Coverage Report

Created: 2025-06-20 06:27

/src/hpn-ssh/misc.c
Line
Count
Source (jump to first uncovered line)
1
/* $OpenBSD: misc.c,v 1.198 2024/10/24 03:14:37 djm Exp $ */
2
/*
3
 * Copyright (c) 2000 Markus Friedl.  All rights reserved.
4
 * Copyright (c) 2005-2020 Damien Miller.  All rights reserved.
5
 * Copyright (c) 2004 Henning Brauer <henning@openbsd.org>
6
 *
7
 * Permission to use, copy, modify, and distribute this software for any
8
 * purpose with or without fee is hereby granted, provided that the above
9
 * copyright notice and this permission notice appear in all copies.
10
 *
11
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
 */
19
20
21
#include "includes.h"
22
23
#include <sys/types.h>
24
#include <sys/ioctl.h>
25
#include <sys/mman.h>
26
#include <sys/socket.h>
27
#include <sys/stat.h>
28
#include <sys/time.h>
29
#include <sys/wait.h>
30
#include <sys/un.h>
31
32
#include <limits.h>
33
#ifdef HAVE_LIBGEN_H
34
# include <libgen.h>
35
#endif
36
#ifdef HAVE_POLL_H
37
#include <poll.h>
38
#endif
39
#ifdef HAVE_NLIST_H
40
#include <nlist.h>
41
#endif
42
#include <signal.h>
43
#include <stdarg.h>
44
#include <stdio.h>
45
#ifdef HAVE_STDINT_H
46
# include <stdint.h>
47
#endif
48
#include <stdlib.h>
49
#include <string.h>
50
#include <time.h>
51
#include <unistd.h>
52
53
#include <netinet/in.h>
54
#include <netinet/in_systm.h>
55
#include <netinet/ip.h>
56
#include <netinet/tcp.h>
57
#include <arpa/inet.h>
58
59
#include <ctype.h>
60
#include <errno.h>
61
#include <fcntl.h>
62
#include <netdb.h>
63
#ifdef HAVE_PATHS_H
64
# include <paths.h>
65
#include <pwd.h>
66
#include <grp.h>
67
#endif
68
#ifdef SSH_TUN_OPENBSD
69
#include <net/if.h>
70
#endif
71
72
#include "xmalloc.h"
73
#include "misc.h"
74
#include "log.h"
75
#include "ssh.h"
76
#include "sshbuf.h"
77
#include "ssherr.h"
78
#include "platform.h"
79
80
void
81
read_mem_stats(statm_t *result, int post_auth)
82
0
{
83
0
  if (!post_auth)
84
0
    return;
85
86
0
  const char* statm_path = "/proc/self/statm";
87
88
0
  FILE *f = fopen(statm_path,"r");
89
0
  if(!f){
90
0
    perror(statm_path);
91
0
    abort();
92
0
  }
93
0
  if(7 != fscanf(f,"%lu %lu %lu %lu %lu %lu %lu",
94
0
           &result->size, &result->resident, &result->share, &result->text, &result->lib,
95
0
           &result->data, &result->dt))
96
0
  {
97
0
    perror(statm_path);
98
0
    abort();
99
0
  }
100
0
  fclose(f);
101
0
}
102
103
/* remove newline at end of string */
104
char *
105
chop(char *s)
106
0
{
107
0
  char *t = s;
108
0
  while (*t) {
109
0
    if (*t == '\n' || *t == '\r') {
110
0
      *t = '\0';
111
0
      return s;
112
0
    }
113
0
    t++;
114
0
  }
115
0
  return s;
116
117
0
}
118
119
/* remove whitespace from end of string */
120
void
121
rtrim(char *s)
122
0
{
123
0
  size_t i;
124
125
0
  if ((i = strlen(s)) == 0)
126
0
    return;
127
0
  for (i--; i > 0; i--) {
128
0
    if (isspace((unsigned char)s[i]))
129
0
      s[i] = '\0';
130
0
  }
131
0
}
132
133
/*
134
 * returns pointer to character after 'prefix' in 's' or otherwise NULL
135
 * if the prefix is not present.
136
 */
137
const char *
138
strprefix(const char *s, const char *prefix, int ignorecase)
139
0
{
140
0
  size_t prefixlen;
141
142
0
  if ((prefixlen = strlen(prefix)) == 0)
143
0
    return s;
144
0
  if (ignorecase) {
145
0
    if (strncasecmp(s, prefix, prefixlen) != 0)
146
0
      return NULL;
147
0
  } else {
148
0
    if (strncmp(s, prefix, prefixlen) != 0)
149
0
      return NULL;
150
0
  }
151
0
  return s + prefixlen;
152
0
}
153
154
/* set/unset filedescriptor to non-blocking */
155
int
156
set_nonblock(int fd)
157
1.44k
{
158
1.44k
  int val;
159
160
1.44k
  val = fcntl(fd, F_GETFL);
161
1.44k
  if (val == -1) {
162
0
    error("fcntl(%d, F_GETFL): %s", fd, strerror(errno));
163
0
    return (-1);
164
0
  }
165
1.44k
  if (val & O_NONBLOCK) {
166
1.44k
    debug3("fd %d is O_NONBLOCK", fd);
167
1.44k
    return (0);
168
1.44k
  }
169
1
  debug2("fd %d setting O_NONBLOCK", fd);
170
1
  val |= O_NONBLOCK;
171
1
  if (fcntl(fd, F_SETFL, val) == -1) {
172
0
    debug("fcntl(%d, F_SETFL, O_NONBLOCK): %s", fd,
173
0
        strerror(errno));
174
0
    return (-1);
175
0
  }
176
1
  return (0);
177
1
}
178
179
int
180
unset_nonblock(int fd)
181
0
{
182
0
  int val;
183
184
0
  val = fcntl(fd, F_GETFL);
185
0
  if (val == -1) {
186
0
    error("fcntl(%d, F_GETFL): %s", fd, strerror(errno));
187
0
    return (-1);
188
0
  }
189
0
  if (!(val & O_NONBLOCK)) {
190
0
    debug3("fd %d is not O_NONBLOCK", fd);
191
0
    return (0);
192
0
  }
193
0
  debug("fd %d clearing O_NONBLOCK", fd);
194
0
  val &= ~O_NONBLOCK;
195
0
  if (fcntl(fd, F_SETFL, val) == -1) {
196
0
    debug("fcntl(%d, F_SETFL, ~O_NONBLOCK): %s",
197
0
        fd, strerror(errno));
198
0
    return (-1);
199
0
  }
200
0
  return (0);
201
0
}
202
203
const char *
204
ssh_gai_strerror(int gaierr)
205
0
{
206
0
  if (gaierr == EAI_SYSTEM && errno != 0)
207
0
    return strerror(errno);
208
0
  return gai_strerror(gaierr);
209
0
}
210
211
/* disable nagle on socket */
212
void
213
set_nodelay(int fd)
214
0
{
215
0
  int opt;
216
0
  socklen_t optlen;
217
218
0
  optlen = sizeof opt;
219
0
  if (getsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &opt, &optlen) == -1) {
220
0
    debug("getsockopt TCP_NODELAY: %.100s", strerror(errno));
221
0
    return;
222
0
  }
223
0
  if (opt == 1) {
224
0
    debug2("fd %d is TCP_NODELAY", fd);
225
0
    return;
226
0
  }
227
0
  opt = 1;
228
0
  debug2("fd %d setting TCP_NODELAY", fd);
229
0
  if (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &opt, sizeof opt) == -1)
230
0
    error("setsockopt TCP_NODELAY: %.100s", strerror(errno));
231
0
}
232
233
/* Allow local port reuse in TIME_WAIT */
234
int
235
set_reuseaddr(int fd)
236
0
{
237
0
  int on = 1;
238
239
0
  if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) == -1) {
240
0
    error("setsockopt SO_REUSEADDR fd %d: %s", fd, strerror(errno));
241
0
    return -1;
242
0
  }
243
0
  return 0;
244
0
}
245
246
/* Get/set routing domain */
247
char *
248
get_rdomain(int fd)
249
0
{
250
0
#if defined(HAVE_SYS_GET_RDOMAIN)
251
0
  return sys_get_rdomain(fd);
252
#elif defined(__OpenBSD__)
253
  int rtable;
254
  char *ret;
255
  socklen_t len = sizeof(rtable);
256
257
  if (getsockopt(fd, SOL_SOCKET, SO_RTABLE, &rtable, &len) == -1) {
258
    error("Failed to get routing domain for fd %d: %s",
259
        fd, strerror(errno));
260
    return NULL;
261
  }
262
  xasprintf(&ret, "%d", rtable);
263
  return ret;
264
#else /* defined(__OpenBSD__) */
265
  return NULL;
266
#endif
267
0
}
268
269
int
270
set_rdomain(int fd, const char *name)
271
0
{
272
0
#if defined(HAVE_SYS_SET_RDOMAIN)
273
0
  return sys_set_rdomain(fd, name);
274
#elif defined(__OpenBSD__)
275
  int rtable;
276
  const char *errstr;
277
278
  if (name == NULL)
279
    return 0; /* default table */
280
281
  rtable = (int)strtonum(name, 0, 255, &errstr);
282
  if (errstr != NULL) {
283
    /* Shouldn't happen */
284
    error("Invalid routing domain \"%s\": %s", name, errstr);
285
    return -1;
286
  }
287
  if (setsockopt(fd, SOL_SOCKET, SO_RTABLE,
288
      &rtable, sizeof(rtable)) == -1) {
289
    error("Failed to set routing domain %d on fd %d: %s",
290
        rtable, fd, strerror(errno));
291
    return -1;
292
  }
293
  return 0;
294
#else /* defined(__OpenBSD__) */
295
  error("Setting routing domain is not supported on this platform");
296
  return -1;
297
#endif
298
0
}
299
300
int
301
get_sock_af(int fd)
302
0
{
303
0
  struct sockaddr_storage to;
304
0
  socklen_t tolen = sizeof(to);
305
306
0
  memset(&to, 0, sizeof(to));
307
0
  if (getsockname(fd, (struct sockaddr *)&to, &tolen) == -1)
308
0
    return -1;
309
0
#ifdef IPV4_IN_IPV6
310
0
  if (to.ss_family == AF_INET6 &&
311
0
      IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)&to)->sin6_addr))
312
0
    return AF_INET;
313
0
#endif
314
0
  return to.ss_family;
315
0
}
316
317
void
318
set_sock_tos(int fd, int tos)
319
0
{
320
0
#ifndef IP_TOS_IS_BROKEN
321
0
  int af;
322
323
0
  switch ((af = get_sock_af(fd))) {
324
0
  case -1:
325
    /* assume not a socket */
326
0
    break;
327
0
  case AF_INET:
328
0
# ifdef IP_TOS
329
0
    debug3_f("set socket %d IP_TOS 0x%02x", fd, tos);
330
0
    if (setsockopt(fd, IPPROTO_IP, IP_TOS,
331
0
        &tos, sizeof(tos)) == -1) {
332
0
      error("setsockopt socket %d IP_TOS %d: %s",
333
0
          fd, tos, strerror(errno));
334
0
    }
335
0
# endif /* IP_TOS */
336
0
    break;
337
0
  case AF_INET6:
338
0
# ifdef IPV6_TCLASS
339
0
    debug3_f("set socket %d IPV6_TCLASS 0x%02x", fd, tos);
340
0
    if (setsockopt(fd, IPPROTO_IPV6, IPV6_TCLASS,
341
0
        &tos, sizeof(tos)) == -1) {
342
0
      error("setsockopt socket %d IPV6_TCLASS %d: %s",
343
0
          fd, tos, strerror(errno));
344
0
    }
345
0
# endif /* IPV6_TCLASS */
346
0
    break;
347
0
  default:
348
0
    debug2_f("unsupported socket family %d", af);
349
0
    break;
350
0
  }
351
0
#endif /* IP_TOS_IS_BROKEN */
352
0
}
353
354
/*
355
 * Wait up to *timeoutp milliseconds for events on fd. Updates
356
 * *timeoutp with time remaining.
357
 * Returns 0 if fd ready or -1 on timeout or error (see errno).
358
 */
359
static int
360
waitfd(int fd, int *timeoutp, short events, volatile sig_atomic_t *stop)
361
0
{
362
0
  struct pollfd pfd;
363
0
  struct timespec timeout;
364
0
  int oerrno, r;
365
0
  sigset_t nsigset, osigset;
366
367
0
  if (timeoutp && *timeoutp == -1)
368
0
    timeoutp = NULL;
369
0
  pfd.fd = fd;
370
0
  pfd.events = events;
371
0
  ptimeout_init(&timeout);
372
0
  if (timeoutp != NULL)
373
0
    ptimeout_deadline_ms(&timeout, *timeoutp);
374
0
  if (stop != NULL)
375
0
    sigfillset(&nsigset);
376
0
  for (; timeoutp == NULL || *timeoutp >= 0;) {
377
0
    if (stop != NULL) {
378
0
      sigprocmask(SIG_BLOCK, &nsigset, &osigset);
379
0
      if (*stop) {
380
0
        sigprocmask(SIG_SETMASK, &osigset, NULL);
381
0
        errno = EINTR;
382
0
        return -1;
383
0
      }
384
0
    }
385
0
    r = ppoll(&pfd, 1, ptimeout_get_tsp(&timeout),
386
0
        stop != NULL ? &osigset : NULL);
387
0
    oerrno = errno;
388
0
    if (stop != NULL)
389
0
      sigprocmask(SIG_SETMASK, &osigset, NULL);
390
0
    if (timeoutp)
391
0
      *timeoutp = ptimeout_get_ms(&timeout);
392
0
    errno = oerrno;
393
0
    if (r > 0)
394
0
      return 0;
395
0
    else if (r == -1 && errno != EAGAIN && errno != EINTR)
396
0
      return -1;
397
0
    else if (r == 0)
398
0
      break;
399
0
  }
400
  /* timeout */
401
0
  errno = ETIMEDOUT;
402
0
  return -1;
403
0
}
404
405
/*
406
 * Wait up to *timeoutp milliseconds for fd to be readable. Updates
407
 * *timeoutp with time remaining.
408
 * Returns 0 if fd ready or -1 on timeout or error (see errno).
409
 */
410
int
411
0
waitrfd(int fd, int *timeoutp, volatile sig_atomic_t *stop) {
412
0
  return waitfd(fd, timeoutp, POLLIN, stop);
413
0
}
414
415
/*
416
 * Attempt a non-blocking connect(2) to the specified address, waiting up to
417
 * *timeoutp milliseconds for the connection to complete. If the timeout is
418
 * <=0, then wait indefinitely.
419
 *
420
 * Returns 0 on success or -1 on failure.
421
 */
422
int
423
timeout_connect(int sockfd, const struct sockaddr *serv_addr,
424
    socklen_t addrlen, int *timeoutp)
425
0
{
426
0
  int optval = 0;
427
0
  socklen_t optlen = sizeof(optval);
428
429
  /* No timeout: just do a blocking connect() */
430
0
  if (timeoutp == NULL || *timeoutp <= 0)
431
0
    return connect(sockfd, serv_addr, addrlen);
432
433
0
  set_nonblock(sockfd);
434
0
  for (;;) {
435
0
    if (connect(sockfd, serv_addr, addrlen) == 0) {
436
      /* Succeeded already? */
437
0
      unset_nonblock(sockfd);
438
0
      return 0;
439
0
    } else if (errno == EINTR)
440
0
      continue;
441
0
    else if (errno != EINPROGRESS)
442
0
      return -1;
443
0
    break;
444
0
  }
445
446
0
  if (waitfd(sockfd, timeoutp, POLLIN | POLLOUT, NULL) == -1)
447
0
    return -1;
448
449
  /* Completed or failed */
450
0
  if (getsockopt(sockfd, SOL_SOCKET, SO_ERROR, &optval, &optlen) == -1) {
451
0
    debug("getsockopt: %s", strerror(errno));
452
0
    return -1;
453
0
  }
454
0
  if (optval != 0) {
455
0
    errno = optval;
456
0
    return -1;
457
0
  }
458
0
  unset_nonblock(sockfd);
459
0
  return 0;
460
0
}
461
462
/* Characters considered whitespace in strsep calls. */
463
0
#define WHITESPACE " \t\r\n"
464
0
#define QUOTE "\""
465
466
/* return next token in configuration line */
467
static char *
468
strdelim_internal(char **s, int split_equals)
469
0
{
470
0
  char *old;
471
0
  int wspace = 0;
472
473
0
  if (*s == NULL)
474
0
    return NULL;
475
476
0
  old = *s;
477
478
0
  *s = strpbrk(*s,
479
0
      split_equals ? WHITESPACE QUOTE "=" : WHITESPACE QUOTE);
480
0
  if (*s == NULL)
481
0
    return (old);
482
483
0
  if (*s[0] == '\"') {
484
0
    memmove(*s, *s + 1, strlen(*s)); /* move nul too */
485
    /* Find matching quote */
486
0
    if ((*s = strpbrk(*s, QUOTE)) == NULL) {
487
0
      return (NULL);    /* no matching quote */
488
0
    } else {
489
0
      *s[0] = '\0';
490
0
      *s += strspn(*s + 1, WHITESPACE) + 1;
491
0
      return (old);
492
0
    }
493
0
  }
494
495
  /* Allow only one '=' to be skipped */
496
0
  if (split_equals && *s[0] == '=')
497
0
    wspace = 1;
498
0
  *s[0] = '\0';
499
500
  /* Skip any extra whitespace after first token */
501
0
  *s += strspn(*s + 1, WHITESPACE) + 1;
502
0
  if (split_equals && *s[0] == '=' && !wspace)
503
0
    *s += strspn(*s + 1, WHITESPACE) + 1;
504
505
0
  return (old);
506
0
}
507
508
/*
509
 * Return next token in configuration line; splts on whitespace or a
510
 * single '=' character.
511
 */
512
char *
513
strdelim(char **s)
514
0
{
515
0
  return strdelim_internal(s, 1);
516
0
}
517
518
/*
519
 * Return next token in configuration line; splts on whitespace only.
520
 */
521
char *
522
strdelimw(char **s)
523
0
{
524
0
  return strdelim_internal(s, 0);
525
0
}
526
527
struct passwd *
528
pwcopy(struct passwd *pw)
529
0
{
530
0
  struct passwd *copy = xcalloc(1, sizeof(*copy));
531
532
0
  copy->pw_name = xstrdup(pw->pw_name);
533
0
  copy->pw_passwd = xstrdup(pw->pw_passwd == NULL ? "*" : pw->pw_passwd);
534
0
#ifdef HAVE_STRUCT_PASSWD_PW_GECOS
535
0
  copy->pw_gecos = xstrdup(pw->pw_gecos);
536
0
#endif
537
0
  copy->pw_uid = pw->pw_uid;
538
0
  copy->pw_gid = pw->pw_gid;
539
#ifdef HAVE_STRUCT_PASSWD_PW_EXPIRE
540
  copy->pw_expire = pw->pw_expire;
541
#endif
542
#ifdef HAVE_STRUCT_PASSWD_PW_CHANGE
543
  copy->pw_change = pw->pw_change;
544
#endif
545
#ifdef HAVE_STRUCT_PASSWD_PW_CLASS
546
  copy->pw_class = xstrdup(pw->pw_class);
547
#endif
548
0
  copy->pw_dir = xstrdup(pw->pw_dir);
549
0
  copy->pw_shell = xstrdup(pw->pw_shell);
550
0
  return copy;
551
0
}
552
553
/*
554
 * Convert ASCII string to TCP/IP port number.
555
 * Port must be >=0 and <=65535.
556
 * Return -1 if invalid.
557
 */
558
int
559
a2port(const char *s)
560
96.3k
{
561
96.3k
  struct servent *se;
562
96.3k
  long long port;
563
96.3k
  const char *errstr;
564
565
96.3k
  port = strtonum(s, 0, 65535, &errstr);
566
96.3k
  if (errstr == NULL)
567
96.0k
    return (int)port;
568
228
  if ((se = getservbyname(s, "tcp")) != NULL)
569
0
    return ntohs(se->s_port);
570
228
  return -1;
571
228
}
572
573
int
574
a2tun(const char *s, int *remote)
575
1.02k
{
576
1.02k
  const char *errstr = NULL;
577
1.02k
  char *sp, *ep;
578
1.02k
  int tun;
579
580
1.02k
  if (remote != NULL) {
581
0
    *remote = SSH_TUNID_ANY;
582
0
    sp = xstrdup(s);
583
0
    if ((ep = strchr(sp, ':')) == NULL) {
584
0
      free(sp);
585
0
      return (a2tun(s, NULL));
586
0
    }
587
0
    ep[0] = '\0'; ep++;
588
0
    *remote = a2tun(ep, NULL);
589
0
    tun = a2tun(sp, NULL);
590
0
    free(sp);
591
0
    return (*remote == SSH_TUNID_ERR ? *remote : tun);
592
0
  }
593
594
1.02k
  if (strcasecmp(s, "any") == 0)
595
194
    return (SSH_TUNID_ANY);
596
597
833
  tun = strtonum(s, 0, SSH_TUNID_MAX, &errstr);
598
833
  if (errstr != NULL)
599
251
    return (SSH_TUNID_ERR);
600
601
582
  return (tun);
602
833
}
603
604
0
#define SECONDS   1
605
0
#define MINUTES   (SECONDS * 60)
606
0
#define HOURS   (MINUTES * 60)
607
0
#define DAYS    (HOURS * 24)
608
0
#define WEEKS   (DAYS * 7)
609
610
static char *
611
scandigits(char *s)
612
0
{
613
0
  while (isdigit((unsigned char)*s))
614
0
    s++;
615
0
  return s;
616
0
}
617
618
/*
619
 * Convert a time string into seconds; format is
620
 * a sequence of:
621
 *      time[qualifier]
622
 *
623
 * Valid time qualifiers are:
624
 *      <none>  seconds
625
 *      s|S     seconds
626
 *      m|M     minutes
627
 *      h|H     hours
628
 *      d|D     days
629
 *      w|W     weeks
630
 *
631
 * Examples:
632
 *      90m     90 minutes
633
 *      1h30m   90 minutes
634
 *      2d      2 days
635
 *      1w      1 week
636
 *
637
 * Return -1 if time string is invalid.
638
 */
639
int
640
convtime(const char *s)
641
0
{
642
0
  int secs, total = 0, multiplier;
643
0
  char *p, *os, *np, c = 0;
644
0
  const char *errstr;
645
646
0
  if (s == NULL || *s == '\0')
647
0
    return -1;
648
0
  p = os = strdup(s); /* deal with const */
649
0
  if (os == NULL)
650
0
    return -1;
651
652
0
  while (*p) {
653
0
    np = scandigits(p);
654
0
    if (np) {
655
0
      c = *np;
656
0
      *np = '\0';
657
0
    }
658
0
    secs = (int)strtonum(p, 0, INT_MAX, &errstr);
659
0
    if (errstr)
660
0
      goto fail;
661
0
    *np = c;
662
663
0
    multiplier = 1;
664
0
    switch (c) {
665
0
    case '\0':
666
0
      np--; /* back up */
667
0
      break;
668
0
    case 's':
669
0
    case 'S':
670
0
      break;
671
0
    case 'm':
672
0
    case 'M':
673
0
      multiplier = MINUTES;
674
0
      break;
675
0
    case 'h':
676
0
    case 'H':
677
0
      multiplier = HOURS;
678
0
      break;
679
0
    case 'd':
680
0
    case 'D':
681
0
      multiplier = DAYS;
682
0
      break;
683
0
    case 'w':
684
0
    case 'W':
685
0
      multiplier = WEEKS;
686
0
      break;
687
0
    default:
688
0
      goto fail;
689
0
    }
690
0
    if (secs > INT_MAX / multiplier)
691
0
      goto fail;
692
0
    secs *= multiplier;
693
0
    if  (total > INT_MAX - secs)
694
0
      goto fail;
695
0
    total += secs;
696
0
    if (total < 0)
697
0
      goto fail;
698
0
    p = ++np;
699
0
  }
700
0
  free(os);
701
0
  return total;
702
0
fail:
703
0
  free(os);
704
0
  return -1;
705
0
}
706
707
0
#define TF_BUFS 8
708
0
#define TF_LEN  9
709
710
const char *
711
fmt_timeframe(time_t t)
712
0
{
713
0
  char    *buf;
714
0
  static char  tfbuf[TF_BUFS][TF_LEN];  /* ring buffer */
715
0
  static int   idx = 0;
716
0
  unsigned int   sec, min, hrs, day;
717
0
  unsigned long long  week;
718
719
0
  buf = tfbuf[idx++];
720
0
  if (idx == TF_BUFS)
721
0
    idx = 0;
722
723
0
  week = t;
724
725
0
  sec = week % 60;
726
0
  week /= 60;
727
0
  min = week % 60;
728
0
  week /= 60;
729
0
  hrs = week % 24;
730
0
  week /= 24;
731
0
  day = week % 7;
732
0
  week /= 7;
733
734
0
  if (week > 0)
735
0
    snprintf(buf, TF_LEN, "%02lluw%01ud%02uh", week, day, hrs);
736
0
  else if (day > 0)
737
0
    snprintf(buf, TF_LEN, "%01ud%02uh%02um", day, hrs, min);
738
0
  else
739
0
    snprintf(buf, TF_LEN, "%02u:%02u:%02u", hrs, min, sec);
740
741
0
  return (buf);
742
0
}
743
744
/*
745
 * Returns a standardized host+port identifier string.
746
 * Caller must free returned string.
747
 */
748
char *
749
put_host_port(const char *host, u_short port)
750
0
{
751
0
  char *hoststr;
752
753
0
  if (port == 0 || port == SSH_DEFAULT_PORT)
754
0
    return(xstrdup(host));
755
0
  if (asprintf(&hoststr, "[%s]:%d", host, (int)port) == -1)
756
0
    fatal("put_host_port: asprintf: %s", strerror(errno));
757
0
  debug3("put_host_port: %s", hoststr);
758
0
  return hoststr;
759
0
}
760
761
/*
762
 * Search for next delimiter between hostnames/addresses and ports.
763
 * Argument may be modified (for termination).
764
 * Returns *cp if parsing succeeds.
765
 * *cp is set to the start of the next field, if one was found.
766
 * The delimiter char, if present, is stored in delim.
767
 * If this is the last field, *cp is set to NULL.
768
 */
769
char *
770
hpdelim2(char **cp, char *delim)
771
97.5k
{
772
97.5k
  char *s, *old;
773
774
97.5k
  if (cp == NULL || *cp == NULL)
775
0
    return NULL;
776
777
97.5k
  old = s = *cp;
778
97.5k
  if (*s == '[') {
779
196
    if ((s = strchr(s, ']')) == NULL)
780
1
      return NULL;
781
195
    else
782
195
      s++;
783
97.3k
  } else if ((s = strpbrk(s, ":/")) == NULL)
784
42
    s = *cp + strlen(*cp); /* skip to end (see first case below) */
785
786
97.5k
  switch (*s) {
787
49
  case '\0':
788
49
    *cp = NULL; /* no more fields*/
789
49
    break;
790
791
22.6k
  case ':':
792
97.4k
  case '/':
793
97.4k
    if (delim != NULL)
794
0
      *delim = *s;
795
97.4k
    *s = '\0';  /* terminate */
796
97.4k
    *cp = s + 1;
797
97.4k
    break;
798
799
1
  default:
800
1
    return NULL;
801
97.5k
  }
802
803
97.5k
  return old;
804
97.5k
}
805
806
/* The common case: only accept colon as delimiter. */
807
char *
808
hpdelim(char **cp)
809
0
{
810
0
  char *r, delim = '\0';
811
812
0
  r =  hpdelim2(cp, &delim);
813
0
  if (delim == '/')
814
0
    return NULL;
815
0
  return r;
816
0
}
817
818
char *
819
cleanhostname(char *host)
820
0
{
821
0
  if (*host == '[' && host[strlen(host) - 1] == ']') {
822
0
    host[strlen(host) - 1] = '\0';
823
0
    return (host + 1);
824
0
  } else
825
0
    return host;
826
0
}
827
828
char *
829
colon(char *cp)
830
0
{
831
0
  int flag = 0;
832
833
0
  if (*cp == ':')   /* Leading colon is part of file name. */
834
0
    return NULL;
835
0
  if (*cp == '[')
836
0
    flag = 1;
837
838
0
  for (; *cp; ++cp) {
839
0
    if (*cp == '@' && *(cp+1) == '[')
840
0
      flag = 1;
841
0
    if (*cp == ']' && *(cp+1) == ':' && flag)
842
0
      return (cp+1);
843
0
    if (*cp == ':' && !flag)
844
0
      return (cp);
845
0
    if (*cp == '/')
846
0
      return NULL;
847
0
  }
848
0
  return NULL;
849
0
}
850
851
/*
852
 * Parse a [user@]host:[path] string.
853
 * Caller must free returned user, host and path.
854
 * Any of the pointer return arguments may be NULL (useful for syntax checking).
855
 * If user was not specified then *userp will be set to NULL.
856
 * If host was not specified then *hostp will be set to NULL.
857
 * If path was not specified then *pathp will be set to ".".
858
 * Returns 0 on success, -1 on failure.
859
 */
860
int
861
parse_user_host_path(const char *s, char **userp, char **hostp, char **pathp)
862
0
{
863
0
  char *user = NULL, *host = NULL, *path = NULL;
864
0
  char *sdup, *tmp;
865
0
  int ret = -1;
866
867
0
  if (userp != NULL)
868
0
    *userp = NULL;
869
0
  if (hostp != NULL)
870
0
    *hostp = NULL;
871
0
  if (pathp != NULL)
872
0
    *pathp = NULL;
873
874
0
  sdup = xstrdup(s);
875
876
  /* Check for remote syntax: [user@]host:[path] */
877
0
  if ((tmp = colon(sdup)) == NULL)
878
0
    goto out;
879
880
  /* Extract optional path */
881
0
  *tmp++ = '\0';
882
0
  if (*tmp == '\0')
883
0
    tmp = ".";
884
0
  path = xstrdup(tmp);
885
886
  /* Extract optional user and mandatory host */
887
0
  tmp = strrchr(sdup, '@');
888
0
  if (tmp != NULL) {
889
0
    *tmp++ = '\0';
890
0
    host = xstrdup(cleanhostname(tmp));
891
0
    if (*sdup != '\0')
892
0
      user = xstrdup(sdup);
893
0
  } else {
894
0
    host = xstrdup(cleanhostname(sdup));
895
0
    user = NULL;
896
0
  }
897
898
  /* Success */
899
0
  if (userp != NULL) {
900
0
    *userp = user;
901
0
    user = NULL;
902
0
  }
903
0
  if (hostp != NULL) {
904
0
    *hostp = host;
905
0
    host = NULL;
906
0
  }
907
0
  if (pathp != NULL) {
908
0
    *pathp = path;
909
0
    path = NULL;
910
0
  }
911
0
  ret = 0;
912
0
out:
913
0
  free(sdup);
914
0
  free(user);
915
0
  free(host);
916
0
  free(path);
917
0
  return ret;
918
0
}
919
920
/*
921
 * Parse a [user@]host[:port] string.
922
 * Caller must free returned user and host.
923
 * Any of the pointer return arguments may be NULL (useful for syntax checking).
924
 * If user was not specified then *userp will be set to NULL.
925
 * If port was not specified then *portp will be -1.
926
 * Returns 0 on success, -1 on failure.
927
 */
928
int
929
parse_user_host_port(const char *s, char **userp, char **hostp, int *portp)
930
0
{
931
0
  char *sdup, *cp, *tmp;
932
0
  char *user = NULL, *host = NULL;
933
0
  int port = -1, ret = -1;
934
935
0
  if (userp != NULL)
936
0
    *userp = NULL;
937
0
  if (hostp != NULL)
938
0
    *hostp = NULL;
939
0
  if (portp != NULL)
940
0
    *portp = -1;
941
942
0
  if ((sdup = tmp = strdup(s)) == NULL)
943
0
    return -1;
944
  /* Extract optional username */
945
0
  if ((cp = strrchr(tmp, '@')) != NULL) {
946
0
    *cp = '\0';
947
0
    if (*tmp == '\0')
948
0
      goto out;
949
0
    if ((user = strdup(tmp)) == NULL)
950
0
      goto out;
951
0
    tmp = cp + 1;
952
0
  }
953
  /* Extract mandatory hostname */
954
0
  if ((cp = hpdelim(&tmp)) == NULL || *cp == '\0')
955
0
    goto out;
956
0
  host = xstrdup(cleanhostname(cp));
957
  /* Convert and verify optional port */
958
0
  if (tmp != NULL && *tmp != '\0') {
959
0
    if ((port = a2port(tmp)) <= 0)
960
0
      goto out;
961
0
  }
962
  /* Success */
963
0
  if (userp != NULL) {
964
0
    *userp = user;
965
0
    user = NULL;
966
0
  }
967
0
  if (hostp != NULL) {
968
0
    *hostp = host;
969
0
    host = NULL;
970
0
  }
971
0
  if (portp != NULL)
972
0
    *portp = port;
973
0
  ret = 0;
974
0
 out:
975
0
  free(sdup);
976
0
  free(user);
977
0
  free(host);
978
0
  return ret;
979
0
}
980
981
/*
982
 * Converts a two-byte hex string to decimal.
983
 * Returns the decimal value or -1 for invalid input.
984
 */
985
static int
986
hexchar(const char *s)
987
0
{
988
0
  unsigned char result[2];
989
0
  int i;
990
991
0
  for (i = 0; i < 2; i++) {
992
0
    if (s[i] >= '0' && s[i] <= '9')
993
0
      result[i] = (unsigned char)(s[i] - '0');
994
0
    else if (s[i] >= 'a' && s[i] <= 'f')
995
0
      result[i] = (unsigned char)(s[i] - 'a') + 10;
996
0
    else if (s[i] >= 'A' && s[i] <= 'F')
997
0
      result[i] = (unsigned char)(s[i] - 'A') + 10;
998
0
    else
999
0
      return -1;
1000
0
  }
1001
0
  return (result[0] << 4) | result[1];
1002
0
}
1003
1004
/*
1005
 * Decode an url-encoded string.
1006
 * Returns a newly allocated string on success or NULL on failure.
1007
 */
1008
static char *
1009
urldecode(const char *src)
1010
0
{
1011
0
  char *ret, *dst;
1012
0
  int ch;
1013
0
  size_t srclen;
1014
1015
0
  if ((srclen = strlen(src)) >= SIZE_MAX)
1016
0
    fatal_f("input too large");
1017
0
  ret = xmalloc(srclen + 1);
1018
0
  for (dst = ret; *src != '\0'; src++) {
1019
0
    switch (*src) {
1020
0
    case '+':
1021
0
      *dst++ = ' ';
1022
0
      break;
1023
0
    case '%':
1024
0
      if (!isxdigit((unsigned char)src[1]) ||
1025
0
          !isxdigit((unsigned char)src[2]) ||
1026
0
          (ch = hexchar(src + 1)) == -1) {
1027
0
        free(ret);
1028
0
        return NULL;
1029
0
      }
1030
0
      *dst++ = ch;
1031
0
      src += 2;
1032
0
      break;
1033
0
    default:
1034
0
      *dst++ = *src;
1035
0
      break;
1036
0
    }
1037
0
  }
1038
0
  *dst = '\0';
1039
1040
0
  return ret;
1041
0
}
1042
1043
/*
1044
 * Parse an (scp|ssh|sftp)://[user@]host[:port][/path] URI.
1045
 * See https://tools.ietf.org/html/draft-ietf-secsh-scp-sftp-ssh-uri-04
1046
 * Either user or path may be url-encoded (but not host or port).
1047
 * Caller must free returned user, host and path.
1048
 * Any of the pointer return arguments may be NULL (useful for syntax checking)
1049
 * but the scheme must always be specified.
1050
 * If user was not specified then *userp will be set to NULL.
1051
 * If port was not specified then *portp will be -1.
1052
 * If path was not specified then *pathp will be set to NULL.
1053
 * Returns 0 on success, 1 if non-uri/wrong scheme, -1 on error/invalid uri.
1054
 */
1055
int
1056
parse_uri(const char *scheme, const char *uri, char **userp, char **hostp,
1057
    int *portp, char **pathp)
1058
0
{
1059
0
  char *uridup, *cp, *tmp, ch;
1060
0
  char *user = NULL, *host = NULL, *path = NULL;
1061
0
  int port = -1, ret = -1;
1062
0
  size_t len;
1063
1064
0
  len = strlen(scheme);
1065
0
  if (strncmp(uri, scheme, len) != 0 || strncmp(uri + len, "://", 3) != 0)
1066
0
    return 1;
1067
0
  uri += len + 3;
1068
1069
0
  if (userp != NULL)
1070
0
    *userp = NULL;
1071
0
  if (hostp != NULL)
1072
0
    *hostp = NULL;
1073
0
  if (portp != NULL)
1074
0
    *portp = -1;
1075
0
  if (pathp != NULL)
1076
0
    *pathp = NULL;
1077
1078
0
  uridup = tmp = xstrdup(uri);
1079
1080
  /* Extract optional ssh-info (username + connection params) */
1081
0
  if ((cp = strchr(tmp, '@')) != NULL) {
1082
0
    char *delim;
1083
1084
0
    *cp = '\0';
1085
    /* Extract username and connection params */
1086
0
    if ((delim = strchr(tmp, ';')) != NULL) {
1087
      /* Just ignore connection params for now */
1088
0
      *delim = '\0';
1089
0
    }
1090
0
    if (*tmp == '\0') {
1091
      /* Empty username */
1092
0
      goto out;
1093
0
    }
1094
0
    if ((user = urldecode(tmp)) == NULL)
1095
0
      goto out;
1096
0
    tmp = cp + 1;
1097
0
  }
1098
1099
  /* Extract mandatory hostname */
1100
0
  if ((cp = hpdelim2(&tmp, &ch)) == NULL || *cp == '\0')
1101
0
    goto out;
1102
0
  host = xstrdup(cleanhostname(cp));
1103
0
  if (!valid_domain(host, 0, NULL))
1104
0
    goto out;
1105
1106
0
  if (tmp != NULL && *tmp != '\0') {
1107
0
    if (ch == ':') {
1108
      /* Convert and verify port. */
1109
0
      if ((cp = strchr(tmp, '/')) != NULL)
1110
0
        *cp = '\0';
1111
0
      if ((port = a2port(tmp)) <= 0)
1112
0
        goto out;
1113
0
      tmp = cp ? cp + 1 : NULL;
1114
0
    }
1115
0
    if (tmp != NULL && *tmp != '\0') {
1116
      /* Extract optional path */
1117
0
      if ((path = urldecode(tmp)) == NULL)
1118
0
        goto out;
1119
0
    }
1120
0
  }
1121
1122
  /* Success */
1123
0
  if (userp != NULL) {
1124
0
    *userp = user;
1125
0
    user = NULL;
1126
0
  }
1127
0
  if (hostp != NULL) {
1128
0
    *hostp = host;
1129
0
    host = NULL;
1130
0
  }
1131
0
  if (portp != NULL)
1132
0
    *portp = port;
1133
0
  if (pathp != NULL) {
1134
0
    *pathp = path;
1135
0
    path = NULL;
1136
0
  }
1137
0
  ret = 0;
1138
0
 out:
1139
0
  free(uridup);
1140
0
  free(user);
1141
0
  free(host);
1142
0
  free(path);
1143
0
  return ret;
1144
0
}
1145
1146
/* function to assist building execv() arguments */
1147
void
1148
addargs(arglist *args, char *fmt, ...)
1149
0
{
1150
0
  va_list ap;
1151
0
  char *cp;
1152
0
  u_int nalloc;
1153
0
  int r;
1154
1155
0
  va_start(ap, fmt);
1156
0
  r = vasprintf(&cp, fmt, ap);
1157
0
  va_end(ap);
1158
0
  if (r == -1)
1159
0
    fatal_f("argument too long");
1160
1161
0
  nalloc = args->nalloc;
1162
0
  if (args->list == NULL) {
1163
0
    nalloc = 32;
1164
0
    args->num = 0;
1165
0
  } else if (args->num > (256 * 1024))
1166
0
    fatal_f("too many arguments");
1167
0
  else if (args->num >= args->nalloc)
1168
0
    fatal_f("arglist corrupt");
1169
0
  else if (args->num+2 >= nalloc)
1170
0
    nalloc *= 2;
1171
1172
0
  args->list = xrecallocarray(args->list, args->nalloc,
1173
0
      nalloc, sizeof(char *));
1174
0
  args->nalloc = nalloc;
1175
0
  args->list[args->num++] = cp;
1176
0
  args->list[args->num] = NULL;
1177
0
}
1178
1179
void
1180
replacearg(arglist *args, u_int which, char *fmt, ...)
1181
0
{
1182
0
  va_list ap;
1183
0
  char *cp;
1184
0
  int r;
1185
1186
0
  va_start(ap, fmt);
1187
0
  r = vasprintf(&cp, fmt, ap);
1188
0
  va_end(ap);
1189
0
  if (r == -1)
1190
0
    fatal_f("argument too long");
1191
0
  if (args->list == NULL || args->num >= args->nalloc)
1192
0
    fatal_f("arglist corrupt");
1193
1194
0
  if (which >= args->num)
1195
0
    fatal_f("tried to replace invalid arg %d >= %d",
1196
0
        which, args->num);
1197
0
  free(args->list[which]);
1198
0
  args->list[which] = cp;
1199
0
}
1200
1201
void
1202
freeargs(arglist *args)
1203
0
{
1204
0
  u_int i;
1205
1206
0
  if (args == NULL)
1207
0
    return;
1208
0
  if (args->list != NULL && args->num < args->nalloc) {
1209
0
    for (i = 0; i < args->num; i++)
1210
0
      free(args->list[i]);
1211
0
    free(args->list);
1212
0
  }
1213
0
  args->nalloc = args->num = 0;
1214
0
  args->list = NULL;
1215
0
}
1216
1217
/*
1218
 * Expands tildes in the file name.  Returns data allocated by xmalloc.
1219
 * Warning: this calls getpw*.
1220
 */
1221
int
1222
tilde_expand(const char *filename, uid_t uid, char **retp)
1223
0
{
1224
0
  char *ocopy = NULL, *copy, *s = NULL;
1225
0
  const char *path = NULL, *user = NULL;
1226
0
  struct passwd *pw;
1227
0
  size_t len;
1228
0
  int ret = -1, r, slash;
1229
1230
0
  *retp = NULL;
1231
0
  if (*filename != '~') {
1232
0
    *retp = xstrdup(filename);
1233
0
    return 0;
1234
0
  }
1235
0
  ocopy = copy = xstrdup(filename + 1);
1236
1237
0
  if (*copy == '\0')       /* ~ */
1238
0
    path = NULL;
1239
0
  else if (*copy == '/') {
1240
0
    copy += strspn(copy, "/");
1241
0
    if (*copy == '\0')
1242
0
      path = NULL;     /* ~/ */
1243
0
    else
1244
0
      path = copy;     /* ~/path */
1245
0
  } else {
1246
0
    user = copy;
1247
0
    if ((path = strchr(copy, '/')) != NULL) {
1248
0
      copy[path - copy] = '\0';
1249
0
      path++;
1250
0
      path += strspn(path, "/");
1251
0
      if (*path == '\0')   /* ~user/ */
1252
0
        path = NULL;
1253
      /* else        ~user/path */
1254
0
    }
1255
    /* else         ~user */
1256
0
  }
1257
0
  if (user != NULL) {
1258
0
    if ((pw = getpwnam(user)) == NULL) {
1259
0
      error_f("No such user %s", user);
1260
0
      goto out;
1261
0
    }
1262
0
  } else if ((pw = getpwuid(uid)) == NULL) {
1263
0
    error_f("No such uid %ld", (long)uid);
1264
0
    goto out;
1265
0
  }
1266
1267
  /* Make sure directory has a trailing '/' */
1268
0
  slash = (len = strlen(pw->pw_dir)) == 0 || pw->pw_dir[len - 1] != '/';
1269
1270
0
  if ((r = xasprintf(&s, "%s%s%s", pw->pw_dir,
1271
0
      slash ? "/" : "", path != NULL ? path : "")) <= 0) {
1272
0
    error_f("xasprintf failed");
1273
0
    goto out;
1274
0
  }
1275
0
  if (r >= PATH_MAX) {
1276
0
    error_f("Path too long");
1277
0
    goto out;
1278
0
  }
1279
  /* success */
1280
0
  ret = 0;
1281
0
  *retp = s;
1282
0
  s = NULL;
1283
0
 out:
1284
0
  free(s);
1285
0
  free(ocopy);
1286
0
  return ret;
1287
0
}
1288
1289
char *
1290
tilde_expand_filename(const char *filename, uid_t uid)
1291
0
{
1292
0
  char *ret;
1293
1294
0
  if (tilde_expand(filename, uid, &ret) != 0)
1295
0
    cleanup_exit(255);
1296
0
  return ret;
1297
0
}
1298
1299
/*
1300
 * Expand a string with a set of %[char] escapes and/or ${ENVIRONMENT}
1301
 * substitutions.  A number of escapes may be specified as
1302
 * (char *escape_chars, char *replacement) pairs. The list must be terminated
1303
 * by a NULL escape_char. Returns replaced string in memory allocated by
1304
 * xmalloc which the caller must free.
1305
 */
1306
static char *
1307
vdollar_percent_expand(int *parseerror, int dollar, int percent,
1308
    const char *string, va_list ap)
1309
0
{
1310
0
#define EXPAND_MAX_KEYS 64
1311
0
  u_int num_keys = 0, i;
1312
0
  struct {
1313
0
    const char *key;
1314
0
    const char *repl;
1315
0
  } keys[EXPAND_MAX_KEYS];
1316
0
  struct sshbuf *buf;
1317
0
  int r, missingvar = 0;
1318
0
  char *ret = NULL, *var, *varend, *val;
1319
0
  size_t len;
1320
1321
0
  if ((buf = sshbuf_new()) == NULL)
1322
0
    fatal_f("sshbuf_new failed");
1323
0
  if (parseerror == NULL)
1324
0
    fatal_f("null parseerror arg");
1325
0
  *parseerror = 1;
1326
1327
  /* Gather keys if we're doing percent expansion. */
1328
0
  if (percent) {
1329
0
    for (num_keys = 0; num_keys < EXPAND_MAX_KEYS; num_keys++) {
1330
0
      keys[num_keys].key = va_arg(ap, char *);
1331
0
      if (keys[num_keys].key == NULL)
1332
0
        break;
1333
0
      keys[num_keys].repl = va_arg(ap, char *);
1334
0
      if (keys[num_keys].repl == NULL) {
1335
0
        fatal_f("NULL replacement for token %s",
1336
0
            keys[num_keys].key);
1337
0
      }
1338
0
    }
1339
0
    if (num_keys == EXPAND_MAX_KEYS && va_arg(ap, char *) != NULL)
1340
0
      fatal_f("too many keys");
1341
0
    if (num_keys == 0)
1342
0
      fatal_f("percent expansion without token list");
1343
0
  }
1344
1345
  /* Expand string */
1346
0
  for (i = 0; *string != '\0'; string++) {
1347
    /* Optionally process ${ENVIRONMENT} expansions. */
1348
0
    if (dollar && string[0] == '$' && string[1] == '{') {
1349
0
      string += 2;  /* skip over '${' */
1350
0
      if ((varend = strchr(string, '}')) == NULL) {
1351
0
        error_f("environment variable '%s' missing "
1352
0
            "closing '}'", string);
1353
0
        goto out;
1354
0
      }
1355
0
      len = varend - string;
1356
0
      if (len == 0) {
1357
0
        error_f("zero-length environment variable");
1358
0
        goto out;
1359
0
      }
1360
0
      var = xmalloc(len + 1);
1361
0
      (void)strlcpy(var, string, len + 1);
1362
0
      if ((val = getenv(var)) == NULL) {
1363
0
        error_f("env var ${%s} has no value", var);
1364
0
        missingvar = 1;
1365
0
      } else {
1366
0
        debug3_f("expand ${%s} -> '%s'", var, val);
1367
0
        if ((r = sshbuf_put(buf, val, strlen(val))) !=0)
1368
0
          fatal_fr(r, "sshbuf_put ${}");
1369
0
      }
1370
0
      free(var);
1371
0
      string += len;
1372
0
      continue;
1373
0
    }
1374
1375
    /*
1376
     * Process percent expansions if we have a list of TOKENs.
1377
     * If we're not doing percent expansion everything just gets
1378
     * appended here.
1379
     */
1380
0
    if (*string != '%' || !percent) {
1381
0
 append:
1382
0
      if ((r = sshbuf_put_u8(buf, *string)) != 0)
1383
0
        fatal_fr(r, "sshbuf_put_u8 %%");
1384
0
      continue;
1385
0
    }
1386
0
    string++;
1387
    /* %% case */
1388
0
    if (*string == '%')
1389
0
      goto append;
1390
0
    if (*string == '\0') {
1391
0
      error_f("invalid format");
1392
0
      goto out;
1393
0
    }
1394
0
    for (i = 0; i < num_keys; i++) {
1395
0
      if (strchr(keys[i].key, *string) != NULL) {
1396
0
        if ((r = sshbuf_put(buf, keys[i].repl,
1397
0
            strlen(keys[i].repl))) != 0)
1398
0
          fatal_fr(r, "sshbuf_put %%-repl");
1399
0
        break;
1400
0
      }
1401
0
    }
1402
0
    if (i >= num_keys) {
1403
0
      error_f("unknown key %%%c", *string);
1404
0
      goto out;
1405
0
    }
1406
0
  }
1407
0
  if (!missingvar && (ret = sshbuf_dup_string(buf)) == NULL)
1408
0
    fatal_f("sshbuf_dup_string failed");
1409
0
  *parseerror = 0;
1410
0
 out:
1411
0
  sshbuf_free(buf);
1412
0
  return *parseerror ? NULL : ret;
1413
0
#undef EXPAND_MAX_KEYS
1414
0
}
1415
1416
/*
1417
 * Expand only environment variables.
1418
 * Note that although this function is variadic like the other similar
1419
 * functions, any such arguments will be unused.
1420
 */
1421
1422
char *
1423
dollar_expand(int *parseerr, const char *string, ...)
1424
0
{
1425
0
  char *ret;
1426
0
  int err;
1427
0
  va_list ap;
1428
1429
0
  va_start(ap, string);
1430
0
  ret = vdollar_percent_expand(&err, 1, 0, string, ap);
1431
0
  va_end(ap);
1432
0
  if (parseerr != NULL)
1433
0
    *parseerr = err;
1434
0
  return ret;
1435
0
}
1436
1437
/*
1438
 * Returns expanded string or NULL if a specified environment variable is
1439
 * not defined, or calls fatal if the string is invalid.
1440
 */
1441
char *
1442
percent_expand(const char *string, ...)
1443
0
{
1444
0
  char *ret;
1445
0
  int err;
1446
0
  va_list ap;
1447
1448
0
  va_start(ap, string);
1449
0
  ret = vdollar_percent_expand(&err, 0, 1, string, ap);
1450
0
  va_end(ap);
1451
0
  if (err)
1452
0
    fatal_f("failed");
1453
0
  return ret;
1454
0
}
1455
1456
/*
1457
 * Returns expanded string or NULL if a specified environment variable is
1458
 * not defined, or calls fatal if the string is invalid.
1459
 */
1460
char *
1461
percent_dollar_expand(const char *string, ...)
1462
0
{
1463
0
  char *ret;
1464
0
  int err;
1465
0
  va_list ap;
1466
1467
0
  va_start(ap, string);
1468
0
  ret = vdollar_percent_expand(&err, 1, 1, string, ap);
1469
0
  va_end(ap);
1470
0
  if (err)
1471
0
    fatal_f("failed");
1472
0
  return ret;
1473
0
}
1474
1475
int
1476
tun_open(int tun, int mode, char **ifname)
1477
0
{
1478
0
#if defined(CUSTOM_SYS_TUN_OPEN)
1479
0
  return (sys_tun_open(tun, mode, ifname));
1480
#elif defined(SSH_TUN_OPENBSD)
1481
  struct ifreq ifr;
1482
  char name[100];
1483
  int fd = -1, sock;
1484
  const char *tunbase = "tun";
1485
1486
  if (ifname != NULL)
1487
    *ifname = NULL;
1488
1489
  if (mode == SSH_TUNMODE_ETHERNET)
1490
    tunbase = "tap";
1491
1492
  /* Open the tunnel device */
1493
  if (tun <= SSH_TUNID_MAX) {
1494
    snprintf(name, sizeof(name), "/dev/%s%d", tunbase, tun);
1495
    fd = open(name, O_RDWR);
1496
  } else if (tun == SSH_TUNID_ANY) {
1497
    for (tun = 100; tun >= 0; tun--) {
1498
      snprintf(name, sizeof(name), "/dev/%s%d",
1499
          tunbase, tun);
1500
      if ((fd = open(name, O_RDWR)) >= 0)
1501
        break;
1502
    }
1503
  } else {
1504
    debug_f("invalid tunnel %u", tun);
1505
    return -1;
1506
  }
1507
1508
  if (fd == -1) {
1509
    debug_f("%s open: %s", name, strerror(errno));
1510
    return -1;
1511
  }
1512
1513
  debug_f("%s mode %d fd %d", name, mode, fd);
1514
1515
  /* Bring interface up if it is not already */
1516
  snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s%d", tunbase, tun);
1517
  if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
1518
    goto failed;
1519
1520
  if (ioctl(sock, SIOCGIFFLAGS, &ifr) == -1) {
1521
    debug_f("get interface %s flags: %s", ifr.ifr_name,
1522
        strerror(errno));
1523
    goto failed;
1524
  }
1525
1526
  if (!(ifr.ifr_flags & IFF_UP)) {
1527
    ifr.ifr_flags |= IFF_UP;
1528
    if (ioctl(sock, SIOCSIFFLAGS, &ifr) == -1) {
1529
      debug_f("activate interface %s: %s", ifr.ifr_name,
1530
          strerror(errno));
1531
      goto failed;
1532
    }
1533
  }
1534
1535
  if (ifname != NULL)
1536
    *ifname = xstrdup(ifr.ifr_name);
1537
1538
  close(sock);
1539
  return fd;
1540
1541
 failed:
1542
  if (fd >= 0)
1543
    close(fd);
1544
  if (sock >= 0)
1545
    close(sock);
1546
  return -1;
1547
#else
1548
  error("Tunnel interfaces are not supported on this platform");
1549
  return (-1);
1550
#endif
1551
0
}
1552
1553
void
1554
sanitise_stdfd(void)
1555
0
{
1556
0
  int nullfd, dupfd;
1557
1558
0
  if ((nullfd = dupfd = open(_PATH_DEVNULL, O_RDWR)) == -1) {
1559
0
    fprintf(stderr, "Couldn't open /dev/null: %s\n",
1560
0
        strerror(errno));
1561
0
    exit(1);
1562
0
  }
1563
0
  while (++dupfd <= STDERR_FILENO) {
1564
    /* Only populate closed fds. */
1565
0
    if (fcntl(dupfd, F_GETFL) == -1 && errno == EBADF) {
1566
0
      if (dup2(nullfd, dupfd) == -1) {
1567
0
        fprintf(stderr, "dup2: %s\n", strerror(errno));
1568
0
        exit(1);
1569
0
      }
1570
0
    }
1571
0
  }
1572
0
  if (nullfd > STDERR_FILENO)
1573
0
    close(nullfd);
1574
0
}
1575
1576
char *
1577
tohex(const void *vp, size_t l)
1578
2.00k
{
1579
2.00k
  const u_char *p = (const u_char *)vp;
1580
2.00k
  char b[3], *r;
1581
2.00k
  size_t i, hl;
1582
1583
2.00k
  if (l > 65536)
1584
0
    return xstrdup("tohex: length > 65536");
1585
1586
2.00k
  hl = l * 2 + 1;
1587
2.00k
  r = xcalloc(1, hl);
1588
97.7k
  for (i = 0; i < l; i++) {
1589
95.7k
    snprintf(b, sizeof(b), "%02x", p[i]);
1590
95.7k
    strlcat(r, b, hl);
1591
95.7k
  }
1592
2.00k
  return (r);
1593
2.00k
}
1594
1595
/*
1596
 * Extend string *sp by the specified format. If *sp is not NULL (or empty),
1597
 * then the separator 'sep' will be prepended before the formatted arguments.
1598
 * Extended strings are heap allocated.
1599
 */
1600
void
1601
xextendf(char **sp, const char *sep, const char *fmt, ...)
1602
0
{
1603
0
  va_list ap;
1604
0
  char *tmp1, *tmp2;
1605
1606
0
  va_start(ap, fmt);
1607
0
  xvasprintf(&tmp1, fmt, ap);
1608
0
  va_end(ap);
1609
1610
0
  if (*sp == NULL || **sp == '\0') {
1611
0
    free(*sp);
1612
0
    *sp = tmp1;
1613
0
    return;
1614
0
  }
1615
0
  xasprintf(&tmp2, "%s%s%s", *sp, sep == NULL ? "" : sep, tmp1);
1616
0
  free(tmp1);
1617
0
  free(*sp);
1618
0
  *sp = tmp2;
1619
0
}
1620
1621
1622
u_int64_t
1623
get_u64(const void *vp)
1624
0
{
1625
0
  const u_char *p = (const u_char *)vp;
1626
0
  u_int64_t v;
1627
1628
0
  v  = (u_int64_t)p[0] << 56;
1629
0
  v |= (u_int64_t)p[1] << 48;
1630
0
  v |= (u_int64_t)p[2] << 40;
1631
0
  v |= (u_int64_t)p[3] << 32;
1632
0
  v |= (u_int64_t)p[4] << 24;
1633
0
  v |= (u_int64_t)p[5] << 16;
1634
0
  v |= (u_int64_t)p[6] << 8;
1635
0
  v |= (u_int64_t)p[7];
1636
1637
0
  return (v);
1638
0
}
1639
1640
u_int32_t
1641
get_u32(const void *vp)
1642
0
{
1643
0
  const u_char *p = (const u_char *)vp;
1644
0
  u_int32_t v;
1645
1646
0
  v  = (u_int32_t)p[0] << 24;
1647
0
  v |= (u_int32_t)p[1] << 16;
1648
0
  v |= (u_int32_t)p[2] << 8;
1649
0
  v |= (u_int32_t)p[3];
1650
1651
0
  return (v);
1652
0
}
1653
1654
u_int16_t
1655
get_u16(const void *vp)
1656
0
{
1657
0
  const u_char *p = (const u_char *)vp;
1658
0
  u_int16_t v;
1659
1660
0
  v  = (u_int16_t)p[0] << 8;
1661
0
  v |= (u_int16_t)p[1];
1662
1663
0
  return (v);
1664
0
}
1665
1666
void
1667
put_u64(void *vp, u_int64_t v)
1668
0
{
1669
0
  u_char *p = (u_char *)vp;
1670
1671
0
  p[0] = (u_char)(v >> 56) & 0xff;
1672
0
  p[1] = (u_char)(v >> 48) & 0xff;
1673
0
  p[2] = (u_char)(v >> 40) & 0xff;
1674
0
  p[3] = (u_char)(v >> 32) & 0xff;
1675
0
  p[4] = (u_char)(v >> 24) & 0xff;
1676
0
  p[5] = (u_char)(v >> 16) & 0xff;
1677
0
  p[6] = (u_char)(v >> 8) & 0xff;
1678
0
  p[7] = (u_char)v & 0xff;
1679
0
}
1680
1681
void
1682
put_u32(void *vp, u_int32_t v)
1683
0
{
1684
0
  u_char *p = (u_char *)vp;
1685
1686
0
  p[0] = (u_char)(v >> 24) & 0xff;
1687
0
  p[1] = (u_char)(v >> 16) & 0xff;
1688
0
  p[2] = (u_char)(v >> 8) & 0xff;
1689
0
  p[3] = (u_char)v & 0xff;
1690
0
}
1691
1692
void
1693
put_u16(void *vp, u_int16_t v)
1694
0
{
1695
0
  u_char *p = (u_char *)vp;
1696
1697
0
  p[0] = (u_char)(v >> 8) & 0xff;
1698
0
  p[1] = (u_char)v & 0xff;
1699
0
}
1700
1701
void
1702
ms_subtract_diff(struct timeval *start, int *ms)
1703
0
{
1704
0
  struct timeval diff, finish;
1705
1706
0
  monotime_tv(&finish);
1707
0
  timersub(&finish, start, &diff);
1708
0
  *ms -= (diff.tv_sec * 1000) + (diff.tv_usec / 1000);
1709
0
}
1710
1711
void
1712
ms_to_timespec(struct timespec *ts, int ms)
1713
0
{
1714
0
  if (ms < 0)
1715
0
    ms = 0;
1716
0
  ts->tv_sec = ms / 1000;
1717
0
  ts->tv_nsec = (ms % 1000) * 1000 * 1000;
1718
0
}
1719
1720
void
1721
monotime_ts(struct timespec *ts)
1722
0
{
1723
0
  struct timeval tv;
1724
0
#if defined(HAVE_CLOCK_GETTIME) && (defined(CLOCK_BOOTTIME) || \
1725
0
    defined(CLOCK_MONOTONIC) || defined(CLOCK_REALTIME))
1726
0
  static int gettime_failed = 0;
1727
1728
0
  if (!gettime_failed) {
1729
0
# ifdef CLOCK_BOOTTIME
1730
0
    if (clock_gettime(CLOCK_BOOTTIME, ts) == 0)
1731
0
      return;
1732
0
# endif /* CLOCK_BOOTTIME */
1733
0
# ifdef CLOCK_MONOTONIC
1734
0
    if (clock_gettime(CLOCK_MONOTONIC, ts) == 0)
1735
0
      return;
1736
0
# endif /* CLOCK_MONOTONIC */
1737
0
# ifdef CLOCK_REALTIME
1738
    /* Not monotonic, but we're almost out of options here. */
1739
0
    if (clock_gettime(CLOCK_REALTIME, ts) == 0)
1740
0
      return;
1741
0
# endif /* CLOCK_REALTIME */
1742
0
    debug3("clock_gettime: %s", strerror(errno));
1743
0
    gettime_failed = 1;
1744
0
  }
1745
0
#endif /* HAVE_CLOCK_GETTIME && (BOOTTIME || MONOTONIC || REALTIME) */
1746
0
  gettimeofday(&tv, NULL);
1747
0
  ts->tv_sec = tv.tv_sec;
1748
0
  ts->tv_nsec = (long)tv.tv_usec * 1000;
1749
0
}
1750
1751
void
1752
monotime_tv(struct timeval *tv)
1753
0
{
1754
0
  struct timespec ts;
1755
1756
0
  monotime_ts(&ts);
1757
0
  tv->tv_sec = ts.tv_sec;
1758
0
  tv->tv_usec = ts.tv_nsec / 1000;
1759
0
}
1760
1761
time_t
1762
monotime(void)
1763
0
{
1764
0
  struct timespec ts;
1765
1766
0
  monotime_ts(&ts);
1767
0
  return ts.tv_sec;
1768
0
}
1769
1770
double
1771
monotime_double(void)
1772
0
{
1773
0
  struct timespec ts;
1774
1775
0
  monotime_ts(&ts);
1776
0
  return ts.tv_sec + ((double)ts.tv_nsec / 1000000000);
1777
0
}
1778
1779
void
1780
bandwidth_limit_init(struct bwlimit *bw, u_int64_t kbps, size_t buflen)
1781
0
{
1782
0
  bw->buflen = buflen;
1783
0
  bw->rate = kbps;
1784
0
  bw->thresh = buflen;
1785
0
  bw->lamt = 0;
1786
0
  timerclear(&bw->bwstart);
1787
0
  timerclear(&bw->bwend);
1788
0
}
1789
1790
/* Callback from read/write loop to insert bandwidth-limiting delays */
1791
void
1792
bandwidth_limit(struct bwlimit *bw, size_t read_len)
1793
0
{
1794
0
  u_int64_t waitlen;
1795
0
  struct timespec ts, rm;
1796
1797
0
  bw->lamt += read_len;
1798
0
  if (!timerisset(&bw->bwstart)) {
1799
0
    monotime_tv(&bw->bwstart);
1800
0
    return;
1801
0
  }
1802
0
  if (bw->lamt < bw->thresh)
1803
0
    return;
1804
1805
0
  monotime_tv(&bw->bwend);
1806
0
  timersub(&bw->bwend, &bw->bwstart, &bw->bwend);
1807
0
  if (!timerisset(&bw->bwend))
1808
0
    return;
1809
1810
0
  bw->lamt *= 8;
1811
0
  waitlen = (double)1000000L * bw->lamt / bw->rate;
1812
1813
0
  bw->bwstart.tv_sec = waitlen / 1000000L;
1814
0
  bw->bwstart.tv_usec = waitlen % 1000000L;
1815
1816
0
  if (timercmp(&bw->bwstart, &bw->bwend, >)) {
1817
0
    timersub(&bw->bwstart, &bw->bwend, &bw->bwend);
1818
1819
    /* Adjust the wait time */
1820
0
    if (bw->bwend.tv_sec) {
1821
0
      bw->thresh /= 2;
1822
0
      if (bw->thresh < bw->buflen / 4)
1823
0
        bw->thresh = bw->buflen / 4;
1824
0
    } else if (bw->bwend.tv_usec < 10000) {
1825
0
      bw->thresh *= 2;
1826
0
      if (bw->thresh > bw->buflen * 8)
1827
0
        bw->thresh = bw->buflen * 8;
1828
0
    }
1829
1830
0
    TIMEVAL_TO_TIMESPEC(&bw->bwend, &ts);
1831
0
    while (nanosleep(&ts, &rm) == -1) {
1832
0
      if (errno != EINTR)
1833
0
        break;
1834
0
      ts = rm;
1835
0
    }
1836
0
  }
1837
1838
0
  bw->lamt = 0;
1839
0
  monotime_tv(&bw->bwstart);
1840
0
}
1841
1842
/* Make a template filename for mk[sd]temp() */
1843
void
1844
mktemp_proto(char *s, size_t len)
1845
0
{
1846
0
  const char *tmpdir;
1847
0
  int r;
1848
1849
0
  if ((tmpdir = getenv("TMPDIR")) != NULL) {
1850
0
    r = snprintf(s, len, "%s/ssh-XXXXXXXXXXXX", tmpdir);
1851
0
    if (r > 0 && (size_t)r < len)
1852
0
      return;
1853
0
  }
1854
0
  r = snprintf(s, len, "/tmp/ssh-XXXXXXXXXXXX");
1855
0
  if (r < 0 || (size_t)r >= len)
1856
0
    fatal_f("template string too short");
1857
0
}
1858
1859
static const struct {
1860
  const char *name;
1861
  int value;
1862
} ipqos[] = {
1863
  { "none", INT_MAX },    /* can't use 0 here; that's CS0 */
1864
  { "af11", IPTOS_DSCP_AF11 },
1865
  { "af12", IPTOS_DSCP_AF12 },
1866
  { "af13", IPTOS_DSCP_AF13 },
1867
  { "af21", IPTOS_DSCP_AF21 },
1868
  { "af22", IPTOS_DSCP_AF22 },
1869
  { "af23", IPTOS_DSCP_AF23 },
1870
  { "af31", IPTOS_DSCP_AF31 },
1871
  { "af32", IPTOS_DSCP_AF32 },
1872
  { "af33", IPTOS_DSCP_AF33 },
1873
  { "af41", IPTOS_DSCP_AF41 },
1874
  { "af42", IPTOS_DSCP_AF42 },
1875
  { "af43", IPTOS_DSCP_AF43 },
1876
  { "cs0", IPTOS_DSCP_CS0 },
1877
  { "cs1", IPTOS_DSCP_CS1 },
1878
  { "cs2", IPTOS_DSCP_CS2 },
1879
  { "cs3", IPTOS_DSCP_CS3 },
1880
  { "cs4", IPTOS_DSCP_CS4 },
1881
  { "cs5", IPTOS_DSCP_CS5 },
1882
  { "cs6", IPTOS_DSCP_CS6 },
1883
  { "cs7", IPTOS_DSCP_CS7 },
1884
  { "ef", IPTOS_DSCP_EF },
1885
  { "le", IPTOS_DSCP_LE },
1886
  { "lowdelay", IPTOS_LOWDELAY },
1887
  { "throughput", IPTOS_THROUGHPUT },
1888
  { "reliability", IPTOS_RELIABILITY },
1889
  { NULL, -1 }
1890
};
1891
1892
int
1893
parse_ipqos(const char *cp)
1894
0
{
1895
0
  const char *errstr;
1896
0
  u_int i;
1897
0
  int val;
1898
1899
0
  if (cp == NULL)
1900
0
    return -1;
1901
0
  for (i = 0; ipqos[i].name != NULL; i++) {
1902
0
    if (strcasecmp(cp, ipqos[i].name) == 0)
1903
0
      return ipqos[i].value;
1904
0
  }
1905
  /* Try parsing as an integer */
1906
0
  val = (int)strtonum(cp, 0, 255, &errstr);
1907
0
  if (errstr)
1908
0
    return -1;
1909
0
  return val;
1910
0
}
1911
1912
const char *
1913
iptos2str(int iptos)
1914
0
{
1915
0
  int i;
1916
0
  static char iptos_str[sizeof "0xff"];
1917
1918
0
  for (i = 0; ipqos[i].name != NULL; i++) {
1919
0
    if (ipqos[i].value == iptos)
1920
0
      return ipqos[i].name;
1921
0
  }
1922
0
  snprintf(iptos_str, sizeof iptos_str, "0x%02x", iptos);
1923
0
  return iptos_str;
1924
0
}
1925
1926
void
1927
lowercase(char *s)
1928
0
{
1929
0
  for (; *s; s++)
1930
0
    *s = tolower((u_char)*s);
1931
0
}
1932
1933
int
1934
unix_listener(const char *path, int backlog, int unlink_first)
1935
0
{
1936
0
  struct sockaddr_un sunaddr;
1937
0
  int saved_errno, sock;
1938
1939
0
  memset(&sunaddr, 0, sizeof(sunaddr));
1940
0
  sunaddr.sun_family = AF_UNIX;
1941
0
  if (strlcpy(sunaddr.sun_path, path,
1942
0
      sizeof(sunaddr.sun_path)) >= sizeof(sunaddr.sun_path)) {
1943
0
    error_f("path \"%s\" too long for Unix domain socket", path);
1944
0
    errno = ENAMETOOLONG;
1945
0
    return -1;
1946
0
  }
1947
1948
0
  sock = socket(PF_UNIX, SOCK_STREAM, 0);
1949
0
  if (sock == -1) {
1950
0
    saved_errno = errno;
1951
0
    error_f("socket: %.100s", strerror(errno));
1952
0
    errno = saved_errno;
1953
0
    return -1;
1954
0
  }
1955
0
  if (unlink_first == 1) {
1956
0
    if (unlink(path) != 0 && errno != ENOENT)
1957
0
      error("unlink(%s): %.100s", path, strerror(errno));
1958
0
  }
1959
0
  if (bind(sock, (struct sockaddr *)&sunaddr, sizeof(sunaddr)) == -1) {
1960
0
    saved_errno = errno;
1961
0
    error_f("cannot bind to path %s: %s", path, strerror(errno));
1962
0
    close(sock);
1963
0
    errno = saved_errno;
1964
0
    return -1;
1965
0
  }
1966
0
  if (listen(sock, backlog) == -1) {
1967
0
    saved_errno = errno;
1968
0
    error_f("cannot listen on path %s: %s", path, strerror(errno));
1969
0
    close(sock);
1970
0
    unlink(path);
1971
0
    errno = saved_errno;
1972
0
    return -1;
1973
0
  }
1974
0
  return sock;
1975
0
}
1976
1977
void
1978
sock_set_v6only(int s)
1979
0
{
1980
0
#if defined(IPV6_V6ONLY) && !defined(__OpenBSD__)
1981
0
  int on = 1;
1982
1983
0
  debug3("%s: set socket %d IPV6_V6ONLY", __func__, s);
1984
0
  if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)) == -1)
1985
0
    error("setsockopt IPV6_V6ONLY: %s", strerror(errno));
1986
0
#endif
1987
0
}
1988
1989
/*
1990
 * Compares two strings that maybe be NULL. Returns non-zero if strings
1991
 * are both NULL or are identical, returns zero otherwise.
1992
 */
1993
static int
1994
strcmp_maybe_null(const char *a, const char *b)
1995
0
{
1996
0
  if ((a == NULL && b != NULL) || (a != NULL && b == NULL))
1997
0
    return 0;
1998
0
  if (a != NULL && strcmp(a, b) != 0)
1999
0
    return 0;
2000
0
  return 1;
2001
0
}
2002
2003
/*
2004
 * Compare two forwards, returning non-zero if they are identical or
2005
 * zero otherwise.
2006
 */
2007
int
2008
forward_equals(const struct Forward *a, const struct Forward *b)
2009
0
{
2010
0
  if (strcmp_maybe_null(a->listen_host, b->listen_host) == 0)
2011
0
    return 0;
2012
0
  if (a->listen_port != b->listen_port)
2013
0
    return 0;
2014
0
  if (strcmp_maybe_null(a->listen_path, b->listen_path) == 0)
2015
0
    return 0;
2016
0
  if (strcmp_maybe_null(a->connect_host, b->connect_host) == 0)
2017
0
    return 0;
2018
0
  if (a->connect_port != b->connect_port)
2019
0
    return 0;
2020
0
  if (strcmp_maybe_null(a->connect_path, b->connect_path) == 0)
2021
0
    return 0;
2022
  /* allocated_port and handle are not checked */
2023
0
  return 1;
2024
0
}
2025
2026
/* returns port number, FWD_PERMIT_ANY_PORT or -1 on error */
2027
int
2028
permitopen_port(const char *p)
2029
0
{
2030
0
  int port;
2031
2032
0
  if (strcmp(p, "*") == 0)
2033
0
    return FWD_PERMIT_ANY_PORT;
2034
0
  if ((port = a2port(p)) > 0)
2035
0
    return port;
2036
0
  return -1;
2037
0
}
2038
2039
/* returns 1 if process is already daemonized, 0 otherwise */
2040
int
2041
daemonized(void)
2042
0
{
2043
0
  int fd;
2044
2045
0
  if ((fd = open(_PATH_TTY, O_RDONLY | O_NOCTTY)) >= 0) {
2046
0
    close(fd);
2047
0
    return 0; /* have controlling terminal */
2048
0
  }
2049
0
  if (getppid() != 1)
2050
0
    return 0; /* parent is not init */
2051
0
  if (getsid(0) != getpid())
2052
0
    return 0; /* not session leader */
2053
0
  debug3("already daemonized");
2054
0
  return 1;
2055
0
}
2056
2057
/*
2058
 * Splits 's' into an argument vector. Handles quoted string and basic
2059
 * escape characters (\\, \", \'). Caller must free the argument vector
2060
 * and its members.
2061
 */
2062
int
2063
argv_split(const char *s, int *argcp, char ***argvp, int terminate_on_comment)
2064
0
{
2065
0
  int r = SSH_ERR_INTERNAL_ERROR;
2066
0
  int argc = 0, quote, i, j;
2067
0
  char *arg, **argv = xcalloc(1, sizeof(*argv));
2068
2069
0
  *argvp = NULL;
2070
0
  *argcp = 0;
2071
2072
0
  for (i = 0; s[i] != '\0'; i++) {
2073
    /* Skip leading whitespace */
2074
0
    if (s[i] == ' ' || s[i] == '\t')
2075
0
      continue;
2076
0
    if (terminate_on_comment && s[i] == '#')
2077
0
      break;
2078
    /* Start of a token */
2079
0
    quote = 0;
2080
2081
0
    argv = xreallocarray(argv, (argc + 2), sizeof(*argv));
2082
0
    arg = argv[argc++] = xcalloc(1, strlen(s + i) + 1);
2083
0
    argv[argc] = NULL;
2084
2085
    /* Copy the token in, removing escapes */
2086
0
    for (j = 0; s[i] != '\0'; i++) {
2087
0
      if (s[i] == '\\') {
2088
0
        if (s[i + 1] == '\'' ||
2089
0
            s[i + 1] == '\"' ||
2090
0
            s[i + 1] == '\\' ||
2091
0
            (quote == 0 && s[i + 1] == ' ')) {
2092
0
          i++; /* Skip '\' */
2093
0
          arg[j++] = s[i];
2094
0
        } else {
2095
          /* Unrecognised escape */
2096
0
          arg[j++] = s[i];
2097
0
        }
2098
0
      } else if (quote == 0 && (s[i] == ' ' || s[i] == '\t'))
2099
0
        break; /* done */
2100
0
      else if (quote == 0 && (s[i] == '\"' || s[i] == '\''))
2101
0
        quote = s[i]; /* quote start */
2102
0
      else if (quote != 0 && s[i] == quote)
2103
0
        quote = 0; /* quote end */
2104
0
      else
2105
0
        arg[j++] = s[i];
2106
0
    }
2107
0
    if (s[i] == '\0') {
2108
0
      if (quote != 0) {
2109
        /* Ran out of string looking for close quote */
2110
0
        r = SSH_ERR_INVALID_FORMAT;
2111
0
        goto out;
2112
0
      }
2113
0
      break;
2114
0
    }
2115
0
  }
2116
  /* Success */
2117
0
  *argcp = argc;
2118
0
  *argvp = argv;
2119
0
  argc = 0;
2120
0
  argv = NULL;
2121
0
  r = 0;
2122
0
 out:
2123
0
  if (argc != 0 && argv != NULL) {
2124
0
    for (i = 0; i < argc; i++)
2125
0
      free(argv[i]);
2126
0
    free(argv);
2127
0
  }
2128
0
  return r;
2129
0
}
2130
2131
/*
2132
 * Reassemble an argument vector into a string, quoting and escaping as
2133
 * necessary. Caller must free returned string.
2134
 */
2135
char *
2136
argv_assemble(int argc, char **argv)
2137
0
{
2138
0
  int i, j, ws, r;
2139
0
  char c, *ret;
2140
0
  struct sshbuf *buf, *arg;
2141
2142
0
  if ((buf = sshbuf_new()) == NULL || (arg = sshbuf_new()) == NULL)
2143
0
    fatal_f("sshbuf_new failed");
2144
2145
0
  for (i = 0; i < argc; i++) {
2146
0
    ws = 0;
2147
0
    sshbuf_reset(arg);
2148
0
    for (j = 0; argv[i][j] != '\0'; j++) {
2149
0
      r = 0;
2150
0
      c = argv[i][j];
2151
0
      switch (c) {
2152
0
      case ' ':
2153
0
      case '\t':
2154
0
        ws = 1;
2155
0
        r = sshbuf_put_u8(arg, c);
2156
0
        break;
2157
0
      case '\\':
2158
0
      case '\'':
2159
0
      case '"':
2160
0
        if ((r = sshbuf_put_u8(arg, '\\')) != 0)
2161
0
          break;
2162
        /* FALLTHROUGH */
2163
0
      default:
2164
0
        r = sshbuf_put_u8(arg, c);
2165
0
        break;
2166
0
      }
2167
0
      if (r != 0)
2168
0
        fatal_fr(r, "sshbuf_put_u8");
2169
0
    }
2170
0
    if ((i != 0 && (r = sshbuf_put_u8(buf, ' ')) != 0) ||
2171
0
        (ws != 0 && (r = sshbuf_put_u8(buf, '"')) != 0) ||
2172
0
        (r = sshbuf_putb(buf, arg)) != 0 ||
2173
0
        (ws != 0 && (r = sshbuf_put_u8(buf, '"')) != 0))
2174
0
      fatal_fr(r, "assemble");
2175
0
  }
2176
0
  if ((ret = malloc(sshbuf_len(buf) + 1)) == NULL)
2177
0
    fatal_f("malloc failed");
2178
0
  memcpy(ret, sshbuf_ptr(buf), sshbuf_len(buf));
2179
0
  ret[sshbuf_len(buf)] = '\0';
2180
0
  sshbuf_free(buf);
2181
0
  sshbuf_free(arg);
2182
0
  return ret;
2183
0
}
2184
2185
char *
2186
argv_next(int *argcp, char ***argvp)
2187
0
{
2188
0
  char *ret = (*argvp)[0];
2189
2190
0
  if (*argcp > 0 && ret != NULL) {
2191
0
    (*argcp)--;
2192
0
    (*argvp)++;
2193
0
  }
2194
0
  return ret;
2195
0
}
2196
2197
void
2198
argv_consume(int *argcp)
2199
0
{
2200
0
  *argcp = 0;
2201
0
}
2202
2203
void
2204
argv_free(char **av, int ac)
2205
0
{
2206
0
  int i;
2207
2208
0
  if (av == NULL)
2209
0
    return;
2210
0
  for (i = 0; i < ac; i++)
2211
0
    free(av[i]);
2212
0
  free(av);
2213
0
}
2214
2215
/* Returns 0 if pid exited cleanly, non-zero otherwise */
2216
int
2217
exited_cleanly(pid_t pid, const char *tag, const char *cmd, int quiet)
2218
0
{
2219
0
  int status;
2220
2221
0
  while (waitpid(pid, &status, 0) == -1) {
2222
0
    if (errno != EINTR) {
2223
0
      error("%s waitpid: %s", tag, strerror(errno));
2224
0
      return -1;
2225
0
    }
2226
0
  }
2227
0
  if (WIFSIGNALED(status)) {
2228
0
    error("%s %s exited on signal %d", tag, cmd, WTERMSIG(status));
2229
0
    return -1;
2230
0
  } else if (WEXITSTATUS(status) != 0) {
2231
0
    do_log2(quiet ? SYSLOG_LEVEL_DEBUG1 : SYSLOG_LEVEL_INFO,
2232
0
        "%s %s failed, status %d", tag, cmd, WEXITSTATUS(status));
2233
0
    return -1;
2234
0
  }
2235
0
  return 0;
2236
0
}
2237
2238
/*
2239
 * Check a given path for security. This is defined as all components
2240
 * of the path to the file must be owned by either the owner of
2241
 * of the file or root and no directories must be group or world writable.
2242
 *
2243
 * XXX Should any specific check be done for sym links ?
2244
 *
2245
 * Takes a file name, its stat information (preferably from fstat() to
2246
 * avoid races), the uid of the expected owner, their home directory and an
2247
 * error buffer plus max size as arguments.
2248
 *
2249
 * Returns 0 on success and -1 on failure
2250
 */
2251
int
2252
safe_path(const char *name, struct stat *stp, const char *pw_dir,
2253
    uid_t uid, char *err, size_t errlen)
2254
0
{
2255
0
  char buf[PATH_MAX], homedir[PATH_MAX];
2256
0
  char *cp;
2257
0
  int comparehome = 0;
2258
0
  struct stat st;
2259
2260
0
  if (realpath(name, buf) == NULL) {
2261
0
    snprintf(err, errlen, "realpath %s failed: %s", name,
2262
0
        strerror(errno));
2263
0
    return -1;
2264
0
  }
2265
0
  if (pw_dir != NULL && realpath(pw_dir, homedir) != NULL)
2266
0
    comparehome = 1;
2267
2268
0
  if (!S_ISREG(stp->st_mode)) {
2269
0
    snprintf(err, errlen, "%s is not a regular file", buf);
2270
0
    return -1;
2271
0
  }
2272
0
  if ((!platform_sys_dir_uid(stp->st_uid) && stp->st_uid != uid) ||
2273
0
      (stp->st_mode & 022) != 0) {
2274
0
    snprintf(err, errlen, "bad ownership or modes for file %s",
2275
0
        buf);
2276
0
    return -1;
2277
0
  }
2278
2279
  /* for each component of the canonical path, walking upwards */
2280
0
  for (;;) {
2281
0
    if ((cp = dirname(buf)) == NULL) {
2282
0
      snprintf(err, errlen, "dirname() failed");
2283
0
      return -1;
2284
0
    }
2285
0
    strlcpy(buf, cp, sizeof(buf));
2286
2287
0
    if (stat(buf, &st) == -1 ||
2288
0
        (!platform_sys_dir_uid(st.st_uid) && st.st_uid != uid) ||
2289
0
        (st.st_mode & 022) != 0) {
2290
0
      snprintf(err, errlen,
2291
0
          "bad ownership or modes for directory %s", buf);
2292
0
      return -1;
2293
0
    }
2294
2295
    /* If are past the homedir then we can stop */
2296
0
    if (comparehome && strcmp(homedir, buf) == 0)
2297
0
      break;
2298
2299
    /*
2300
     * dirname should always complete with a "/" path,
2301
     * but we can be paranoid and check for "." too
2302
     */
2303
0
    if ((strcmp("/", buf) == 0) || (strcmp(".", buf) == 0))
2304
0
      break;
2305
0
  }
2306
0
  return 0;
2307
0
}
2308
2309
/*
2310
 * Version of safe_path() that accepts an open file descriptor to
2311
 * avoid races.
2312
 *
2313
 * Returns 0 on success and -1 on failure
2314
 */
2315
int
2316
safe_path_fd(int fd, const char *file, struct passwd *pw,
2317
    char *err, size_t errlen)
2318
0
{
2319
0
  struct stat st;
2320
2321
  /* check the open file to avoid races */
2322
0
  if (fstat(fd, &st) == -1) {
2323
0
    snprintf(err, errlen, "cannot stat file %s: %s",
2324
0
        file, strerror(errno));
2325
0
    return -1;
2326
0
  }
2327
0
  return safe_path(file, &st, pw->pw_dir, pw->pw_uid, err, errlen);
2328
0
}
2329
2330
/*
2331
 * Sets the value of the given variable in the environment.  If the variable
2332
 * already exists, its value is overridden.
2333
 */
2334
void
2335
child_set_env(char ***envp, u_int *envsizep, const char *name,
2336
  const char *value)
2337
0
{
2338
0
  char **env;
2339
0
  u_int envsize;
2340
0
  u_int i, namelen;
2341
2342
0
  if (strchr(name, '=') != NULL) {
2343
0
    error("Invalid environment variable \"%.100s\"", name);
2344
0
    return;
2345
0
  }
2346
2347
  /*
2348
   * If we're passed an uninitialized list, allocate a single null
2349
   * entry before continuing.
2350
   */
2351
0
  if ((*envp == NULL) != (*envsizep == 0))
2352
0
    fatal_f("environment size mismatch");
2353
0
  if (*envp == NULL && *envsizep == 0) {
2354
0
    *envp = xmalloc(sizeof(char *));
2355
0
    *envp[0] = NULL;
2356
0
    *envsizep = 1;
2357
0
  }
2358
2359
  /*
2360
   * Find the slot where the value should be stored.  If the variable
2361
   * already exists, we reuse the slot; otherwise we append a new slot
2362
   * at the end of the array, expanding if necessary.
2363
   */
2364
0
  env = *envp;
2365
0
  namelen = strlen(name);
2366
0
  for (i = 0; env[i]; i++)
2367
0
    if (strncmp(env[i], name, namelen) == 0 && env[i][namelen] == '=')
2368
0
      break;
2369
0
  if (env[i]) {
2370
    /* Reuse the slot. */
2371
0
    free(env[i]);
2372
0
  } else {
2373
    /* New variable.  Expand if necessary. */
2374
0
    envsize = *envsizep;
2375
0
    if (i >= envsize - 1) {
2376
0
      if (envsize >= 1000)
2377
0
        fatal("child_set_env: too many env vars");
2378
0
      envsize += 50;
2379
0
      env = (*envp) = xreallocarray(env, envsize, sizeof(char *));
2380
0
      *envsizep = envsize;
2381
0
    }
2382
    /* Need to set the NULL pointer at end of array beyond the new slot. */
2383
0
    env[i + 1] = NULL;
2384
0
  }
2385
2386
  /* Allocate space and format the variable in the appropriate slot. */
2387
  /* XXX xasprintf */
2388
0
  env[i] = xmalloc(strlen(name) + 1 + strlen(value) + 1);
2389
0
  snprintf(env[i], strlen(name) + 1 + strlen(value) + 1, "%s=%s", name, value);
2390
0
}
2391
2392
/*
2393
 * Check and optionally lowercase a domain name, also removes trailing '.'
2394
 * Returns 1 on success and 0 on failure, storing an error message in errstr.
2395
 */
2396
int
2397
valid_domain(char *name, int makelower, const char **errstr)
2398
0
{
2399
0
  size_t i, l = strlen(name);
2400
0
  u_char c, last = '\0';
2401
0
  static char errbuf[256];
2402
2403
0
  if (l == 0) {
2404
0
    strlcpy(errbuf, "empty domain name", sizeof(errbuf));
2405
0
    goto bad;
2406
0
  }
2407
0
  if (!isalpha((u_char)name[0]) && !isdigit((u_char)name[0]) &&
2408
0
     name[0] != '_' /* technically invalid, but common */) {
2409
0
    snprintf(errbuf, sizeof(errbuf), "domain name \"%.100s\" "
2410
0
        "starts with invalid character", name);
2411
0
    goto bad;
2412
0
  }
2413
0
  for (i = 0; i < l; i++) {
2414
0
    c = tolower((u_char)name[i]);
2415
0
    if (makelower)
2416
0
      name[i] = (char)c;
2417
0
    if (last == '.' && c == '.') {
2418
0
      snprintf(errbuf, sizeof(errbuf), "domain name "
2419
0
          "\"%.100s\" contains consecutive separators", name);
2420
0
      goto bad;
2421
0
    }
2422
0
    if (c != '.' && c != '-' && !isalnum(c) &&
2423
0
        c != '_') /* technically invalid, but common */ {
2424
0
      snprintf(errbuf, sizeof(errbuf), "domain name "
2425
0
          "\"%.100s\" contains invalid characters", name);
2426
0
      goto bad;
2427
0
    }
2428
0
    last = c;
2429
0
  }
2430
0
  if (name[l - 1] == '.')
2431
0
    name[l - 1] = '\0';
2432
0
  if (errstr != NULL)
2433
0
    *errstr = NULL;
2434
0
  return 1;
2435
0
bad:
2436
0
  if (errstr != NULL)
2437
0
    *errstr = errbuf;
2438
0
  return 0;
2439
0
}
2440
2441
/*
2442
 * Verify that a environment variable name (not including initial '$') is
2443
 * valid; consisting of one or more alphanumeric or underscore characters only.
2444
 * Returns 1 on valid, 0 otherwise.
2445
 */
2446
int
2447
valid_env_name(const char *name)
2448
1.92k
{
2449
1.92k
  const char *cp;
2450
2451
1.92k
  if (name[0] == '\0')
2452
6
    return 0;
2453
6.80k
  for (cp = name; *cp != '\0'; cp++) {
2454
4.89k
    if (!isalnum((u_char)*cp) && *cp != '_')
2455
10
      return 0;
2456
4.89k
  }
2457
1.90k
  return 1;
2458
1.91k
}
2459
2460
const char *
2461
atoi_err(const char *nptr, int *val)
2462
0
{
2463
0
  const char *errstr = NULL;
2464
2465
0
  if (nptr == NULL || *nptr == '\0')
2466
0
    return "missing";
2467
0
  *val = strtonum(nptr, 0, INT_MAX, &errstr);
2468
0
  return errstr;
2469
0
}
2470
2471
int
2472
parse_absolute_time(const char *s, uint64_t *tp)
2473
2.92k
{
2474
2.92k
  struct tm tm;
2475
2.92k
  time_t tt;
2476
2.92k
  char buf[32], *fmt;
2477
2.92k
  const char *cp;
2478
2.92k
  size_t l;
2479
2.92k
  int is_utc = 0;
2480
2481
2.92k
  *tp = 0;
2482
2483
2.92k
  l = strlen(s);
2484
2.92k
  if (l > 1 && strcasecmp(s + l - 1, "Z") == 0) {
2485
563
    is_utc = 1;
2486
563
    l--;
2487
2.36k
  } else if (l > 3 && strcasecmp(s + l - 3, "UTC") == 0) {
2488
199
    is_utc = 1;
2489
199
    l -= 3;
2490
199
  }
2491
  /*
2492
   * POSIX strptime says "The application shall ensure that there
2493
   * is white-space or other non-alphanumeric characters between
2494
   * any two conversion specifications" so arrange things this way.
2495
   */
2496
2.92k
  switch (l) {
2497
2.11k
  case 8: /* YYYYMMDD */
2498
2.11k
    fmt = "%Y-%m-%d";
2499
2.11k
    snprintf(buf, sizeof(buf), "%.4s-%.2s-%.2s", s, s + 4, s + 6);
2500
2.11k
    break;
2501
308
  case 12: /* YYYYMMDDHHMM */
2502
308
    fmt = "%Y-%m-%dT%H:%M";
2503
308
    snprintf(buf, sizeof(buf), "%.4s-%.2s-%.2sT%.2s:%.2s",
2504
308
        s, s + 4, s + 6, s + 8, s + 10);
2505
308
    break;
2506
296
  case 14: /* YYYYMMDDHHMMSS */
2507
296
    fmt = "%Y-%m-%dT%H:%M:%S";
2508
296
    snprintf(buf, sizeof(buf), "%.4s-%.2s-%.2sT%.2s:%.2s:%.2s",
2509
296
        s, s + 4, s + 6, s + 8, s + 10, s + 12);
2510
296
    break;
2511
203
  default:
2512
203
    return SSH_ERR_INVALID_FORMAT;
2513
2.92k
  }
2514
2515
2.72k
  memset(&tm, 0, sizeof(tm));
2516
2.72k
  if ((cp = strptime(buf, fmt, &tm)) == NULL || *cp != '\0')
2517
25
    return SSH_ERR_INVALID_FORMAT;
2518
2.69k
  if (is_utc) {
2519
737
    if ((tt = timegm(&tm)) < 0)
2520
96
      return SSH_ERR_INVALID_FORMAT;
2521
1.96k
  } else {
2522
1.96k
    if ((tt = mktime(&tm)) < 0)
2523
95
      return SSH_ERR_INVALID_FORMAT;
2524
1.96k
  }
2525
  /* success */
2526
2.50k
  *tp = (uint64_t)tt;
2527
2.50k
  return 0;
2528
2.69k
}
2529
2530
void
2531
format_absolute_time(uint64_t t, char *buf, size_t len)
2532
0
{
2533
0
  time_t tt = t > SSH_TIME_T_MAX ? SSH_TIME_T_MAX : t;
2534
0
  struct tm tm;
2535
2536
0
  localtime_r(&tt, &tm);
2537
0
  strftime(buf, len, "%Y-%m-%dT%H:%M:%S", &tm);
2538
0
}
2539
2540
/*
2541
 * Parse a "pattern=interval" clause (e.g. a ChannelTimeout).
2542
 * Returns 0 on success or non-zero on failure.
2543
 * Caller must free *typep.
2544
 */
2545
int
2546
parse_pattern_interval(const char *s, char **typep, int *secsp)
2547
0
{
2548
0
  char *cp, *sdup;
2549
0
  int secs;
2550
2551
0
  if (typep != NULL)
2552
0
    *typep = NULL;
2553
0
  if (secsp != NULL)
2554
0
    *secsp = 0;
2555
0
  if (s == NULL)
2556
0
    return -1;
2557
0
  sdup = xstrdup(s);
2558
2559
0
  if ((cp = strchr(sdup, '=')) == NULL || cp == sdup) {
2560
0
    free(sdup);
2561
0
    return -1;
2562
0
  }
2563
0
  *cp++ = '\0';
2564
0
  if ((secs = convtime(cp)) < 0) {
2565
0
    free(sdup);
2566
0
    return -1;
2567
0
  }
2568
  /* success */
2569
0
  if (typep != NULL)
2570
0
    *typep = xstrdup(sdup);
2571
0
  if (secsp != NULL)
2572
0
    *secsp = secs;
2573
0
  free(sdup);
2574
0
  return 0;
2575
0
}
2576
2577
/* check if path is absolute */
2578
int
2579
path_absolute(const char *path)
2580
0
{
2581
0
  return (*path == '/') ? 1 : 0;
2582
0
}
2583
2584
void
2585
skip_space(char **cpp)
2586
0
{
2587
0
  char *cp;
2588
2589
0
  for (cp = *cpp; *cp == ' ' || *cp == '\t'; cp++)
2590
0
    ;
2591
0
  *cpp = cp;
2592
0
}
2593
2594
/* authorized_key-style options parsing helpers */
2595
2596
/*
2597
 * Match flag 'opt' in *optsp, and if allow_negate is set then also match
2598
 * 'no-opt'. Returns -1 if option not matched, 1 if option matches or 0
2599
 * if negated option matches.
2600
 * If the option or negated option matches, then *optsp is updated to
2601
 * point to the first character after the option.
2602
 */
2603
int
2604
opt_flag(const char *opt, int allow_negate, const char **optsp)
2605
944k
{
2606
944k
  size_t opt_len = strlen(opt);
2607
944k
  const char *opts = *optsp;
2608
944k
  int negate = 0;
2609
2610
944k
  if (allow_negate && strncasecmp(opts, "no-", 3) == 0) {
2611
227
    opts += 3;
2612
227
    negate = 1;
2613
227
  }
2614
944k
  if (strncasecmp(opts, opt, opt_len) == 0) {
2615
1.97k
    *optsp = opts + opt_len;
2616
1.97k
    return negate ? 0 : 1;
2617
1.97k
  }
2618
942k
  return -1;
2619
944k
}
2620
2621
char *
2622
opt_dequote(const char **sp, const char **errstrp)
2623
103k
{
2624
103k
  const char *s = *sp;
2625
103k
  char *ret;
2626
103k
  size_t i;
2627
2628
103k
  *errstrp = NULL;
2629
103k
  if (*s != '"') {
2630
55
    *errstrp = "missing start quote";
2631
55
    return NULL;
2632
55
  }
2633
103k
  s++;
2634
103k
  if ((ret = malloc(strlen((s)) + 1)) == NULL) {
2635
0
    *errstrp = "memory allocation failed";
2636
0
    return NULL;
2637
0
  }
2638
5.56M
  for (i = 0; *s != '\0' && *s != '"';) {
2639
5.45M
    if (s[0] == '\\' && s[1] == '"')
2640
388
      s++;
2641
5.45M
    ret[i++] = *s++;
2642
5.45M
  }
2643
103k
  if (*s == '\0') {
2644
100
    *errstrp = "missing end quote";
2645
100
    free(ret);
2646
100
    return NULL;
2647
100
  }
2648
103k
  ret[i] = '\0';
2649
103k
  s++;
2650
103k
  *sp = s;
2651
103k
  return ret;
2652
103k
}
2653
2654
int
2655
opt_match(const char **opts, const char *term)
2656
645k
{
2657
645k
  if (strncasecmp((*opts), term, strlen(term)) == 0 &&
2658
645k
      (*opts)[strlen(term)] == '=') {
2659
103k
    *opts += strlen(term) + 1;
2660
103k
    return 1;
2661
103k
  }
2662
541k
  return 0;
2663
645k
}
2664
2665
void
2666
opt_array_append2(const char *file, const int line, const char *directive,
2667
    char ***array, int **iarray, u_int *lp, const char *s, int i)
2668
0
{
2669
2670
0
  if (*lp >= INT_MAX)
2671
0
    fatal("%s line %d: Too many %s entries", file, line, directive);
2672
2673
0
  if (iarray != NULL) {
2674
0
    *iarray = xrecallocarray(*iarray, *lp, *lp + 1,
2675
0
        sizeof(**iarray));
2676
0
    (*iarray)[*lp] = i;
2677
0
  }
2678
2679
0
  *array = xrecallocarray(*array, *lp, *lp + 1, sizeof(**array));
2680
0
  (*array)[*lp] = xstrdup(s);
2681
0
  (*lp)++;
2682
0
}
2683
2684
void
2685
opt_array_append(const char *file, const int line, const char *directive,
2686
    char ***array, u_int *lp, const char *s)
2687
0
{
2688
0
  opt_array_append2(file, line, directive, array, NULL, lp, s, 0);
2689
0
}
2690
2691
void
2692
opt_array_free2(char **array, int **iarray, u_int l)
2693
0
{
2694
0
  u_int i;
2695
2696
0
  if (array == NULL || l == 0)
2697
0
    return;
2698
0
  for (i = 0; i < l; i++)
2699
0
    free(array[i]);
2700
0
  free(array);
2701
0
  free(iarray);
2702
0
}
2703
2704
sshsig_t
2705
ssh_signal(int signum, sshsig_t handler)
2706
0
{
2707
0
  struct sigaction sa, osa;
2708
2709
  /* mask all other signals while in handler */
2710
0
  memset(&sa, 0, sizeof(sa));
2711
0
  sa.sa_handler = handler;
2712
0
  sigfillset(&sa.sa_mask);
2713
0
#if defined(SA_RESTART) && !defined(NO_SA_RESTART)
2714
0
  if (signum != SIGALRM)
2715
0
    sa.sa_flags = SA_RESTART;
2716
0
#endif
2717
0
  if (sigaction(signum, &sa, &osa) == -1) {
2718
0
    debug3("sigaction(%s): %s", strsignal(signum), strerror(errno));
2719
0
    return SIG_ERR;
2720
0
  }
2721
0
  return osa.sa_handler;
2722
0
}
2723
2724
int
2725
stdfd_devnull(int do_stdin, int do_stdout, int do_stderr)
2726
0
{
2727
0
  int devnull, ret = 0;
2728
2729
0
  if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) {
2730
0
    error_f("open %s: %s", _PATH_DEVNULL,
2731
0
        strerror(errno));
2732
0
    return -1;
2733
0
  }
2734
0
  if ((do_stdin && dup2(devnull, STDIN_FILENO) == -1) ||
2735
0
      (do_stdout && dup2(devnull, STDOUT_FILENO) == -1) ||
2736
0
      (do_stderr && dup2(devnull, STDERR_FILENO) == -1)) {
2737
0
    error_f("dup2: %s", strerror(errno));
2738
0
    ret = -1;
2739
0
  }
2740
0
  if (devnull > STDERR_FILENO)
2741
0
    close(devnull);
2742
0
  return ret;
2743
0
}
2744
2745
/*
2746
 * Runs command in a subprocess with a minimal environment.
2747
 * Returns pid on success, 0 on failure.
2748
 * The child stdout and stderr maybe captured, left attached or sent to
2749
 * /dev/null depending on the contents of flags.
2750
 * "tag" is prepended to log messages.
2751
 * NB. "command" is only used for logging; the actual command executed is
2752
 * av[0].
2753
 */
2754
pid_t
2755
subprocess(const char *tag, const char *command,
2756
    int ac, char **av, FILE **child, u_int flags,
2757
    struct passwd *pw, privdrop_fn *drop_privs, privrestore_fn *restore_privs)
2758
0
{
2759
0
  FILE *f = NULL;
2760
0
  struct stat st;
2761
0
  int fd, devnull, p[2], i;
2762
0
  pid_t pid;
2763
0
  char *cp, errmsg[512];
2764
0
  u_int nenv = 0;
2765
0
  char **env = NULL;
2766
2767
  /* If dropping privs, then must specify user and restore function */
2768
0
  if (drop_privs != NULL && (pw == NULL || restore_privs == NULL)) {
2769
0
    error("%s: inconsistent arguments", tag); /* XXX fatal? */
2770
0
    return 0;
2771
0
  }
2772
0
  if (pw == NULL && (pw = getpwuid(getuid())) == NULL) {
2773
0
    error("%s: no user for current uid", tag);
2774
0
    return 0;
2775
0
  }
2776
0
  if (child != NULL)
2777
0
    *child = NULL;
2778
2779
0
  debug3_f("%s command \"%s\" running as %s (flags 0x%x)",
2780
0
      tag, command, pw->pw_name, flags);
2781
2782
  /* Check consistency */
2783
0
  if ((flags & SSH_SUBPROCESS_STDOUT_DISCARD) != 0 &&
2784
0
      (flags & SSH_SUBPROCESS_STDOUT_CAPTURE) != 0) {
2785
0
    error_f("inconsistent flags");
2786
0
    return 0;
2787
0
  }
2788
0
  if (((flags & SSH_SUBPROCESS_STDOUT_CAPTURE) == 0) != (child == NULL)) {
2789
0
    error_f("inconsistent flags/output");
2790
0
    return 0;
2791
0
  }
2792
2793
  /*
2794
   * If executing an explicit binary, then verify the it exists
2795
   * and appears safe-ish to execute
2796
   */
2797
0
  if (!path_absolute(av[0])) {
2798
0
    error("%s path is not absolute", tag);
2799
0
    return 0;
2800
0
  }
2801
0
  if (drop_privs != NULL)
2802
0
    drop_privs(pw);
2803
0
  if (stat(av[0], &st) == -1) {
2804
0
    error("Could not stat %s \"%s\": %s", tag,
2805
0
        av[0], strerror(errno));
2806
0
    goto restore_return;
2807
0
  }
2808
0
  if ((flags & SSH_SUBPROCESS_UNSAFE_PATH) == 0 &&
2809
0
      safe_path(av[0], &st, NULL, 0, errmsg, sizeof(errmsg)) != 0) {
2810
0
    error("Unsafe %s \"%s\": %s", tag, av[0], errmsg);
2811
0
    goto restore_return;
2812
0
  }
2813
  /* Prepare to keep the child's stdout if requested */
2814
0
  if (pipe(p) == -1) {
2815
0
    error("%s: pipe: %s", tag, strerror(errno));
2816
0
 restore_return:
2817
0
    if (restore_privs != NULL)
2818
0
      restore_privs();
2819
0
    return 0;
2820
0
  }
2821
0
  if (restore_privs != NULL)
2822
0
    restore_privs();
2823
2824
0
  switch ((pid = fork())) {
2825
0
  case -1: /* error */
2826
0
    error("%s: fork: %s", tag, strerror(errno));
2827
0
    close(p[0]);
2828
0
    close(p[1]);
2829
0
    return 0;
2830
0
  case 0: /* child */
2831
    /* Prepare a minimal environment for the child. */
2832
0
    if ((flags & SSH_SUBPROCESS_PRESERVE_ENV) == 0) {
2833
0
      nenv = 5;
2834
0
      env = xcalloc(sizeof(*env), nenv);
2835
0
      child_set_env(&env, &nenv, "PATH", _PATH_STDPATH);
2836
0
      child_set_env(&env, &nenv, "USER", pw->pw_name);
2837
0
      child_set_env(&env, &nenv, "LOGNAME", pw->pw_name);
2838
0
      child_set_env(&env, &nenv, "HOME", pw->pw_dir);
2839
0
      if ((cp = getenv("LANG")) != NULL)
2840
0
        child_set_env(&env, &nenv, "LANG", cp);
2841
0
    }
2842
2843
0
    for (i = 1; i < NSIG; i++)
2844
0
      ssh_signal(i, SIG_DFL);
2845
2846
0
    if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) {
2847
0
      error("%s: open %s: %s", tag, _PATH_DEVNULL,
2848
0
          strerror(errno));
2849
0
      _exit(1);
2850
0
    }
2851
0
    if (dup2(devnull, STDIN_FILENO) == -1) {
2852
0
      error("%s: dup2: %s", tag, strerror(errno));
2853
0
      _exit(1);
2854
0
    }
2855
2856
    /* Set up stdout as requested; leave stderr in place for now. */
2857
0
    fd = -1;
2858
0
    if ((flags & SSH_SUBPROCESS_STDOUT_CAPTURE) != 0)
2859
0
      fd = p[1];
2860
0
    else if ((flags & SSH_SUBPROCESS_STDOUT_DISCARD) != 0)
2861
0
      fd = devnull;
2862
0
    if (fd != -1 && dup2(fd, STDOUT_FILENO) == -1) {
2863
0
      error("%s: dup2: %s", tag, strerror(errno));
2864
0
      _exit(1);
2865
0
    }
2866
0
    closefrom(STDERR_FILENO + 1);
2867
2868
0
    if (geteuid() == 0 &&
2869
0
        initgroups(pw->pw_name, pw->pw_gid) == -1) {
2870
0
      error("%s: initgroups(%s, %u): %s", tag,
2871
0
          pw->pw_name, (u_int)pw->pw_gid, strerror(errno));
2872
0
      _exit(1);
2873
0
    }
2874
0
    if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1) {
2875
0
      error("%s: setresgid %u: %s", tag, (u_int)pw->pw_gid,
2876
0
          strerror(errno));
2877
0
      _exit(1);
2878
0
    }
2879
0
    if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) == -1) {
2880
0
      error("%s: setresuid %u: %s", tag, (u_int)pw->pw_uid,
2881
0
          strerror(errno));
2882
0
      _exit(1);
2883
0
    }
2884
    /* stdin is pointed to /dev/null at this point */
2885
0
    if ((flags & SSH_SUBPROCESS_STDOUT_DISCARD) != 0 &&
2886
0
        dup2(STDIN_FILENO, STDERR_FILENO) == -1) {
2887
0
      error("%s: dup2: %s", tag, strerror(errno));
2888
0
      _exit(1);
2889
0
    }
2890
0
    if (env != NULL)
2891
0
      execve(av[0], av, env);
2892
0
    else
2893
0
      execv(av[0], av);
2894
0
    error("%s %s \"%s\": %s", tag, env == NULL ? "execv" : "execve",
2895
0
        command, strerror(errno));
2896
0
    _exit(127);
2897
0
  default: /* parent */
2898
0
    break;
2899
0
  }
2900
2901
0
  close(p[1]);
2902
0
  if ((flags & SSH_SUBPROCESS_STDOUT_CAPTURE) == 0)
2903
0
    close(p[0]);
2904
0
  else if ((f = fdopen(p[0], "r")) == NULL) {
2905
0
    error("%s: fdopen: %s", tag, strerror(errno));
2906
0
    close(p[0]);
2907
    /* Don't leave zombie child */
2908
0
    kill(pid, SIGTERM);
2909
0
    while (waitpid(pid, NULL, 0) == -1 && errno == EINTR)
2910
0
      ;
2911
0
    return 0;
2912
0
  }
2913
  /* Success */
2914
0
  debug3_f("%s pid %ld", tag, (long)pid);
2915
0
  if (child != NULL)
2916
0
    *child = f;
2917
0
  return pid;
2918
0
}
2919
2920
const char *
2921
lookup_env_in_list(const char *env, char * const *envs, size_t nenvs)
2922
0
{
2923
0
  size_t i, envlen;
2924
2925
0
  envlen = strlen(env);
2926
0
  for (i = 0; i < nenvs; i++) {
2927
0
    if (strncmp(envs[i], env, envlen) == 0 &&
2928
0
        envs[i][envlen] == '=') {
2929
0
      return envs[i] + envlen + 1;
2930
0
    }
2931
0
  }
2932
0
  return NULL;
2933
0
}
2934
2935
const char *
2936
lookup_setenv_in_list(const char *env, char * const *envs, size_t nenvs)
2937
0
{
2938
0
  char *name, *cp;
2939
0
  const char *ret;
2940
2941
0
  name = xstrdup(env);
2942
0
  if ((cp = strchr(name, '=')) == NULL) {
2943
0
    free(name);
2944
0
    return NULL; /* not env=val */
2945
0
  }
2946
0
  *cp = '\0';
2947
0
  ret = lookup_env_in_list(name, envs, nenvs);
2948
0
  free(name);
2949
0
  return ret;
2950
0
}
2951
2952
/*
2953
 * Helpers for managing poll(2)/ppoll(2) timeouts
2954
 * Will remember the earliest deadline and return it for use in poll/ppoll.
2955
 */
2956
2957
/* Initialise a poll/ppoll timeout with an indefinite deadline */
2958
void
2959
ptimeout_init(struct timespec *pt)
2960
0
{
2961
  /*
2962
   * Deliberately invalid for ppoll(2).
2963
   * Will be converted to NULL in ptimeout_get_tspec() later.
2964
   */
2965
0
  pt->tv_sec = -1;
2966
0
  pt->tv_nsec = 0;
2967
0
}
2968
2969
/* Specify a poll/ppoll deadline of at most 'sec' seconds */
2970
void
2971
ptimeout_deadline_sec(struct timespec *pt, long sec)
2972
0
{
2973
0
  if (pt->tv_sec == -1 || pt->tv_sec >= sec) {
2974
0
    pt->tv_sec = sec;
2975
0
    pt->tv_nsec = 0;
2976
0
  }
2977
0
}
2978
2979
/* Specify a poll/ppoll deadline of at most 'p' (timespec) */
2980
static void
2981
ptimeout_deadline_tsp(struct timespec *pt, struct timespec *p)
2982
0
{
2983
0
  if (pt->tv_sec == -1 || timespeccmp(pt, p, >=))
2984
0
    *pt = *p;
2985
0
}
2986
2987
/* Specify a poll/ppoll deadline of at most 'ms' milliseconds */
2988
void
2989
ptimeout_deadline_ms(struct timespec *pt, long ms)
2990
0
{
2991
0
  struct timespec p;
2992
2993
0
  p.tv_sec = ms / 1000;
2994
0
  p.tv_nsec = (ms % 1000) * 1000000;
2995
0
  ptimeout_deadline_tsp(pt, &p);
2996
0
}
2997
2998
/* Specify a poll/ppoll deadline at wall clock monotime 'when' (timespec) */
2999
void
3000
ptimeout_deadline_monotime_tsp(struct timespec *pt, struct timespec *when)
3001
0
{
3002
0
  struct timespec now, t;
3003
3004
0
  monotime_ts(&now);
3005
3006
0
  if (timespeccmp(&now, when, >=)) {
3007
    /* 'when' is now or in the past. Timeout ASAP */
3008
0
    pt->tv_sec = 0;
3009
0
    pt->tv_nsec = 0;
3010
0
  } else {
3011
0
    timespecsub(when, &now, &t);
3012
0
    ptimeout_deadline_tsp(pt, &t);
3013
0
  }
3014
0
}
3015
3016
/* Specify a poll/ppoll deadline at wall clock monotime 'when' */
3017
void
3018
ptimeout_deadline_monotime(struct timespec *pt, time_t when)
3019
0
{
3020
0
  struct timespec t;
3021
3022
0
  t.tv_sec = when;
3023
0
  t.tv_nsec = 0;
3024
0
  ptimeout_deadline_monotime_tsp(pt, &t);
3025
0
}
3026
3027
/* Get a poll(2) timeout value in milliseconds */
3028
int
3029
ptimeout_get_ms(struct timespec *pt)
3030
0
{
3031
0
  if (pt->tv_sec == -1)
3032
0
    return -1;
3033
0
  if (pt->tv_sec >= (INT_MAX - (pt->tv_nsec / 1000000)) / 1000)
3034
0
    return INT_MAX;
3035
0
  return (pt->tv_sec * 1000) + (pt->tv_nsec / 1000000);
3036
0
}
3037
3038
/* Get a ppoll(2) timeout value as a timespec pointer */
3039
struct timespec *
3040
ptimeout_get_tsp(struct timespec *pt)
3041
0
{
3042
0
  return pt->tv_sec == -1 ? NULL : pt;
3043
0
}
3044
3045
/* Returns non-zero if a timeout has been set (i.e. is not indefinite) */
3046
int
3047
ptimeout_isset(struct timespec *pt)
3048
0
{
3049
0
  return pt->tv_sec != -1;
3050
0
}
3051
3052
/*
3053
 * Returns zero if the library at 'path' contains symbol 's', nonzero
3054
 * otherwise.
3055
 */
3056
int
3057
lib_contains_symbol(const char *path, const char *s)
3058
0
{
3059
#ifdef HAVE_NLIST_H
3060
  struct nlist nl[2];
3061
  int ret = -1, r;
3062
3063
  memset(nl, 0, sizeof(nl));
3064
  nl[0].n_name = xstrdup(s);
3065
  nl[1].n_name = NULL;
3066
  if ((r = nlist(path, nl)) == -1) {
3067
    error_f("nlist failed for %s", path);
3068
    goto out;
3069
  }
3070
  if (r != 0 || nl[0].n_value == 0 || nl[0].n_type == 0) {
3071
    error_f("library %s does not contain symbol %s", path, s);
3072
    goto out;
3073
  }
3074
  /* success */
3075
  ret = 0;
3076
 out:
3077
  free(nl[0].n_name);
3078
  return ret;
3079
#else /* HAVE_NLIST_H */
3080
0
  int fd, ret = -1;
3081
0
  struct stat st;
3082
0
  void *m = NULL;
3083
0
  size_t sz = 0;
3084
3085
0
  memset(&st, 0, sizeof(st));
3086
0
  if ((fd = open(path, O_RDONLY)) < 0) {
3087
0
    error_f("open %s: %s", path, strerror(errno));
3088
0
    return -1;
3089
0
  }
3090
0
  if (fstat(fd, &st) != 0) {
3091
0
    error_f("fstat %s: %s", path, strerror(errno));
3092
0
    goto out;
3093
0
  }
3094
0
  if (!S_ISREG(st.st_mode)) {
3095
0
    error_f("%s is not a regular file", path);
3096
0
    goto out;
3097
0
  }
3098
0
  if (st.st_size < 0 ||
3099
0
      (size_t)st.st_size < strlen(s) ||
3100
0
      st.st_size >= INT_MAX/2) {
3101
0
    error_f("%s bad size %lld", path, (long long)st.st_size);
3102
0
    goto out;
3103
0
  }
3104
0
  sz = (size_t)st.st_size;
3105
0
  if ((m = mmap(NULL, sz, PROT_READ, MAP_PRIVATE, fd, 0)) == MAP_FAILED ||
3106
0
      m == NULL) {
3107
0
    error_f("mmap %s: %s", path, strerror(errno));
3108
0
    goto out;
3109
0
  }
3110
0
  if (memmem(m, sz, s, strlen(s)) == NULL) {
3111
0
    error_f("%s does not contain expected string %s", path, s);
3112
0
    goto out;
3113
0
  }
3114
  /* success */
3115
0
  ret = 0;
3116
0
 out:
3117
0
  if (m != NULL && m != MAP_FAILED)
3118
0
    munmap(m, sz);
3119
0
  close(fd);
3120
0
  return ret;
3121
0
#endif /* HAVE_NLIST_H */
3122
0
}
3123
3124
int
3125
signal_is_crash(int sig)
3126
0
{
3127
0
  switch (sig) {
3128
0
  case SIGSEGV:
3129
0
  case SIGBUS:
3130
0
  case SIGTRAP:
3131
0
  case SIGSYS:
3132
0
  case SIGFPE:
3133
0
  case SIGILL:
3134
0
  case SIGABRT:
3135
0
    return 1;
3136
0
  }
3137
0
  return 0;
3138
0
}