xref: /openssh-portable/mux.c (revision 816036f1)
1 /* $OpenBSD: mux.c,v 1.85 2020/10/18 11:32:01 djm Exp $ */
2 /*
3  * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 /* ssh session multiplexing support */
19 
20 #include "includes.h"
21 
22 #include <sys/types.h>
23 #include <sys/stat.h>
24 #include <sys/socket.h>
25 #include <sys/un.h>
26 
27 #include <errno.h>
28 #include <fcntl.h>
29 #include <signal.h>
30 #include <stdarg.h>
31 #include <stddef.h>
32 #include <stdlib.h>
33 #include <stdio.h>
34 #include <string.h>
35 #include <unistd.h>
36 #ifdef HAVE_PATHS_H
37 #include <paths.h>
38 #endif
39 
40 #ifdef HAVE_POLL_H
41 #include <poll.h>
42 #else
43 # ifdef HAVE_SYS_POLL_H
44 #  include <sys/poll.h>
45 # endif
46 #endif
47 
48 #ifdef HAVE_UTIL_H
49 # include <util.h>
50 #endif
51 
52 #include "openbsd-compat/sys-queue.h"
53 #include "xmalloc.h"
54 #include "log.h"
55 #include "ssh.h"
56 #include "ssh2.h"
57 #include "pathnames.h"
58 #include "misc.h"
59 #include "match.h"
60 #include "sshbuf.h"
61 #include "channels.h"
62 #include "msg.h"
63 #include "packet.h"
64 #include "monitor_fdpass.h"
65 #include "sshpty.h"
66 #include "sshkey.h"
67 #include "readconf.h"
68 #include "clientloop.h"
69 #include "ssherr.h"
70 
71 /* from ssh.c */
72 extern int tty_flag;
73 extern Options options;
74 extern int stdin_null_flag;
75 extern char *host;
76 extern int subsystem_flag;
77 extern struct sshbuf *command;
78 extern volatile sig_atomic_t quit_pending;
79 
80 /* Context for session open confirmation callback */
81 struct mux_session_confirm_ctx {
82 	u_int want_tty;
83 	u_int want_subsys;
84 	u_int want_x_fwd;
85 	u_int want_agent_fwd;
86 	struct sshbuf *cmd;
87 	char *term;
88 	struct termios tio;
89 	char **env;
90 	u_int rid;
91 };
92 
93 /* Context for stdio fwd open confirmation callback */
94 struct mux_stdio_confirm_ctx {
95 	u_int rid;
96 };
97 
98 /* Context for global channel callback */
99 struct mux_channel_confirm_ctx {
100 	u_int cid;	/* channel id */
101 	u_int rid;	/* request id */
102 	int fid;	/* forward id */
103 };
104 
105 /* fd to control socket */
106 int muxserver_sock = -1;
107 
108 /* client request id */
109 u_int muxclient_request_id = 0;
110 
111 /* Multiplexing control command */
112 u_int muxclient_command = 0;
113 
114 /* Set when signalled. */
115 static volatile sig_atomic_t muxclient_terminate = 0;
116 
117 /* PID of multiplex server */
118 static u_int muxserver_pid = 0;
119 
120 static Channel *mux_listener_channel = NULL;
121 
122 struct mux_master_state {
123 	int hello_rcvd;
124 };
125 
126 /* mux protocol messages */
127 #define MUX_MSG_HELLO		0x00000001
128 #define MUX_C_NEW_SESSION	0x10000002
129 #define MUX_C_ALIVE_CHECK	0x10000004
130 #define MUX_C_TERMINATE		0x10000005
131 #define MUX_C_OPEN_FWD		0x10000006
132 #define MUX_C_CLOSE_FWD		0x10000007
133 #define MUX_C_NEW_STDIO_FWD	0x10000008
134 #define MUX_C_STOP_LISTENING	0x10000009
135 #define MUX_C_PROXY		0x1000000f
136 #define MUX_S_OK		0x80000001
137 #define MUX_S_PERMISSION_DENIED	0x80000002
138 #define MUX_S_FAILURE		0x80000003
139 #define MUX_S_EXIT_MESSAGE	0x80000004
140 #define MUX_S_ALIVE		0x80000005
141 #define MUX_S_SESSION_OPENED	0x80000006
142 #define MUX_S_REMOTE_PORT	0x80000007
143 #define MUX_S_TTY_ALLOC_FAIL	0x80000008
144 #define MUX_S_PROXY		0x8000000f
145 
146 /* type codes for MUX_C_OPEN_FWD and MUX_C_CLOSE_FWD */
147 #define MUX_FWD_LOCAL   1
148 #define MUX_FWD_REMOTE  2
149 #define MUX_FWD_DYNAMIC 3
150 
151 static void mux_session_confirm(struct ssh *, int, int, void *);
152 static void mux_stdio_confirm(struct ssh *, int, int, void *);
153 
154 static int mux_master_process_hello(struct ssh *, u_int,
155 	    Channel *, struct sshbuf *, struct sshbuf *);
156 static int mux_master_process_new_session(struct ssh *, u_int,
157 	    Channel *, struct sshbuf *, struct sshbuf *);
158 static int mux_master_process_alive_check(struct ssh *, u_int,
159 	    Channel *, struct sshbuf *, struct sshbuf *);
160 static int mux_master_process_terminate(struct ssh *, u_int,
161 	    Channel *, struct sshbuf *, struct sshbuf *);
162 static int mux_master_process_open_fwd(struct ssh *, u_int,
163 	    Channel *, struct sshbuf *, struct sshbuf *);
164 static int mux_master_process_close_fwd(struct ssh *, u_int,
165 	    Channel *, struct sshbuf *, struct sshbuf *);
166 static int mux_master_process_stdio_fwd(struct ssh *, u_int,
167 	    Channel *, struct sshbuf *, struct sshbuf *);
168 static int mux_master_process_stop_listening(struct ssh *, u_int,
169 	    Channel *, struct sshbuf *, struct sshbuf *);
170 static int mux_master_process_proxy(struct ssh *, u_int,
171 	    Channel *, struct sshbuf *, struct sshbuf *);
172 
173 static const struct {
174 	u_int type;
175 	int (*handler)(struct ssh *, u_int, Channel *,
176 	    struct sshbuf *, struct sshbuf *);
177 } mux_master_handlers[] = {
178 	{ MUX_MSG_HELLO, mux_master_process_hello },
179 	{ MUX_C_NEW_SESSION, mux_master_process_new_session },
180 	{ MUX_C_ALIVE_CHECK, mux_master_process_alive_check },
181 	{ MUX_C_TERMINATE, mux_master_process_terminate },
182 	{ MUX_C_OPEN_FWD, mux_master_process_open_fwd },
183 	{ MUX_C_CLOSE_FWD, mux_master_process_close_fwd },
184 	{ MUX_C_NEW_STDIO_FWD, mux_master_process_stdio_fwd },
185 	{ MUX_C_STOP_LISTENING, mux_master_process_stop_listening },
186 	{ MUX_C_PROXY, mux_master_process_proxy },
187 	{ 0, NULL }
188 };
189 
190 /* Cleanup callback fired on closure of mux client _session_ channel */
191 /* ARGSUSED */
192 static void
mux_master_session_cleanup_cb(struct ssh * ssh,int cid,void * unused)193 mux_master_session_cleanup_cb(struct ssh *ssh, int cid, void *unused)
194 {
195 	Channel *cc, *c = channel_by_id(ssh, cid);
196 
197 	debug3_f("entering for channel %d", cid);
198 	if (c == NULL)
199 		fatal_f("channel_by_id(%i) == NULL", cid);
200 	if (c->ctl_chan != -1) {
201 		if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
202 			fatal_f("channel %d missing control channel %d",
203 			    c->self, c->ctl_chan);
204 		c->ctl_chan = -1;
205 		cc->remote_id = 0;
206 		cc->have_remote_id = 0;
207 		chan_rcvd_oclose(ssh, cc);
208 	}
209 	channel_cancel_cleanup(ssh, c->self);
210 }
211 
212 /* Cleanup callback fired on closure of mux client _control_ channel */
213 /* ARGSUSED */
214 static void
mux_master_control_cleanup_cb(struct ssh * ssh,int cid,void * unused)215 mux_master_control_cleanup_cb(struct ssh *ssh, int cid, void *unused)
216 {
217 	Channel *sc, *c = channel_by_id(ssh, cid);
218 
219 	debug3_f("entering for channel %d", cid);
220 	if (c == NULL)
221 		fatal_f("channel_by_id(%i) == NULL", cid);
222 	if (c->have_remote_id) {
223 		if ((sc = channel_by_id(ssh, c->remote_id)) == NULL)
224 			fatal_f("channel %d missing session channel %u",
225 			    c->self, c->remote_id);
226 		c->remote_id = 0;
227 		c->have_remote_id = 0;
228 		sc->ctl_chan = -1;
229 		if (sc->type != SSH_CHANNEL_OPEN &&
230 		    sc->type != SSH_CHANNEL_OPENING) {
231 			debug2_f("channel %d: not open", sc->self);
232 			chan_mark_dead(ssh, sc);
233 		} else {
234 			if (sc->istate == CHAN_INPUT_OPEN)
235 				chan_read_failed(ssh, sc);
236 			if (sc->ostate == CHAN_OUTPUT_OPEN)
237 				chan_write_failed(ssh, sc);
238 		}
239 	}
240 	channel_cancel_cleanup(ssh, c->self);
241 }
242 
243 /* Check mux client environment variables before passing them to mux master. */
244 static int
env_permitted(char * env)245 env_permitted(char *env)
246 {
247 	int i, ret;
248 	char name[1024], *cp;
249 
250 	if ((cp = strchr(env, '=')) == NULL || cp == env)
251 		return 0;
252 	ret = snprintf(name, sizeof(name), "%.*s", (int)(cp - env), env);
253 	if (ret <= 0 || (size_t)ret >= sizeof(name)) {
254 		error_f("name '%.100s...' too long", env);
255 		return 0;
256 	}
257 
258 	for (i = 0; i < options.num_send_env; i++)
259 		if (match_pattern(name, options.send_env[i]))
260 			return 1;
261 
262 	return 0;
263 }
264 
265 /* Mux master protocol message handlers */
266 
267 static int
mux_master_process_hello(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)268 mux_master_process_hello(struct ssh *ssh, u_int rid,
269     Channel *c, struct sshbuf *m, struct sshbuf *reply)
270 {
271 	u_int ver;
272 	struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx;
273 	int r;
274 
275 	if (state == NULL)
276 		fatal_f("channel %d: c->mux_ctx == NULL", c->self);
277 	if (state->hello_rcvd) {
278 		error_f("HELLO received twice");
279 		return -1;
280 	}
281 	if ((r = sshbuf_get_u32(m, &ver)) != 0) {
282 		error_fr(r, "parse");
283 		return -1;
284 	}
285 	if (ver != SSHMUX_VER) {
286 		error_f("unsupported multiplexing protocol version %u "
287 		    "(expected %u)", ver, SSHMUX_VER);
288 		return -1;
289 	}
290 	debug2_f("channel %d client version %u", c->self, ver);
291 
292 	/* No extensions are presently defined */
293 	while (sshbuf_len(m) > 0) {
294 		char *name = NULL;
295 		size_t value_len = 0;
296 
297 		if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 ||
298 		    (r = sshbuf_get_string_direct(m, NULL, &value_len)) != 0) {
299 			error_fr(r, "parse extension");
300 			return -1;
301 		}
302 		debug2_f("Unrecognised extension \"%s\" length %zu",
303 		    name, value_len);
304 		free(name);
305 	}
306 	state->hello_rcvd = 1;
307 	return 0;
308 }
309 
310 /* Enqueue a "ok" response to the reply buffer */
311 static void
reply_ok(struct sshbuf * reply,u_int rid)312 reply_ok(struct sshbuf *reply, u_int rid)
313 {
314 	int r;
315 
316 	if ((r = sshbuf_put_u32(reply, MUX_S_OK)) != 0 ||
317 	    (r = sshbuf_put_u32(reply, rid)) != 0)
318 		fatal_fr(r, "reply");
319 }
320 
321 /* Enqueue an error response to the reply buffer */
322 static void
reply_error(struct sshbuf * reply,u_int type,u_int rid,const char * msg)323 reply_error(struct sshbuf *reply, u_int type, u_int rid, const char *msg)
324 {
325 	int r;
326 
327 	if ((r = sshbuf_put_u32(reply, type)) != 0 ||
328 	    (r = sshbuf_put_u32(reply, rid)) != 0 ||
329 	    (r = sshbuf_put_cstring(reply, msg)) != 0)
330 		fatal_fr(r, "reply");
331 }
332 
333 static int
mux_master_process_new_session(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)334 mux_master_process_new_session(struct ssh *ssh, u_int rid,
335     Channel *c, struct sshbuf *m, struct sshbuf *reply)
336 {
337 	Channel *nc;
338 	struct mux_session_confirm_ctx *cctx;
339 	char *cmd, *cp;
340 	u_int i, j, env_len, escape_char, window, packetmax;
341 	int r, new_fd[3];
342 
343 	/* Reply for SSHMUX_COMMAND_OPEN */
344 	cctx = xcalloc(1, sizeof(*cctx));
345 	cctx->term = NULL;
346 	cctx->rid = rid;
347 	cmd = NULL;
348 	cctx->env = NULL;
349 	env_len = 0;
350 	if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */
351 	    (r = sshbuf_get_u32(m, &cctx->want_tty)) != 0 ||
352 	    (r = sshbuf_get_u32(m, &cctx->want_x_fwd)) != 0 ||
353 	    (r = sshbuf_get_u32(m, &cctx->want_agent_fwd)) != 0 ||
354 	    (r = sshbuf_get_u32(m, &cctx->want_subsys)) != 0 ||
355 	    (r = sshbuf_get_u32(m, &escape_char)) != 0 ||
356 	    (r = sshbuf_get_cstring(m, &cctx->term, NULL)) != 0 ||
357 	    (r = sshbuf_get_cstring(m, &cmd, NULL)) != 0) {
358  malf:
359 		free(cmd);
360 		for (j = 0; j < env_len; j++)
361 			free(cctx->env[j]);
362 		free(cctx->env);
363 		free(cctx->term);
364 		free(cctx);
365 		error_f("malformed message");
366 		return -1;
367 	}
368 
369 #define MUX_MAX_ENV_VARS	4096
370 	while (sshbuf_len(m) > 0) {
371 		if ((r = sshbuf_get_cstring(m, &cp, NULL)) != 0)
372 			goto malf;
373 		if (!env_permitted(cp)) {
374 			free(cp);
375 			continue;
376 		}
377 		cctx->env = xreallocarray(cctx->env, env_len + 2,
378 		    sizeof(*cctx->env));
379 		cctx->env[env_len++] = cp;
380 		cctx->env[env_len] = NULL;
381 		if (env_len > MUX_MAX_ENV_VARS) {
382 			error_f(">%d environment variables received, "
383 			    "ignoring additional", MUX_MAX_ENV_VARS);
384 			break;
385 		}
386 	}
387 
388 	debug2_f("channel %d: request tty %d, X %d, agent %d, subsys %d, "
389 	    "term \"%s\", cmd \"%s\", env %u", c->self,
390 	    cctx->want_tty, cctx->want_x_fwd, cctx->want_agent_fwd,
391 	    cctx->want_subsys, cctx->term, cmd, env_len);
392 
393 	if ((cctx->cmd = sshbuf_new()) == NULL)
394 		fatal_f("sshbuf_new");
395 	if ((r = sshbuf_put(cctx->cmd, cmd, strlen(cmd))) != 0)
396 		fatal_fr(r, "sshbuf_put");
397 	free(cmd);
398 	cmd = NULL;
399 
400 	/* Gather fds from client */
401 	for(i = 0; i < 3; i++) {
402 		if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) {
403 			error_f("failed to receive fd %d from client", i);
404 			for (j = 0; j < i; j++)
405 				close(new_fd[j]);
406 			for (j = 0; j < env_len; j++)
407 				free(cctx->env[j]);
408 			free(cctx->env);
409 			free(cctx->term);
410 			sshbuf_free(cctx->cmd);
411 			free(cctx);
412 			reply_error(reply, MUX_S_FAILURE, rid,
413 			    "did not receive file descriptors");
414 			return -1;
415 		}
416 	}
417 
418 	debug3_f("got fds stdin %d, stdout %d, stderr %d",
419 	    new_fd[0], new_fd[1], new_fd[2]);
420 
421 	/* XXX support multiple child sessions in future */
422 	if (c->have_remote_id) {
423 		debug2_f("session already open");
424 		reply_error(reply, MUX_S_FAILURE, rid,
425 		    "Multiple sessions not supported");
426  cleanup:
427 		close(new_fd[0]);
428 		close(new_fd[1]);
429 		close(new_fd[2]);
430 		free(cctx->term);
431 		if (env_len != 0) {
432 			for (i = 0; i < env_len; i++)
433 				free(cctx->env[i]);
434 			free(cctx->env);
435 		}
436 		sshbuf_free(cctx->cmd);
437 		free(cctx);
438 		return 0;
439 	}
440 
441 	if (options.control_master == SSHCTL_MASTER_ASK ||
442 	    options.control_master == SSHCTL_MASTER_AUTO_ASK) {
443 		if (!ask_permission("Allow shared connection to %s? ", host)) {
444 			debug2_f("session refused by user");
445 			reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
446 			    "Permission denied");
447 			goto cleanup;
448 		}
449 	}
450 
451 	/* Try to pick up ttymodes from client before it goes raw */
452 	if (cctx->want_tty && tcgetattr(new_fd[0], &cctx->tio) == -1)
453 		error_f("tcgetattr: %s", strerror(errno));
454 
455 	/* enable nonblocking unless tty */
456 	if (!isatty(new_fd[0]))
457 		set_nonblock(new_fd[0]);
458 	if (!isatty(new_fd[1]))
459 		set_nonblock(new_fd[1]);
460 	if (!isatty(new_fd[2]))
461 		set_nonblock(new_fd[2]);
462 
463 	window = CHAN_SES_WINDOW_DEFAULT;
464 	packetmax = CHAN_SES_PACKET_DEFAULT;
465 	if (cctx->want_tty) {
466 		window >>= 1;
467 		packetmax >>= 1;
468 	}
469 
470 	nc = channel_new(ssh, "session", SSH_CHANNEL_OPENING,
471 	    new_fd[0], new_fd[1], new_fd[2], window, packetmax,
472 	    CHAN_EXTENDED_WRITE, "client-session", /*nonblock*/0);
473 
474 	nc->ctl_chan = c->self;		/* link session -> control channel */
475 	c->remote_id = nc->self; 	/* link control -> session channel */
476 	c->have_remote_id = 1;
477 
478 	if (cctx->want_tty && escape_char != 0xffffffff) {
479 		channel_register_filter(ssh, nc->self,
480 		    client_simple_escape_filter, NULL,
481 		    client_filter_cleanup,
482 		    client_new_escape_filter_ctx((int)escape_char));
483 	}
484 
485 	debug2_f("channel_new: %d linked to control channel %d",
486 	    nc->self, nc->ctl_chan);
487 
488 	channel_send_open(ssh, nc->self);
489 	channel_register_open_confirm(ssh, nc->self, mux_session_confirm, cctx);
490 	c->mux_pause = 1; /* stop handling messages until open_confirm done */
491 	channel_register_cleanup(ssh, nc->self,
492 	    mux_master_session_cleanup_cb, 1);
493 
494 	/* reply is deferred, sent by mux_session_confirm */
495 	return 0;
496 }
497 
498 static int
mux_master_process_alive_check(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)499 mux_master_process_alive_check(struct ssh *ssh, u_int rid,
500     Channel *c, struct sshbuf *m, struct sshbuf *reply)
501 {
502 	int r;
503 
504 	debug2_f("channel %d: alive check", c->self);
505 
506 	/* prepare reply */
507 	if ((r = sshbuf_put_u32(reply, MUX_S_ALIVE)) != 0 ||
508 	    (r = sshbuf_put_u32(reply, rid)) != 0 ||
509 	    (r = sshbuf_put_u32(reply, (u_int)getpid())) != 0)
510 		fatal_fr(r, "reply");
511 
512 	return 0;
513 }
514 
515 static int
mux_master_process_terminate(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)516 mux_master_process_terminate(struct ssh *ssh, u_int rid,
517     Channel *c, struct sshbuf *m, struct sshbuf *reply)
518 {
519 	debug2_f("channel %d: terminate request", c->self);
520 
521 	if (options.control_master == SSHCTL_MASTER_ASK ||
522 	    options.control_master == SSHCTL_MASTER_AUTO_ASK) {
523 		if (!ask_permission("Terminate shared connection to %s? ",
524 		    host)) {
525 			debug2_f("termination refused by user");
526 			reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
527 			    "Permission denied");
528 			return 0;
529 		}
530 	}
531 
532 	quit_pending = 1;
533 	reply_ok(reply, rid);
534 	/* XXX exit happens too soon - message never makes it to client */
535 	return 0;
536 }
537 
538 static char *
format_forward(u_int ftype,struct Forward * fwd)539 format_forward(u_int ftype, struct Forward *fwd)
540 {
541 	char *ret;
542 
543 	switch (ftype) {
544 	case MUX_FWD_LOCAL:
545 		xasprintf(&ret, "local forward %.200s:%d -> %.200s:%d",
546 		    (fwd->listen_path != NULL) ? fwd->listen_path :
547 		    (fwd->listen_host == NULL) ?
548 		    (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
549 		    fwd->listen_host, fwd->listen_port,
550 		    (fwd->connect_path != NULL) ? fwd->connect_path :
551 		    fwd->connect_host, fwd->connect_port);
552 		break;
553 	case MUX_FWD_DYNAMIC:
554 		xasprintf(&ret, "dynamic forward %.200s:%d -> *",
555 		    (fwd->listen_host == NULL) ?
556 		    (options.fwd_opts.gateway_ports ? "*" : "LOCALHOST") :
557 		     fwd->listen_host, fwd->listen_port);
558 		break;
559 	case MUX_FWD_REMOTE:
560 		xasprintf(&ret, "remote forward %.200s:%d -> %.200s:%d",
561 		    (fwd->listen_path != NULL) ? fwd->listen_path :
562 		    (fwd->listen_host == NULL) ?
563 		    "LOCALHOST" : fwd->listen_host,
564 		    fwd->listen_port,
565 		    (fwd->connect_path != NULL) ? fwd->connect_path :
566 		    fwd->connect_host, fwd->connect_port);
567 		break;
568 	default:
569 		fatal_f("unknown forward type %u", ftype);
570 	}
571 	return ret;
572 }
573 
574 static int
compare_host(const char * a,const char * b)575 compare_host(const char *a, const char *b)
576 {
577 	if (a == NULL && b == NULL)
578 		return 1;
579 	if (a == NULL || b == NULL)
580 		return 0;
581 	return strcmp(a, b) == 0;
582 }
583 
584 static int
compare_forward(struct Forward * a,struct Forward * b)585 compare_forward(struct Forward *a, struct Forward *b)
586 {
587 	if (!compare_host(a->listen_host, b->listen_host))
588 		return 0;
589 	if (!compare_host(a->listen_path, b->listen_path))
590 		return 0;
591 	if (a->listen_port != b->listen_port)
592 		return 0;
593 	if (!compare_host(a->connect_host, b->connect_host))
594 		return 0;
595 	if (!compare_host(a->connect_path, b->connect_path))
596 		return 0;
597 	if (a->connect_port != b->connect_port)
598 		return 0;
599 
600 	return 1;
601 }
602 
603 static void
mux_confirm_remote_forward(struct ssh * ssh,int type,u_int32_t seq,void * ctxt)604 mux_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
605 {
606 	struct mux_channel_confirm_ctx *fctx = ctxt;
607 	char *failmsg = NULL;
608 	struct Forward *rfwd;
609 	Channel *c;
610 	struct sshbuf *out;
611 	u_int port;
612 	int r;
613 
614 	if ((c = channel_by_id(ssh, fctx->cid)) == NULL) {
615 		/* no channel for reply */
616 		error_f("unknown channel");
617 		return;
618 	}
619 	if ((out = sshbuf_new()) == NULL)
620 		fatal_f("sshbuf_new");
621 	if (fctx->fid >= options.num_remote_forwards ||
622 	    (options.remote_forwards[fctx->fid].connect_path == NULL &&
623 	    options.remote_forwards[fctx->fid].connect_host == NULL)) {
624 		xasprintf(&failmsg, "unknown forwarding id %d", fctx->fid);
625 		goto fail;
626 	}
627 	rfwd = &options.remote_forwards[fctx->fid];
628 	debug_f("%s for: listen %d, connect %s:%d",
629 	    type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
630 	    rfwd->listen_port, rfwd->connect_path ? rfwd->connect_path :
631 	    rfwd->connect_host, rfwd->connect_port);
632 	if (type == SSH2_MSG_REQUEST_SUCCESS) {
633 		if (rfwd->listen_port == 0) {
634 			if ((r = sshpkt_get_u32(ssh, &port)) != 0)
635 				fatal_fr(r, "parse port");
636 			if (port > 65535) {
637 				fatal("Invalid allocated port %u for "
638 				    "mux remote forward to %s:%d", port,
639 				    rfwd->connect_host, rfwd->connect_port);
640 			}
641 			rfwd->allocated_port = (int)port;
642 			debug("Allocated port %u for mux remote forward"
643 			    " to %s:%d", rfwd->allocated_port,
644 			    rfwd->connect_host, rfwd->connect_port);
645 			if ((r = sshbuf_put_u32(out,
646 			    MUX_S_REMOTE_PORT)) != 0 ||
647 			    (r = sshbuf_put_u32(out, fctx->rid)) != 0 ||
648 			    (r = sshbuf_put_u32(out,
649 			    rfwd->allocated_port)) != 0)
650 				fatal_fr(r, "reply");
651 			channel_update_permission(ssh, rfwd->handle,
652 			   rfwd->allocated_port);
653 		} else {
654 			reply_ok(out, fctx->rid);
655 		}
656 		goto out;
657 	} else {
658 		if (rfwd->listen_port == 0)
659 			channel_update_permission(ssh, rfwd->handle, -1);
660 		if (rfwd->listen_path != NULL)
661 			xasprintf(&failmsg, "remote port forwarding failed for "
662 			    "listen path %s", rfwd->listen_path);
663 		else
664 			xasprintf(&failmsg, "remote port forwarding failed for "
665 			    "listen port %d", rfwd->listen_port);
666 
667                 debug2_f("clearing registered forwarding for listen %d, "
668 		    "connect %s:%d", rfwd->listen_port,
669 		    rfwd->connect_path ? rfwd->connect_path :
670 		    rfwd->connect_host, rfwd->connect_port);
671 
672 		free(rfwd->listen_host);
673 		free(rfwd->listen_path);
674 		free(rfwd->connect_host);
675 		free(rfwd->connect_path);
676 		memset(rfwd, 0, sizeof(*rfwd));
677 	}
678  fail:
679 	error_f("%s", failmsg);
680 	reply_error(out, MUX_S_FAILURE, fctx->rid, failmsg);
681 	free(failmsg);
682  out:
683 	if ((r = sshbuf_put_stringb(c->output, out)) != 0)
684 		fatal_fr(r, "enqueue");
685 	sshbuf_free(out);
686 	if (c->mux_pause <= 0)
687 		fatal_f("mux_pause %d", c->mux_pause);
688 	c->mux_pause = 0; /* start processing messages again */
689 }
690 
691 static int
mux_master_process_open_fwd(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)692 mux_master_process_open_fwd(struct ssh *ssh, u_int rid,
693     Channel *c, struct sshbuf *m, struct sshbuf *reply)
694 {
695 	struct Forward fwd;
696 	char *fwd_desc = NULL;
697 	char *listen_addr, *connect_addr;
698 	u_int ftype;
699 	u_int lport, cport;
700 	int r, i, ret = 0, freefwd = 1;
701 
702 	memset(&fwd, 0, sizeof(fwd));
703 
704 	/* XXX - lport/cport check redundant */
705 	if ((r = sshbuf_get_u32(m, &ftype)) != 0 ||
706 	    (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 ||
707 	    (r = sshbuf_get_u32(m, &lport)) != 0 ||
708 	    (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 ||
709 	    (r = sshbuf_get_u32(m, &cport)) != 0 ||
710 	    (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
711 	    (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
712 		error_f("malformed message");
713 		ret = -1;
714 		goto out;
715 	}
716 	if (*listen_addr == '\0') {
717 		free(listen_addr);
718 		listen_addr = NULL;
719 	}
720 	if (*connect_addr == '\0') {
721 		free(connect_addr);
722 		connect_addr = NULL;
723 	}
724 
725 	memset(&fwd, 0, sizeof(fwd));
726 	fwd.listen_port = lport;
727 	if (fwd.listen_port == PORT_STREAMLOCAL)
728 		fwd.listen_path = listen_addr;
729 	else
730 		fwd.listen_host = listen_addr;
731 	fwd.connect_port = cport;
732 	if (fwd.connect_port == PORT_STREAMLOCAL)
733 		fwd.connect_path = connect_addr;
734 	else
735 		fwd.connect_host = connect_addr;
736 
737 	debug2_f("channel %d: request %s", c->self,
738 	    (fwd_desc = format_forward(ftype, &fwd)));
739 
740 	if (ftype != MUX_FWD_LOCAL && ftype != MUX_FWD_REMOTE &&
741 	    ftype != MUX_FWD_DYNAMIC) {
742 		logit_f("invalid forwarding type %u", ftype);
743  invalid:
744 		free(listen_addr);
745 		free(connect_addr);
746 		reply_error(reply, MUX_S_FAILURE, rid,
747 		    "Invalid forwarding request");
748 		return 0;
749 	}
750 	if (ftype == MUX_FWD_DYNAMIC && fwd.listen_path) {
751 		logit_f("streamlocal and dynamic forwards "
752 		    "are mutually exclusive");
753 		goto invalid;
754 	}
755 	if (fwd.listen_port != PORT_STREAMLOCAL && fwd.listen_port >= 65536) {
756 		logit_f("invalid listen port %u", fwd.listen_port);
757 		goto invalid;
758 	}
759 	if ((fwd.connect_port != PORT_STREAMLOCAL &&
760 	    fwd.connect_port >= 65536) ||
761 	    (ftype != MUX_FWD_DYNAMIC && ftype != MUX_FWD_REMOTE &&
762 	    fwd.connect_port == 0)) {
763 		logit_f("invalid connect port %u",
764 		    fwd.connect_port);
765 		goto invalid;
766 	}
767 	if (ftype != MUX_FWD_DYNAMIC && fwd.connect_host == NULL &&
768 	    fwd.connect_path == NULL) {
769 		logit_f("missing connect host");
770 		goto invalid;
771 	}
772 
773 	/* Skip forwards that have already been requested */
774 	switch (ftype) {
775 	case MUX_FWD_LOCAL:
776 	case MUX_FWD_DYNAMIC:
777 		for (i = 0; i < options.num_local_forwards; i++) {
778 			if (compare_forward(&fwd,
779 			    options.local_forwards + i)) {
780  exists:
781 				debug2_f("found existing forwarding");
782 				reply_ok(reply, rid);
783 				goto out;
784 			}
785 		}
786 		break;
787 	case MUX_FWD_REMOTE:
788 		for (i = 0; i < options.num_remote_forwards; i++) {
789 			if (!compare_forward(&fwd, options.remote_forwards + i))
790 				continue;
791 			if (fwd.listen_port != 0)
792 				goto exists;
793 			debug2_f("found allocated port");
794 			if ((r = sshbuf_put_u32(reply,
795 			    MUX_S_REMOTE_PORT)) != 0 ||
796 			    (r = sshbuf_put_u32(reply, rid)) != 0 ||
797 			    (r = sshbuf_put_u32(reply,
798 			    options.remote_forwards[i].allocated_port)) != 0)
799 				fatal_fr(r, "reply FWD_REMOTE");
800 			goto out;
801 		}
802 		break;
803 	}
804 
805 	if (options.control_master == SSHCTL_MASTER_ASK ||
806 	    options.control_master == SSHCTL_MASTER_AUTO_ASK) {
807 		if (!ask_permission("Open %s on %s?", fwd_desc, host)) {
808 			debug2_f("forwarding refused by user");
809 			reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
810 			    "Permission denied");
811 			goto out;
812 		}
813 	}
814 
815 	if (ftype == MUX_FWD_LOCAL || ftype == MUX_FWD_DYNAMIC) {
816 		if (!channel_setup_local_fwd_listener(ssh, &fwd,
817 		    &options.fwd_opts)) {
818  fail:
819 			logit_f("requested %s failed", fwd_desc);
820 			reply_error(reply, MUX_S_FAILURE, rid,
821 			    "Port forwarding failed");
822 			goto out;
823 		}
824 		add_local_forward(&options, &fwd);
825 		freefwd = 0;
826 	} else {
827 		struct mux_channel_confirm_ctx *fctx;
828 
829 		fwd.handle = channel_request_remote_forwarding(ssh, &fwd);
830 		if (fwd.handle < 0)
831 			goto fail;
832 		add_remote_forward(&options, &fwd);
833 		fctx = xcalloc(1, sizeof(*fctx));
834 		fctx->cid = c->self;
835 		fctx->rid = rid;
836 		fctx->fid = options.num_remote_forwards - 1;
837 		client_register_global_confirm(mux_confirm_remote_forward,
838 		    fctx);
839 		freefwd = 0;
840 		c->mux_pause = 1; /* wait for mux_confirm_remote_forward */
841 		/* delayed reply in mux_confirm_remote_forward */
842 		goto out;
843 	}
844 	reply_ok(reply, rid);
845  out:
846 	free(fwd_desc);
847 	if (freefwd) {
848 		free(fwd.listen_host);
849 		free(fwd.listen_path);
850 		free(fwd.connect_host);
851 		free(fwd.connect_path);
852 	}
853 	return ret;
854 }
855 
856 static int
mux_master_process_close_fwd(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)857 mux_master_process_close_fwd(struct ssh *ssh, u_int rid,
858     Channel *c, struct sshbuf *m, struct sshbuf *reply)
859 {
860 	struct Forward fwd, *found_fwd;
861 	char *fwd_desc = NULL;
862 	const char *error_reason = NULL;
863 	char *listen_addr = NULL, *connect_addr = NULL;
864 	u_int ftype;
865 	int r, i, ret = 0;
866 	u_int lport, cport;
867 
868 	memset(&fwd, 0, sizeof(fwd));
869 
870 	if ((r = sshbuf_get_u32(m, &ftype)) != 0 ||
871 	    (r = sshbuf_get_cstring(m, &listen_addr, NULL)) != 0 ||
872 	    (r = sshbuf_get_u32(m, &lport)) != 0 ||
873 	    (r = sshbuf_get_cstring(m, &connect_addr, NULL)) != 0 ||
874 	    (r = sshbuf_get_u32(m, &cport)) != 0 ||
875 	    (lport != (u_int)PORT_STREAMLOCAL && lport > 65535) ||
876 	    (cport != (u_int)PORT_STREAMLOCAL && cport > 65535)) {
877 		error_f("malformed message");
878 		ret = -1;
879 		goto out;
880 	}
881 
882 	if (*listen_addr == '\0') {
883 		free(listen_addr);
884 		listen_addr = NULL;
885 	}
886 	if (*connect_addr == '\0') {
887 		free(connect_addr);
888 		connect_addr = NULL;
889 	}
890 
891 	memset(&fwd, 0, sizeof(fwd));
892 	fwd.listen_port = lport;
893 	if (fwd.listen_port == PORT_STREAMLOCAL)
894 		fwd.listen_path = listen_addr;
895 	else
896 		fwd.listen_host = listen_addr;
897 	fwd.connect_port = cport;
898 	if (fwd.connect_port == PORT_STREAMLOCAL)
899 		fwd.connect_path = connect_addr;
900 	else
901 		fwd.connect_host = connect_addr;
902 
903 	debug2_f("channel %d: request cancel %s", c->self,
904 	    (fwd_desc = format_forward(ftype, &fwd)));
905 
906 	/* make sure this has been requested */
907 	found_fwd = NULL;
908 	switch (ftype) {
909 	case MUX_FWD_LOCAL:
910 	case MUX_FWD_DYNAMIC:
911 		for (i = 0; i < options.num_local_forwards; i++) {
912 			if (compare_forward(&fwd,
913 			    options.local_forwards + i)) {
914 				found_fwd = options.local_forwards + i;
915 				break;
916 			}
917 		}
918 		break;
919 	case MUX_FWD_REMOTE:
920 		for (i = 0; i < options.num_remote_forwards; i++) {
921 			if (compare_forward(&fwd,
922 			    options.remote_forwards + i)) {
923 				found_fwd = options.remote_forwards + i;
924 				break;
925 			}
926 		}
927 		break;
928 	}
929 
930 	if (found_fwd == NULL)
931 		error_reason = "port not forwarded";
932 	else if (ftype == MUX_FWD_REMOTE) {
933 		/*
934 		 * This shouldn't fail unless we confused the host/port
935 		 * between options.remote_forwards and permitted_opens.
936 		 * However, for dynamic allocated listen ports we need
937 		 * to use the actual listen port.
938 		 */
939 		if (channel_request_rforward_cancel(ssh, found_fwd) == -1)
940 			error_reason = "port not in permitted opens";
941 	} else {	/* local and dynamic forwards */
942 		/* Ditto */
943 		if (channel_cancel_lport_listener(ssh, &fwd, fwd.connect_port,
944 		    &options.fwd_opts) == -1)
945 			error_reason = "port not found";
946 	}
947 
948 	if (error_reason != NULL)
949 		reply_error(reply, MUX_S_FAILURE, rid, error_reason);
950 	else {
951 		reply_ok(reply, rid);
952 		free(found_fwd->listen_host);
953 		free(found_fwd->listen_path);
954 		free(found_fwd->connect_host);
955 		free(found_fwd->connect_path);
956 		found_fwd->listen_host = found_fwd->connect_host = NULL;
957 		found_fwd->listen_path = found_fwd->connect_path = NULL;
958 		found_fwd->listen_port = found_fwd->connect_port = 0;
959 	}
960  out:
961 	free(fwd_desc);
962 	free(listen_addr);
963 	free(connect_addr);
964 
965 	return ret;
966 }
967 
968 static int
mux_master_process_stdio_fwd(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)969 mux_master_process_stdio_fwd(struct ssh *ssh, u_int rid,
970     Channel *c, struct sshbuf *m, struct sshbuf *reply)
971 {
972 	Channel *nc;
973 	char *chost = NULL;
974 	u_int cport, i, j;
975 	int r, new_fd[2];
976 	struct mux_stdio_confirm_ctx *cctx;
977 
978 	if ((r = sshbuf_skip_string(m)) != 0 || /* reserved */
979 	    (r = sshbuf_get_cstring(m, &chost, NULL)) != 0 ||
980 	    (r = sshbuf_get_u32(m, &cport)) != 0) {
981 		free(chost);
982 		error_f("malformed message");
983 		return -1;
984 	}
985 
986 	debug2_f("channel %d: stdio fwd to %s:%u", c->self, chost, cport);
987 
988 	/* Gather fds from client */
989 	for(i = 0; i < 2; i++) {
990 		if ((new_fd[i] = mm_receive_fd(c->sock)) == -1) {
991 			error_f("failed to receive fd %d from client", i);
992 			for (j = 0; j < i; j++)
993 				close(new_fd[j]);
994 			free(chost);
995 
996 			/* prepare reply */
997 			reply_error(reply, MUX_S_FAILURE, rid,
998 			    "did not receive file descriptors");
999 			return -1;
1000 		}
1001 	}
1002 
1003 	debug3_f("got fds stdin %d, stdout %d", new_fd[0], new_fd[1]);
1004 
1005 	/* XXX support multiple child sessions in future */
1006 	if (c->have_remote_id) {
1007 		debug2_f("session already open");
1008 		reply_error(reply, MUX_S_FAILURE, rid,
1009 		    "Multiple sessions not supported");
1010  cleanup:
1011 		close(new_fd[0]);
1012 		close(new_fd[1]);
1013 		free(chost);
1014 		return 0;
1015 	}
1016 
1017 	if (options.control_master == SSHCTL_MASTER_ASK ||
1018 	    options.control_master == SSHCTL_MASTER_AUTO_ASK) {
1019 		if (!ask_permission("Allow forward to %s:%u? ",
1020 		    chost, cport)) {
1021 			debug2_f("stdio fwd refused by user");
1022 			reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
1023 			    "Permission denied");
1024 			goto cleanup;
1025 		}
1026 	}
1027 
1028 	/* enable nonblocking unless tty */
1029 	if (!isatty(new_fd[0]))
1030 		set_nonblock(new_fd[0]);
1031 	if (!isatty(new_fd[1]))
1032 		set_nonblock(new_fd[1]);
1033 
1034 	nc = channel_connect_stdio_fwd(ssh, chost, cport, new_fd[0], new_fd[1]);
1035 	free(chost);
1036 
1037 	nc->ctl_chan = c->self;		/* link session -> control channel */
1038 	c->remote_id = nc->self; 	/* link control -> session channel */
1039 	c->have_remote_id = 1;
1040 
1041 	debug2_f("channel_new: %d control %d", nc->self, nc->ctl_chan);
1042 
1043 	channel_register_cleanup(ssh, nc->self,
1044 	    mux_master_session_cleanup_cb, 1);
1045 
1046 	cctx = xcalloc(1, sizeof(*cctx));
1047 	cctx->rid = rid;
1048 	channel_register_open_confirm(ssh, nc->self, mux_stdio_confirm, cctx);
1049 	c->mux_pause = 1; /* stop handling messages until open_confirm done */
1050 
1051 	/* reply is deferred, sent by mux_session_confirm */
1052 	return 0;
1053 }
1054 
1055 /* Callback on open confirmation in mux master for a mux stdio fwd session. */
1056 static void
mux_stdio_confirm(struct ssh * ssh,int id,int success,void * arg)1057 mux_stdio_confirm(struct ssh *ssh, int id, int success, void *arg)
1058 {
1059 	struct mux_stdio_confirm_ctx *cctx = arg;
1060 	Channel *c, *cc;
1061 	struct sshbuf *reply;
1062 	int r;
1063 
1064 	if (cctx == NULL)
1065 		fatal_f("cctx == NULL");
1066 	if ((c = channel_by_id(ssh, id)) == NULL)
1067 		fatal_f("no channel for id %d", id);
1068 	if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1069 		fatal_f("channel %d lacks control channel %d",
1070 		    id, c->ctl_chan);
1071 	if ((reply = sshbuf_new()) == NULL)
1072 		fatal_f("sshbuf_new");
1073 
1074 	if (!success) {
1075 		debug3_f("sending failure reply");
1076 		reply_error(reply, MUX_S_FAILURE, cctx->rid,
1077 		    "Session open refused by peer");
1078 		/* prepare reply */
1079 		goto done;
1080 	}
1081 
1082 	debug3_f("sending success reply");
1083 	/* prepare reply */
1084 	if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 ||
1085 	    (r = sshbuf_put_u32(reply, cctx->rid)) != 0 ||
1086 	    (r = sshbuf_put_u32(reply, c->self)) != 0)
1087 		fatal_fr(r, "reply");
1088 
1089  done:
1090 	/* Send reply */
1091 	if ((r = sshbuf_put_stringb(cc->output, reply)) != 0)
1092 		fatal_fr(r, "enqueue");
1093 	sshbuf_free(reply);
1094 
1095 	if (cc->mux_pause <= 0)
1096 		fatal_f("mux_pause %d", cc->mux_pause);
1097 	cc->mux_pause = 0; /* start processing messages again */
1098 	c->open_confirm_ctx = NULL;
1099 	free(cctx);
1100 }
1101 
1102 static int
mux_master_process_stop_listening(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)1103 mux_master_process_stop_listening(struct ssh *ssh, u_int rid,
1104     Channel *c, struct sshbuf *m, struct sshbuf *reply)
1105 {
1106 	debug_f("channel %d: stop listening", c->self);
1107 
1108 	if (options.control_master == SSHCTL_MASTER_ASK ||
1109 	    options.control_master == SSHCTL_MASTER_AUTO_ASK) {
1110 		if (!ask_permission("Disable further multiplexing on shared "
1111 		    "connection to %s? ", host)) {
1112 			debug2_f("stop listen refused by user");
1113 			reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
1114 			    "Permission denied");
1115 			return 0;
1116 		}
1117 	}
1118 
1119 	if (mux_listener_channel != NULL) {
1120 		channel_free(ssh, mux_listener_channel);
1121 		client_stop_mux();
1122 		free(options.control_path);
1123 		options.control_path = NULL;
1124 		mux_listener_channel = NULL;
1125 		muxserver_sock = -1;
1126 	}
1127 
1128 	reply_ok(reply, rid);
1129 	return 0;
1130 }
1131 
1132 static int
mux_master_process_proxy(struct ssh * ssh,u_int rid,Channel * c,struct sshbuf * m,struct sshbuf * reply)1133 mux_master_process_proxy(struct ssh *ssh, u_int rid,
1134     Channel *c, struct sshbuf *m, struct sshbuf *reply)
1135 {
1136 	int r;
1137 
1138 	debug_f("channel %d: proxy request", c->self);
1139 
1140 	c->mux_rcb = channel_proxy_downstream;
1141 	if ((r = sshbuf_put_u32(reply, MUX_S_PROXY)) != 0 ||
1142 	    (r = sshbuf_put_u32(reply, rid)) != 0)
1143 		fatal_fr(r, "reply");
1144 
1145 	return 0;
1146 }
1147 
1148 /* Channel callbacks fired on read/write from mux client fd */
1149 static int
mux_master_read_cb(struct ssh * ssh,Channel * c)1150 mux_master_read_cb(struct ssh *ssh, Channel *c)
1151 {
1152 	struct mux_master_state *state = (struct mux_master_state *)c->mux_ctx;
1153 	struct sshbuf *in = NULL, *out = NULL;
1154 	u_int type, rid, i;
1155 	int r, ret = -1;
1156 
1157 	if ((out = sshbuf_new()) == NULL)
1158 		fatal_f("sshbuf_new");
1159 
1160 	/* Setup ctx and  */
1161 	if (c->mux_ctx == NULL) {
1162 		state = xcalloc(1, sizeof(*state));
1163 		c->mux_ctx = state;
1164 		channel_register_cleanup(ssh, c->self,
1165 		    mux_master_control_cleanup_cb, 0);
1166 
1167 		/* Send hello */
1168 		if ((r = sshbuf_put_u32(out, MUX_MSG_HELLO)) != 0 ||
1169 		    (r = sshbuf_put_u32(out, SSHMUX_VER)) != 0)
1170 			fatal_fr(r, "reply");
1171 		/* no extensions */
1172 		if ((r = sshbuf_put_stringb(c->output, out)) != 0)
1173 			fatal_fr(r, "enqueue");
1174 		debug3_f("channel %d: hello sent", c->self);
1175 		ret = 0;
1176 		goto out;
1177 	}
1178 
1179 	/* Channel code ensures that we receive whole packets */
1180 	if ((r = sshbuf_froms(c->input, &in)) != 0) {
1181  malf:
1182 		error_f("malformed message");
1183 		goto out;
1184 	}
1185 
1186 	if ((r = sshbuf_get_u32(in, &type)) != 0)
1187 		goto malf;
1188 	debug3_f("channel %d packet type 0x%08x len %zu", c->self,
1189 	    type, sshbuf_len(in));
1190 
1191 	if (type == MUX_MSG_HELLO)
1192 		rid = 0;
1193 	else {
1194 		if (!state->hello_rcvd) {
1195 			error_f("expected MUX_MSG_HELLO(0x%08x), "
1196 			    "received 0x%08x", MUX_MSG_HELLO, type);
1197 			goto out;
1198 		}
1199 		if ((r = sshbuf_get_u32(in, &rid)) != 0)
1200 			goto malf;
1201 	}
1202 
1203 	for (i = 0; mux_master_handlers[i].handler != NULL; i++) {
1204 		if (type == mux_master_handlers[i].type) {
1205 			ret = mux_master_handlers[i].handler(ssh, rid,
1206 			    c, in, out);
1207 			break;
1208 		}
1209 	}
1210 	if (mux_master_handlers[i].handler == NULL) {
1211 		error_f("unsupported mux message 0x%08x", type);
1212 		reply_error(out, MUX_S_FAILURE, rid, "unsupported request");
1213 		ret = 0;
1214 	}
1215 	/* Enqueue reply packet */
1216 	if (sshbuf_len(out) != 0 &&
1217 	    (r = sshbuf_put_stringb(c->output, out)) != 0)
1218 		fatal_fr(r, "enqueue");
1219  out:
1220 	sshbuf_free(in);
1221 	sshbuf_free(out);
1222 	return ret;
1223 }
1224 
1225 void
mux_exit_message(struct ssh * ssh,Channel * c,int exitval)1226 mux_exit_message(struct ssh *ssh, Channel *c, int exitval)
1227 {
1228 	struct sshbuf *m;
1229 	Channel *mux_chan;
1230 	int r;
1231 
1232 	debug3_f("channel %d: exit message, exitval %d", c->self, exitval);
1233 
1234 	if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL)
1235 		fatal_f("channel %d missing mux %d", c->self, c->ctl_chan);
1236 
1237 	/* Append exit message packet to control socket output queue */
1238 	if ((m = sshbuf_new()) == NULL)
1239 		fatal_f("sshbuf_new");
1240 	if ((r = sshbuf_put_u32(m, MUX_S_EXIT_MESSAGE)) != 0 ||
1241 	    (r = sshbuf_put_u32(m, c->self)) != 0 ||
1242 	    (r = sshbuf_put_u32(m, exitval)) != 0 ||
1243 	    (r = sshbuf_put_stringb(mux_chan->output, m)) != 0)
1244 		fatal_fr(r, "reply");
1245 	sshbuf_free(m);
1246 }
1247 
1248 void
mux_tty_alloc_failed(struct ssh * ssh,Channel * c)1249 mux_tty_alloc_failed(struct ssh *ssh, Channel *c)
1250 {
1251 	struct sshbuf *m;
1252 	Channel *mux_chan;
1253 	int r;
1254 
1255 	debug3_f("channel %d: TTY alloc failed", c->self);
1256 
1257 	if ((mux_chan = channel_by_id(ssh, c->ctl_chan)) == NULL)
1258 		fatal_f("channel %d missing mux %d", c->self, c->ctl_chan);
1259 
1260 	/* Append exit message packet to control socket output queue */
1261 	if ((m = sshbuf_new()) == NULL)
1262 		fatal_f("sshbuf_new");
1263 	if ((r = sshbuf_put_u32(m, MUX_S_TTY_ALLOC_FAIL)) != 0 ||
1264 	    (r = sshbuf_put_u32(m, c->self)) != 0 ||
1265 	    (r = sshbuf_put_stringb(mux_chan->output, m)) != 0)
1266 		fatal_fr(r, "reply");
1267 	sshbuf_free(m);
1268 }
1269 
1270 /* Prepare a mux master to listen on a Unix domain socket. */
1271 void
muxserver_listen(struct ssh * ssh)1272 muxserver_listen(struct ssh *ssh)
1273 {
1274 	mode_t old_umask;
1275 	char *orig_control_path = options.control_path;
1276 	char rbuf[16+1];
1277 	u_int i, r;
1278 	int oerrno;
1279 
1280 	if (options.control_path == NULL ||
1281 	    options.control_master == SSHCTL_MASTER_NO)
1282 		return;
1283 
1284 	debug("setting up multiplex master socket");
1285 
1286 	/*
1287 	 * Use a temporary path before listen so we can pseudo-atomically
1288 	 * establish the listening socket in its final location to avoid
1289 	 * other processes racing in between bind() and listen() and hitting
1290 	 * an unready socket.
1291 	 */
1292 	for (i = 0; i < sizeof(rbuf) - 1; i++) {
1293 		r = arc4random_uniform(26+26+10);
1294 		rbuf[i] = (r < 26) ? 'a' + r :
1295 		    (r < 26*2) ? 'A' + r - 26 :
1296 		    '0' + r - 26 - 26;
1297 	}
1298 	rbuf[sizeof(rbuf) - 1] = '\0';
1299 	options.control_path = NULL;
1300 	xasprintf(&options.control_path, "%s.%s", orig_control_path, rbuf);
1301 	debug3_f("temporary control path %s", options.control_path);
1302 
1303 	old_umask = umask(0177);
1304 	muxserver_sock = unix_listener(options.control_path, 64, 0);
1305 	oerrno = errno;
1306 	umask(old_umask);
1307 	if (muxserver_sock < 0) {
1308 		if (oerrno == EINVAL || oerrno == EADDRINUSE) {
1309 			error("ControlSocket %s already exists, "
1310 			    "disabling multiplexing", options.control_path);
1311  disable_mux_master:
1312 			if (muxserver_sock != -1) {
1313 				close(muxserver_sock);
1314 				muxserver_sock = -1;
1315 			}
1316 			free(orig_control_path);
1317 			free(options.control_path);
1318 			options.control_path = NULL;
1319 			options.control_master = SSHCTL_MASTER_NO;
1320 			return;
1321 		} else {
1322 			/* unix_listener() logs the error */
1323 			cleanup_exit(255);
1324 		}
1325 	}
1326 
1327 	/* Now atomically "move" the mux socket into position */
1328 	if (link(options.control_path, orig_control_path) != 0) {
1329 		if (errno != EEXIST) {
1330 			fatal_f("link mux listener %s => %s: %s",
1331 			    options.control_path, orig_control_path,
1332 			    strerror(errno));
1333 		}
1334 		error("ControlSocket %s already exists, disabling multiplexing",
1335 		    orig_control_path);
1336 		unlink(options.control_path);
1337 		goto disable_mux_master;
1338 	}
1339 	unlink(options.control_path);
1340 	free(options.control_path);
1341 	options.control_path = orig_control_path;
1342 
1343 	set_nonblock(muxserver_sock);
1344 
1345 	mux_listener_channel = channel_new(ssh, "mux listener",
1346 	    SSH_CHANNEL_MUX_LISTENER, muxserver_sock, muxserver_sock, -1,
1347 	    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1348 	    0, options.control_path, 1);
1349 	mux_listener_channel->mux_rcb = mux_master_read_cb;
1350 	debug3_f("mux listener channel %d fd %d",
1351 	    mux_listener_channel->self, mux_listener_channel->sock);
1352 }
1353 
1354 /* Callback on open confirmation in mux master for a mux client session. */
1355 static void
mux_session_confirm(struct ssh * ssh,int id,int success,void * arg)1356 mux_session_confirm(struct ssh *ssh, int id, int success, void *arg)
1357 {
1358 	struct mux_session_confirm_ctx *cctx = arg;
1359 	const char *display;
1360 	Channel *c, *cc;
1361 	int i, r;
1362 	struct sshbuf *reply;
1363 
1364 	if (cctx == NULL)
1365 		fatal_f("cctx == NULL");
1366 	if ((c = channel_by_id(ssh, id)) == NULL)
1367 		fatal_f("no channel for id %d", id);
1368 	if ((cc = channel_by_id(ssh, c->ctl_chan)) == NULL)
1369 		fatal_f("channel %d lacks control channel %d",
1370 		    id, c->ctl_chan);
1371 	if ((reply = sshbuf_new()) == NULL)
1372 		fatal_f("sshbuf_new");
1373 
1374 	if (!success) {
1375 		debug3_f("sending failure reply");
1376 		reply_error(reply, MUX_S_FAILURE, cctx->rid,
1377 		    "Session open refused by peer");
1378 		goto done;
1379 	}
1380 
1381 	display = getenv("DISPLAY");
1382 	if (cctx->want_x_fwd && options.forward_x11 && display != NULL) {
1383 		char *proto, *data;
1384 
1385 		/* Get reasonable local authentication information. */
1386 		if (client_x11_get_proto(ssh, display, options.xauth_location,
1387 		    options.forward_x11_trusted, options.forward_x11_timeout,
1388 		    &proto, &data) == 0) {
1389 			/* Request forwarding with authentication spoofing. */
1390 			debug("Requesting X11 forwarding with authentication "
1391 			    "spoofing.");
1392 			x11_request_forwarding_with_spoofing(ssh, id,
1393 			    display, proto, data, 1);
1394 			/* XXX exit_on_forward_failure */
1395 			client_expect_confirm(ssh, id, "X11 forwarding",
1396 			    CONFIRM_WARN);
1397 		}
1398 	}
1399 
1400 	if (cctx->want_agent_fwd && options.forward_agent) {
1401 		debug("Requesting authentication agent forwarding.");
1402 		channel_request_start(ssh, id, "auth-agent-req@openssh.com", 0);
1403 		if ((r = sshpkt_send(ssh)) != 0)
1404 			fatal_fr(r, "send");
1405 	}
1406 
1407 	client_session2_setup(ssh, id, cctx->want_tty, cctx->want_subsys,
1408 	    cctx->term, &cctx->tio, c->rfd, cctx->cmd, cctx->env);
1409 
1410 	debug3_f("sending success reply");
1411 	/* prepare reply */
1412 	if ((r = sshbuf_put_u32(reply, MUX_S_SESSION_OPENED)) != 0 ||
1413 	    (r = sshbuf_put_u32(reply, cctx->rid)) != 0 ||
1414 	    (r = sshbuf_put_u32(reply, c->self)) != 0)
1415 		fatal_fr(r, "reply");
1416 
1417  done:
1418 	/* Send reply */
1419 	if ((r = sshbuf_put_stringb(cc->output, reply)) != 0)
1420 		fatal_fr(r, "enqueue");
1421 	sshbuf_free(reply);
1422 
1423 	if (cc->mux_pause <= 0)
1424 		fatal_f("mux_pause %d", cc->mux_pause);
1425 	cc->mux_pause = 0; /* start processing messages again */
1426 	c->open_confirm_ctx = NULL;
1427 	sshbuf_free(cctx->cmd);
1428 	free(cctx->term);
1429 	if (cctx->env != NULL) {
1430 		for (i = 0; cctx->env[i] != NULL; i++)
1431 			free(cctx->env[i]);
1432 		free(cctx->env);
1433 	}
1434 	free(cctx);
1435 }
1436 
1437 /* ** Multiplexing client support */
1438 
1439 /* Exit signal handler */
1440 static void
control_client_sighandler(int signo)1441 control_client_sighandler(int signo)
1442 {
1443 	muxclient_terminate = signo;
1444 }
1445 
1446 /*
1447  * Relay signal handler - used to pass some signals from mux client to
1448  * mux master.
1449  */
1450 static void
control_client_sigrelay(int signo)1451 control_client_sigrelay(int signo)
1452 {
1453 	int save_errno = errno;
1454 
1455 	if (muxserver_pid > 1)
1456 		kill(muxserver_pid, signo);
1457 
1458 	errno = save_errno;
1459 }
1460 
1461 static int
mux_client_read(int fd,struct sshbuf * b,size_t need)1462 mux_client_read(int fd, struct sshbuf *b, size_t need)
1463 {
1464 	size_t have;
1465 	ssize_t len;
1466 	u_char *p;
1467 	struct pollfd pfd;
1468 	int r;
1469 
1470 	pfd.fd = fd;
1471 	pfd.events = POLLIN;
1472 	if ((r = sshbuf_reserve(b, need, &p)) != 0)
1473 		fatal_fr(r, "reserve");
1474 	for (have = 0; have < need; ) {
1475 		if (muxclient_terminate) {
1476 			errno = EINTR;
1477 			return -1;
1478 		}
1479 		len = read(fd, p + have, need - have);
1480 		if (len == -1) {
1481 			switch (errno) {
1482 #if defined(EWOULDBLOCK) && (EWOULDBLOCK != EAGAIN)
1483 			case EWOULDBLOCK:
1484 #endif
1485 			case EAGAIN:
1486 				(void)poll(&pfd, 1, -1);
1487 				/* FALLTHROUGH */
1488 			case EINTR:
1489 				continue;
1490 			default:
1491 				return -1;
1492 			}
1493 		}
1494 		if (len == 0) {
1495 			errno = EPIPE;
1496 			return -1;
1497 		}
1498 		have += (size_t)len;
1499 	}
1500 	return 0;
1501 }
1502 
1503 static int
mux_client_write_packet(int fd,struct sshbuf * m)1504 mux_client_write_packet(int fd, struct sshbuf *m)
1505 {
1506 	struct sshbuf *queue;
1507 	u_int have, need;
1508 	int r, oerrno, len;
1509 	const u_char *ptr;
1510 	struct pollfd pfd;
1511 
1512 	pfd.fd = fd;
1513 	pfd.events = POLLOUT;
1514 	if ((queue = sshbuf_new()) == NULL)
1515 		fatal_f("sshbuf_new");
1516 	if ((r = sshbuf_put_stringb(queue, m)) != 0)
1517 		fatal_fr(r, "enqueue");
1518 
1519 	need = sshbuf_len(queue);
1520 	ptr = sshbuf_ptr(queue);
1521 
1522 	for (have = 0; have < need; ) {
1523 		if (muxclient_terminate) {
1524 			sshbuf_free(queue);
1525 			errno = EINTR;
1526 			return -1;
1527 		}
1528 		len = write(fd, ptr + have, need - have);
1529 		if (len == -1) {
1530 			switch (errno) {
1531 #if defined(EWOULDBLOCK) && (EWOULDBLOCK != EAGAIN)
1532 			case EWOULDBLOCK:
1533 #endif
1534 			case EAGAIN:
1535 				(void)poll(&pfd, 1, -1);
1536 				/* FALLTHROUGH */
1537 			case EINTR:
1538 				continue;
1539 			default:
1540 				oerrno = errno;
1541 				sshbuf_free(queue);
1542 				errno = oerrno;
1543 				return -1;
1544 			}
1545 		}
1546 		if (len == 0) {
1547 			sshbuf_free(queue);
1548 			errno = EPIPE;
1549 			return -1;
1550 		}
1551 		have += (u_int)len;
1552 	}
1553 	sshbuf_free(queue);
1554 	return 0;
1555 }
1556 
1557 static int
mux_client_read_packet(int fd,struct sshbuf * m)1558 mux_client_read_packet(int fd, struct sshbuf *m)
1559 {
1560 	struct sshbuf *queue;
1561 	size_t need, have;
1562 	const u_char *ptr;
1563 	int r, oerrno;
1564 
1565 	if ((queue = sshbuf_new()) == NULL)
1566 		fatal_f("sshbuf_new");
1567 	if (mux_client_read(fd, queue, 4) != 0) {
1568 		if ((oerrno = errno) == EPIPE)
1569 			debug3_f("read header failed: %s",
1570 			    strerror(errno));
1571 		sshbuf_free(queue);
1572 		errno = oerrno;
1573 		return -1;
1574 	}
1575 	need = PEEK_U32(sshbuf_ptr(queue));
1576 	if (mux_client_read(fd, queue, need) != 0) {
1577 		oerrno = errno;
1578 		debug3_f("read body failed: %s", strerror(errno));
1579 		sshbuf_free(queue);
1580 		errno = oerrno;
1581 		return -1;
1582 	}
1583 	if ((r = sshbuf_get_string_direct(queue, &ptr, &have)) != 0 ||
1584 	    (r = sshbuf_put(m, ptr, have)) != 0)
1585 		fatal_fr(r, "dequeue");
1586 	sshbuf_free(queue);
1587 	return 0;
1588 }
1589 
1590 static int
mux_client_hello_exchange(int fd)1591 mux_client_hello_exchange(int fd)
1592 {
1593 	struct sshbuf *m;
1594 	u_int type, ver;
1595 	int r, ret = -1;
1596 
1597 	if ((m = sshbuf_new()) == NULL)
1598 		fatal_f("sshbuf_new");
1599 	if ((r = sshbuf_put_u32(m, MUX_MSG_HELLO)) != 0 ||
1600 	    (r = sshbuf_put_u32(m, SSHMUX_VER)) != 0)
1601 		fatal_fr(r, "assemble hello");
1602 	/* no extensions */
1603 
1604 	if (mux_client_write_packet(fd, m) != 0) {
1605 		debug_f("write packet: %s", strerror(errno));
1606 		goto out;
1607 	}
1608 
1609 	sshbuf_reset(m);
1610 
1611 	/* Read their HELLO */
1612 	if (mux_client_read_packet(fd, m) != 0) {
1613 		debug_f("read packet failed");
1614 		goto out;
1615 	}
1616 
1617 	if ((r = sshbuf_get_u32(m, &type)) != 0)
1618 		fatal_fr(r, "parse type");
1619 	if (type != MUX_MSG_HELLO) {
1620 		error_f("expected HELLO (%u) got %u", MUX_MSG_HELLO, type);
1621 		goto out;
1622 	}
1623 	if ((r = sshbuf_get_u32(m, &ver)) != 0)
1624 		fatal_fr(r, "parse version");
1625 	if (ver != SSHMUX_VER) {
1626 		error("Unsupported multiplexing protocol version %d "
1627 		    "(expected %d)", ver, SSHMUX_VER);
1628 		goto out;
1629 	}
1630 	debug2_f("master version %u", ver);
1631 	/* No extensions are presently defined */
1632 	while (sshbuf_len(m) > 0) {
1633 		char *name = NULL;
1634 
1635 		if ((r = sshbuf_get_cstring(m, &name, NULL)) != 0 ||
1636 		    (r = sshbuf_skip_string(m)) != 0) { /* value */
1637 			error_fr(r, "parse extension");
1638 			goto out;
1639 		}
1640 		debug2("Unrecognised master extension \"%s\"", name);
1641 		free(name);
1642 	}
1643 	/* success */
1644 	ret = 0;
1645  out:
1646 	sshbuf_free(m);
1647 	return ret;
1648 }
1649 
1650 static u_int
mux_client_request_alive(int fd)1651 mux_client_request_alive(int fd)
1652 {
1653 	struct sshbuf *m;
1654 	char *e;
1655 	u_int pid, type, rid;
1656 	int r;
1657 
1658 	debug3_f("entering");
1659 
1660 	if ((m = sshbuf_new()) == NULL)
1661 		fatal_f("sshbuf_new");
1662 	if ((r = sshbuf_put_u32(m, MUX_C_ALIVE_CHECK)) != 0 ||
1663 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1664 		fatal_fr(r, "assemble");
1665 
1666 	if (mux_client_write_packet(fd, m) != 0)
1667 		fatal_f("write packet: %s", strerror(errno));
1668 
1669 	sshbuf_reset(m);
1670 
1671 	/* Read their reply */
1672 	if (mux_client_read_packet(fd, m) != 0) {
1673 		sshbuf_free(m);
1674 		return 0;
1675 	}
1676 
1677 	if ((r = sshbuf_get_u32(m, &type)) != 0)
1678 		fatal_fr(r, "parse type");
1679 	if (type != MUX_S_ALIVE) {
1680 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1681 			fatal_fr(r, "parse error message");
1682 		fatal_f("master returned error: %s", e);
1683 	}
1684 
1685 	if ((r = sshbuf_get_u32(m, &rid)) != 0)
1686 		fatal_fr(r, "parse remote ID");
1687 	if (rid != muxclient_request_id)
1688 		fatal_f("out of sequence reply: my id %u theirs %u",
1689 		    muxclient_request_id, rid);
1690 	if ((r = sshbuf_get_u32(m, &pid)) != 0)
1691 		fatal_fr(r, "parse PID");
1692 	sshbuf_free(m);
1693 
1694 	debug3_f("done pid = %u", pid);
1695 
1696 	muxclient_request_id++;
1697 
1698 	return pid;
1699 }
1700 
1701 static void
mux_client_request_terminate(int fd)1702 mux_client_request_terminate(int fd)
1703 {
1704 	struct sshbuf *m;
1705 	char *e;
1706 	u_int type, rid;
1707 	int r;
1708 
1709 	debug3_f("entering");
1710 
1711 	if ((m = sshbuf_new()) == NULL)
1712 		fatal_f("sshbuf_new");
1713 	if ((r = sshbuf_put_u32(m, MUX_C_TERMINATE)) != 0 ||
1714 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
1715 		fatal_fr(r, "request");
1716 
1717 	if (mux_client_write_packet(fd, m) != 0)
1718 		fatal_f("write packet: %s", strerror(errno));
1719 
1720 	sshbuf_reset(m);
1721 
1722 	/* Read their reply */
1723 	if (mux_client_read_packet(fd, m) != 0) {
1724 		/* Remote end exited already */
1725 		if (errno == EPIPE) {
1726 			sshbuf_free(m);
1727 			return;
1728 		}
1729 		fatal_f("read from master failed: %s", strerror(errno));
1730 	}
1731 
1732 	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1733 	    (r = sshbuf_get_u32(m, &rid)) != 0)
1734 		fatal_fr(r, "parse");
1735 	if (rid != muxclient_request_id)
1736 		fatal_f("out of sequence reply: my id %u theirs %u",
1737 		    muxclient_request_id, rid);
1738 	switch (type) {
1739 	case MUX_S_OK:
1740 		break;
1741 	case MUX_S_PERMISSION_DENIED:
1742 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1743 			fatal_fr(r, "parse error message");
1744 		fatal("Master refused termination request: %s", e);
1745 	case MUX_S_FAILURE:
1746 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1747 			fatal_fr(r, "parse error message");
1748 		fatal_f("termination request failed: %s", e);
1749 	default:
1750 		fatal_f("unexpected response from master 0x%08x", type);
1751 	}
1752 	sshbuf_free(m);
1753 	muxclient_request_id++;
1754 }
1755 
1756 static int
mux_client_forward(int fd,int cancel_flag,u_int ftype,struct Forward * fwd)1757 mux_client_forward(int fd, int cancel_flag, u_int ftype, struct Forward *fwd)
1758 {
1759 	struct sshbuf *m;
1760 	char *e, *fwd_desc;
1761 	const char *lhost, *chost;
1762 	u_int type, rid;
1763 	int r;
1764 
1765 	fwd_desc = format_forward(ftype, fwd);
1766 	debug("Requesting %s %s",
1767 	    cancel_flag ? "cancellation of" : "forwarding of", fwd_desc);
1768 	free(fwd_desc);
1769 
1770 	type = cancel_flag ? MUX_C_CLOSE_FWD : MUX_C_OPEN_FWD;
1771 	if (fwd->listen_path != NULL)
1772 		lhost = fwd->listen_path;
1773 	else if (fwd->listen_host == NULL)
1774 		lhost = "";
1775 	else if (*fwd->listen_host == '\0')
1776 		lhost = "*";
1777 	else
1778 		lhost = fwd->listen_host;
1779 
1780 	if (fwd->connect_path != NULL)
1781 		chost = fwd->connect_path;
1782 	else if (fwd->connect_host == NULL)
1783 		chost = "";
1784 	else
1785 		chost = fwd->connect_host;
1786 
1787 	if ((m = sshbuf_new()) == NULL)
1788 		fatal_f("sshbuf_new");
1789 	if ((r = sshbuf_put_u32(m, type)) != 0 ||
1790 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
1791 	    (r = sshbuf_put_u32(m, ftype)) != 0 ||
1792 	    (r = sshbuf_put_cstring(m, lhost)) != 0 ||
1793 	    (r = sshbuf_put_u32(m, fwd->listen_port)) != 0 ||
1794 	    (r = sshbuf_put_cstring(m, chost)) != 0 ||
1795 	    (r = sshbuf_put_u32(m, fwd->connect_port)) != 0)
1796 		fatal_fr(r, "request");
1797 
1798 	if (mux_client_write_packet(fd, m) != 0)
1799 		fatal_f("write packet: %s", strerror(errno));
1800 
1801 	sshbuf_reset(m);
1802 
1803 	/* Read their reply */
1804 	if (mux_client_read_packet(fd, m) != 0) {
1805 		sshbuf_free(m);
1806 		return -1;
1807 	}
1808 
1809 	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1810 	    (r = sshbuf_get_u32(m, &rid)) != 0)
1811 		fatal_fr(r, "parse");
1812 	if (rid != muxclient_request_id)
1813 		fatal_f("out of sequence reply: my id %u theirs %u",
1814 		    muxclient_request_id, rid);
1815 
1816 	switch (type) {
1817 	case MUX_S_OK:
1818 		break;
1819 	case MUX_S_REMOTE_PORT:
1820 		if (cancel_flag)
1821 			fatal_f("got MUX_S_REMOTE_PORT for cancel");
1822 		if ((r = sshbuf_get_u32(m, &fwd->allocated_port)) != 0)
1823 			fatal_fr(r, "parse port");
1824 		verbose("Allocated port %u for remote forward to %s:%d",
1825 		    fwd->allocated_port,
1826 		    fwd->connect_host ? fwd->connect_host : "",
1827 		    fwd->connect_port);
1828 		if (muxclient_command == SSHMUX_COMMAND_FORWARD)
1829 			fprintf(stdout, "%i\n", fwd->allocated_port);
1830 		break;
1831 	case MUX_S_PERMISSION_DENIED:
1832 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1833 			fatal_fr(r, "parse error message");
1834 		sshbuf_free(m);
1835 		error("Master refused forwarding request: %s", e);
1836 		return -1;
1837 	case MUX_S_FAILURE:
1838 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1839 			fatal_fr(r, "parse error message");
1840 		sshbuf_free(m);
1841 		error_f("forwarding request failed: %s", e);
1842 		return -1;
1843 	default:
1844 		fatal_f("unexpected response from master 0x%08x", type);
1845 	}
1846 	sshbuf_free(m);
1847 
1848 	muxclient_request_id++;
1849 	return 0;
1850 }
1851 
1852 static int
mux_client_forwards(int fd,int cancel_flag)1853 mux_client_forwards(int fd, int cancel_flag)
1854 {
1855 	int i, ret = 0;
1856 
1857 	debug3_f("%s forwardings: %d local, %d remote",
1858 	    cancel_flag ? "cancel" : "request",
1859 	    options.num_local_forwards, options.num_remote_forwards);
1860 
1861 	/* XXX ExitOnForwardingFailure */
1862 	for (i = 0; i < options.num_local_forwards; i++) {
1863 		if (mux_client_forward(fd, cancel_flag,
1864 		    options.local_forwards[i].connect_port == 0 ?
1865 		    MUX_FWD_DYNAMIC : MUX_FWD_LOCAL,
1866 		    options.local_forwards + i) != 0)
1867 			ret = -1;
1868 	}
1869 	for (i = 0; i < options.num_remote_forwards; i++) {
1870 		if (mux_client_forward(fd, cancel_flag, MUX_FWD_REMOTE,
1871 		    options.remote_forwards + i) != 0)
1872 			ret = -1;
1873 	}
1874 	return ret;
1875 }
1876 
1877 static int
mux_client_request_session(int fd)1878 mux_client_request_session(int fd)
1879 {
1880 	struct sshbuf *m;
1881 	char *e;
1882 	const char *term;
1883 	u_int echar, rid, sid, esid, exitval, type, exitval_seen;
1884 	extern char **environ;
1885 	int r, i, rawmode;
1886 
1887 	debug3_f("entering");
1888 
1889 	if ((muxserver_pid = mux_client_request_alive(fd)) == 0) {
1890 		error_f("master alive request failed");
1891 		return -1;
1892 	}
1893 
1894 	ssh_signal(SIGPIPE, SIG_IGN);
1895 
1896 	if (stdin_null_flag && stdfd_devnull(1, 0, 0) == -1)
1897 		fatal_f("stdfd_devnull failed");
1898 
1899 	if ((term = getenv("TERM")) == NULL)
1900 		term = "";
1901 	echar = 0xffffffff;
1902 	if (options.escape_char != SSH_ESCAPECHAR_NONE)
1903 	    echar = (u_int)options.escape_char;
1904 
1905 	if ((m = sshbuf_new()) == NULL)
1906 		fatal_f("sshbuf_new");
1907 	if ((r = sshbuf_put_u32(m, MUX_C_NEW_SESSION)) != 0 ||
1908 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
1909 	    (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */
1910 	    (r = sshbuf_put_u32(m, tty_flag)) != 0 ||
1911 	    (r = sshbuf_put_u32(m, options.forward_x11)) != 0 ||
1912 	    (r = sshbuf_put_u32(m, options.forward_agent)) != 0 ||
1913 	    (r = sshbuf_put_u32(m, subsystem_flag)) != 0 ||
1914 	    (r = sshbuf_put_u32(m, echar)) != 0 ||
1915 	    (r = sshbuf_put_cstring(m, term)) != 0 ||
1916 	    (r = sshbuf_put_stringb(m, command)) != 0)
1917 		fatal_fr(r, "request");
1918 
1919 	/* Pass environment */
1920 	if (options.num_send_env > 0 && environ != NULL) {
1921 		for (i = 0; environ[i] != NULL; i++) {
1922 			if (!env_permitted(environ[i]))
1923 				continue;
1924 			if ((r = sshbuf_put_cstring(m, environ[i])) != 0)
1925 				fatal_fr(r, "request sendenv");
1926 		}
1927 	}
1928 	for (i = 0; i < options.num_setenv; i++) {
1929 		if ((r = sshbuf_put_cstring(m, options.setenv[i])) != 0)
1930 			fatal_fr(r, "request setenv");
1931 	}
1932 
1933 	if (mux_client_write_packet(fd, m) != 0)
1934 		fatal_f("write packet: %s", strerror(errno));
1935 
1936 	/* Send the stdio file descriptors */
1937 	if (mm_send_fd(fd, STDIN_FILENO) == -1 ||
1938 	    mm_send_fd(fd, STDOUT_FILENO) == -1 ||
1939 	    mm_send_fd(fd, STDERR_FILENO) == -1)
1940 		fatal_f("send fds failed");
1941 
1942 	debug3_f("session request sent");
1943 
1944 	/* Read their reply */
1945 	sshbuf_reset(m);
1946 	if (mux_client_read_packet(fd, m) != 0) {
1947 		error_f("read from master failed: %s", strerror(errno));
1948 		sshbuf_free(m);
1949 		return -1;
1950 	}
1951 
1952 	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
1953 	    (r = sshbuf_get_u32(m, &rid)) != 0)
1954 		fatal_fr(r, "parse");
1955 	if (rid != muxclient_request_id)
1956 		fatal_f("out of sequence reply: my id %u theirs %u",
1957 		    muxclient_request_id, rid);
1958 
1959 	switch (type) {
1960 	case MUX_S_SESSION_OPENED:
1961 		if ((r = sshbuf_get_u32(m, &sid)) != 0)
1962 			fatal_fr(r, "parse session ID");
1963 		debug_f("master session id: %u", sid);
1964 		break;
1965 	case MUX_S_PERMISSION_DENIED:
1966 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1967 			fatal_fr(r, "parse error message");
1968 		error("Master refused session request: %s", e);
1969 		sshbuf_free(m);
1970 		return -1;
1971 	case MUX_S_FAILURE:
1972 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
1973 			fatal_fr(r, "parse error message");
1974 		error_f("session request failed: %s", e);
1975 		sshbuf_free(m);
1976 		return -1;
1977 	default:
1978 		sshbuf_free(m);
1979 		error_f("unexpected response from master 0x%08x", type);
1980 		return -1;
1981 	}
1982 	muxclient_request_id++;
1983 
1984 	if (pledge("stdio proc tty", NULL) == -1)
1985 		fatal_f("pledge(): %s", strerror(errno));
1986 	platform_pledge_mux();
1987 
1988 	ssh_signal(SIGHUP, control_client_sighandler);
1989 	ssh_signal(SIGINT, control_client_sighandler);
1990 	ssh_signal(SIGTERM, control_client_sighandler);
1991 	ssh_signal(SIGWINCH, control_client_sigrelay);
1992 
1993 	rawmode = tty_flag;
1994 	if (tty_flag)
1995 		enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
1996 
1997 	/*
1998 	 * Stick around until the controlee closes the client_fd.
1999 	 * Before it does, it is expected to write an exit message.
2000 	 * This process must read the value and wait for the closure of
2001 	 * the client_fd; if this one closes early, the multiplex master will
2002 	 * terminate early too (possibly losing data).
2003 	 */
2004 	for (exitval = 255, exitval_seen = 0;;) {
2005 		sshbuf_reset(m);
2006 		if (mux_client_read_packet(fd, m) != 0)
2007 			break;
2008 		if ((r = sshbuf_get_u32(m, &type)) != 0)
2009 			fatal_fr(r, "parse type");
2010 		switch (type) {
2011 		case MUX_S_TTY_ALLOC_FAIL:
2012 			if ((r = sshbuf_get_u32(m, &esid)) != 0)
2013 				fatal_fr(r, "parse session ID");
2014 			if (esid != sid)
2015 				fatal_f("tty alloc fail on unknown session: "
2016 				    "my id %u theirs %u", sid, esid);
2017 			leave_raw_mode(options.request_tty ==
2018 			    REQUEST_TTY_FORCE);
2019 			rawmode = 0;
2020 			continue;
2021 		case MUX_S_EXIT_MESSAGE:
2022 			if ((r = sshbuf_get_u32(m, &esid)) != 0)
2023 				fatal_fr(r, "parse session ID");
2024 			if (esid != sid)
2025 				fatal_f("exit on unknown session: "
2026 				    "my id %u theirs %u", sid, esid);
2027 			if (exitval_seen)
2028 				fatal_f("exitval sent twice");
2029 			if ((r = sshbuf_get_u32(m, &exitval)) != 0)
2030 				fatal_fr(r, "parse exitval");
2031 			exitval_seen = 1;
2032 			continue;
2033 		default:
2034 			if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2035 				fatal_fr(r, "parse error message");
2036 			fatal_f("master returned error: %s", e);
2037 		}
2038 	}
2039 
2040 	close(fd);
2041 	if (rawmode)
2042 		leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
2043 
2044 	if (muxclient_terminate) {
2045 		debug2("Exiting on signal: %s", strsignal(muxclient_terminate));
2046 		exitval = 255;
2047 	} else if (!exitval_seen) {
2048 		debug2("Control master terminated unexpectedly");
2049 		exitval = 255;
2050 	} else
2051 		debug2("Received exit status from master %d", exitval);
2052 
2053 	if (tty_flag && options.log_level != SYSLOG_LEVEL_QUIET)
2054 		fprintf(stderr, "Shared connection to %s closed.\r\n", host);
2055 
2056 	exit(exitval);
2057 }
2058 
2059 static int
mux_client_proxy(int fd)2060 mux_client_proxy(int fd)
2061 {
2062 	struct sshbuf *m;
2063 	char *e;
2064 	u_int type, rid;
2065 	int r;
2066 
2067 	if ((m = sshbuf_new()) == NULL)
2068 		fatal_f("sshbuf_new");
2069 	if ((r = sshbuf_put_u32(m, MUX_C_PROXY)) != 0 ||
2070 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
2071 		fatal_fr(r, "request");
2072 	if (mux_client_write_packet(fd, m) != 0)
2073 		fatal_f("write packet: %s", strerror(errno));
2074 
2075 	sshbuf_reset(m);
2076 
2077 	/* Read their reply */
2078 	if (mux_client_read_packet(fd, m) != 0) {
2079 		sshbuf_free(m);
2080 		return 0;
2081 	}
2082 	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2083 	    (r = sshbuf_get_u32(m, &rid)) != 0)
2084 		fatal_fr(r, "parse");
2085 	if (rid != muxclient_request_id)
2086 		fatal_f("out of sequence reply: my id %u theirs %u",
2087 		    muxclient_request_id, rid);
2088 	if (type != MUX_S_PROXY) {
2089 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2090 			fatal_fr(r, "parse error message");
2091 		fatal_f("master returned error: %s", e);
2092 	}
2093 	sshbuf_free(m);
2094 
2095 	debug3_f("done");
2096 	muxclient_request_id++;
2097 	return 0;
2098 }
2099 
2100 static int
mux_client_request_stdio_fwd(int fd)2101 mux_client_request_stdio_fwd(int fd)
2102 {
2103 	struct sshbuf *m;
2104 	char *e;
2105 	u_int type, rid, sid;
2106 	int r;
2107 
2108 	debug3_f("entering");
2109 
2110 	if ((muxserver_pid = mux_client_request_alive(fd)) == 0) {
2111 		error_f("master alive request failed");
2112 		return -1;
2113 	}
2114 
2115 	ssh_signal(SIGPIPE, SIG_IGN);
2116 
2117 	if (stdin_null_flag && stdfd_devnull(1, 0, 0) == -1)
2118 		fatal_f("stdfd_devnull failed");
2119 
2120 	if ((m = sshbuf_new()) == NULL)
2121 		fatal_f("sshbuf_new");
2122 	if ((r = sshbuf_put_u32(m, MUX_C_NEW_STDIO_FWD)) != 0 ||
2123 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0 ||
2124 	    (r = sshbuf_put_string(m, NULL, 0)) != 0 || /* reserved */
2125 	    (r = sshbuf_put_cstring(m, options.stdio_forward_host)) != 0 ||
2126 	    (r = sshbuf_put_u32(m, options.stdio_forward_port)) != 0)
2127 		fatal_fr(r, "request");
2128 
2129 	if (mux_client_write_packet(fd, m) != 0)
2130 		fatal_f("write packet: %s", strerror(errno));
2131 
2132 	/* Send the stdio file descriptors */
2133 	if (mm_send_fd(fd, STDIN_FILENO) == -1 ||
2134 	    mm_send_fd(fd, STDOUT_FILENO) == -1)
2135 		fatal_f("send fds failed");
2136 
2137 	if (pledge("stdio proc tty", NULL) == -1)
2138 		fatal_f("pledge(): %s", strerror(errno));
2139 	platform_pledge_mux();
2140 
2141 	debug3_f("stdio forward request sent");
2142 
2143 	/* Read their reply */
2144 	sshbuf_reset(m);
2145 
2146 	if (mux_client_read_packet(fd, m) != 0) {
2147 		error_f("read from master failed: %s", strerror(errno));
2148 		sshbuf_free(m);
2149 		return -1;
2150 	}
2151 
2152 	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2153 	    (r = sshbuf_get_u32(m, &rid)) != 0)
2154 		fatal_fr(r, "parse");
2155 	if (rid != muxclient_request_id)
2156 		fatal_f("out of sequence reply: my id %u theirs %u",
2157 		    muxclient_request_id, rid);
2158 	switch (type) {
2159 	case MUX_S_SESSION_OPENED:
2160 		if ((r = sshbuf_get_u32(m, &sid)) != 0)
2161 			fatal_fr(r, "parse session ID");
2162 		debug_f("master session id: %u", sid);
2163 		break;
2164 	case MUX_S_PERMISSION_DENIED:
2165 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2166 			fatal_fr(r, "parse error message");
2167 		sshbuf_free(m);
2168 		fatal("Master refused stdio forwarding request: %s", e);
2169 	case MUX_S_FAILURE:
2170 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2171 			fatal_fr(r, "parse error message");
2172 		sshbuf_free(m);
2173 		fatal("Stdio forwarding request failed: %s", e);
2174 	default:
2175 		sshbuf_free(m);
2176 		error_f("unexpected response from master 0x%08x", type);
2177 		return -1;
2178 	}
2179 	muxclient_request_id++;
2180 
2181 	ssh_signal(SIGHUP, control_client_sighandler);
2182 	ssh_signal(SIGINT, control_client_sighandler);
2183 	ssh_signal(SIGTERM, control_client_sighandler);
2184 	ssh_signal(SIGWINCH, control_client_sigrelay);
2185 
2186 	/*
2187 	 * Stick around until the controlee closes the client_fd.
2188 	 */
2189 	sshbuf_reset(m);
2190 	if (mux_client_read_packet(fd, m) != 0) {
2191 		if (errno == EPIPE ||
2192 		    (errno == EINTR && muxclient_terminate != 0))
2193 			return 0;
2194 		fatal_f("mux_client_read_packet: %s", strerror(errno));
2195 	}
2196 	fatal_f("master returned unexpected message %u", type);
2197 }
2198 
2199 static void
mux_client_request_stop_listening(int fd)2200 mux_client_request_stop_listening(int fd)
2201 {
2202 	struct sshbuf *m;
2203 	char *e;
2204 	u_int type, rid;
2205 	int r;
2206 
2207 	debug3_f("entering");
2208 
2209 	if ((m = sshbuf_new()) == NULL)
2210 		fatal_f("sshbuf_new");
2211 	if ((r = sshbuf_put_u32(m, MUX_C_STOP_LISTENING)) != 0 ||
2212 	    (r = sshbuf_put_u32(m, muxclient_request_id)) != 0)
2213 		fatal_fr(r, "request");
2214 
2215 	if (mux_client_write_packet(fd, m) != 0)
2216 		fatal_f("write packet: %s", strerror(errno));
2217 
2218 	sshbuf_reset(m);
2219 
2220 	/* Read their reply */
2221 	if (mux_client_read_packet(fd, m) != 0)
2222 		fatal_f("read from master failed: %s", strerror(errno));
2223 
2224 	if ((r = sshbuf_get_u32(m, &type)) != 0 ||
2225 	    (r = sshbuf_get_u32(m, &rid)) != 0)
2226 		fatal_fr(r, "parse");
2227 	if (rid != muxclient_request_id)
2228 		fatal_f("out of sequence reply: my id %u theirs %u",
2229 		    muxclient_request_id, rid);
2230 
2231 	switch (type) {
2232 	case MUX_S_OK:
2233 		break;
2234 	case MUX_S_PERMISSION_DENIED:
2235 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2236 			fatal_fr(r, "parse error message");
2237 		fatal("Master refused stop listening request: %s", e);
2238 	case MUX_S_FAILURE:
2239 		if ((r = sshbuf_get_cstring(m, &e, NULL)) != 0)
2240 			fatal_fr(r, "parse error message");
2241 		fatal_f("stop listening request failed: %s", e);
2242 	default:
2243 		fatal_f("unexpected response from master 0x%08x", type);
2244 	}
2245 	sshbuf_free(m);
2246 	muxclient_request_id++;
2247 }
2248 
2249 /* Multiplex client main loop. */
2250 int
muxclient(const char * path)2251 muxclient(const char *path)
2252 {
2253 	struct sockaddr_un addr;
2254 	int sock;
2255 	u_int pid;
2256 
2257 	if (muxclient_command == 0) {
2258 		if (options.stdio_forward_host != NULL)
2259 			muxclient_command = SSHMUX_COMMAND_STDIO_FWD;
2260 		else
2261 			muxclient_command = SSHMUX_COMMAND_OPEN;
2262 	}
2263 
2264 	switch (options.control_master) {
2265 	case SSHCTL_MASTER_AUTO:
2266 	case SSHCTL_MASTER_AUTO_ASK:
2267 		debug("auto-mux: Trying existing master");
2268 		/* FALLTHROUGH */
2269 	case SSHCTL_MASTER_NO:
2270 		break;
2271 	default:
2272 		return -1;
2273 	}
2274 
2275 	memset(&addr, '\0', sizeof(addr));
2276 	addr.sun_family = AF_UNIX;
2277 
2278 	if (strlcpy(addr.sun_path, path,
2279 	    sizeof(addr.sun_path)) >= sizeof(addr.sun_path))
2280 		fatal("ControlPath too long ('%s' >= %u bytes)", path,
2281 		     (unsigned int)sizeof(addr.sun_path));
2282 
2283 	if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
2284 		fatal_f("socket(): %s", strerror(errno));
2285 
2286 	if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
2287 		switch (muxclient_command) {
2288 		case SSHMUX_COMMAND_OPEN:
2289 		case SSHMUX_COMMAND_STDIO_FWD:
2290 			break;
2291 		default:
2292 			fatal("Control socket connect(%.100s): %s", path,
2293 			    strerror(errno));
2294 		}
2295 		if (errno == ECONNREFUSED &&
2296 		    options.control_master != SSHCTL_MASTER_NO) {
2297 			debug("Stale control socket %.100s, unlinking", path);
2298 			unlink(path);
2299 		} else if (errno == ENOENT) {
2300 			debug("Control socket \"%.100s\" does not exist", path);
2301 		} else {
2302 			error("Control socket connect(%.100s): %s", path,
2303 			    strerror(errno));
2304 		}
2305 		close(sock);
2306 		return -1;
2307 	}
2308 	set_nonblock(sock);
2309 
2310 	if (mux_client_hello_exchange(sock) != 0) {
2311 		error_f("master hello exchange failed");
2312 		close(sock);
2313 		return -1;
2314 	}
2315 
2316 	switch (muxclient_command) {
2317 	case SSHMUX_COMMAND_ALIVE_CHECK:
2318 		if ((pid = mux_client_request_alive(sock)) == 0)
2319 			fatal_f("master alive check failed");
2320 		fprintf(stderr, "Master running (pid=%u)\r\n", pid);
2321 		exit(0);
2322 	case SSHMUX_COMMAND_TERMINATE:
2323 		mux_client_request_terminate(sock);
2324 		if (options.log_level != SYSLOG_LEVEL_QUIET)
2325 			fprintf(stderr, "Exit request sent.\r\n");
2326 		exit(0);
2327 	case SSHMUX_COMMAND_FORWARD:
2328 		if (mux_client_forwards(sock, 0) != 0)
2329 			fatal_f("master forward request failed");
2330 		exit(0);
2331 	case SSHMUX_COMMAND_OPEN:
2332 		if (mux_client_forwards(sock, 0) != 0) {
2333 			error_f("master forward request failed");
2334 			return -1;
2335 		}
2336 		mux_client_request_session(sock);
2337 		return -1;
2338 	case SSHMUX_COMMAND_STDIO_FWD:
2339 		mux_client_request_stdio_fwd(sock);
2340 		exit(0);
2341 	case SSHMUX_COMMAND_STOP:
2342 		mux_client_request_stop_listening(sock);
2343 		if (options.log_level != SYSLOG_LEVEL_QUIET)
2344 			fprintf(stderr, "Stop listening request sent.\r\n");
2345 		exit(0);
2346 	case SSHMUX_COMMAND_CANCEL_FWD:
2347 		if (mux_client_forwards(sock, 1) != 0)
2348 			error_f("master cancel forward request failed");
2349 		exit(0);
2350 	case SSHMUX_COMMAND_PROXY:
2351 		mux_client_proxy(sock);
2352 		return (sock);
2353 	default:
2354 		fatal("unrecognised muxclient_command %d", muxclient_command);
2355 	}
2356 }
2357