1 files changed, 167 insertions, 107 deletions

diff --git a/ssh.c b/ssh.c
index 6138fd4d3..7879d4f4d 100644
--- a/ssh.c
+++ b/ssh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.c,v 1.519 2020/02/07 03:54:44 dtucker Exp $ */
+/* $OpenBSD: ssh.c,v 1.527 2020/04/10 00:52:07 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -86,7 +86,6 @@
 #include "canohost.h"
 #include "compat.h"
 #include "cipher.h"
-#include "digest.h"
 #include "packet.h"
 #include "sshbuf.h"
 #include "channels.h"
@@ -191,7 +190,7 @@ struct sshbuf *command;
 int subsystem_flag = 0;
 
 /* # of replies received for global requests */
-static int remote_forward_confirms_received = 0;
+static int forward_confirms_pending = -1;
 
 /* mux.c */
 extern int muxserver_sock;
@@ -232,6 +231,34 @@ tilde_expand_paths(char **paths, u_int num_paths)
         }
 }
 
+#define DEFAULT_CLIENT_PERCENT_EXPAND_ARGS \
+    "C", conn_hash_hex, \
+    "L", shorthost, \
+    "i", uidstr, \
+    "l", thishost, \
+    "n", host_arg, \
+    "p", portstr
+
+/*
+ * Expands the set of percent_expand options used by the majority of keywords
+ * in the client that support percent expansion.
+ * Caller must free returned string.
+ */
+static char *
+default_client_percent_expand(const char *str, const char *homedir,
+    const char *remhost, const char *remuser, const char *locuser)
+{
+        return percent_expand(str,
+            /* values from statics above */
+            DEFAULT_CLIENT_PERCENT_EXPAND_ARGS,
+            /* values from arguments */
+            "d", homedir,
+            "h", remhost,
+            "r", remuser,
+            "u", locuser,
+            (char *)NULL);
+}
+
 /*
  * Attempt to resolve a host name / port to a set of addresses and
  * optionally return any CNAMEs encountered along the way.
@@ -248,6 +275,8 @@ resolve_host(const char *name, int port, int logerr, char *cname, size_t clen)
 
         if (port <= 0)
                 port = default_ssh_port();
+        if (cname != NULL)
+                *cname = '\0';
 
         snprintf(strport, sizeof strport, "%d", port);
         memset(&hints, 0, sizeof(hints));
@@ -477,7 +506,6 @@ resolve_canonicalize(char **hostp, int port)
         }
         /* Attempt each supplied suffix */
         for (i = 0; i < options.num_canonical_domains; i++) {
-                *newname = '\0';
                 xasprintf(&fullhost, "%s.%s.", *hostp,
                     options.canonical_domains[i]);
                 debug3("%s: attempting \"%s\" => \"%s\"", __func__,
@@ -600,8 +628,6 @@ main(int ac, char **av)
         extern char *optarg;
         struct Forward fwd;
         struct addrinfo *addrs = NULL;
-        struct ssh_digest_ctx *md;
-        u_char conn_hash[SSH_DIGEST_MAX_LENGTH];
         size_t n, len;
 
         /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
@@ -1210,6 +1236,14 @@ main(int ac, char **av)
         if (options.jump_host != NULL) {
                 char port_s[8];
                 const char *sshbin = argv0;
+                int port = options.port, jumpport = options.jump_port;
+
+                if (port <= 0)
+                        port = default_ssh_port();
+                if (jumpport <= 0)
+                        jumpport = default_ssh_port();
+                if (strcmp(options.jump_host, host) == 0 && port == jumpport)
+                        fatal("jumphost loop via %s", options.jump_host);
 
                 /*
                  * Try to use SSH indicated by argv[0], but fall back to
@@ -1323,15 +1357,8 @@ main(int ac, char **av)
         snprintf(uidstr, sizeof(uidstr), "%llu",
             (unsigned long long)pw->pw_uid);
 
-        if ((md = ssh_digest_start(SSH_DIGEST_SHA1)) == NULL ||
-            ssh_digest_update(md, thishost, strlen(thishost)) < 0 ||
-            ssh_digest_update(md, host, strlen(host)) < 0 ||
-            ssh_digest_update(md, portstr, strlen(portstr)) < 0 ||
-            ssh_digest_update(md, options.user, strlen(options.user)) < 0 ||
-            ssh_digest_final(md, conn_hash, sizeof(conn_hash)) < 0)
-                fatal("%s: mux digest failed", __func__);
-        ssh_digest_free(md);
-        conn_hash_hex = tohex(conn_hash, ssh_digest_bytes(SSH_DIGEST_SHA1));
+        conn_hash_hex = ssh_connection_hash(thishost, host, portstr,
+            options.user);
 
         /*
          * Expand tokens in arguments. NB. LocalCommand is expanded later,
@@ -1341,18 +1368,8 @@ main(int ac, char **av)
         if (options.remote_command != NULL) {
                 debug3("expanding RemoteCommand: %s", options.remote_command);
                 cp = options.remote_command;
-                options.remote_command = percent_expand(cp,
-                    "C", conn_hash_hex,
-                    "L", shorthost,
-                    "d", pw->pw_dir,
-                    "h", host,
-                    "i", uidstr,
-                    "l", thishost,
-                    "n", host_arg,
-                    "p", portstr,
-                    "r", options.user,
-                    "u", pw->pw_name,
-                    (char *)NULL);
+                options.remote_command = default_client_percent_expand(cp,
+                    pw->pw_dir, host, options.user, pw->pw_name);
                 debug3("expanded RemoteCommand: %s", options.remote_command);
                 free(cp);
                 if ((r = sshbuf_put(command, options.remote_command,
@@ -1363,21 +1380,76 @@ main(int ac, char **av)
         if (options.control_path != NULL) {
                 cp = tilde_expand_filename(options.control_path, getuid());
                 free(options.control_path);
-                options.control_path = percent_expand(cp,
-                    "C", conn_hash_hex,
-                    "L", shorthost,
-                    "h", host,
-                    "i", uidstr,
-                    "l", thishost,
-                    "n", host_arg,
-                    "p", portstr,
-                    "r", options.user,
-                    "u", pw->pw_name,
-                    "i", uidstr,
-                    (char *)NULL);
+                options.control_path = default_client_percent_expand(cp,
+                    pw->pw_dir, host, options.user, pw->pw_name);
                 free(cp);
         }
 
+        if (options.identity_agent != NULL) {
+                p = tilde_expand_filename(options.identity_agent, getuid());
+                cp = default_client_percent_expand(p,
+                    pw->pw_dir, host, options.user, pw->pw_name);
+                free(p);
+                free(options.identity_agent);
+                options.identity_agent = cp;
+        }
+
+        if (options.forward_agent_sock_path != NULL) {
+                p = tilde_expand_filename(options.forward_agent_sock_path,
+                    getuid());
+                cp = default_client_percent_expand(p,
+                    pw->pw_dir, host, options.user, pw->pw_name);
+                free(p);
+                free(options.forward_agent_sock_path);
+                options.forward_agent_sock_path = cp;
+        }
+
+        for (i = 0; i < options.num_local_forwards; i++) {
+                if (options.local_forwards[i].listen_path != NULL) {
+                        cp = options.local_forwards[i].listen_path;
+                        p = options.local_forwards[i].listen_path =
+                            default_client_percent_expand(cp,
+                            pw->pw_dir, host, options.user, pw->pw_name);
+                        if (strcmp(cp, p) != 0)
+                                debug3("expanded LocalForward listen path "
+                                    "'%s' -> '%s'", cp, p);
+                        free(cp);
+                }
+                if (options.local_forwards[i].connect_path != NULL) {
+                        cp = options.local_forwards[i].connect_path;
+                        p = options.local_forwards[i].connect_path =
+                            default_client_percent_expand(cp,
+                            pw->pw_dir, host, options.user, pw->pw_name);
+                        if (strcmp(cp, p) != 0)
+                                debug3("expanded LocalForward connect path "
+                                    "'%s' -> '%s'", cp, p);
+                        free(cp);
+                }
+        }
+
+        for (i = 0; i < options.num_remote_forwards; i++) {
+                if (options.remote_forwards[i].listen_path != NULL) {
+                        cp = options.remote_forwards[i].listen_path;
+                        p = options.remote_forwards[i].listen_path =
+                            default_client_percent_expand(cp,
+                            pw->pw_dir, host, options.user, pw->pw_name);
+                        if (strcmp(cp, p) != 0)
+                                debug3("expanded RemoteForward listen path "
+                                    "'%s' -> '%s'", cp, p);
+                        free(cp);
+                }
+                if (options.remote_forwards[i].connect_path != NULL) {
+                        cp = options.remote_forwards[i].connect_path;
+                        p = options.remote_forwards[i].connect_path =
+                            default_client_percent_expand(cp,
+                            pw->pw_dir, host, options.user, pw->pw_name);
+                        if (strcmp(cp, p) != 0)
+                                debug3("expanded RemoteForward connect path "
+                                    "'%s' -> '%s'", cp, p);
+                        free(cp);
+                }
+        }
+
         if (config_test) {
                 dump_client_config(&options, host);
                 exit(0);
@@ -1502,23 +1574,7 @@ main(int ac, char **av)
                 if (strcmp(options.identity_agent, "none") == 0) {
                         unsetenv(SSH_AUTHSOCKET_ENV_NAME);
                 } else {
-                        p = tilde_expand_filename(options.identity_agent,
-                            getuid());
-                        cp = percent_expand(p,
-                            "d", pw->pw_dir,
-                            "h", host,
-                            "i", uidstr,
-                            "l", thishost,
-                            "r", options.user,
-                            "u", pw->pw_name,
-                            (char *)NULL);
-                        free(p);
-                        /*
-                         * If identity_agent represents an environment variable
-                         * then recheck that it is valid (since processing with
-                         * percent_expand() may have changed it) and substitute
-                         * its value.
-                         */
+                        cp = options.identity_agent;
                         if (cp[0] == '$') {
                                 if (!valid_env_name(cp + 1)) {
                                         fatal("Invalid IdentityAgent "
@@ -1532,22 +1588,11 @@ main(int ac, char **av)
                                 /* identity_agent specifies a path directly */
                                 setenv(SSH_AUTHSOCKET_ENV_NAME, cp, 1);
                         }
-                        free(cp);
                 }
         }
 
-        if (options.forward_agent && (options.forward_agent_sock_path != NULL)) {
-                p = tilde_expand_filename(options.forward_agent_sock_path, getuid());
-                cp = percent_expand(p,
-                    "d", pw->pw_dir,
-                    "h", host,
-                    "i", uidstr,
-                    "l", thishost,
-                    "r", options.user,
-                    "u", pw->pw_name,
-                    (char *)NULL);
-                free(p);
-
+        if (options.forward_agent && options.forward_agent_sock_path != NULL) {
+                cp = options.forward_agent_sock_path;
                 if (cp[0] == '$') {
                         if (!valid_env_name(cp + 1)) {
                                 fatal("Invalid ForwardAgent environment variable name %s", cp);
@@ -1678,6 +1723,21 @@ fork_postauth(void)
                 fatal("daemon() failed: %.200s", strerror(errno));
 }
 
+static void
+forwarding_success(void)
+{
+        if (forward_confirms_pending == -1)
+                return;
+        if (--forward_confirms_pending == 0) {
+                debug("%s: all expected forwarding replies received", __func__);
+                if (fork_after_authentication_flag)
+                        fork_postauth();
+        } else {
+                debug2("%s: %d expected forwarding replies remaining",
+                    __func__, forward_confirms_pending);
+        }
+}
+
 /* Callback for remote forward global requests */
 static void
 ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
@@ -1737,11 +1797,7 @@ ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
                                     "for listen port %d", rfwd->listen_port);
                 }
         }
-        if (++remote_forward_confirms_received == options.num_remote_forwards) {
-                debug("All remote forwarding requests processed");
-                if (fork_after_authentication_flag)
-                        fork_postauth();
-        }
+        forwarding_success();
 }
 
 static void
@@ -1759,6 +1815,19 @@ ssh_stdio_confirm(struct ssh *ssh, int id, int success, void *arg)
 }
 
 static void
+ssh_tun_confirm(struct ssh *ssh, int id, int success, void *arg)
+{
+        if (!success) {
+                error("Tunnel forwarding failed");
+                if (options.exit_on_forward_failure)
+                        cleanup_exit(255);
+        }
+
+        debug("%s: tunnel forward established, id=%d", __func__, id);
+        forwarding_success();
+}
+
+static void
 ssh_init_stdio_forwarding(struct ssh *ssh)
 {
         Channel *c;
@@ -1786,6 +1855,8 @@ ssh_init_forwarding(struct ssh *ssh, char **ifname)
         int success = 0;
         int i;
 
+        if (options.exit_on_forward_failure)
+                forward_confirms_pending = 0; /* track pending requests */
         /* Initiate local TCP/IP port forwardings. */
         for (i = 0; i < options.num_local_forwards; i++) {
                 debug("Local connections to %.200s:%d forwarded to remote "
@@ -1821,32 +1892,33 @@ ssh_init_forwarding(struct ssh *ssh, char **ifname)
                     options.remote_forwards[i].connect_path :
                     options.remote_forwards[i].connect_host,
                     options.remote_forwards[i].connect_port);
-                options.remote_forwards[i].handle =
+                if ((options.remote_forwards[i].handle =
                     channel_request_remote_forwarding(ssh,
-                    &options.remote_forwards[i]);
-                if (options.remote_forwards[i].handle < 0) {
-                        if (options.exit_on_forward_failure)
-                                fatal("Could not request remote forwarding.");
-                        else
-                                logit("Warning: Could not request remote "
-                                    "forwarding.");
-                } else {
+                    &options.remote_forwards[i])) >= 0) {
                         client_register_global_confirm(
                             ssh_confirm_remote_forward,
                             &options.remote_forwards[i]);
-                }
+                        forward_confirms_pending++;
+                } else if (options.exit_on_forward_failure)
+                        fatal("Could not request remote forwarding.");
+                else
+                        logit("Warning: Could not request remote forwarding.");
         }
 
         /* Initiate tunnel forwarding. */
         if (options.tun_open != SSH_TUNMODE_NO) {
                 if ((*ifname = client_request_tun_fwd(ssh,
                     options.tun_open, options.tun_local,
-                    options.tun_remote)) == NULL) {
-                        if (options.exit_on_forward_failure)
-                                fatal("Could not request tunnel forwarding.");
-                        else
-                                error("Could not request tunnel forwarding.");
-                }
+                    options.tun_remote, ssh_tun_confirm, NULL)) != NULL)
+                        forward_confirms_pending++;
+                else if (options.exit_on_forward_failure)
+                        fatal("Could not request tunnel forwarding.");
+                else
+                        error("Could not request tunnel forwarding.");
+        }
+        if (forward_confirms_pending > 0) {
+                debug("%s: expecting replies for %d forwards", __func__,
+                    forward_confirms_pending);
         }
 }
 
@@ -1972,14 +2044,9 @@ ssh_session2(struct ssh *ssh, struct passwd *pw)
                 debug3("expanding LocalCommand: %s", options.local_command);
                 cp = options.local_command;
                 options.local_command = percent_expand(cp,
-                    "C", conn_hash_hex,
-                    "L", shorthost,
+                    DEFAULT_CLIENT_PERCENT_EXPAND_ARGS,
                     "d", pw->pw_dir,
                     "h", host,
-                    "i", uidstr,
-                    "l", thishost,
-                    "n", host_arg,
-                    "p", portstr,
                     "r", options.user,
                     "u", pw->pw_name,
                     "T", tun_fwd_ifname == NULL ? "NONE" : tun_fwd_ifname,
@@ -2136,9 +2203,8 @@ load_public_identity_files(struct passwd *pw)
                         continue;
                 }
                 cp = tilde_expand_filename(options.identity_files[i], getuid());
-                filename = percent_expand(cp, "d", pw->pw_dir,
-                    "u", pw->pw_name, "l", thishost, "h", host,
-                    "r", options.user, (char *)NULL);
+                filename = default_client_percent_expand(cp,
+                    pw->pw_dir, host, options.user, pw->pw_name);
                 free(cp);
                 check_load(sshkey_load_public(filename, &public, NULL),
                     filename, "pubkey");
@@ -2187,14 +2253,8 @@ load_public_identity_files(struct passwd *pw)
         for (i = 0; i < options.num_certificate_files; i++) {
                 cp = tilde_expand_filename(options.certificate_files[i],
                     getuid());
-                filename = percent_expand(cp,
-                    "d", pw->pw_dir,
-                    "h", host,
-                    "i", uidstr,
-                    "l", thishost,
-                    "r", options.user,
-                    "u", pw->pw_name,
-                    (char *)NULL);
+                filename = default_client_percent_expand(cp,
+                    pw->pw_dir, host, options.user, pw->pw_name);
                 free(cp);
 
                 check_load(sshkey_load_public(filename, &public, NULL),