1 files changed, 167 insertions, 53 deletions

diff --git a/sftp-server.c b/sftp-server.c
index 76edebc5a..24c4ff717 100644
--- a/sftp-server.c
+++ b/sftp-server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-server.c,v 1.73 2007/05/17 07:55:29 djm Exp $ */
+/* $OpenBSD: sftp-server.c,v 1.84 2008/06/26 06:10:09 djm Exp $ */
 /*
  * Copyright (c) 2000-2004 Markus Friedl.  All rights reserved.
  *
@@ -23,6 +23,12 @@
 #ifdef HAVE_SYS_TIME_H
 # include <sys/time.h>
 #endif
+#ifdef HAVE_SYS_MOUNT_H
+#include <sys/mount.h>
+#endif
+#ifdef HAVE_SYS_STATVFS_H
+#include <sys/statvfs.h>
+#endif
 
 #include <dirent.h>
 #include <errno.h>
@@ -98,6 +104,9 @@ errno_to_portable(int unixerrno)
         case EINVAL:
                 ret = SSH2_FX_BAD_MESSAGE;
                 break;
+        case ENOSYS:
+                ret = SSH2_FX_OP_UNSUPPORTED;
+                break;
         default:
                 ret = SSH2_FX_FAILURE;
                 break;
@@ -169,6 +178,7 @@ struct Handle {
         int fd;
         char *name;
         u_int64_t bytes_read, bytes_write;
+        int next_unused;
 };
 
 enum {
@@ -177,40 +187,46 @@ enum {
         HANDLE_FILE
 };
 
-Handle  handles[100];
+Handle *handles = NULL;
+u_int num_handles = 0;
+int first_unused_handle = -1;
 
-static void
-handle_init(void)
+static void handle_unused(int i)
 {
-        u_int i;
-
-        for (i = 0; i < sizeof(handles)/sizeof(Handle); i++)
-                handles[i].use = HANDLE_UNUSED;
+        handles[i].use = HANDLE_UNUSED;
+        handles[i].next_unused = first_unused_handle;
+        first_unused_handle = i;
 }
 
 static int
 handle_new(int use, const char *name, int fd, DIR *dirp)
 {
-        u_int i;
+        int i;
 
-        for (i = 0; i < sizeof(handles)/sizeof(Handle); i++) {
-                if (handles[i].use == HANDLE_UNUSED) {
-                        handles[i].use = use;
-                        handles[i].dirp = dirp;
-                        handles[i].fd = fd;
-                        handles[i].name = xstrdup(name);
-                        handles[i].bytes_read = handles[i].bytes_write = 0;
-                        return i;
-                }
+        if (first_unused_handle == -1) {
+                if (num_handles + 1 <= num_handles)
+                        return -1;
+                num_handles++;
+                handles = xrealloc(handles, num_handles, sizeof(Handle));
+                handle_unused(num_handles - 1);
         }
-        return -1;
+
+        i = first_unused_handle;
+        first_unused_handle = handles[i].next_unused;
+
+        handles[i].use = use;
+        handles[i].dirp = dirp;
+        handles[i].fd = fd;
+        handles[i].name = xstrdup(name);
+        handles[i].bytes_read = handles[i].bytes_write = 0;
+
+        return i;
 }
 
 static int
 handle_is_ok(int i, int type)
 {
-        return i >= 0 && (u_int)i < sizeof(handles)/sizeof(Handle) &&
-            handles[i].use == type;
+        return i >= 0 && (u_int)i < num_handles && handles[i].use == type;
 }
 
 static int
@@ -300,12 +316,12 @@ handle_close(int handle)
 
         if (handle_is_ok(handle, HANDLE_FILE)) {
                 ret = close(handles[handle].fd);
-                handles[handle].use = HANDLE_UNUSED;
                 xfree(handles[handle].name);
+                handle_unused(handle);
         } else if (handle_is_ok(handle, HANDLE_DIR)) {
                 ret = closedir(handles[handle].dirp);
-                handles[handle].use = HANDLE_UNUSED;
                 xfree(handles[handle].name);
+                handle_unused(handle);
         } else {
                 errno = ENOENT;
         }
@@ -333,7 +349,7 @@ handle_log_exit(void)
 {
         u_int i;
 
-        for (i = 0; i < sizeof(handles)/sizeof(Handle); i++)
+        for (i = 0; i < num_handles; i++)
                 if (handles[i].use != HANDLE_UNUSED)
                         handle_log_close(i, "forced");
 }
@@ -468,6 +484,33 @@ send_attrib(u_int32_t id, const Attrib *a)
         buffer_free(&msg);
 }
 
+static void
+send_statvfs(u_int32_t id, struct statvfs *st)
+{
+        Buffer msg;
+        u_int64_t flag;
+
+        flag = (st->f_flag & ST_RDONLY) ? SSH2_FXE_STATVFS_ST_RDONLY : 0;
+        flag |= (st->f_flag & ST_NOSUID) ? SSH2_FXE_STATVFS_ST_NOSUID : 0;
+
+        buffer_init(&msg);
+        buffer_put_char(&msg, SSH2_FXP_EXTENDED_REPLY);
+        buffer_put_int(&msg, id);
+        buffer_put_int64(&msg, st->f_bsize);
+        buffer_put_int64(&msg, st->f_frsize);
+        buffer_put_int64(&msg, st->f_blocks);
+        buffer_put_int64(&msg, st->f_bfree);
+        buffer_put_int64(&msg, st->f_bavail);
+        buffer_put_int64(&msg, st->f_files);
+        buffer_put_int64(&msg, st->f_ffree);
+        buffer_put_int64(&msg, st->f_favail);
+        buffer_put_int64(&msg, FSID_TO_ULONG(st->f_fsid));
+        buffer_put_int64(&msg, flag);
+        buffer_put_int64(&msg, st->f_namemax);
+        send_msg(&msg);
+        buffer_free(&msg);
+}
+
 /* parse incoming */
 
 static void
@@ -480,6 +523,15 @@ process_init(void)
         buffer_init(&msg);
         buffer_put_char(&msg, SSH2_FXP_VERSION);
         buffer_put_int(&msg, SSH2_FILEXFER_VERSION);
+        /* POSIX rename extension */
+        buffer_put_cstring(&msg, "posix-rename@openssh.com");
+        buffer_put_cstring(&msg, "1"); /* version */
+        /* statvfs extension */
+        buffer_put_cstring(&msg, "statvfs@openssh.com");
+        buffer_put_cstring(&msg, "2"); /* version */
+        /* fstatvfs extension */
+        buffer_put_cstring(&msg, "fstatvfs@openssh.com");
+        buffer_put_cstring(&msg, "2"); /* version */
         send_msg(&msg);
         buffer_free(&msg);
 }
@@ -711,7 +763,7 @@ process_setstat(void)
         }
         if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
                 logit("set \"%s\" mode %04o", name, a->perm);
-                ret = chmod(name, a->perm & 0777);
+                ret = chmod(name, a->perm & 07777);
                 if (ret == -1)
                         status = errno_to_portable(errno);
         }
@@ -765,9 +817,9 @@ process_fsetstat(void)
                 if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
                         logit("set \"%s\" mode %04o", name, a->perm);
 #ifdef HAVE_FCHMOD
-                        ret = fchmod(fd, a->perm & 0777);
+                        ret = fchmod(fd, a->perm & 07777);
 #else
-                        ret = chmod(name, a->perm & 0777);
+                        ret = chmod(name, a->perm & 07777);
 #endif
                         if (ret == -1)
                                 status = errno_to_portable(errno);
@@ -918,7 +970,7 @@ process_mkdir(void)
         name = get_string(NULL);
         a = get_attrib();
         mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
-            a->perm & 0777 : 0777;
+            a->perm & 07777 : 0777;
         debug3("request %u: mkdir", id);
         logit("mkdir name \"%s\" mode 0%o", name, mode);
         ret = mkdir(name, mode);
@@ -990,6 +1042,9 @@ process_rename(void)
                 /* Race-free rename of regular files */
                 if (link(oldpath, newpath) == -1) {
                         if (errno == EOPNOTSUPP
+#ifdef EXDEV
+                            || errno == EXDEV
+#endif
 #ifdef LINK_OPNOTSUPP_ERRNO
                             || errno == LINK_OPNOTSUPP_ERRNO
 #endif
@@ -1073,6 +1128,59 @@ process_symlink(void)
 }
 
 static void
+process_extended_posix_rename(u_int32_t id)
+{
+        char *oldpath, *newpath;
+
+        oldpath = get_string(NULL);
+        newpath = get_string(NULL);
+        debug3("request %u: posix-rename", id);
+        logit("posix-rename old \"%s\" new \"%s\"", oldpath, newpath);
+        if (rename(oldpath, newpath) == -1)
+                send_status(id, errno_to_portable(errno));
+        else
+                send_status(id, SSH2_FX_OK);
+        xfree(oldpath);
+        xfree(newpath);
+}
+
+static void
+process_extended_statvfs(u_int32_t id)
+{
+        char *path;
+        struct statvfs st;
+
+        path = get_string(NULL);
+        debug3("request %u: statfs", id);
+        logit("statfs \"%s\"", path);
+
+        if (statvfs(path, &st) != 0)
+                send_status(id, errno_to_portable(errno));
+        else
+                send_statvfs(id, &st);
+        xfree(path);
+}
+
+static void
+process_extended_fstatvfs(u_int32_t id)
+{
+        int handle, fd;
+        struct statvfs st;
+
+        handle = get_handle();
+        debug("request %u: fstatvfs \"%s\" (handle %u)",
+            id, handle_to_name(handle), handle);
+        if ((fd = handle_to_fd(handle)) < 0) {
+                send_status(id, SSH2_FX_FAILURE);
+                return;
+        }
+        if (fstatvfs(fd, &st) != 0)
+                send_status(id, errno_to_portable(errno));
+        else
+                send_statvfs(id, &st);
+}
+
+static void
 process_extended(void)
 {
         u_int32_t id;
@@ -1080,7 +1188,14 @@ process_extended(void)
 
         id = get_int();
         request = get_string(NULL);
-        send_status(id, SSH2_FX_OP_UNSUPPORTED);                /* MUST */
+        if (strcmp(request, "posix-rename@openssh.com") == 0)
+                process_extended_posix_rename(id);
+        else if (strcmp(request, "statvfs@openssh.com") == 0)
+                process_extended_statvfs(id);
+        else if (strcmp(request, "fstatvfs@openssh.com") == 0)
+                process_extended_fstatvfs(id);
+        else
+                send_status(id, SSH2_FX_OP_UNSUPPORTED);        /* MUST */
         xfree(request);
 }
 
@@ -1103,7 +1218,7 @@ process(void)
         if (msg_len > SFTP_MAX_MSG_LENGTH) {
                 error("bad message from %s local user %s",
                     client_addr, pw->pw_name);
-                cleanup_exit(11);
+                sftp_server_cleanup_exit(11);
         }
         if (buf_len < msg_len + 4)
                 return;
@@ -1176,18 +1291,22 @@ process(void)
                 break;
         }
         /* discard the remaining bytes from the current packet */
-        if (buf_len < buffer_len(&iqueue))
-                fatal("iqueue grew unexpectedly");
+        if (buf_len < buffer_len(&iqueue)) {
+                error("iqueue grew unexpectedly");
+                sftp_server_cleanup_exit(255);
+        }
         consumed = buf_len - buffer_len(&iqueue);
-        if (msg_len < consumed)
-                fatal("msg_len %d < consumed %d", msg_len, consumed);
+        if (msg_len < consumed) {
+                error("msg_len %d < consumed %d", msg_len, consumed);
+                sftp_server_cleanup_exit(255);
+        }
         if (msg_len > consumed)
                 buffer_consume(&iqueue, msg_len - consumed);
 }
 
 /* Cleanup handler that logs active handles upon normal exit */
 void
-cleanup_exit(int i)
+sftp_server_cleanup_exit(int i)
 {
         if (pw != NULL && client_addr != NULL) {
                 handle_log_exit();
@@ -1198,7 +1317,7 @@ cleanup_exit(int i)
 }
 
 static void
-usage(void)
+sftp_server_usage(void)
 {
         extern char *__progname;
 
@@ -1208,7 +1327,7 @@ usage(void)
 }
 
 int
-main(int argc, char **argv)
+sftp_server_main(int argc, char **argv, struct passwd *user_pw)
 {
         fd_set *rset, *wset;
         int in, out, max, ch, skipargs = 0, log_stderr = 0;
@@ -1219,9 +1338,6 @@ main(int argc, char **argv)
         extern char *optarg;
         extern char *__progname;
 
-        /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
-        sanitise_stdfd();
-
         __progname = ssh_get_progname(argv[0]);
         log_init(__progname, log_level, log_facility, log_stderr);
 
@@ -1244,12 +1360,12 @@ main(int argc, char **argv)
                         break;
                 case 'f':
                         log_facility = log_facility_number(optarg);
-                        if (log_level == SYSLOG_FACILITY_NOT_SET)
+                        if (log_facility == SYSLOG_FACILITY_NOT_SET)
                                 error("Invalid log facility \"%s\"", optarg);
                         break;
                 case 'h':
                 default:
-                        usage();
+                        sftp_server_usage();
                 }
         }
 
@@ -1257,22 +1373,20 @@ main(int argc, char **argv)
 
         if ((cp = getenv("SSH_CONNECTION")) != NULL) {
                 client_addr = xstrdup(cp);
-                if ((cp = strchr(client_addr, ' ')) == NULL)
-                        fatal("Malformed SSH_CONNECTION variable: \"%s\"",
+                if ((cp = strchr(client_addr, ' ')) == NULL) {
+                        error("Malformed SSH_CONNECTION variable: \"%s\"",
                             getenv("SSH_CONNECTION"));
+                        sftp_server_cleanup_exit(255);
+                }
                 *cp = '\0';
         } else
                 client_addr = xstrdup("UNKNOWN");
 
-        if ((pw = getpwuid(getuid())) == NULL)
-                fatal("No user found for uid %lu", (u_long)getuid());
-        pw = pwcopy(pw);
+        pw = pwcopy(user_pw);
 
         logit("session opened for local user %s from [%s]",
             pw->pw_name, client_addr);
 
-        handle_init();
-
         in = dup(STDIN_FILENO);
         out = dup(STDOUT_FILENO);
 
@@ -1315,7 +1429,7 @@ main(int argc, char **argv)
                         if (errno == EINTR)
                                 continue;
                         error("select: %s", strerror(errno));
-                        cleanup_exit(2);
+                        sftp_server_cleanup_exit(2);
                 }
 
                 /* copy stdin to iqueue */
@@ -1323,10 +1437,10 @@ main(int argc, char **argv)
                         len = read(in, buf, sizeof buf);
                         if (len == 0) {
                                 debug("read eof");
-                                cleanup_exit(0);
+                                sftp_server_cleanup_exit(0);
                         } else if (len < 0) {
                                 error("read: %s", strerror(errno));
-                                cleanup_exit(1);
+                                sftp_server_cleanup_exit(1);
                         } else {
                                 buffer_append(&iqueue, buf, len);
                         }
@@ -1336,7 +1450,7 @@ main(int argc, char **argv)
                         len = write(out, buffer_ptr(&oqueue), olen);
                         if (len < 0) {
                                 error("write: %s", strerror(errno));
-                                cleanup_exit(1);
+                                sftp_server_cleanup_exit(1);
                         } else {
                                 buffer_consume(&oqueue, len);
                         }