, SFTP_MAX_READ_LENGTH);
 809                 len = SFTP_MAX_READ_LENGTH;
 810         }
 811         if (len > buflen) {
 812                 debug3_f("allocate %zu => %u", buflen, len);
 813                 if ((buf = realloc(NULL, len)) == NULL)
 814                         fatal_f("realloc failed");
 815                 buflen = len;
 816         }
 817         if (lseek(fd, off, SEEK_SET) == -1) {
 818                 status = errno_to_portable(errno);
 819                 error_f("seek \"%.100s\": %s", handle_to_name(handle),
 820                     strerror(errno));
 821                 goto out;
 822         }
 823         if (len == 0) {
 824                 /* weird, but not strictly disallowed */
 825                 ret = 0;
 826         } else if ((ret = read(fd, buf, len)) == -1) {
 827                 status = errno_to_portable(errno);
 828                 error_f("read \"%.100s\": %s", handle_to_name(handle),
 829                     strerror(errno));
 830                 goto out;
 831         } else if (ret == 0) {
 832                 status = SSH2_FX_EOF;
 833                 goto out;
 834         }
 835         send_data(id, buf, ret);
 836         handle_update_read(handle, ret);
 837         /* success */
 838         status = SSH2_FX_OK;
 839  out:
 840         if (status != SSH2_FX_OK)
 841                 send_status(id, status);
 842 }
 843
 844 static void
 845 process_write(u_int32_t id)
 846 {
 847         u_int64_t off;
 848         size_t len;
 849         int r, handle, fd, ret, status;
 850         u_char *data;
 851
 852         if ((r = get_handle(iqueue, &handle)) != 0 ||
 853             (r = sshbuf_get_u64(iqueue, &off)) != 0 ||
 854             (r = sshbuf_get_string(iqueue, &data, &len)) != 0)
 855                 fatal_fr(r, "parse");
 856
 857         debug("request %u: write \"%s\" (handle %d) off %llu len %zu",
 858             id, handle_to_name(handle), handle, (unsigned long long)off, len);
 859         fd = handle_to_fd(handle);
 860
 861         if (fd < 0)
 862                 status = SSH2_FX_FAILURE;
 863         else {
 864                 if (!(handle_to_flags(handle) & O_APPEND) &&
 865                     lseek(fd, off, SEEK_SET) == -1) {
 866                         status = errno_to_portable(errno);
 867                         error_f("seek \"%.100s\": %s", handle_to_name(handle),
 868                             strerror(errno));
 869                 } else {
 870 /* XXX ATOMICIO ? */
 871                         ret = write(fd, data, len);
 872                         if (ret == -1) {
 873                                 status = errno_to_portable(errno);
 874                                 error_f("write \"%.100s\": %s",
 875                                     handle_to_name(handle), strerror(errno));
 876                         } else if ((size_t)ret == len) {
 877                                 status = SSH2_FX_OK;
 878                                 handle_update_write(handle, ret);
 879                         } else {
 880                                 debug2_f("nothing at all written");
 881                                 status = SSH2_FX_FAILURE;
 882                         }
 883                 }
 884         }
 885         send_status(id, status);
 886         free(data);
 887 }
 888
 889 static void
 890 process_do_stat(u_int32_t id, int do_lstat)
 891 {
 892         Attrib a;
 893         struct stat st;
 894         char *name;
 895         int r, status = SSH2_FX_FAILURE;
 896
 897         if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
 898                 fatal_fr(r, "parse");
 899
 900         debug3("request %u: %sstat", id, do_lstat ? "l" : "");
 901         verbose("%sstat name \"%s\"", do_lstat ? "l" : "", name);
 902         r = do_lstat ? lstat(name, &st) : stat(name, &st);
 903         if (r == -1) {
 904                 status = errno_to_portable(errno);
 905         } else {
 906                 stat_to_attrib(&st, &a);
 907                 send_attrib(id, &a);
 908                 status = SSH2_FX_OK;
 909         }
 910         if (status != SSH2_FX_OK)
 911                 send_status(id, status);
 912         free(name);
 913 }
 914
 915 static void
 916 process_stat(u_int32_t id)
 917 {
 918         process_do_stat(id, 0);
 919 }
 920
 921 static void
 922 process_lstat(u_int32_t id)
 923 {
 924         process_do_stat(id, 1);
 925 }
 926
 927 static void
 928 process_fstat(u_int32_t id)
 929 {
 930         Attrib a;
 931         struct stat st;
 932         int fd, r, handle, status = SSH2_FX_FAILURE;
 933
 934         if ((r = get_handle(iqueue, &handle)) != 0)
 935                 fatal_fr(r, "parse");
 936         debug("request %u: fstat \"%s\" (handle %u)",
 937             id, handle_to_name(handle), handle);
 938         fd = handle_to_fd(handle);
 939         if (fd >= 0) {
 940                 r = fstat(fd, &st);
 941                 if (r == -1) {
 942                         status = errno_to_portable(errno);
 943                 } else {
 944                         stat_to_attrib(&st, &a);
 945                         send_attrib(id, &a);
 946                         status = SSH2_FX_OK;
 947                 }
 948         }
 949         if (status != SSH2_FX_OK)
 950                 send_status(id, status);
 951 }
 952
 953 static struct timeval *
 954 attrib_to_tv(const Attrib *a)
 955 {
 956         static struct timeval tv[2];
 957
 958         tv[0].tv_sec = a->atime;
 959         tv[0].tv_usec = 0;
 960         tv[1].tv_sec = a->mtime;
 961         tv[1].tv_usec = 0;
 962         return tv;
 963 }
 964
 965 static struct timespec *
 966 attrib_to_ts(const Attrib *a)
 967 {
 968         static struct timespec ts[2];
 969
 970         ts[0].tv_sec = a->atime;
 971         ts[0].tv_nsec = 0;
 972         ts[1].tv_sec = a->mtime;
 973         ts[1].tv_nsec = 0;
 974         return ts;
 975 }
 976
 977 static void
 978 process_setstat(u_int32_t id)
 979 {
 980         Attrib a;
 981         char *name;
 982         int r, status = SSH2_FX_OK;
 983
 984         if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
 985             (r = decode_attrib(iqueue, &a)) != 0)
 986                 fatal_fr(r, "parse");
 987
 988         debug("request %u: setstat name \"%s\"", id, name);
 989         if (a.flags & SSH2_FILEXFER_ATTR_SIZE) {
 990                 logit("set \"%s\" size %llu",
 991                     name, (unsigned long long)a.size);
 992                 r = truncate(name, a.size);
 993                 if (r == -1)
 994                         status = errno_to_portable(errno);
 995         }
 996         if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
 997                 logit("set \"%s\" mode %04o", name, a.perm);
 998                 r = chmod(name, a.perm & 07777);
 999                 if (r == -1)
1000                         status = errno_to_portable(errno);
1001         }
1002         if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
1003                 char buf[64];
1004                 time_t t = a.mtime;
1005
1006                 strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S",
1007                     localtime(&t));
1008                 logit("set \"%s\" modtime %s", name, buf);
1009                 r = utimes(name, attrib_to_tv(&a));
1010                 if (r == -1)
1011                         status = errno_to_portable(errno);
1012         }
1013         if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) {
1014                 logit("set \"%s\" owner %lu group %lu", name,
1015                     (u_long)a.uid, (u_long)a.gid);
1016                 r = chown(name, a.uid, a.gid);
1017                 if (r == -1)
1018                         status = errno_to_portable(errno);
1019         }
1020         send_status(id, status);
1021         free(name);
1022 }
1023
1024 static void
1025 process_fsetstat(u_int32_t id)
1026 {
1027         Attrib a;
1028         int handle, fd, r;
1029         int status = SSH2_FX_OK;
1030
1031         if ((r = get_handle(iqueue, &handle)) != 0 ||
1032             (r = decode_attrib(iqueue, &a)) != 0)
1033                 fatal_fr(r, "parse");
1034
1035         debug("request %u: fsetstat handle %d", id, handle);
1036         fd = handle_to_fd(handle);
1037         if (fd < 0)
1038                 status = SSH2_FX_FAILURE;
1039         else {
1040                 char *name = handle_to_name(handle);
1041
1042                 if (a.flags & SSH2_FILEXFER_ATTR_SIZE) {
1043                         logit("set \"%s\" size %llu",
1044                             name, (unsigned long long)a.size);
1045                         r = ftruncate(fd, a.size);
1046                         if (r == -1)
1047                                 status = errno_to_portable(errno);
1048                 }
1049                 if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
1050                         logit("set \"%s\" mode %04o", name, a.perm);
1051 #ifdef HAVE_FCHMOD
1052                         r = fchmod(fd, a.perm & 07777);
1053 #else
1054                         r = chmod(name, a.perm & 07777);
1055 #endif
1056                         if (r == -1)
1057                                 status = errno_to_portable(errno);
1058                 }
1059                 if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
1060                         char buf[64];
1061                         time_t t = a.mtime;
1062
1063                         strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S",
1064                             localtime(&t));
1065                         logit("set \"%s\" modtime %s", name, buf);
1066 #ifdef HAVE_FUTIMES
1067                         r = futimes(fd, attrib_to_tv(&a));
1068 #else
1069                         r = utimes(name, attrib_to_tv(&a));
1070 #endif
1071                         if (r == -1)
1072                                 status = errno_to_portable(errno);
1073                 }
1074                 if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) {
1075                         logit("set \"%s\" owner %lu group %lu", name,
1076                             (u_long)a.uid, (u_long)a.gid);
1077 #ifdef HAVE_FCHOWN
1078                         r = fchown(fd, a.uid, a.gid);
1079 #else
1080                         r = chown(name, a.uid, a.gid);
1081 #endif
1082                         if (r == -1)
1083                                 status = errno_to_portable(errno);
1084                 }
1085         }
1086         send_status(id, status);
1087 }
1088
1089 static void
1090 process_opendir(u_int32_t id)
1091 {
1092         DIR *dirp = NULL;
1093         char *path;
1094         int r, handle, status = SSH2_FX_FAILURE;
1095
1096         if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
1097                 fatal_fr(r, "parse");
1098
1099         debug3("request %u: opendir", id);
1100         logit("opendir \"%s\"", path);
1101         dirp = opendir(path);
1102         if (dirp == NULL) {
1103                 status = errno_to_portable(errno);
1104         } else {
1105                 handle = handle_new(HANDLE_DIR, path, 0, 0, dirp);
1106                 if (handle < 0) {
1107                         closedir(dirp);
1108                 } else {
1109                         send_handle(id, handle);
1110                         status = SSH2_FX_OK;
1111                 }
1112
1113         }
1114         if (status != SSH2_FX_OK)
1115                 send_status(id, status);
1116         free(path);
1117 }
1118
1119 static void
1120 process_readdir(u_int32_t id)
1121 {
1122         DIR *dirp;
1123         struct dirent *dp;
1124         char *path;
1125         int r, handle;
1126
1127         if ((r = get_handle(iqueue, &handle)) != 0)
1128                 fatal_fr(r, "parse");
1129
1130         debug("request %u: readdir \"%s\" (handle %d)", id,
1131             handle_to_name(handle), handle);
1132         dirp = handle_to_dir(handle);
1133         path = handle_to_name(handle);
1134         if (dirp == NULL || path == NULL) {
1135                 send_status(id, SSH2_FX_FAILURE);
1136         } else {
1137                 struct stat st;
1138                 char pathname[PATH_MAX];
1139                 Stat *stats;
1140                 int nstats = 10, count = 0, i;
1141
1142                 stats = xcalloc(nstats, sizeof(Stat));
1143                 while ((dp = readdir(dirp)) != NULL) {
1144                         if (count >= nstats) {
1145                                 nstats *= 2;
1146                                 stats = xreallocarray(stats, nstats, sizeof(Stat));
1147                         }
1148 /* XXX OVERFLOW ? */
1149                         snprintf(pathname, sizeof pathname, "%s%s%s", path,
1150                             strcmp(path, "/") ? "/" : "", dp->d_name);
1151                         if (lstat(pathname, &st) == -1)
1152                                 continue;
1153                         stat_to_attrib(&st, &(stats[count].attrib));
1154                         stats[count].name = xstrdup(dp->d_name);
1155                         stats[count].long_name = ls_file(dp->d_name, &st, 0, 0);
1156                         count++;
1157                         /* send up to 100 entries in one message */
1158                         /* XXX check packet size instead */
1159                         if (count == 100)
1160                                 break;
1161                 }
1162                 if (count > 0) {
1163                         send_names(id, count, stats);
1164                         for (i = 0; i < count; i++) {
1165                                 free(stats[i].name);
1166                                 free(stats[i].long_name);
1167                         }
1168                 } else {
1169                         send_status(id, SSH2_FX_EOF);
1170                 }
1171                 free(stats);
1172         }
1173 }
1174
1175 static void
1176 process_remove(u_int32_t id)
1177 {
1178         char *name;
1179         int r, status = SSH2_FX_FAILURE;
1180
1181         if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
1182                 fatal_fr(r, "parse");
1183
1184         debug3("request %u: remove", id);
1185         logit("remove name \"%s\"", name);
1186         r = unlink(name);
1187         status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1188         send_status(id, status);
1189         free(name);
1190 }
1191
1192 static void
1193 process_mkdir(u_int32_t id)
1194 {
1195         Attrib a;
1196         char *name;
1197         int r, mode, status = SSH2_FX_FAILURE;
1198
1199         if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
1200             (r = decode_attrib(iqueue, &a)) != 0)
1201                 fatal_fr(r, "parse");
1202
1203         mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
1204             a.perm & 07777 : 0777;
1205         debug3("request %u: mkdir", id);
1206         logit("mkdir name \"%s\" mode 0%o", name, mode);
1207         r = mkdir(name, mode);
1208         status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1209         send_status(id, status);
1210         free(name);
1211 }
1212
1213 static void
1214 process_rmdir(u_int32_t id)
1215 {
1216         char *name;
1217         int r, status;
1218
1219         if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0)
1220                 fatal_fr(r, "parse");
1221
1222         debug3("request %u: rmdir", id);
1223         logit("rmdir name \"%s\"", name);
1224         r = rmdir(name);
1225         status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1226         send_status(id, status);
1227         free(name);
1228 }
1229
1230 static void
1231 process_realpath(u_int32_t id)
1232 {
1233         char resolvedname[PATH_MAX];
1234         char *path;
1235         int r;
1236
1237         if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
1238                 fatal_fr(r, "parse");
1239
1240         if (path[0] == '\0') {
1241                 free(path);
1242                 path = xstrdup(".");
1243         }
1244         debug3("request %u: realpath", id);
1245         verbose("realpath \"%s\"", path);
1246         if (sftp_realpath(path, resolvedname) == NULL) {
1247                 send_status(id, errno_to_portable(errno));
1248         } else {
1249                 Stat s;
1250                 attrib_clear(&s.attrib);
1251                 s.name = s.long_name = resolvedname;
1252                 send_names(id, 1, &s);
1253         }
1254         free(path);
1255 }
1256
1257 static void
1258 process_rename(u_int32_t id)
1259 {
1260         char *oldpath, *newpath;
1261         int r, status;
1262         struct stat sb;
1263
1264         if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 ||
1265             (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
1266                 fatal_fr(r, "parse");
1267
1268         debug3("request %u: rename", id);
1269         logit("rename old \"%s\" new \"%s\"", oldpath, newpath);
1270         status = SSH2_FX_FAILURE;
1271         if (lstat(oldpath, &sb) == -1)
1272                 status = errno_to_portable(errno);
1273         else if (S_ISREG(sb.st_mode)) {
1274                 /* Race-free rename of regular files */
1275                 if (link(oldpath, newpath) == -1) {
1276                         if (errno == EOPNOTSUPP || errno == ENOSYS
1277 #ifdef EXDEV
1278                             || errno == EXDEV
1279 #endif
1280 #ifdef LINK_OPNOTSUPP_ERRNO
1281                             || errno == LINK_OPNOTSUPP_ERRNO
1282 #endif
1283                             ) {
1284                                 struct stat st;
1285
1286                                 /*
1287                                  * fs doesn't support links, so fall back to
1288                                  * stat+rename.  This is racy.
1289                                  */
1290                                 if (stat(newpath, &st) == -1) {
1291                                         if (rename(oldpath, newpath) == -1)
1292                                                 status =
1293                                                     errno_to_portable(errno);
1294                                         else
1295                                                 status = SSH2_FX_OK;
1296                                 }
1297                         } else {
1298                                 status = errno_to_portable(errno);
1299                         }
1300                 } else if (unlink(oldpath) == -1) {
1301                         status = errno_to_portable(errno);
1302                         /* clean spare link */
1303                         unlink(newpath);
1304                 } else
1305                         status = SSH2_FX_OK;
1306         } else if (stat(newpath, &sb) == -1) {
1307                 if (rename(oldpath, newpath) == -1)
1308                         status = errno_to_portable(errno);
1309                 else
1310                         status = SSH2_FX_OK;
1311         }
1312         send_status(id, status);
1313         free(oldpath);
1314         free(newpath);
1315 }
1316
1317 static void
1318 process_readlink(u_int32_t id)
1319 {
1320         int r, len;
1321         char buf[PATH_MAX];
1322         char *path;
1323
1324         if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
1325                 fatal_fr(r, "parse");
1326
1327         debug3("request %u: readlink", id);
1328         verbose("readlink \"%s\"", path);
1329         if ((len = readlink(path, buf, sizeof(buf) - 1)) == -1)
1330                 send_status(id, errno_to_portable(errno));
1331         else {
1332                 Stat s;
1333
1334                 buf[len] = '\0';
1335                 attrib_clear(&s.attrib);
1336                 s.name = s.long_name = buf;
1337                 send_names(id, 1, &s);
1338         }
1339         free(path);
1340 }
1341
1342 static void
1343 process_symlink(u_int32_t id)
1344 {
1345         char *oldpath, *newpath;
1346         int r, status;
1347
1348         if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 ||
1349             (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
1350                 fatal_fr(r, "parse");
1351
1352         debug3("request %u: symlink", id);
1353         logit("symlink old \"%s\" new \"%s\"", oldpath, newpath);
1354         /* this will fail if 'newpath' exists */
1355         r = symlink(oldpath, newpath);
1356         status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1357         send_status(id, status);
1358         free(oldpath);
1359         free(newpath);
1360 }
1361
1362 static void
1363 process_extended_posix_rename(u_int32_t id)
1364 {
1365         char *oldpath, *newpath;
1366         int r, status;
1367
1368         if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 ||
1369             (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
1370                 fatal_fr(r, "parse");
1371
1372         debug3("request %u: posix-rename", id);
1373         logit("posix-rename old \"%s\" new \"%s\"", oldpath, newpath);
1374         r = rename(oldpath, newpath);
1375         status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1376         send_status(id, status);
1377         free(oldpath);
1378         free(newpath);
1379 }
1380
1381 static void
1382 process_extended_statvfs(u_int32_t id)
1383 {
1384         char *path;
1385         struct statvfs st;
1386         int r;
1387
1388         if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
1389                 fatal_fr(r, "parse");
1390         debug3("request %u: statvfs", id);
1391         logit("statvfs \"%s\"", path);
1392
1393         if (statvfs(path, &st) != 0)
1394                 send_status(id, errno_to_portable(errno));
1395         else
1396                 send_statvfs(id, &st);
1397         free(path);
1398 }
1399
1400 static void
1401 process_extended_fstatvfs(u_int32_t id)
1402 {
1403         int r, handle, fd;
1404         struct statvfs st;
1405
1406         if ((r = get_handle(iqueue, &handle)) != 0)
1407                 fatal_fr(r, "parse");
1408         debug("request %u: fstatvfs \"%s\" (handle %u)",
1409             id, handle_to_name(handle), handle);
1410         if ((fd = handle_to_fd(handle)) < 0) {
1411                 send_status(id, SSH2_FX_FAILURE);
1412                 return;
1413         }
1414         if (fstatvfs(fd, &st) != 0)
1415                 send_status(id, errno_to_portable(errno));
1416         else
1417                 send_statvfs(id, &st);
1418 }
1419
1420 static void
1421 process_extended_hardlink(u_int32_t id)
1422 {
1423         char *oldpath, *newpath;
1424         int r, status;
1425
1426         if ((r = sshbuf_get_cstring(iqueue, &oldpath, NULL)) != 0 ||
1427             (r = sshbuf_get_cstring(iqueue, &newpath, NULL)) != 0)
1428                 fatal_fr(r, "parse");
1429
1430         debug3("request %u: hardlink", id);
1431         logit("hardlink old \"%s\" new \"%s\"", oldpath, newpath);
1432         r = link(oldpath, newpath);
1433         status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1434         send_status(id, status);
1435         free(oldpath);
1436         free(newpath);
1437 }
1438
1439 static void
1440 process_extended_fsync(u_int32_t id)
1441 {
1442         int handle, fd, r, status = SSH2_FX_OP_UNSUPPORTED;
1443
1444         if ((r = get_handle(iqueue, &handle)) != 0)
1445                 fatal_fr(r, "parse");
1446         debug3("request %u: fsync (handle %u)", id, handle);
1447         verbose("fsync \"%s\"", handle_to_name(handle));
1448         if ((fd = handle_to_fd(handle)) < 0)
1449                 status = SSH2_FX_NO_SUCH_FILE;
1450         else if (handle_is_ok(handle, HANDLE_FILE)) {
1451                 r = fsync(fd);
1452                 status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
1453         }
1454         send_status(id, status);
1455 }
1456
1457 static void
1458 process_extended_lsetstat(u_int32_t id)
1459 {
1460         Attrib a;
1461         char *name;
1462         int r, status = SSH2_FX_OK;
1463
1464         if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
1465             (r = decode_attrib(iqueue, &a)) != 0)
1466                 fatal_fr(r, "parse");
1467
1468         debug("request %u: lsetstat name \"%s\"", id, name);
1469         if (a.flags & SSH2_FILEXFER_ATTR_SIZE) {
1470                 /* nonsensical for links */
1471                 status = SSH2_FX_BAD_MESSAGE;
1472                 goto out;
1473         }
1474         if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
1475                 logit("set \"%s\" mode %04o", name, a.perm);
1476                 r = fchmodat(AT_FDCWD, name,
1477                     a.perm & 07777, AT_SYMLINK_NOFOLLOW);
1478                 if (r == -1)
1479                         status = errno_to_portable(errno);
1480         }
1481         if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
1482                 char buf[64];
1483                 time_t t = a.mtime;
1484
1485                 strftime(buf, sizeof(buf), "%Y%m%d-%H:%M:%S",
1486                     localtime(&t));
1487                 logit("set \"%s\" modtime %s", name, buf);
1488                 r = utimensat(AT_FDCWD, name,
1489                     attrib_to_ts(&a), AT_SYMLINK_NOFOLLOW);
1490                 if (r == -1)
1491                         status = errno_to_portable(errno);
1492         }
1493         if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) {
1494                 logit("set \"%s\" owner %lu group %lu", name,
1495                     (u_long)a.uid, (u_long)a.gid);
1496                 r = fchownat(AT_FDCWD, name, a.uid, a.gid,
1497                     AT_SYMLINK_NOFOLLOW);
1498                 if (r == -1)
1499                         status = errno_to_portable(errno);
1500         }
1501  out:
1502         send_status(id, status);
1503         free(name);
1504 }
1505
1506 static void
1507 process_extended_limits(u_int32_t id)
1508 {
1509         struct sshbuf *msg;
1510         int r;
1511         uint64_t nfiles = 0;
1512 #if defined(HAVE_GETRLIMIT) && defined(RLIMIT_NOFILE)
1513         struct rlimit rlim;
1514 #endif
1515
1516         debug("request %u: limits", id);
1517
1518 #if defined(HAVE_GETRLIMIT) && defined(RLIMIT_NOFILE)
1519         if (getrlimit(RLIMIT_NOFILE, &rlim) != -1 && rlim.rlim_cur > 5)
1520                 nfiles = rlim.rlim_cur - 5; /* stdio(3) + syslog + spare */
1521 #endif
1522
1523         if ((msg = sshbuf_new()) == NULL)
1524                 fatal_f("sshbuf_new failed");
1525         if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED_REPLY)) != 0 ||
1526             (r = sshbuf_put_u32(msg, id)) != 0 ||
1527             /* max-packet-length */
1528             (r = sshbuf_put_u64(msg, SFTP_MAX_MSG_LENGTH)) != 0 ||
1529             /* max-read-length */
1530             (r = sshbuf_put_u64(msg, SFTP_MAX_READ_LENGTH)) != 0 ||
1531             /* max-write-length */
1532             (r = sshbuf_put_u64(msg, SFTP_MAX_MSG_LENGTH - 1024)) != 0 ||
1533             /* max-open-handles */
1534             (r = sshbuf_put_u64(msg, nfiles)) != 0)
1535                 fatal_fr(r, "compose");
1536         send_msg(msg);
1537         sshbuf_free(msg);
1538 }
1539
1540 static void
1541 process_extended_expand(u_int32_t id)
1542 {
1543         char cwd[PATH_MAX], resolvedname[PATH_MAX];
1544         char *path, *npath;
1545         int r;
1546         Stat s;
1547
1548         if ((r = sshbuf_get_cstring(iqueue, &path, NULL)) != 0)
1549                 fatal_fr(r, "parse");
1550         if (getcwd(cwd, sizeof(cwd)) == NULL) {
1551                 send_status(id, errno_to_portable(errno));
1552                 goto out;
1553         }
1554
1555         debug3("request %u: expand, original \"%s\"", id, path);
1556         if (path[0] == '\0') {
1557                 /* empty path */
1558                 free(path);
1559                 path = xstrdup(".");
1560         } else if (*path == '~') {
1561                 /* ~ expand path */
1562                 /* Special-case for "~" and "~/" to respect homedir flag */
1563                 if (strcmp(path, "~") == 0) {
1564                         free(path);
1565                         path = xstrdup(cwd);
1566                 } else if (strncmp(path, "~/", 2) == 0) {
1567                         npath = xstrdup(path + 2);
1568                         free(path);
1569                         xasprintf(&path, "%s/%s", cwd, npath);
1570                         free(npath);
1571                 } else {
1572                         /* ~user expansions */
1573                         if (tilde_expand(path, pw->pw_uid, &npath) != 0) {
1574                                 send_status_errmsg(id,
1575                                     errno_to_portable(ENOENT), "no such user");
1576                                 goto out;
1577                         }
1578                         free(path);
1579                         path = npath;
1580                 }
1581         } else if (*path != '/') {
1582                 /* relative path */
1583                 xasprintf(&npath, "%s/%s", cwd, path);
1584                 free(path);
1585                 path = npath;
1586         }
1587         verbose("expand \"%s\"", path);
1588         if (sftp_realpath(path, resolvedname) == NULL) {
1589                 send_status(id, errno_to_portable(errno));
1590                 goto out;
1591         }
1592         attrib_clear(&s.attrib);
1593         s.name = s.long_name = resolvedname;
1594         send_names(id, 1, &s);
1595  out:
1596         free(path);
1597 }
1598
1599 static void
1600 process_extended_copy_data(u_int32_t id)
1601 {
1602         u_char buf[64*1024];
1603         int read_handle, read_fd, write_handle, write_fd;
1604         u_int64_t len, read_off, read_len, write_off;
1605         int r, copy_until_eof, status = SSH2_FX_OP_UNSUPPORTED;
1606         size_t ret;
1607
1608         if ((r = get_handle(iqueue, &read_handle)) != 0 ||
1609             (r = sshbuf_get_u64(iqueue, &read_off)) != 0 ||
1610             (r = sshbuf_get_u64(iqueue, &read_len)) != 0 ||
1611             (r = get_handle(iqueue, &write_handle)) != 0 ||
1612             (r = sshbuf_get_u64(iqueue, &write_off)) != 0)
1613                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
1614
1615         debug("request %u: copy-data from \"%s\" (handle %d) off %llu len %llu "
1616             "to \"%s\" (handle %d) off %llu",
1617             id, handle_to_name(read_handle), read_handle,
1618             (unsigned long long)read_off, (unsigned long long)read_len,
1619             handle_to_name(write_handle), write_handle,
1620             (unsigned long long)write_off);
1621
1622         /* For read length of 0, we read until EOF. */
1623         if (read_len == 0) {
1624                 read_len = (u_int64_t)-1 - read_off;
1625                 copy_until_eof = 1;
1626         } else
1627                 copy_until_eof = 0;
1628
1629         read_fd = handle_to_fd(read_handle);
1630         write_fd = handle_to_fd(write_handle);
1631
1632         /* Disallow reading & writing to the same handle or same path or dirs */
1633         if (read_handle == write_handle || read_fd < 0 || write_fd < 0 ||
1634             !strcmp(handle_to_name(read_handle), handle_to_name(write_handle))) {
1635                 status = SSH2_FX_FAILURE;
1636                 goto out;
1637         }
1638
1639         if (lseek(read_fd, read_off, SEEK_SET) < 0) {
1640                 status = errno_to_portable(errno);
1641                 error("%s: read_seek failed", __func__);
1642                 goto out;
1643         }
1644
1645         if ((handle_to_flags(write_handle) & O_APPEND) == 0 &&
1646             lseek(write_fd, write_off, SEEK_SET) < 0) {
1647                 status = errno_to_portable(errno);
1648                 error("%s: write_seek failed", __func__);
1649                 goto out;
1650         }
1651
1652         /* Process the request in chunks. */
1653         while (read_len > 0 || copy_until_eof) {
1654                 len = MINIMUM(sizeof(buf), read_len);
1655                 read_len -= len;
1656
1657                 ret = atomicio(read, read_fd, buf, len);
1658                 if (ret == 0 && errno == EPIPE) {
1659                         status = copy_until_eof ? SSH2_FX_OK : SSH2_FX_EOF;
1660                         break;
1661                 } else if (ret == 0) {
1662                         status = errno_to_portable(errno);
1663                         error("%s: read failed: %s", __func__, strerror(errno));
1664                         break;
1665                 }
1666                 len = ret;
1667                 handle_update_read(read_handle, len);
1668
1669                 ret = atomicio(vwrite, write_fd, buf, len);
1670                 if (ret != len) {
1671                         status = errno_to_portable(errno);
1672                         error("%s: write failed: %llu != %llu: %s", __func__,
1673                             (unsigned long long)ret, (unsigned long long)len,
1674                             strerror(errno));
1675                         break;
1676                 }
1677                 handle_update_write(write_handle, len);
1678         }
1679
1680         if (read_len == 0)
1681                 status = SSH2_FX_OK;
1682
1683  out:
1684         send_status(id, status);
1685 }
1686
1687 static void
1688 process_extended(u_int32_t id)
1689 {
1690         char *request;
1691         int r;
1692         const struct sftp_handler *exthand;
1693
1694         if ((r = sshbuf_get_cstring(iqueue, &request, NULL)) != 0)
1695                 fatal_fr(r, "parse");
1696         if ((exthand = extended_handler_byname(request)) == NULL) {
1697                 error("Unknown extended request \"%.100s\"", request);
1698                 send_status(id, SSH2_FX_OP_UNSUPPORTED);        /* MUST */
1699         } else {
1700                 if (!request_permitted(exthand))
1701                         send_status(id, SSH2_FX_PERMISSION_DENIED);
1702                 else
1703                         exthand->handler(id);
1704         }
1705         free(request);
1706 }
1707
1708 /* stolen from ssh-agent */
1709
1710 static void
1711 process(void)
1712 {
1713         u_int msg_len;
1714         u_int buf_len;
1715         u_int consumed;
1716         u_char type;
1717         const u_char *cp;
1718         int i, r;
1719         u_int32_t id;
1720
1721         buf_len = sshbuf_len(iqueue);
1722         if (buf_len < 5)
1723                 return;         /* Incomplete message. */
1724         cp = sshbuf_ptr(iqueue);
1725         msg_len = get_u32(cp);
1726         if (msg_len > SFTP_MAX_MSG_LENGTH) {
1727                 error("bad message from %s local user %s",
1728                     client_addr, pw->pw_name);
1729                 sftp_server_cleanup_exit(11);
1730         }
1731         if (buf_len < msg_len + 4)
1732                 return;
1733         if ((r = sshbuf_consume(iqueue, 4)) != 0)
1734                 fatal_fr(r, "consume");
1735         buf_len -= 4;
1736         if ((r = sshbuf_get_u8(iqueue, &type)) != 0)
1737                 fatal_fr(r, "parse type");
1738
1739         switch (type) {
1740         case SSH2_FXP_INIT:
1741                 process_init();
1742                 init_done = 1;
1743                 break;
1744         case SSH2_FXP_EXTENDED:
1745                 if (!init_done)
1746                         fatal("Received extended request before init");
1747                 if ((r = sshbuf_get_u32(iqueue, &id)) != 0)
1748                         fatal_fr(r, "parse extended ID");
1749                 process_extended(id);
1750                 break;
1751         default:
1752                 if (!init_done)
1753                         fatal("Received %u request before init", type);
1754                 if ((r = sshbuf_get_u32(iqueue, &id)) != 0)
1755                         fatal_fr(r, "parse ID");
1756                 for (i = 0; handlers[i].handler != NULL; i++) {
1757                         if (type == handlers[i].type) {
1758                                 if (!request_permitted(&handlers[i])) {
1759                                         send_status(id,
1760                                             SSH2_FX_PERMISSION_DENIED);
1761                                 } else {
1762                                         handlers[i].handler(id);
1763                                 }
1764                                 break;
1765                         }
1766                 }
1767                 if (handlers[i].handler == NULL)
1768                         error("Unknown message %u", type);
1769         }
1770         /* discard the remaining bytes from the current packet */
1771         if (buf_len < sshbuf_len(iqueue)) {
1772                 error("iqueue grew unexpectedly");
1773                 sftp_server_cleanup_exit(255);
1774         }
1775         consumed = buf_len - sshbuf_len(iqueue);
1776         if (msg_len < consumed) {
1777                 error("msg_len %u < consumed %u", msg_len, consumed);
1778                 sftp_server_cleanup_exit(255);
1779         }
1780         if (msg_len > consumed &&
1781             (r = sshbuf_consume(iqueue, msg_len - consumed)) != 0)
1782                 fatal_fr(r, "consume");
1783 }
1784
1785 /* Cleanup handler that logs active handles upon normal exit */
1786 void
1787 sftp_server_cleanup_exit(int i)
1788 {
1789         if (pw != NULL && client_addr != NULL) {
1790                 handle_log_exit();
1791                 logit("session closed for local user %s from [%s]",
1792                     pw->pw_name, client_addr);
1793         }
1794         _exit(i);
1795 }
1796
1797 static void
1798 sftp_server_usage(void)
1799 {
1800         extern char *__progname;
1801
1802         fprintf(stderr,
1803             "usage: %s [-ehR] [-d start_directory] [-f log_facility] "
1804             "[-l log_level]\n\t[-P denied_requests] "
1805             "[-p allowed_requests] [-u umask]\n"
1806             "       %s -Q protocol_feature\n",
1807             __progname, __progname);
1808         exit(1);
1809 }
1810
1811 int
1812 sftp_server_main(int argc, char **argv, struct passwd *user_pw)
1813 {
1814         int i, r, in, out, ch, skipargs = 0, log_stderr = 0;
1815         ssize_t len, olen;
1816         SyslogFacility log_facility = SYSLOG_FACILITY_AUTH;
1817         char *cp, *homedir = NULL, uidstr[32], buf[4*4096];
1818         long mask;
1819
1820         extern char *optarg;
1821         extern char *__progname;
1822
1823         __progname = ssh_get_progname(argv[0]);
1824         log_init(__progname, log_level, log_facility, log_stderr);
1825
1826         pw = pwcopy(user_pw);
1827
1828         while (!skipargs && (ch = getopt(argc, argv,
1829             "d:f:l:P:p:Q:u:cehR")) != -1) {
1830                 switch (ch) {
1831                 case 'Q':
1832                         if (strcasecmp(optarg, "requests") != 0) {
1833                                 fprintf(stderr, "Invalid query type\n");
1834                                 exit(1);
1835                         }
1836                         for (i = 0; handlers[i].handler != NULL; i++)
1837                                 printf("%s\n", handlers[i].name);
1838                         for (i = 0; extended_handlers[i].handler != NULL; i++)
1839                                 printf("%s\n", extended_handlers[i].name);
1840                         exit(0);
1841                         break;
1842                 case 'R':
1843                         readonly = 1;
1844                         break;
1845                 case 'c':
1846                         /*
1847                          * Ignore all arguments if we are invoked as a
1848                          * shell using "sftp-server -c command"
1849                          */
1850                         skipargs = 1;
1851                         break;
1852                 case 'e':
1853                         log_stderr = 1;
1854                         break;
1855                 case 'l':
1856                         log_level = log_level_number(optarg);
1857                         if (log_level == SYSLOG_LEVEL_NOT_SET)
1858                                 error("Invalid log level \"%s\"", optarg);
1859                         break;
1860                 case 'f':
1861                         log_facility = log_facility_number(optarg);
1862                         if (log_facility == SYSLOG_FACILITY_NOT_SET)
1863                                 error("Invalid log facility \"%s\"", optarg);
1864                         break;
1865                 case 'd':
1866                         cp = tilde_expand_filename(optarg, user_pw->pw_uid);
1867                         snprintf(uidstr, sizeof(uidstr), "%llu",
1868                             (unsigned long long)pw->pw_uid);
1869                         homedir = percent_expand(cp, "d", user_pw->pw_dir,
1870                             "u", user_pw->pw_name, "U", uidstr, (char *)NULL);
1871                         free(cp);
1872                         break;
1873                 case 'p':
1874                         if (request_allowlist != NULL)
1875                                 fatal("Permitted requests already set");
1876                         request_allowlist = xstrdup(optarg);
1877                         break;
1878                 case 'P':
1879                         if (request_denylist != NULL)
1880                                 fatal("Refused requests already set");
1881                         request_denylist = xstrdup(optarg);
1882                         break;
1883                 case 'u':
1884                         errno = 0;
1885                         mask = strtol(optarg, &cp, 8);
1886                         if (mask < 0 || mask > 0777 || *cp != '\0' ||
1887                             cp == optarg || (mask == 0 && errno != 0))
1888                                 fatal("Invalid umask \"%s\"", optarg);
1889                         (void)umask((mode_t)mask);
1890                         break;
1891                 case 'h':
1892                 default:
1893                         sftp_server_usage();
1894                 }
1895         }
1896
1897         log_init(__progname, log_level, log_facility, log_stderr);
1898
1899         /*
1900          * On platforms where we can, avoid making /proc/self/{mem,maps}
1901          * available to the user so that sftp access doesn't automatically
1902          * imply arbitrary code execution access that will break
1903          * restricted configurations.
1904          */
1905         platform_disable_tracing(1);    /* strict */
1906
1907         /* Drop any fine-grained privileges we don't need */
1908         platform_pledge_sftp_server();
1909
1910         if ((cp = getenv("SSH_CONNECTION")) != NULL) {
1911                 client_addr = xstrdup(cp);
1912                 if ((cp = strchr(client_addr, ' ')) == NULL) {
1913                         error("Malformed SSH_CONNECTION variable: \"%s\"",
1914                             getenv("SSH_CONNECTION"));
1915                         sftp_server_cleanup_exit(255);
1916                 }
1917                 *cp = '\0';
1918         } else
1919                 client_addr = xstrdup("UNKNOWN");
1920
1921         logit("session opened for local user %s from [%s]",
1922             pw->pw_name, client_addr);
1923
1924         in = STDIN_FILENO;
1925         out = STDOUT_FILENO;
1926
1927 #ifdef HAVE_CYGWIN
1928         setmode(in, O_BINARY);
1929         setmode(out, O_BINARY);
1930 #endif
1931
1932         if ((iqueue = sshbuf_new()) == NULL)
1933                 fatal_f("sshbuf_new failed");
1934         if ((oqueue = sshbuf_new()) == NULL)
1935                 fatal_f("sshbuf_new failed");
1936
1937         if (homedir != NULL) {
1938                 if (chdir(homedir) != 0) {
1939                         error("chdir to \"%s\" failed: %s", homedir,
1940                             strerror(errno));
1941                 }
1942         }
1943
1944         for (;;) {
1945                 struct pollfd pfd[2];
1946
1947                 memset(pfd, 0, sizeof pfd);
1948                 pfd[0].fd = pfd[1].fd = -1;
1949
1950                 /*
1951                  * Ensure that we can read a full buffer and handle
1952                  * the worst-case length packet it can generate,
1953                  * otherwise apply backpressure by stopping reads.
1954                  */
1955                 if ((r = sshbuf_check_reserve(iqueue, sizeof(buf))) == 0 &&
1956                     (r = sshbuf_check_reserve(oqueue,
1957                     SFTP_MAX_MSG_LENGTH)) == 0) {
1958                         pfd[0].fd = in;
1959                         pfd[0].events = POLLIN;
1960                 }
1961                 else if (r != SSH_ERR_NO_BUFFER_SPACE)
1962                         fatal_fr(r, "reserve");
1963
1964                 olen = sshbuf_len(oqueue);
1965                 if (olen > 0) {
1966                         pfd[1].fd = out;
1967                         pfd[1].events = POLLOUT;
1968                 }
1969
1970                 if (poll(pfd, 2, -1) == -1) {
1971                         if (errno == EINTR)
1972                                 continue;
1973                         error("poll: %s", strerror(errno));
1974                         sftp_server_cleanup_exit(2);
1975                 }
1976
1977                 /* copy stdin to iqueue */
1978                 if (pfd[0].revents & (POLLIN|POLLHUP)) {
1979                         len = read(in, buf, sizeof buf);
1980                         if (len == 0) {
1981                                 debug("read eof");
1982                                 sftp_server_cleanup_exit(0);
1983                         } else if (len == -1) {
1984                                 if (errno != EAGAIN && errno != EINTR) {
1985                                         error("read: %s", strerror(errno));
1986                                         sftp_server_cleanup_exit(1);
1987                                 }
1988                         } else if ((r = sshbuf_put(iqueue, buf, len)) != 0)
1989                                 fatal_fr(r, "sshbuf_put");
1990                 }
1991                 /* send oqueue to stdout */
1992                 if (pfd[1].revents & (POLLOUT|POLLHUP)) {
1993                         len = write(out, sshbuf_ptr(oqueue), olen);
1994                         if (len == 0 || (len == -1 && errno == EPIPE)) {
1995                                 debug("write eof");
1996                                 sftp_server_cleanup_exit(0);
1997                         } else if (len == -1) {
1998                                 sftp_server_cleanup_exit(1);
1999                                 if (errno != EAGAIN && errno != EINTR) {
2000                                         error("write: %s", strerror(errno));
2001                                         sftp_server_cleanup_exit(1);
2002                                 }
2003                         } else if ((r = sshbuf_consume(oqueue, len)) != 0)
2004                                 fatal_fr(r, "consume");
2005                 }
2006
2007                 /*
2008                  * Process requests from client if we can fit the results
2009                  * into the output buffer, otherwise stop processing input
2010                  * and let the output queue drain.
2011                  */
2012                 r = sshbuf_check_reserve(oqueue, SFTP_MAX_MSG_LENGTH);
2013                 if (r == 0)
2014                         process();
2015                 else if (r != SSH_ERR_NO_BUFFER_SPACE)
2016                         fatal_fr(r, "reserve");
2017         }
2018 }