/src/libssh/src/messages.c

Source
/*
 * messages.c - message parsing for client and server
 *
 * This file is part of the SSH Library
 *
 * Copyright (c) 2003-2013 by Aris Adamantiadis
 *
 * The SSH Library is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation; either version 2.1 of the License, or (at your
 * option) any later version.
 *
 * The SSH Library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
 * License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with the SSH Library; see the file COPYING.  If not, write to
 * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

#include "config.h"

#include <string.h>
#include <stdlib.h>

#ifndef _WIN32
#include <netinet/in.h>
#include <arpa/inet.h>
#endif

#include "libssh/libssh.h"
#include "libssh/priv.h"
#include "libssh/ssh2.h"
#include "libssh/buffer.h"
#include "libssh/packet.h"
#include "libssh/channels.h"
#include "libssh/session.h"
#include "libssh/misc.h"
#include "libssh/pki.h"
#include "libssh/messages.h"
#include "libssh/socket.h"
#ifdef WITH_SERVER
#include "libssh/server.h"
#include "libssh/gssapi.h"
#endif

/**
 * @defgroup libssh_messages The SSH message functions
 * @ingroup libssh
 *
 * This file contains the message parsing utilities for client and server
 * programs using libssh.
 *
 * On the server the main loop of the program will call
 * ssh_message_get(session) to get messages as they come. They are not 1-1 with
 * the protocol messages. Then, the user will know what kind of a message it is
 * and use the appropriate functions to handle it (or use the default handlers
 * if you don't know what to do).
 *
 * @{
 */

static ssh_message ssh_message_new(ssh_session session)
{
    ssh_message msg = calloc(1, sizeof(struct ssh_message_struct));
    if (msg == NULL) {
        return NULL;
    }
    msg->session = session;

    /* Set states explicitly */
    msg->auth_request.signature_state = SSH_PUBLICKEY_STATE_NONE;

    return msg;
}

#ifndef WITH_SERVER

/* Reduced version of the reply default that only replies with
 * SSH_MSG_UNIMPLEMENTED
 */
static int ssh_message_reply_default(ssh_message msg)
{
    int rc;

    SSH_LOG(SSH_LOG_FUNCTIONS, "Reporting unknown packet");

    rc = ssh_buffer_add_u8(msg->session->out_buffer, SSH2_MSG_UNIMPLEMENTED);
    if (rc < 0) {
        goto error;
    }
    rc = ssh_buffer_add_u32(msg->session->out_buffer,
                            htonl(msg->session->recv_seq - 1));
    if (rc < 0) {
        goto error;
    }
    return ssh_packet_send(msg->session);

error:
    return SSH_ERROR;
}

#endif

static int ssh_send_disconnect(ssh_session session)
{
    int rc = SSH_ERROR;

    if (session == NULL) {
        return SSH_ERROR;
    }

    if (session->disconnect_message == NULL) {
        session->disconnect_message = strdup("Bye Bye");
        if (session->disconnect_message == NULL) {
            ssh_set_error_oom(session);
            return SSH_ERROR;
        }
    }

    if (session->socket != NULL && ssh_socket_is_open(session->socket)) {
        rc = ssh_buffer_pack(session->out_buffer,
                             "bdss",
                             SSH2_MSG_DISCONNECT,
                             SSH2_DISCONNECT_BY_APPLICATION,
                             session->disconnect_message,
                             ""); /* language tag */
        if (rc != SSH_OK) {
            ssh_set_error_oom(session);
            return SSH_ERROR;
        }

        rc = ssh_packet_send(session);
        ssh_session_socket_close(session);
    }

    return rc;
}

#ifdef WITH_SERVER

static int ssh_execute_server_request(ssh_session session, ssh_message msg)
{
    ssh_channel channel = NULL;
    int rc;

    switch (msg->type) {
    case SSH_REQUEST_AUTH:
        if (msg->auth_request.method == SSH_AUTH_METHOD_PASSWORD &&
            ssh_callbacks_exists(session->server_callbacks,
                                 auth_password_function)) {
            rc = session->server_callbacks->auth_password_function(
                session,
                msg->auth_request.username,
                msg->auth_request.password,
                session->server_callbacks->userdata);
            if (rc == SSH_AUTH_SUCCESS || rc == SSH_AUTH_PARTIAL) {
                ssh_message_auth_reply_success(msg, rc == SSH_AUTH_PARTIAL);
            } else {
                ssh_message_reply_default(msg);
            }

            return SSH_OK;
        } else if (msg->auth_request.method == SSH_AUTH_METHOD_PUBLICKEY &&
                   ssh_callbacks_exists(session->server_callbacks,
                                        auth_pubkey_function)) {
            rc = session->server_callbacks->auth_pubkey_function(
                session,
                msg->auth_request.username,
                msg->auth_request.pubkey,
                msg->auth_request.signature_state,
                session->server_callbacks->userdata);
            if (msg->auth_request.signature_state != SSH_PUBLICKEY_STATE_NONE) {
                if (rc == SSH_AUTH_SUCCESS || rc == SSH_AUTH_PARTIAL) {
                    ssh_message_auth_reply_success(msg, rc == SSH_AUTH_PARTIAL);
                } else {
                    ssh_message_reply_default(msg);
                }
            } else {
                if (rc == SSH_AUTH_SUCCESS) {
                    ssh_message_auth_reply_pk_ok_simple(msg);
                } else {
                    ssh_message_reply_default(msg);
                }
            }

            return SSH_OK;
        } else if (msg->auth_request.method == SSH_AUTH_METHOD_NONE &&
                   ssh_callbacks_exists(session->server_callbacks,
                                        auth_none_function)) {
            rc = session->server_callbacks->auth_none_function(
                session,
                msg->auth_request.username,
                session->server_callbacks->userdata);
            if (rc == SSH_AUTH_SUCCESS || rc == SSH_AUTH_PARTIAL) {
                ssh_message_auth_reply_success(msg, rc == SSH_AUTH_PARTIAL);
            } else {
                ssh_message_reply_default(msg);
            }

            return SSH_OK;
        } else if (msg->auth_request.method == SSH_AUTH_METHOD_INTERACTIVE &&
                   ssh_callbacks_exists(session->server_callbacks,
                                        auth_kbdint_function)) {
            rc = session->server_callbacks->auth_kbdint_function(
                msg,
                session,
                session->server_callbacks->userdata);
            if (rc == SSH_AUTH_SUCCESS || rc == SSH_AUTH_PARTIAL) {
                ssh_message_auth_reply_success(msg, rc == SSH_AUTH_PARTIAL);
            } else if (rc == SSH_AUTH_INFO) {
                return SSH_OK;
            } else {
                ssh_message_reply_default(msg);
            }
            return SSH_OK;
        }
        break;
    case SSH_REQUEST_CHANNEL_OPEN:
#define CB channel_open_request_session_function
        if (msg->channel_request_open.type == SSH_CHANNEL_SESSION &&
            ssh_callbacks_exists(session->server_callbacks, CB)) {
            channel = session->server_callbacks->CB(
                session,
                session->server_callbacks->userdata);
#undef CB
            if (channel != NULL) {
                rc = ssh_message_channel_request_open_reply_accept_channel(
                    msg,
                    channel);
                if (rc != SSH_OK) {
                    SSH_LOG(SSH_LOG_TRACE,
                            "Failed to send reply for accepting a channel "
                            "open");
                }
                return SSH_OK;
            } else {
                ssh_message_reply_default(msg);
            }

            return SSH_OK;
#define CB channel_open_request_direct_tcpip_function
        } else if (msg->channel_request_open.type == SSH_CHANNEL_DIRECT_TCPIP &&
                   ssh_callbacks_exists(session->server_callbacks, CB)) {
            struct ssh_channel_request_open *rq = &msg->channel_request_open;
            channel = session->server_callbacks->CB(session,
                                                    rq->destination,
                                                    rq->destination_port,
                                                    rq->originator,
                                                    rq->originator_port,
                                                    session->server_callbacks->userdata);
#undef CB
            if (channel != NULL) {
                rc = ssh_message_channel_request_open_reply_accept_channel(
                    msg,
                    channel);
                if (rc != SSH_OK) {
                    SSH_LOG(SSH_LOG_TRACE,
                            "Failed to send reply for accepting a channel "
                            "open");
                }
                return SSH_OK;
            } else {
                ssh_message_reply_default(msg);
            }

            return SSH_OK;
        }

        break;
    case SSH_REQUEST_CHANNEL:
        channel = msg->channel_request.channel;

        if (msg->channel_request.type == SSH_CHANNEL_REQUEST_PTY) {
            ssh_callbacks_iterate (channel->callbacks,
                                   ssh_channel_callbacks,
                                   channel_pty_request_function) {
                rc = ssh_callbacks_iterate_exec(channel_pty_request_function,
                                                session,
                                                channel,
                                                msg->channel_request.TERM,
                                                msg->channel_request.width,
                                                msg->channel_request.height,
                                                msg->channel_request.pxwidth,
                                                msg->channel_request.pxheight);
                if (rc == 0) {
                    ssh_message_channel_request_reply_success(msg);
                } else {
                    ssh_message_reply_default(msg);
                }
                return SSH_OK;
            }
            ssh_callbacks_iterate_end();
        } else if (msg->channel_request.type == SSH_CHANNEL_REQUEST_SHELL) {
            ssh_callbacks_iterate (channel->callbacks,
                                   ssh_channel_callbacks,
                                   channel_shell_request_function) {
                rc = ssh_callbacks_iterate_exec(channel_shell_request_function,
                                                session,
                                                channel);
                if (rc == 0) {
                    ssh_message_channel_request_reply_success(msg);
                } else {
                    ssh_message_reply_default(msg);
                }
                return SSH_OK;
            }
            ssh_callbacks_iterate_end();
        } else if (msg->channel_request.type == SSH_CHANNEL_REQUEST_X11) {
            ssh_callbacks_iterate (channel->callbacks,
                                   ssh_channel_callbacks,
                                   channel_x11_req_function) {
                ssh_callbacks_iterate_exec(channel_x11_req_function,
                                           session,
                                           channel,
                                           msg->channel_request.x11_single_connection,
                                           msg->channel_request.x11_auth_protocol,
                                           msg->channel_request.x11_auth_cookie,
                                           msg->channel_request.x11_screen_number);
                ssh_message_channel_request_reply_success(msg);
                return SSH_OK;
            }
            ssh_callbacks_iterate_end();
        } else if (msg->channel_request.type == SSH_CHANNEL_REQUEST_WINDOW_CHANGE) {
            ssh_callbacks_iterate (channel->callbacks,
                                   ssh_channel_callbacks,
                                   channel_pty_window_change_function) {
                rc = ssh_callbacks_iterate_exec(channel_pty_window_change_function,
                                                session,
                                                channel,
                                                msg->channel_request.width,
                                                msg->channel_request.height,
                                                msg->channel_request.pxwidth,
                                                msg->channel_request.pxheight);
                if (rc != SSH_OK) {
                    SSH_LOG(SSH_LOG_TRACE,
                            "Failed to iterate callbacks for window change");
                }
                return SSH_OK;
            }
            ssh_callbacks_iterate_end();
        } else if (msg->channel_request.type == SSH_CHANNEL_REQUEST_EXEC) {
            ssh_callbacks_iterate (channel->callbacks,
                                   ssh_channel_callbacks,
                                   channel_exec_request_function) {
                rc = ssh_callbacks_iterate_exec(channel_exec_request_function,
                                                session,
                                                channel,
                                                msg->channel_request.command);
                if (rc == 0) {
                    ssh_message_channel_request_reply_success(msg);
                } else {
                    ssh_message_reply_default(msg);
                }

                return SSH_OK;
            }
            ssh_callbacks_iterate_end();
        } else if (msg->channel_request.type == SSH_CHANNEL_REQUEST_ENV) {
            ssh_callbacks_iterate (channel->callbacks,
                                   ssh_channel_callbacks,
                                   channel_env_request_function) {
                rc = ssh_callbacks_iterate_exec(channel_env_request_function,
                                                session,
                                                channel,
                                                msg->channel_request.var_name,
                                                msg->channel_request.var_value);
                if (rc == 0) {
                    ssh_message_channel_request_reply_success(msg);
                } else {
                    ssh_message_reply_default(msg);
                }
                return SSH_OK;
            }
            ssh_callbacks_iterate_end();
        } else if (msg->channel_request.type == SSH_CHANNEL_REQUEST_SUBSYSTEM) {
            ssh_callbacks_iterate (channel->callbacks,
                                   ssh_channel_callbacks,
                                   channel_subsystem_request_function) {
                rc = ssh_callbacks_iterate_exec(
                    channel_subsystem_request_function,
                    session,
                    channel,
                    msg->channel_request.subsystem);
                if (rc == 0) {
                    ssh_message_channel_request_reply_success(msg);
                } else {
                    ssh_message_reply_default(msg);
                }

                return SSH_OK;
            }
            ssh_callbacks_iterate_end();
        }
        break;
    case SSH_REQUEST_SERVICE:
        if (ssh_callbacks_exists(session->server_callbacks,
                                 service_request_function)) {
            rc = session->server_callbacks->service_request_function(
                session,
                msg->service_request.service,
                session->server_callbacks->userdata);
            if (rc == 0) {
                ssh_message_reply_default(msg);
            } else {
                ssh_send_disconnect(session);
            }

            return SSH_OK;
        }

        return SSH_AGAIN;
    case SSH_REQUEST_GLOBAL:
        break;
    }

    return SSH_AGAIN;
}

static int ssh_reply_channel_open_request(ssh_message msg, ssh_channel channel)
{
    if (channel != NULL) {
        return ssh_message_channel_request_open_reply_accept_channel(msg, channel);
    }

    ssh_message_reply_default(msg);

    return SSH_OK;
}

static int ssh_execute_client_request(ssh_session session, ssh_message msg)
{
    ssh_channel channel = NULL;
    int rc = SSH_AGAIN;

#define CB channel_open_request_x11_function
    if (msg->type == SSH_REQUEST_CHANNEL_OPEN &&
        msg->channel_request_open.type == SSH_CHANNEL_X11 &&
        ssh_callbacks_exists(session->common.callbacks, CB)) {
        channel = session->common.callbacks->CB(
            session,
            msg->channel_request_open.originator,
            msg->channel_request_open.originator_port,
            session->common.callbacks->userdata);
#undef CB

        return ssh_reply_channel_open_request(msg, channel);
#define CB channel_open_request_auth_agent_function
    } else if (msg->type == SSH_REQUEST_CHANNEL_OPEN &&
               msg->channel_request_open.type == SSH_CHANNEL_AUTH_AGENT &&
               ssh_callbacks_exists(session->common.callbacks, CB)) {
        channel = session->common.callbacks->CB(
            session,
            session->common.callbacks->userdata);
#undef CB

        return ssh_reply_channel_open_request(msg, channel);
#define CB channel_open_request_forwarded_tcpip_function
    } else if (msg->type == SSH_REQUEST_CHANNEL_OPEN &&
               msg->channel_request_open.type == SSH_CHANNEL_FORWARDED_TCPIP &&
               ssh_callbacks_exists(session->common.callbacks, CB)) {
        channel = session->common.callbacks->CB(
            session,
            msg->channel_request_open.destination,
            msg->channel_request_open.destination_port,
            msg->channel_request_open.originator,
            msg->channel_request_open.originator_port,
            session->common.callbacks->userdata);
#undef CB

        return ssh_reply_channel_open_request(msg, channel);
    }

    return rc;
}

/** @internal
 * Executes the callbacks defined in session->server_callbacks, out of an ssh_message
 * I don't like ssh_message interface but it works.
 * @returns SSH_OK if the message has been handled, or SSH_AGAIN otherwise.
 */
static int ssh_execute_server_callbacks(ssh_session session, ssh_message msg)
{
    int rc = SSH_AGAIN;

    if (session->server_callbacks != NULL) {
        rc = ssh_execute_server_request(session, msg);
    } else if (session->common.callbacks != NULL) {
        /* This one is in fact a client callback... */
        rc = ssh_execute_client_request(session, msg);
    }

    return rc;
}

#endif /* WITH_SERVER */

static int ssh_execute_message_callback(ssh_session session, ssh_message msg)
{
    int ret;

    if (session->ssh_message_callback != NULL) {
        ret = session->ssh_message_callback(session,
                                            msg,
                                            session->ssh_message_callback_data);
        if (ret == 1) {
            ret = ssh_message_reply_default(msg);
            SSH_MESSAGE_FREE(msg);
            if(ret != SSH_OK) {
                return ret;
            }
        } else {
            SSH_MESSAGE_FREE(msg);
        }
    } else {
        ret = ssh_message_reply_default(msg);
        SSH_MESSAGE_FREE(msg);
        if(ret != SSH_OK) {
            return ret;
        }
    }
    return SSH_OK;
}

/**
 * @internal
 *
 * @brief Add a message to the current queue of messages to be parsed and/or call
 * the various callback functions.
 *
 * @param[in]  session  The SSH session to add the message.
 *
 * @param[in]  message  The message to add to the queue.
 */
static void ssh_message_queue(ssh_session session, ssh_message message)
{
#ifdef WITH_SERVER
    int ret;
#endif

    if (message == NULL) {
        return;
    }

#ifdef WITH_SERVER
    /* probably not the best place to execute server callbacks, but still better
     * than nothing.
     */
    ret = ssh_execute_server_callbacks(session, message);
    if (ret == SSH_OK) {
        SSH_MESSAGE_FREE(message);
        return;
    }
#endif /* WITH_SERVER */

    if (session->ssh_message_callback != NULL) {
        /* This will transfer the message, do not free. */
        ssh_execute_message_callback(session, message);
        return;
    }

    if (session->server_callbacks != NULL) {
        /* if we have server callbacks, but nothing was executed, it means we are
         * in non-synchronous mode, and we just don't care about the message we
         * received. Just send a default response. Do not queue it.
         */
        ssh_message_reply_default(message);
        SSH_MESSAGE_FREE(message);
        return;
    }

    if (session->ssh_message_list == NULL) {
        session->ssh_message_list = ssh_list_new();
        if (session->ssh_message_list == NULL) {
            /*
             * If the message list couldn't be allocated, the message can't be
             * enqueued
             */
            ssh_message_reply_default(message);
            ssh_set_error_oom(session);
            SSH_MESSAGE_FREE(message);
            return;
        }
    }

    /* This will transfer the message, do not free. */
    ssh_list_append(session->ssh_message_list, message);
    return;
}

/**
 * @internal
 *
 * @brief Pop a message from the message list and dequeue it.
 *
 * @param[in]  session  The SSH session to pop the message.
 *
 * @returns             The head message or NULL if it doesn't exist.
 */
ssh_message ssh_message_pop_head(ssh_session session)
{
    ssh_message msg = NULL;
    struct ssh_iterator *i = NULL;

    if (session->ssh_message_list == NULL) {
        return NULL;
    }

    i = ssh_list_get_iterator(session->ssh_message_list);
    if (i != NULL) {
        msg = ssh_iterator_value(ssh_message, i);
        ssh_list_remove(session->ssh_message_list, i);
    }
    return msg;
}

/* Returns 1 if there is a message available */
static int ssh_message_termination(void *s)
{
    ssh_session session = s;
    struct ssh_iterator *it = NULL;

    if (session->session_state == SSH_SESSION_STATE_ERROR)
        return 1;

    it = ssh_list_get_iterator(session->ssh_message_list);
    if (!it) {
        return 0;
    } else {
        return 1;
    }
}
/**
 * @brief Retrieve a SSH message from a SSH session.
 *
 * @param[in]  session  The SSH session to get the message.
 *
 * @returns             The SSH message received, NULL in case of error, or timeout
 *                      elapsed.
 *
 * @warning This function blocks until a message has been received. Betterset up
 *          a callback if this behavior is unwanted.
 */
ssh_message ssh_message_get(ssh_session session)
{
    ssh_message msg = NULL;
    int rc;

    msg = ssh_message_pop_head(session);
    if (msg != NULL) {
        return msg;
    }
    if (session->ssh_message_list == NULL) {
        session->ssh_message_list = ssh_list_new();
        if (session->ssh_message_list == NULL) {
            ssh_set_error_oom(session);
            return NULL;
        }
    }
    rc = ssh_handle_packets_termination(session,
                                        SSH_TIMEOUT_USER,
                                        ssh_message_termination,
                                        session);
    if (rc || session->session_state == SSH_SESSION_STATE_ERROR) {
        return NULL;
    }
    msg = ssh_list_pop_head(ssh_message, session->ssh_message_list);

    return msg;
}

/**
 * @brief Get the type of the message.
 *
 * @param[in] msg       The message to get the type from.
 *
 * @return              The message type or -1 on error.
 */
int ssh_message_type(ssh_message msg)
{
    if (msg == NULL) {
        return -1;
    }

    return msg->type;
}

/**
 * @brief Get the subtype of the message.
 *
 * @param[in] msg       The message to get the subtype from.
 *
 * @return              The message type or -1 on error.
 */
int ssh_message_subtype(ssh_message msg)
{
    if (msg == NULL) {
        return -1;
    }

    switch (msg->type) {
    case SSH_REQUEST_AUTH:
        return msg->auth_request.method;
    case SSH_REQUEST_CHANNEL_OPEN:
        return msg->channel_request_open.type;
    case SSH_REQUEST_CHANNEL:
        return msg->channel_request.type;
    case SSH_REQUEST_GLOBAL:
        return msg->global_request.type;
    }

    return -1;
}

/**
 * @brief Free a SSH message.
 *
 * @param[in] msg       The message to release the memory.
 */
void ssh_message_free(ssh_message msg)
{
    if (msg == NULL) {
        return;
    }

    switch (msg->type) {
    case SSH_REQUEST_AUTH:
        SAFE_FREE(msg->auth_request.username);
        SAFE_FREE(msg->auth_request.sigtype);
        if (msg->auth_request.password) {
            ssh_burn(msg->auth_request.password,
                     strlen(msg->auth_request.password));
            SAFE_FREE(msg->auth_request.password);
        }
        ssh_key_free(msg->auth_request.pubkey);
        ssh_key_free(msg->auth_request.server_pubkey);
        break;
    case SSH_REQUEST_CHANNEL_OPEN:
        SAFE_FREE(msg->channel_request_open.originator);
        SAFE_FREE(msg->channel_request_open.destination);
        break;
    case SSH_REQUEST_CHANNEL:
        SAFE_FREE(msg->channel_request.TERM);
        SAFE_FREE(msg->channel_request.modes);
        SAFE_FREE(msg->channel_request.var_name);
        SAFE_FREE(msg->channel_request.var_value);
        SAFE_FREE(msg->channel_request.command);
        SAFE_FREE(msg->channel_request.subsystem);
        switch (msg->channel_request.type) {
        case SSH_CHANNEL_REQUEST_EXEC:
            SAFE_FREE(msg->channel_request.command);
            break;
        case SSH_CHANNEL_REQUEST_ENV:
            SAFE_FREE(msg->channel_request.var_name);
            SAFE_FREE(msg->channel_request.var_value);
            break;
        case SSH_CHANNEL_REQUEST_PTY:
            SAFE_FREE(msg->channel_request.TERM);
            break;
        case SSH_CHANNEL_REQUEST_SUBSYSTEM:
            SAFE_FREE(msg->channel_request.subsystem);
            break;
        case SSH_CHANNEL_REQUEST_X11:
            SAFE_FREE(msg->channel_request.x11_auth_protocol);
            SAFE_FREE(msg->channel_request.x11_auth_cookie);
            break;
        }
        break;
    case SSH_REQUEST_SERVICE:
        SAFE_FREE(msg->service_request.service);
        break;
    case SSH_REQUEST_GLOBAL:
        SAFE_FREE(msg->global_request.bind_address);
        break;
    }
    ZERO_STRUCTP(msg);
    SAFE_FREE(msg);
}

#ifdef WITH_SERVER

SSH_PACKET_CALLBACK(ssh_packet_service_request)
{
    char *service_c = NULL;
    ssh_message msg = NULL;
    int rc;

    (void)type;
    (void)user;

    rc = ssh_buffer_unpack(packet,
                           "s",
                           &service_c);
    if (rc != SSH_OK) {
        ssh_set_error(session,
                      SSH_FATAL,
                      "Invalid SSH_MSG_SERVICE_REQUEST packet");
        goto error;
    }

    SSH_LOG(SSH_LOG_PACKET,
            "Received a SERVICE_REQUEST for service %s",
            service_c);

    msg = ssh_message_new(session);
    if (msg == NULL) {
        SAFE_FREE(service_c);
        goto error;
    }

    msg->type = SSH_REQUEST_SERVICE;
    msg->service_request.service = service_c;

    ssh_message_queue(session, msg);
error:

    return SSH_PACKET_USED;
}


/*
 * This function concats in a buffer the values needed to do a signature
 * verification.
 */
static ssh_buffer ssh_msg_userauth_build_digest(ssh_session session,
                                                ssh_message msg,
                                                const char *service,
                                                ssh_string algo,
                                                const char *method)
{
    struct ssh_crypto_struct *crypto = NULL;
    ssh_buffer buffer = NULL;
    ssh_string str = NULL;
    int rc;

    crypto = ssh_packet_get_current_crypto(session, SSH_DIRECTION_IN);
    if (crypto == NULL) {
        return NULL;
    }

    buffer = ssh_buffer_new();
    if (buffer == NULL) {
        return NULL;
    }
    rc = ssh_pki_export_pubkey_blob(msg->auth_request.pubkey, &str);
    if (rc < 0) {
        SSH_BUFFER_FREE(buffer);
        return NULL;
    }

    rc = ssh_buffer_pack(buffer,
                         "dPbsssbsS",
                         (uint32_t)crypto->session_id_len, /* session ID string */
                         crypto->session_id_len,
                         crypto->session_id,
                         SSH2_MSG_USERAUTH_REQUEST, /* type */
                         msg->auth_request.username,
                         service,
                         method,
                         1, /* has to be signed (true) */
                         ssh_string_get_char(algo), /* pubkey algorithm */
                         str);                      /* public key as a blob */

    SSH_STRING_FREE(str);
    if (rc != SSH_OK) {
        ssh_set_error_oom(session);
        SSH_BUFFER_FREE(buffer);
        return NULL;
    }

    /* Add server public key for hostbound extension */
    if (strcmp(method, "publickey-hostbound-v00@openssh.com") == 0 &&
        msg->auth_request.server_pubkey != NULL) {

        rc = ssh_pki_export_pubkey_blob(msg->auth_request.server_pubkey, &str);
        if (rc < 0) {
            SSH_BUFFER_FREE(buffer);
            return NULL;
        }

        rc = ssh_buffer_add_ssh_string(buffer, str);
        SSH_STRING_FREE(str);
        if (rc < 0) {
            ssh_set_error_oom(session);
            SSH_BUFFER_FREE(buffer);
            return NULL;
        }
    }

    return buffer;
}

/**
 * @internal
 *
 * @brief Handle a SSH_MSG_MSG_USERAUTH_REQUEST packet and queue a
 * SSH Message
 */
SSH_PACKET_CALLBACK(ssh_packet_userauth_request)
{
    ssh_message msg = NULL;
    ssh_signature sig = NULL;
    char *service = NULL;
    char *method = NULL;
    int cmp;
    int rc;

    (void)user;
    (void)type;

    msg = ssh_message_new(session);
    if (msg == NULL) {
        ssh_set_error_oom(session);
        goto error;
    }
    msg->type = SSH_REQUEST_AUTH;
    rc = ssh_buffer_unpack(packet,
                           "sss",
                           &msg->auth_request.username,
                           &service,
                           &method);

    if (rc != SSH_OK) {
        goto error;
    }

    SSH_LOG(SSH_LOG_PACKET,
            "Auth request for service %s, method %s for user '%s'",
            service,
            method,
            msg->auth_request.username);

    cmp = strcmp(service, "ssh-connection");
    if (cmp != 0) {
        SSH_LOG(SSH_LOG_TRACE, "Invalid service request: %s", service);
        goto end;
    }

    if (strcmp(method, "none") == 0) {
        msg->auth_request.method = SSH_AUTH_METHOD_NONE;
        goto end;
    }

    if (strcmp(method, "password") == 0) {
        uint8_t tmp;

        msg->auth_request.method = SSH_AUTH_METHOD_PASSWORD;
        rc = ssh_buffer_unpack(packet, "bs", &tmp, &msg->auth_request.password);
        if (rc != SSH_OK) {
            goto error;
        }
        goto end;
    }

    if (strcmp(method, "keyboard-interactive") == 0) {
        ssh_string lang = NULL;
        ssh_string submethods = NULL;

        msg->auth_request.method = SSH_AUTH_METHOD_INTERACTIVE;
        lang = ssh_buffer_get_ssh_string(packet);
        if (lang == NULL) {
            goto error;
        }
        /* from the RFC 4256
         * 3.1.  Initial Exchange
         * "The language tag is deprecated and SHOULD be the empty string."
         */
        SSH_STRING_FREE(lang);

        submethods = ssh_buffer_get_ssh_string(packet);
        if (submethods == NULL) {
            goto error;
        }
        /* from the RFC 4256
         * 3.1.  Initial Exchange
         * "One possible implementation strategy of the submethods field on the
         *  server is that, unless the user may use multiple different
         *  submethods, the server ignores this field."
         */
        SSH_STRING_FREE(submethods);

        goto end;
    }

    if (strcmp(method, "publickey") == 0 ||
        strcmp(method, "publickey-hostbound-v00@openssh.com") == 0) {
        ssh_string algo = NULL;
        ssh_string pubkey_blob = NULL;
        ssh_string server_pubkey_blob = NULL;
        uint8_t has_sign;

        msg->auth_request.method = SSH_AUTH_METHOD_PUBLICKEY;

        rc = ssh_buffer_unpack(packet, "bSS", &has_sign, &algo, &pubkey_blob);

        if (rc != SSH_OK) {
            goto error;
        }

        cmp = strcmp(method, "publickey-hostbound-v00@openssh.com");
        if (cmp == 0) {
            server_pubkey_blob = ssh_buffer_get_ssh_string(packet);
            if (server_pubkey_blob == NULL) {
                SSH_STRING_FREE(pubkey_blob);
                SSH_STRING_FREE(algo);
                goto error;
            }

            rc = ssh_pki_import_pubkey_blob(server_pubkey_blob,
                                            &msg->auth_request.server_pubkey);
            SSH_STRING_FREE(server_pubkey_blob);

            if (rc < 0) {
                SSH_STRING_FREE(pubkey_blob);
                SSH_STRING_FREE(algo);
                goto error;
            }
        }

        rc = ssh_pki_import_pubkey_blob(pubkey_blob, &msg->auth_request.pubkey);
        SSH_STRING_FREE(pubkey_blob);
        pubkey_blob = NULL;
        if (rc < 0) {
            SSH_STRING_FREE(algo);
            algo = NULL;
            goto error;
        }
        msg->auth_request.signature_state = SSH_PUBLICKEY_STATE_NONE;
        msg->auth_request.sigtype = strdup(ssh_string_get_char(algo));
        if (msg->auth_request.sigtype == NULL) {
            msg->auth_request.signature_state = SSH_PUBLICKEY_STATE_ERROR;
            SSH_STRING_FREE(algo);
            algo = NULL;
            goto error;
        }

        // has a valid signature ?
        if (has_sign) {
            ssh_string sig_blob = NULL;
            ssh_buffer digest = NULL;

            sig_blob = ssh_buffer_get_ssh_string(packet);
            if (sig_blob == NULL) {
                SSH_LOG(SSH_LOG_PACKET, "Invalid signature packet from peer");
                msg->auth_request.signature_state = SSH_PUBLICKEY_STATE_ERROR;
                SSH_STRING_FREE(algo);
                algo = NULL;
                goto error;
            }

            digest = ssh_msg_userauth_build_digest(session,
                                                   msg,
                                                   service,
                                                   algo,
                                                   method);
            SSH_STRING_FREE(algo);
            algo = NULL;
            if (digest == NULL) {
                SSH_STRING_FREE(sig_blob);
                SSH_LOG(SSH_LOG_PACKET, "Failed to get digest");
                msg->auth_request.signature_state = SSH_PUBLICKEY_STATE_WRONG;
                goto error;
            }

            rc = ssh_pki_import_signature_blob(sig_blob,
                                               msg->auth_request.pubkey,
                                               &sig);
            if (rc == SSH_OK) {
                /* Check if the signature from client matches server preferences
                 */
                if (session->opts.pubkey_accepted_types) {
                    cmp = match_group(session->opts.pubkey_accepted_types,
                                      sig->type_c);
                    if (cmp != 1) {
                        ssh_set_error(
                            session,
                            SSH_FATAL,
                            "Public key from client (%s) doesn't match server "
                            "preference (%s)",
                            sig->type_c,
                            session->opts.pubkey_accepted_types);
                        rc = SSH_ERROR;
                    }
                }

                if (rc == SSH_OK) {
                    rc = ssh_pki_signature_verify(session,
                                                  sig,
                                                  msg->auth_request.pubkey,
                                                  ssh_buffer_get(digest),
                                                  ssh_buffer_get_len(digest));
                }
            }
            SSH_STRING_FREE(sig_blob);
            SSH_BUFFER_FREE(digest);
            ssh_signature_free(sig);
            if (rc < 0) {
                SSH_LOG(SSH_LOG_PACKET,
                        "Received an invalid signature from peer");
                msg->auth_request.signature_state = SSH_PUBLICKEY_STATE_WRONG;
                goto error;
            }

            SSH_LOG(SSH_LOG_PACKET, "Valid signature received");

            cmp = strcmp(method, "publickey-hostbound-v00@openssh.com");
            if (cmp == 0) {
                ssh_key server_key = NULL;

                if (msg->auth_request.server_pubkey == NULL) {
                    SSH_LOG(SSH_LOG_PACKET,
                            "Server public key not provided by client");
                    msg->auth_request.signature_state =
                        SSH_PUBLICKEY_STATE_WRONG;
                    goto error;
                }

                rc = ssh_get_server_publickey(session, &server_key);
                if (rc != SSH_OK) {
                    SSH_LOG(SSH_LOG_PACKET,
                            "Failed to get server public key for hostbound "
                            "verification");
                    msg->auth_request.signature_state =
                        SSH_PUBLICKEY_STATE_ERROR;
                    ssh_key_free(server_key);
                    goto error;
                }

                if (ssh_key_cmp(server_key,
                                msg->auth_request.server_pubkey,
                                SSH_KEY_CMP_PUBLIC) != 0) {
                    SSH_LOG(SSH_LOG_PACKET,
                            "Server public key doesn't match the one provided "
                            "by client");
                    msg->auth_request.signature_state =
                        SSH_PUBLICKEY_STATE_WRONG;
                    ssh_key_free(server_key);
                    goto error;
                }
                ssh_key_free(server_key);
            }

            msg->auth_request.signature_state = SSH_PUBLICKEY_STATE_VALID;
        }

        SAFE_FREE(method);
        SSH_STRING_FREE(algo);
        goto end;
    }
#ifdef WITH_GSSAPI
    if (strcmp(method, "gssapi-with-mic") == 0) {
        uint32_t n_oid;
        ssh_string *oids = NULL;
        ssh_string oid = NULL;
        char *hexa = NULL;
        int i;
        rc = ssh_buffer_get_u32(packet, &n_oid);
        if (rc != sizeof(uint32_t)) {
            ssh_set_error(session,
                          SSH_FATAL,
                          "USERAUTH_REQUEST: Failed to unpack OIDs");
            goto error;
        }
        n_oid = ntohl(n_oid);
        if (n_oid > 100) {
            ssh_set_error(
                session,
                SSH_FATAL,
                "USERAUTH_REQUEST: gssapi-with-mic OID count too big (%d)",
                n_oid);
            goto error;
        }
        SSH_LOG(SSH_LOG_PACKET, "gssapi: %d OIDs", n_oid);
        oids = calloc(n_oid, sizeof(ssh_string));
        if (oids == NULL) {
            ssh_set_error_oom(session);
            goto error;
        }
        for (i = 0; i < (int)n_oid; ++i) {
            oid = ssh_buffer_get_ssh_string(packet);
            if (oid == NULL) {
                for (i = i - 1; i >= 0; --i) {
                    SAFE_FREE(oids[i]);
                }
                SAFE_FREE(oids);
                ssh_set_error(session,
                              SSH_LOG_PACKET,
                              "USERAUTH_REQUEST: gssapi-with-mic missing OID");
                goto error;
            }
            oids[i] = oid;
            if (session->common.log_verbosity >= SSH_LOG_PACKET) {
                hexa = ssh_get_hexa(ssh_string_data(oid), ssh_string_len(oid));
                SSH_LOG(SSH_LOG_PACKET, "gssapi: OID %d: %s", i, hexa);
                SAFE_FREE(hexa);
            }
        }
        ssh_gssapi_handle_userauth(session,
                                   msg->auth_request.username,
                                   n_oid,
                                   oids);

        for (i = 0; i < (int)n_oid; ++i) {
            SAFE_FREE(oids[i]);
        }
        SAFE_FREE(oids);
        /* bypass the message queue thing */
        SAFE_FREE(service);
        SAFE_FREE(method);
        SSH_MESSAGE_FREE(msg);

        return SSH_PACKET_USED;
    }
    if (strcmp(method, "gssapi-keyex") == 0) {
        gss_buffer_desc received_mic = GSS_C_EMPTY_BUFFER;
        gss_buffer_desc mic_buf = GSS_C_EMPTY_BUFFER;
        ssh_string mic_token_string = NULL;
        OM_uint32 maj_stat, min_stat;
        ssh_buffer buf = NULL;
        ssh_server_callbacks callbacks = session->server_callbacks;

        if (!ssh_session_kex_is_gss(session)) {
            ssh_set_error(session,
                          SSH_FATAL,
                          "Attempt to authenticate with gssapi-keyex without "
                          "doing GSSAPI Key Exchange.");
            ssh_auth_reply_default(session, 0);
            goto error;
        }

        if (session->gssapi == NULL || session->gssapi->ctx == NULL) {
            ssh_set_error(session, SSH_FATAL, "GSSAPI context not initialized");
            ssh_auth_reply_default(session, 0);
            goto error;
        }

        rc = ssh_buffer_unpack(packet, "S", &mic_token_string);
        if (rc != SSH_OK) {
            ssh_auth_reply_default(session, 0);
            goto error;
        }
        received_mic.length = ssh_string_len(mic_token_string);
        received_mic.value = ssh_string_data(mic_token_string);

        SAFE_FREE(session->gssapi->user);
        session->gssapi->user = strdup(msg->auth_request.username);
        buf = ssh_gssapi_build_mic(session, "gssapi-keyex");
        if (buf == NULL) {
            ssh_set_error_oom(session);
            SSH_STRING_FREE(mic_token_string);
            ssh_auth_reply_default(session, 0);
            goto error;
        }

        mic_buf.length = ssh_buffer_get_len(buf);
        mic_buf.value = ssh_buffer_get(buf);

        maj_stat = gss_verify_mic(&min_stat,
                                  session->gssapi->ctx,
                                  &mic_buf,
                                  &received_mic,
                                  NULL);
        if (maj_stat != GSS_S_COMPLETE) {
            ssh_set_error(session,
                          SSH_FATAL,
                          "Failed to verify MIC for gssapi-keyex auth");
            SSH_BUFFER_FREE(buf);
            SSH_STRING_FREE(mic_token_string);
            ssh_auth_reply_default(session, 0);
            goto error;
        }

        if (ssh_callbacks_exists(callbacks, auth_gssapi_mic_function)) {
            rc = callbacks->auth_gssapi_mic_function(session,
                                                     session->gssapi->user,
                                                     session->gssapi->canonic_user,
                                                     callbacks->userdata);
            switch (rc) {
            case SSH_AUTH_SUCCESS:
                ssh_auth_reply_success(session, 0);
                break;
            case SSH_AUTH_PARTIAL:
                ssh_auth_reply_success(session, 1);
                break;
            default:
                ssh_auth_reply_default(session, 0);
                break;
            }
        }

        /* bypass the message queue thing */
        SAFE_FREE(service);
        SAFE_FREE(method);
        SSH_BUFFER_FREE(buf);
        SSH_MESSAGE_FREE(msg);
        SSH_STRING_FREE(mic_token_string);

        return SSH_PACKET_USED;
    }
#endif

    msg->auth_request.method = SSH_AUTH_METHOD_UNKNOWN;
    SAFE_FREE(method);
    goto end;
error:
    SAFE_FREE(service);
    SAFE_FREE(method);

    SSH_MESSAGE_FREE(msg);

    return SSH_PACKET_USED;
end:
    SAFE_FREE(service);
    SAFE_FREE(method);

    ssh_message_queue(session, msg);

    return SSH_PACKET_USED;
}

#endif /* WITH_SERVER */
/**
 * @internal
 *
 * @brief Handle a SSH_MSG_MSG_USERAUTH_INFO_RESPONSE packet and queue a
 * SSH Message
 */
#ifndef WITH_SERVER
SSH_PACKET_CALLBACK(ssh_packet_userauth_info_response)
{
    (void)session;
    (void)type;
    (void)packet;
    (void)user;
    return SSH_PACKET_USED;
}
#else /* WITH_SERVER */
SSH_PACKET_CALLBACK(ssh_packet_userauth_info_response)
{
    uint32_t nanswers;
    uint32_t i;
    ssh_string tmp = NULL;
    int rc;

    ssh_message msg = NULL;

    /* GSSAPI_TOKEN has same packed number. XXX fix this */
#ifdef WITH_GSSAPI
    if (session->gssapi != NULL) {
        return ssh_packet_userauth_gssapi_token(session, type, packet, user);
    }
#endif
    (void)user;
    (void)type;

    msg = ssh_message_new(session);
    if (msg == NULL) {
        ssh_set_error_oom(session);
        goto error;
    }

    /* HACK: we forge a message to be able to handle it in the
     * same switch() as other auth methods */
    msg->type = SSH_REQUEST_AUTH;
    msg->auth_request.method = SSH_AUTH_METHOD_INTERACTIVE;
    msg->auth_request.kbdint_response = 1;
#if 0 // should we wipe the username ?
    msg->auth_request.username = NULL;
#endif

    rc = ssh_buffer_unpack(packet, "d", &nanswers);
    if (rc != SSH_OK) {
        ssh_set_error_invalid(session);
        goto error;
    }

    if (session->kbdint == NULL) {
        SSH_LOG(SSH_LOG_DEBUG,
                "Warning: Got a keyboard-interactive response but it seems"
                " we didn't send the request.");

        session->kbdint = ssh_kbdint_new();
        if (session->kbdint == NULL) {
            ssh_set_error_oom(session);

            goto error;
        }
    } else if (session->kbdint->answers != NULL) {
        uint32_t n;

        for (n = 0; n < session->kbdint->nanswers; n++) {
            ssh_burn(session->kbdint->answers[n],
                     strlen(session->kbdint->answers[n]));
            SAFE_FREE(session->kbdint->answers[n]);
        }
        SAFE_FREE(session->kbdint->answers);
        session->kbdint->nanswers = 0;
    }

    SSH_LOG(SSH_LOG_PACKET, "kbdint: %" PRIu32 " answers", nanswers);
    if (nanswers > KBDINT_MAX_PROMPT) {
        ssh_set_error(session,
                      SSH_FATAL,
                      "Too much answers received from client: %" PRIu32
                      " (0x%.4" PRIx32 ")",
                      nanswers,
                      nanswers);
        ssh_kbdint_free(session->kbdint);
        session->kbdint = NULL;

        goto error;
    }

    if (nanswers != session->kbdint->nprompts) {
        /* warn but let the application handle this case */
        SSH_LOG(SSH_LOG_DEBUG,
                "Warning: Number of prompts and answers  mismatch: p=%" PRIu32
                " a=%" PRIu32,
                session->kbdint->nprompts,
                nanswers);
    }
    session->kbdint->nanswers = nanswers;

    session->kbdint->answers = calloc(nanswers, sizeof(char *));
    if (session->kbdint->answers == NULL) {
        session->kbdint->nanswers = 0;
        ssh_set_error_oom(session);
        ssh_kbdint_free(session->kbdint);
        session->kbdint = NULL;

        goto error;
    }

    for (i = 0; i < nanswers; i++) {
        tmp = ssh_buffer_get_ssh_string(packet);
        if (tmp == NULL) {
            ssh_set_error(session, SSH_FATAL, "Short INFO_RESPONSE packet");
            session->kbdint->nanswers = i;
            ssh_kbdint_free(session->kbdint);
            session->kbdint = NULL;

            goto error;
        }
        session->kbdint->answers[i] = ssh_string_to_char(tmp);
        SSH_STRING_FREE(tmp);
        if (session->kbdint->answers[i] == NULL) {
            ssh_set_error_oom(session);
            session->kbdint->nanswers = i;
            ssh_kbdint_free(session->kbdint);
            session->kbdint = NULL;

            goto error;
        }
    }

    ssh_message_queue(session, msg);

    return SSH_PACKET_USED;

error:
    SSH_MESSAGE_FREE(msg);

    return SSH_PACKET_USED;
}
#endif /* WITH_SERVER */

SSH_PACKET_CALLBACK(ssh_packet_channel_open)
{
    ssh_message msg = NULL;
    char *type_c = NULL;
    uint32_t originator_port, destination_port;
    int rc;

    (void)type;
    (void)user;

    msg = ssh_message_new(session);
    if (msg == NULL) {
        ssh_set_error_oom(session);
        goto error;
    }

    msg->type = SSH_REQUEST_CHANNEL_OPEN;
    rc = ssh_buffer_unpack(packet, "s", &type_c);
    if (rc != SSH_OK) {
        goto error;
    }

    SSH_LOG(SSH_LOG_PACKET, "Clients wants to open a %s channel", type_c);

    rc = ssh_buffer_unpack(packet,
                           "ddd",
                           &msg->channel_request_open.sender,
                           &msg->channel_request_open.window,
                           &msg->channel_request_open.packet_size);
    if (rc != SSH_OK) {
        goto error;
    }

    if (msg->channel_request_open.packet_size == 0) {
        ssh_set_error(session,
                      SSH_FATAL,
                      "Invalid maximum packet size 0 in SSH2_MSG_CHANNEL_OPEN");
        goto error;
    }

    if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED) {
        ssh_set_error(session,
                      SSH_FATAL,
                      "Invalid state when receiving channel open request "
                      "(must be authenticated)");
        goto error;
    }

    if (strcmp(type_c, "session") == 0) {
        if (session->flags & SSH_SESSION_FLAG_NO_MORE_SESSIONS) {
            ssh_session_set_disconnect_message(session,
                                               "No more sessions allowed!");
            ssh_set_error(session, SSH_FATAL, "No more sessions allowed!");
            session->session_state = SSH_SESSION_STATE_ERROR;
            ssh_send_disconnect(session);
            goto error;
        }

        msg->channel_request_open.type = SSH_CHANNEL_SESSION;
        SAFE_FREE(type_c);
        goto end;
    }

    if (strcmp(type_c, "direct-tcpip") == 0) {
        rc = ssh_buffer_unpack(packet,
                               "sdsd",
                               &msg->channel_request_open.destination,
                               &destination_port,
                               &msg->channel_request_open.originator,
                               &originator_port);
        if (rc != SSH_OK) {
            goto error;
        }

        msg->channel_request_open.destination_port = (uint16_t)destination_port;
        msg->channel_request_open.originator_port = (uint16_t)originator_port;
        msg->channel_request_open.type = SSH_CHANNEL_DIRECT_TCPIP;
        goto end;
    }

    if (strcmp(type_c, "forwarded-tcpip") == 0) {
        rc = ssh_buffer_unpack(packet,
                               "sdsd",
                               &msg->channel_request_open.destination,
                               &destination_port,
                               &msg->channel_request_open.originator,
                               &originator_port);
        if (rc != SSH_OK) {
            goto error;
        }
        msg->channel_request_open.destination_port = (uint16_t)destination_port;
        msg->channel_request_open.originator_port = (uint16_t)originator_port;
        msg->channel_request_open.type = SSH_CHANNEL_FORWARDED_TCPIP;
        goto end;
    }

    if (strcmp(type_c, "x11") == 0) {
        rc = ssh_buffer_unpack(packet,
                               "sd",
                               &msg->channel_request_open.originator,
                               &originator_port);
        if (rc != SSH_OK) {
            goto error;
        }
        msg->channel_request_open.originator_port = (uint16_t)originator_port;
        msg->channel_request_open.type = SSH_CHANNEL_X11;
        goto end;
    }

    if (strcmp(type_c, "auth-agent") == 0 ||
        strcmp(type_c, "auth-agent@openssh.com") == 0) {
        msg->channel_request_open.type = SSH_CHANNEL_AUTH_AGENT;
        goto end;
    }

    msg->channel_request_open.type = SSH_CHANNEL_UNKNOWN;
    goto end;

error:
    SSH_MESSAGE_FREE(msg);

end:
    SAFE_FREE(type_c);
    if (msg != NULL)
        ssh_message_queue(session, msg);

    return SSH_PACKET_USED;
}

/**
 * @internal
 *
 * @brief This function accepts a channel open request for the specified channel.
 *
 * @param[in]  msg      The message.
 *
 * @param[in]  chan     The channel the request is made on.
 *
 * @returns             SSH_OK on success, SSH_ERROR if an error occurred.
 */
int ssh_message_channel_request_open_reply_accept_channel(ssh_message msg,
                                                          ssh_channel chan)
{
    ssh_session session = NULL;
    int rc;

    if (msg == NULL) {
        return SSH_ERROR;
    }

    session = msg->session;

    chan->local_channel = ssh_channel_new_id(session);
    chan->local_maxpacket = 35000;
    chan->local_window = 32000;
    chan->remote_channel = msg->channel_request_open.sender;
    chan->remote_maxpacket = msg->channel_request_open.packet_size;
    chan->remote_window = msg->channel_request_open.window;
    chan->state = SSH_CHANNEL_STATE_OPEN;
    chan->flags &= ~SSH_CHANNEL_FLAG_NOT_BOUND;

    rc = ssh_buffer_pack(session->out_buffer,
                         "bdddd",
                         SSH2_MSG_CHANNEL_OPEN_CONFIRMATION,
                         chan->remote_channel,
                         chan->local_channel,
                         chan->local_window,
                         chan->local_maxpacket);
    if (rc != SSH_OK) {
        ssh_set_error_oom(session);
        return SSH_ERROR;
    }

    SSH_LOG(SSH_LOG_PACKET,
            "Accepting a channel request_open for chan %" PRIu32,
            chan->remote_channel);

    rc = ssh_packet_send(session);

    return rc;
}

/**
 * @internal
 *
 * @brief This function accepts a channel open request.
 *
 * @param[in]  msg      The message.
 *
 * @returns a valid ssh_channel handle if the request is to be allowed
 *
 * @returns NULL in case of error
 */
ssh_channel ssh_message_channel_request_open_reply_accept(ssh_message msg)
{
    ssh_channel chan = NULL;
    int rc;

    if (msg == NULL) {
        return NULL;
    }

    chan = ssh_channel_new(msg->session);
    if (chan == NULL) {
        return NULL;
    }
    rc = ssh_message_channel_request_open_reply_accept_channel(msg, chan);
    if (rc < 0) {
        SSH_CHANNEL_FREE(chan);
    }
    return chan;
}

/**
 * @internal
 *
 * @brief This function parses the last end of a channel request packet.
 *
 * This is normally converted to a SSH message and placed in the queue.
 *
 * @param[in]  session  The SSH session.
 *
 * @param[in]  channel  The channel the request is made on.
 *
 * @param[in]  packet   The rest of the packet to be parsed.
 *
 * @param[in]  request  The type of request.
 *
 * @param[in]  want_reply The want_reply field from the request.
 *
 * @returns             SSH_OK on success, SSH_ERROR if an error occurred.
 */
int
ssh_message_handle_channel_request(ssh_session session,
                                   ssh_channel channel,
                                   ssh_buffer packet,
                                   const char *request,
                                   uint8_t want_reply)
{
    ssh_message msg = NULL;
    int rc;

    msg = ssh_message_new(session);
    if (msg == NULL) {
        ssh_set_error_oom(session);
        goto error;
    }

    SSH_LOG(SSH_LOG_PACKET,
            "Received a %s channel_request for channel (%" PRIu32 ":%" PRIu32
            ") (want_reply=%hhu)",
            request,
            channel->local_channel,
            channel->remote_channel,
            want_reply);

    msg->type = SSH_REQUEST_CHANNEL;
    msg->channel_request.channel = channel;
    msg->channel_request.want_reply = want_reply;

    if (strcmp(request, "pty-req") == 0) {
        rc = ssh_buffer_unpack(packet,
                               "sddddS",
                               &msg->channel_request.TERM,
                               &msg->channel_request.width,
                               &msg->channel_request.height,
                               &msg->channel_request.pxwidth,
                               &msg->channel_request.pxheight,
                               &msg->channel_request.modes);

        msg->channel_request.type = SSH_CHANNEL_REQUEST_PTY;

        if (rc != SSH_OK) {
            goto error;
        }
        goto end;
    }

    if (strcmp(request, "window-change") == 0) {
        msg->channel_request.type = SSH_CHANNEL_REQUEST_WINDOW_CHANGE;
        rc = ssh_buffer_unpack(packet,
                               "dddd",
                               &msg->channel_request.width,
                               &msg->channel_request.height,
                               &msg->channel_request.pxwidth,
                               &msg->channel_request.pxheight);
        if (rc != SSH_OK) {
            goto error;
        }
        goto end;
    }

    if (strcmp(request, "subsystem") == 0) {
        rc = ssh_buffer_unpack(packet, "s", &msg->channel_request.subsystem);
        msg->channel_request.type = SSH_CHANNEL_REQUEST_SUBSYSTEM;
        if (rc != SSH_OK) {
            goto error;
        }
        goto end;
    }

    if (strcmp(request, "shell") == 0) {
        msg->channel_request.type = SSH_CHANNEL_REQUEST_SHELL;
        goto end;
    }

    if (strcmp(request, "exec") == 0) {
        rc = ssh_buffer_unpack(packet, "s", &msg->channel_request.command);
        msg->channel_request.type = SSH_CHANNEL_REQUEST_EXEC;
        if (rc != SSH_OK) {
            goto error;
        }
        goto end;
    }

    if (strcmp(request, "env") == 0) {
        rc = ssh_buffer_unpack(packet,
                               "ss",
                               &msg->channel_request.var_name,
                               &msg->channel_request.var_value);
        msg->channel_request.type = SSH_CHANNEL_REQUEST_ENV;
        if (rc != SSH_OK) {
            goto error;
        }
        goto end;
    }

    if (strcmp(request, "x11-req") == 0) {
        rc = ssh_buffer_unpack(packet,
                               "bssd",
                               &msg->channel_request.x11_single_connection,
                               &msg->channel_request.x11_auth_protocol,
                               &msg->channel_request.x11_auth_cookie,
                               &msg->channel_request.x11_screen_number);

        msg->channel_request.type = SSH_CHANNEL_REQUEST_X11;
        if (rc != SSH_OK) {
            goto error;
        }

        goto end;
    }

    msg->channel_request.type = SSH_CHANNEL_REQUEST_UNKNOWN;
end:
    ssh_message_queue(session, msg);

    return SSH_OK;
error:
    SSH_MESSAGE_FREE(msg);

    return SSH_ERROR;
}

/** @internal
 *
 * @brief       Sends a successful channel request reply
 *
 * @param msg   A message to reply to
 *
 * @returns     SSH_OK on success, SSH_ERROR if an error occurred.
 */
int ssh_message_channel_request_reply_success(ssh_message msg)
{
    uint32_t channel;
    int rc;

    if (msg == NULL) {
        return SSH_ERROR;
    }

    if (msg->channel_request.want_reply) {
        channel = msg->channel_request.channel->remote_channel;

        SSH_LOG(SSH_LOG_PACKET,
                "Sending a channel_request success to channel %" PRIu32,
                channel);

        rc = ssh_buffer_pack(msg->session->out_buffer,
                             "bd",
                             SSH2_MSG_CHANNEL_SUCCESS,
                             channel);
        if (rc != SSH_OK) {
            ssh_set_error_oom(msg->session);
            return SSH_ERROR;
        }

        return ssh_packet_send(msg->session);
    }

    SSH_LOG(SSH_LOG_PACKET,
            "The client doesn't want to know the request succeeded");

    return SSH_OK;
}

#ifdef WITH_SERVER
SSH_PACKET_CALLBACK(ssh_packet_global_request)
{
    ssh_message msg = NULL;
    char *request = NULL;
    uint8_t want_reply;
    uint32_t bind_port = 0;
    int rc = SSH_PACKET_USED;
    int r;

    (void)user;
    (void)type;
    (void)packet;

    SSH_LOG(SSH_LOG_DEBUG,"Received SSH_MSG_GLOBAL_REQUEST packet");
    r = ssh_buffer_unpack(packet, "sb", &request, &want_reply);
    if (r != SSH_OK) {
        goto error;
    }

    msg = ssh_message_new(session);
    if (msg == NULL) {
        ssh_set_error_oom(session);
        goto error;
    }
    msg->type = SSH_REQUEST_GLOBAL;

    if (strcmp(request, "tcpip-forward") == 0) {

        /* According to RFC4254, the client SHOULD reject this message */
        if (session->client) {
            goto reply_with_failure;
        }

        r = ssh_buffer_unpack(packet,
                              "sd",
                              &msg->global_request.bind_address,
                              &bind_port);
        if (r != SSH_OK) {
            goto reply_with_failure;
        }
        msg->global_request.bind_port = (uint16_t)bind_port;
        msg->global_request.type = SSH_GLOBAL_REQUEST_TCPIP_FORWARD;
        msg->global_request.want_reply = want_reply;

        SSH_LOG(SSH_LOG_DEBUG,
                "Received SSH_MSG_GLOBAL_REQUEST %s %hhu %s:%d",
                request,
                want_reply,
                msg->global_request.bind_address,
                msg->global_request.bind_port);

        if (ssh_callbacks_exists(session->common.callbacks,
                                 global_request_function)) {
            SSH_LOG(SSH_LOG_DEBUG,
                    "Calling callback for SSH_MSG_GLOBAL_REQUEST %s %hhu %s:%d",
                    request,
                    want_reply,
                    msg->global_request.bind_address,
                    msg->global_request.bind_port);
            session->common.callbacks->global_request_function(
                session,
                msg,
                session->common.callbacks->userdata);
        } else {
            SAFE_FREE(request);
            ssh_message_queue(session, msg);
            return rc;
        }
    } else if (strcmp(request, "cancel-tcpip-forward") == 0) {

        /* According to RFC4254, the client SHOULD reject this message */
        if (session->client) {
            goto reply_with_failure;
        }

        r = ssh_buffer_unpack(packet,
                              "sd",
                              &msg->global_request.bind_address,
                              &bind_port);
        if (r != SSH_OK) {
            goto reply_with_failure;
        }
        msg->global_request.bind_port = (uint16_t)bind_port;
        msg->global_request.type = SSH_GLOBAL_REQUEST_CANCEL_TCPIP_FORWARD;
        msg->global_request.want_reply = want_reply;

        SSH_LOG(SSH_LOG_DEBUG,
                "Received SSH_MSG_GLOBAL_REQUEST %s %hhu %s:%d",
                request,
                want_reply,
                msg->global_request.bind_address,
                msg->global_request.bind_port);

        if (ssh_callbacks_exists(session->common.callbacks,
                                 global_request_function)) {
            session->common.callbacks->global_request_function(
                session,
                msg,
                session->common.callbacks->userdata);
        } else {
            SAFE_FREE(request);
            ssh_message_queue(session, msg);
            return rc;
        }
    } else if(strcmp(request, "keepalive@openssh.com") == 0) {
        msg->global_request.type = SSH_GLOBAL_REQUEST_KEEPALIVE;
        msg->global_request.want_reply = want_reply;
        SSH_LOG(SSH_LOG_DEBUG,
                "Received keepalive@openssh.com %hhu",
                want_reply);
        if (ssh_callbacks_exists(session->common.callbacks,
                                 global_request_function)) {
            SSH_LOG(SSH_LOG_DEBUG,
                    "Calling callback for SSH_MSG_GLOBAL_REQUEST %s %hhu",
                    request,
                    want_reply);
            session->common.callbacks->global_request_function(
                session,
                msg,
                session->common.callbacks->userdata);
        } else if (want_reply) {
            ssh_message_global_request_reply_success(msg, 0);
        }
    } else if (strcmp(request, "no-more-sessions@openssh.com") == 0) {
        msg->global_request.type = SSH_GLOBAL_REQUEST_NO_MORE_SESSIONS;
        msg->global_request.want_reply = want_reply;

        SSH_LOG(SSH_LOG_PROTOCOL,
                "Received no-more-sessions@openssh.com %hhu",
                want_reply);
        if (ssh_callbacks_exists(session->common.callbacks,
                                 global_request_function)) {
            SSH_LOG(SSH_LOG_DEBUG,
                    "Calling callback for SSH_MSG_GLOBAL_REQUEST %s %hhu",
                    request,
                    want_reply);
            session->common.callbacks->global_request_function(
                session,
                msg,
                session->common.callbacks->userdata);
        } else if (want_reply) {
            ssh_message_global_request_reply_success(msg, 0);
        }

        session->flags |= SSH_SESSION_FLAG_NO_MORE_SESSIONS;
    } else {
        SSH_LOG(SSH_LOG_DEBUG,
                "UNKNOWN SSH_MSG_GLOBAL_REQUEST %s, want_reply = %hhu",
                request,
                want_reply);
        goto reply_with_failure;
    }

    SSH_MESSAGE_FREE(msg);
    SAFE_FREE(request);
    return rc;

reply_with_failure:
    /* Only report the failure if requested */
    if (want_reply) {
        r = ssh_buffer_add_u8(session->out_buffer, SSH2_MSG_REQUEST_FAILURE);
        if (r < 0) {
            ssh_set_error_oom(session);
            goto error;
        }

        r = ssh_packet_send(session);
        if (r != SSH_OK) {
            goto error;
        }
    } else {
        SSH_LOG(SSH_LOG_PACKET,
                "The requester doesn't want to know the request failed!");
    }

    /* Consume the message to avoid sending UNIMPLEMENTED later */
    rc = SSH_PACKET_USED;
error:
    SSH_MESSAGE_FREE(msg);
    SAFE_FREE(request);
    SSH_LOG(SSH_LOG_TRACE, "Invalid SSH_MSG_GLOBAL_REQUEST packet");
    return rc;
}

#endif /* WITH_SERVER */

/** @} */

Coverage Report

Created: 2026-10-22 06:47