#include "config.h"

#include <stdbool.h>

#include <errno.h>

#include <ctype.h>

#include <fcntl.h>

#include <stdio.h>

#include <stdint.h>

#include <sys/types.h>

#include <sys/stat.h>

#include <limits.h>

#ifndef _WIN32

#include <netinet/in.h>

#include <arpa/inet.h>

#include "libssh/priv.h"

#include "libssh/ssh2.h"

#include "libssh/sftp.h"

#include "libssh/sftp_priv.h"

#include "libssh/buffer.h"

#include "libssh/channels.h"

#include "libssh/session.h"

#include "libssh/misc.h"

#include "libssh/bytearray.h"

#ifdef WITH_SFTP

#define SFTP_PACKET_SIZE_MAX 0x10000000

#define SFTP_BUFFER_SIZE_MAX 16384

struct sftp_ext_struct {

};

static int sftp_enqueue(sftp_session session, sftp_message msg);

static void sftp_message_free(sftp_message msg);

static void sftp_set_error(sftp_session sftp, int errnum);

static void status_msg_free(sftp_status_message status);

static sftp_ext sftp_ext_new(void) {

sftp_ext ext;

ext = calloc(1, sizeof(struct sftp_ext_struct));

if (ext == NULL) {

return NULL;

}

return ext;

}

static void sftp_ext_free(sftp_ext ext)

{

size_t i;

if (ext == NULL) {

return;

}

if (ext->count > 0) {

if (ext->name != NULL) {

for (i = 0; i < ext->count; i++) {

SAFE_FREE(ext->name[i]);

}

SAFE_FREE(ext->name);

}

if (ext->data != NULL) {

for (i = 0; i < ext->count; i++) {

SAFE_FREE(ext->data[i]);

}

SAFE_FREE(ext->data);

}

}

SAFE_FREE(ext);

}

sftp_session sftp_new(ssh_session session)

{

sftp_session sftp;

if (session == NULL) {

return NULL;

}

sftp = calloc(1, sizeof(struct sftp_session_struct));

if (sftp == NULL) {

ssh_set_error_oom(session);

return NULL;

}

sftp->ext = sftp_ext_new();

if (sftp->ext == NULL) {

ssh_set_error_oom(session);

goto error;

}

sftp->read_packet = calloc(1, sizeof(struct sftp_packet_struct));

if (sftp->read_packet == NULL) {

ssh_set_error_oom(session);

goto error;

}

sftp->read_packet->payload = ssh_buffer_new();

if (sftp->read_packet->payload == NULL) {

ssh_set_error_oom(session);

goto error;

}

sftp->session = session;

sftp->channel = ssh_channel_new(session);

if (sftp->channel == NULL) {

ssh_set_error_oom(session);

goto error;

}

if (ssh_channel_open_session(sftp->channel)) {

goto error;

}

if (ssh_channel_request_sftp(sftp->channel)) {

goto error;

}

return sftp;

error:

if (sftp->ext != NULL) {

sftp_ext_free(sftp->ext);

}

if (sftp->channel != NULL) {

ssh_channel_free(sftp->channel);

}

if (sftp->read_packet != NULL) {

if (sftp->read_packet->payload != NULL) {

SSH_BUFFER_FREE(sftp->read_packet->payload);

}

SAFE_FREE(sftp->read_packet);

}

SAFE_FREE(sftp);

return NULL;

}

sftp_session sftp_new_channel(ssh_session session, ssh_channel channel){

sftp_session sftp;

if (session == NULL) {

return NULL;

}

sftp = calloc(1, sizeof(struct sftp_session_struct));

if (sftp == NULL) {

ssh_set_error_oom(session);

return NULL;

}

sftp->ext = sftp_ext_new();

if (sftp->ext == NULL) {

ssh_set_error_oom(session);

SAFE_FREE(sftp);

return NULL;

}

sftp->session = session;

sftp->channel = channel;

return sftp;

}

#ifdef WITH_SERVER

sftp_session sftp_server_new(ssh_session session, ssh_channel chan){

sftp_session sftp = NULL;

sftp = calloc(1, sizeof(struct sftp_session_struct));

if (sftp == NULL) {

ssh_set_error_oom(session);

return NULL;

}

sftp->read_packet = calloc(1, sizeof(struct sftp_packet_struct));

if (sftp->read_packet == NULL) {

goto error;

}

sftp->read_packet->payload = ssh_buffer_new();

if (sftp->read_packet->payload == NULL) {

goto error;

}

sftp->session = session;

sftp->channel = chan;

return sftp;

error:

ssh_set_error_oom(session);

if (sftp->read_packet != NULL) {

if (sftp->read_packet->payload != NULL) {

SSH_BUFFER_FREE(sftp->read_packet->payload);

}

SAFE_FREE(sftp->read_packet);

}

SAFE_FREE(sftp);

return NULL;

}

int sftp_server_init(sftp_session sftp){

ssh_session session = sftp->session;

sftp_packet packet = NULL;

ssh_buffer reply = NULL;

uint32_t version;

int rc;

packet = sftp_packet_read(sftp);

if (packet == NULL) {

return -1;

}

if (packet->type != SSH_FXP_INIT) {

ssh_set_error(session, SSH_FATAL,

"Packet read of type %d instead of SSH_FXP_INIT",

packet->type);

return -1;

}

SSH_LOG(SSH_LOG_PACKET, "Received SSH_FXP_INIT");

ssh_buffer_get_u32(packet->payload, &version);

version = ntohl(version);

SSH_LOG(SSH_LOG_PACKET, "Client version: %d", version);

sftp->client_version = (int)version;

reply = ssh_buffer_new();

if (reply == NULL) {

ssh_set_error_oom(session);

return -1;

}

rc = ssh_buffer_pack(reply, "dssss",

LIBSFTP_VERSION,

"posix-rename@openssh.com",

"1",

"hardlink@openssh.com",

"1");

if (rc != SSH_OK) {

ssh_set_error_oom(session);

SSH_BUFFER_FREE(reply);

return -1;

}

if (sftp_packet_write(sftp, SSH_FXP_VERSION, reply) < 0) {

SSH_BUFFER_FREE(reply);

return -1;

}

SSH_BUFFER_FREE(reply);

SSH_LOG(SSH_LOG_PROTOCOL, "Server version sent");

if (version > LIBSFTP_VERSION) {

sftp->version = LIBSFTP_VERSION;

} else {

sftp->version = (int)version;

}

return 0;

}

void sftp_server_free(sftp_session sftp)

{

sftp_request_queue ptr;

if (sftp == NULL) {

return;

}

ptr = sftp->queue;

while(ptr) {

sftp_request_queue old;

sftp_message_free(ptr->message);

old = ptr->next;

SAFE_FREE(ptr);

ptr = old;

}

SAFE_FREE(sftp->handles);

SSH_BUFFER_FREE(sftp->read_packet->payload);

SAFE_FREE(sftp->read_packet);

sftp_ext_free(sftp->ext);

SAFE_FREE(sftp);

}

#endif /* WITH_SERVER */

void sftp_free(sftp_session sftp)

{

sftp_request_queue ptr;

if (sftp == NULL) {

return;

}

if (sftp->channel != NULL) {

ssh_channel_send_eof(sftp->channel);

ptr = sftp->queue;

while(ptr) {

sftp_request_queue old;

sftp_message_free(ptr->message);

old = ptr->next;

SAFE_FREE(ptr);

ptr = old;

}

ssh_channel_free(sftp->channel);

sftp->channel = NULL;

}

SAFE_FREE(sftp->handles);

SSH_BUFFER_FREE(sftp->read_packet->payload);

SAFE_FREE(sftp->read_packet);

sftp_ext_free(sftp->ext);

SAFE_FREE(sftp);

}

ssize_t sftp_packet_write(sftp_session sftp, uint8_t type, ssh_buffer payload)

{

uint8_t header[5] = {0};

uint32_t payload_size;

ssize_t size;

int rc;

/* Add size of type */

payload_size = ssh_buffer_get_len(payload) + sizeof(uint8_t);

PUSH_BE_U32(header, 0, payload_size);

PUSH_BE_U8(header, 4, type);

rc = ssh_buffer_prepend_data(payload, header, sizeof(header));

if (rc < 0) {

ssh_set_error_oom(sftp->session);

sftp_set_error(sftp, SSH_FX_FAILURE);

return -1;

}

size = ssh_channel_write(sftp->channel,

ssh_buffer_get(payload),

ssh_buffer_get_len(payload));

if (size < 0) {

sftp_set_error(sftp, SSH_FX_FAILURE);

return -1;

}

if ((uint32_t)size != ssh_buffer_get_len(payload)) {

SSH_LOG(SSH_LOG_PACKET,

"Had to write %d bytes, wrote only %zd",

ssh_buffer_get_len(payload),

size);

}

return size;

}

sftp_packet sftp_packet_read(sftp_session sftp)

{

uint8_t buffer[SFTP_BUFFER_SIZE_MAX];

sftp_packet packet = sftp->read_packet;

uint32_t size;

int nread;

bool is_eof;

int rc;

packet->sftp = sftp;

/*

if (packet->payload != NULL) {

rc = ssh_buffer_reinit(packet->payload);

if (rc != 0) {

ssh_set_error_oom(sftp->session);

sftp_set_error(sftp, SSH_FX_FAILURE);

return NULL;

}

} else {

packet->payload = ssh_buffer_new();

if (packet->payload == NULL) {

ssh_set_error_oom(sftp->session);

sftp_set_error(sftp, SSH_FX_FAILURE);

return NULL;

}

}

nread = 0;

do {

int s;

// read from channel until 4 bytes have been read or an error occurs

s = ssh_channel_read(sftp->channel, buffer + nread, 4 - nread, 0);

if (s < 0) {

goto error;

} else if (s == 0) {

is_eof = ssh_channel_is_eof(sftp->channel);

if (is_eof) {

ssh_set_error(sftp->session,

SSH_FATAL,

"Received EOF while reading sftp packet size");

sftp_set_error(sftp, SSH_FX_EOF);

goto error;

}

} else {

nread += s;

}

} while (nread < 4);

size = PULL_BE_U32(buffer, 0);

if (size == 0 || size > SFTP_PACKET_SIZE_MAX) {

ssh_set_error(sftp->session, SSH_FATAL, "Invalid sftp packet size!");

sftp_set_error(sftp, SSH_FX_FAILURE);

goto error;

}

do {

nread = ssh_channel_read(sftp->channel, buffer, 1, 0);

if (nread < 0) {

goto error;

} else if (nread == 0) {

is_eof = ssh_channel_is_eof(sftp->channel);

if (is_eof) {

ssh_set_error(sftp->session,

SSH_FATAL,

"Received EOF while reading sftp packet type");

sftp_set_error(sftp, SSH_FX_EOF);

goto error;

}

}

} while (nread < 1);

packet->type = buffer[0];

/* Remove the packet type size */

size -= sizeof(uint8_t);

nread = ssh_buffer_allocate_size(packet->payload, size);

if (nread < 0) {

ssh_set_error_oom(sftp->session);

sftp_set_error(sftp, SSH_FX_FAILURE);

goto error;

}

while (size > 0 && size < SFTP_PACKET_SIZE_MAX) {

nread = ssh_channel_read(sftp->channel,

buffer,

sizeof(buffer) > size ? size : sizeof(buffer),

0);

if (nread < 0) {

/* TODO: check if there are cases where an error needs to be set here */

goto error;

}

if (nread > 0) {

rc = ssh_buffer_add_data(packet->payload, buffer, nread);

if (rc != 0) {

ssh_set_error_oom(sftp->session);

sftp_set_error(sftp, SSH_FX_FAILURE);

goto error;

}

} else { /* nread == 0 */

/* Retry the reading unless the remote was closed */

is_eof = ssh_channel_is_eof(sftp->channel);

if (is_eof) {

ssh_set_error(sftp->session,

SSH_REQUEST_DENIED,

"Received EOF while reading sftp packet");

sftp_set_error(sftp, SSH_FX_EOF);

goto error;

}

}

size -= nread;

}

return packet;

error:

ssh_buffer_reinit(packet->payload);

return NULL;

}

static void sftp_set_error(sftp_session sftp, int errnum) {

if (sftp != NULL) {

sftp->errnum = errnum;

}

}

int sftp_get_error(sftp_session sftp) {

if (sftp == NULL) {

return -1;

}

return sftp->errnum;

}

static void sftp_message_free(sftp_message msg)

{

if (msg == NULL) {

return;

}

SSH_BUFFER_FREE(msg->payload);

SAFE_FREE(msg);

}

static sftp_message sftp_get_message(sftp_packet packet)

{

sftp_session sftp = packet->sftp;

sftp_message msg = NULL;

int rc;

switch(packet->type) {

case SSH_FXP_STATUS:

case SSH_FXP_HANDLE:

case SSH_FXP_DATA:

case SSH_FXP_ATTRS:

case SSH_FXP_NAME:

case SSH_FXP_EXTENDED_REPLY:

break;

default:

ssh_set_error(packet->sftp->session,

SSH_FATAL,

"Unknown packet type %d",

packet->type);

sftp_set_error(packet->sftp, SSH_FX_FAILURE);

return NULL;

}

msg = calloc(1, sizeof(struct sftp_message_struct));

if (msg == NULL) {

ssh_set_error_oom(sftp->session);

sftp_set_error(packet->sftp, SSH_FX_FAILURE);

return NULL;

}

msg->sftp = packet->sftp;

msg->packet_type = packet->type;

/* Move the payload from the packet to the message */

msg->payload = packet->payload;

packet->payload = NULL;

rc = ssh_buffer_unpack(msg->payload, "d", &msg->id);

if (rc != SSH_OK) {

ssh_set_error(packet->sftp->session, SSH_FATAL,

"Invalid packet %d: no ID", packet->type);

sftp_message_free(msg);

sftp_set_error(packet->sftp, SSH_FX_FAILURE);

return NULL;

}

SSH_LOG(SSH_LOG_PACKET,

"Packet with id %d type %d",

msg->id,

msg->packet_type);

return msg;

}

static int sftp_read_and_dispatch(sftp_session sftp)

{

sftp_packet packet = NULL;

sftp_message msg = NULL;

packet = sftp_packet_read(sftp);

if (packet == NULL) {

/* something nasty happened reading the packet */

return -1;

}

msg = sftp_get_message(packet);

if (msg == NULL) {

return -1;

}

if (sftp_enqueue(sftp, msg) < 0) {

sftp_message_free(msg);

return -1;

}

return 0;

}

void sftp_packet_free(sftp_packet packet)

{

if (packet == NULL) {

return;

}

SSH_BUFFER_FREE(packet->payload);

free(packet);

}

int sftp_init(sftp_session sftp) {

sftp_packet packet = NULL;

ssh_buffer buffer = NULL;

char *ext_name = NULL;

char *ext_data = NULL;

uint32_t version;

int rc;

buffer = ssh_buffer_new();

if (buffer == NULL) {

ssh_set_error_oom(sftp->session);

sftp_set_error(sftp, SSH_FX_FAILURE);

return -1;

}

rc = ssh_buffer_pack(buffer, "d", LIBSFTP_VERSION);

if (rc != SSH_OK) {

ssh_set_error_oom(sftp->session);

SSH_BUFFER_FREE(buffer);

sftp_set_error(sftp, SSH_FX_FAILURE);

return -1;

}

if (sftp_packet_write(sftp, SSH_FXP_INIT, buffer) < 0) {

SSH_BUFFER_FREE(buffer);

return -1;

}

SSH_BUFFER_FREE(buffer);

packet = sftp_packet_read(sftp);

if (packet == NULL) {

return -1;

}

if (packet->type != SSH_FXP_VERSION) {

ssh_set_error(sftp->session, SSH_FATAL,

"Received a %d messages instead of SSH_FXP_VERSION", packet->type);

return -1;

}

/* TODO: are we sure there are 4 bytes ready? */

rc = ssh_buffer_unpack(packet->payload, "d", &version);

if (rc != SSH_OK){

sftp_set_error(sftp, SSH_FX_FAILURE);

return -1;

}

SSH_LOG(SSH_LOG_PROTOCOL,

"SFTP server version %d",

version);

rc = ssh_buffer_unpack(packet->payload, "s", &ext_name);

while (rc == SSH_OK) {

uint32_t count = sftp->ext->count;

char **tmp;

rc = ssh_buffer_unpack(packet->payload, "s", &ext_data);

if (rc == SSH_ERROR) {

break;

}

SSH_LOG(SSH_LOG_PROTOCOL,

"SFTP server extension: %s, version: %s",

ext_name, ext_data);

count++;

tmp = realloc(sftp->ext->name, count * sizeof(char *));

if (tmp == NULL) {

ssh_set_error_oom(sftp->session);

SAFE_FREE(ext_name);

SAFE_FREE(ext_data);

sftp_set_error(sftp, SSH_FX_FAILURE);

return -1;

}

tmp[count - 1] = ext_name;

sftp->ext->name = tmp;

tmp = realloc(sftp->ext->data, count * sizeof(char *));

if (tmp == NULL) {

ssh_set_error_oom(sftp->session);

SAFE_FREE(ext_name);

SAFE_FREE(ext_data);

sftp_set_error(sftp, SSH_FX_FAILURE);

return -1;

}

tmp[count - 1] = ext_data;

sftp->ext->data = tmp;

sftp->ext->count = count;

rc = ssh_buffer_unpack(packet->payload, "s", &ext_name);

}

sftp->version = sftp->server_version = (int)version;

return 0;

}

unsigned int sftp_extensions_get_count(sftp_session sftp) {

if (sftp == NULL || sftp->ext == NULL) {

return 0;

}

return sftp->ext->count;

}

const char *sftp_extensions_get_name(sftp_session sftp, unsigned int idx) {

if (sftp == NULL)

return NULL;

if (sftp->ext == NULL || sftp->ext->name == NULL) {

ssh_set_error_invalid(sftp->session);

return NULL;

}

if (idx > sftp->ext->count) {

ssh_set_error_invalid(sftp->session);

return NULL;

}

return sftp->ext->name[idx];

}

const char *sftp_extensions_get_data(sftp_session sftp, unsigned int idx) {

if (sftp == NULL)

return NULL;

if (sftp->ext == NULL || sftp->ext->name == NULL) {

ssh_set_error_invalid(sftp->session);

return NULL;

}

if (idx > sftp->ext->count) {

ssh_set_error_invalid(sftp->session);

return NULL;

}

return sftp->ext->data[idx];

}

int sftp_extension_supported(sftp_session sftp, const char *name,

const char *data) {

size_t i, n;

if (sftp == NULL || name == NULL || data == NULL) {

return 0;

}

n = sftp_extensions_get_count(sftp);

for (i = 0; i < n; i++) {

const char *ext_name = sftp_extensions_get_name(sftp, i);

const char *ext_data = sftp_extensions_get_data(sftp, i);

if (ext_name != NULL && ext_data != NULL &&

strcmp(ext_name, name) == 0 &&

strcmp(ext_data, data) == 0) {

return 1;

}

}

return 0;

}

static sftp_request_queue request_queue_new(sftp_message msg) {

sftp_request_queue queue = NULL;

queue = calloc(1, sizeof(struct sftp_request_queue_struct));

if (queue == NULL) {

ssh_set_error_oom(msg->sftp->session);

sftp_set_error(msg->sftp, SSH_FX_FAILURE);

return NULL;

}

queue->message = msg;

return queue;

}

static void request_queue_free(sftp_request_queue queue) {

if (queue == NULL) {

return;

}

ZERO_STRUCTP(queue);

SAFE_FREE(queue);

}

static int sftp_enqueue(sftp_session sftp, sftp_message msg) {

sftp_request_queue queue = NULL;

sftp_request_queue ptr;

queue = request_queue_new(msg);

if (queue == NULL) {

return -1;

}

SSH_LOG(SSH_LOG_PACKET,

"Queued msg id %d type %d",

msg->id, msg->packet_type);

if(sftp->queue == NULL) {

sftp->queue = queue;

} else {

ptr = sftp->queue;

while(ptr->next) {

ptr=ptr->next; /* find end of linked list */

}

ptr->next = queue; /* add it on bottom */

}

return 0;

}

static sftp_message sftp_dequeue(sftp_session sftp, uint32_t id){

sftp_request_queue prev = NULL;

sftp_request_queue queue;

sftp_message msg;

if(sftp->queue == NULL) {

return NULL;

}

queue = sftp->queue;

while (queue) {

if(queue->message->id == id) {

/* remove from queue */

if (prev == NULL) {

sftp->queue = queue->next;

} else {

prev->next = queue->next;

}

msg = queue->message;

request_queue_free(queue);

SSH_LOG(SSH_LOG_PACKET,

"Dequeued msg id %d type %d",

msg->id,

msg->packet_type);

return msg;

}

prev = queue;

queue = queue->next;

}

return NULL;

}

static inline uint32_t sftp_get_new_id(sftp_session session) {

return ++session->id_counter;

}

static sftp_status_message parse_status_msg(sftp_message msg){

sftp_status_message status;

int rc;

if (msg->packet_type != SSH_FXP_STATUS) {

ssh_set_error(msg->sftp->session, SSH_FATAL,

"Not a ssh_fxp_status message passed in!");

sftp_set_error(msg->sftp, SSH_FX_BAD_MESSAGE);

return NULL;

}

status = calloc(1, sizeof(struct sftp_status_message_struct));

if (status == NULL) {

ssh_set_error_oom(msg->sftp->session);

sftp_set_error(msg->sftp, SSH_FX_FAILURE);

return NULL;

}

status->id = msg->id;

rc = ssh_buffer_unpack(msg->payload, "d",

&status->status);

if (rc != SSH_OK){

SAFE_FREE(status);

ssh_set_error(msg->sftp->session, SSH_FATAL,

"Invalid SSH_FXP_STATUS message");

sftp_set_error(msg->sftp, SSH_FX_FAILURE);

return NULL;

}

rc = ssh_buffer_unpack(msg->payload, "ss",

&status->errormsg,

&status->langmsg);

if(rc != SSH_OK && msg->sftp->version >=3){

/* These are mandatory from version 3 */

SAFE_FREE(status);

ssh_set_error(msg->sftp->session, SSH_FATAL,

"Invalid SSH_FXP_STATUS message");

sftp_set_error(msg->sftp, SSH_FX_FAILURE);

return NULL;

}

if (status->errormsg == NULL)

status->errormsg = strdup("No error message in packet");

if (status->langmsg == NULL)

status->langmsg = strdup("");

if (status->errormsg == NULL || status->langmsg == NULL) {

ssh_set_error_oom(msg->sftp->session);

sftp_set_error(msg->sftp, SSH_FX_FAILURE);

status_msg_free(status);

return NULL;

}

return status;

}

static void status_msg_free(sftp_status_message status){

if (status == NULL) {

return;

}

SAFE_FREE(status->errormsg);

SAFE_FREE(status->langmsg);

SAFE_FREE(status);

}

static sftp_file parse_handle_msg(sftp_message msg){

sftp_file file;

if(msg->packet_type != SSH_FXP_HANDLE) {

ssh_set_error(msg->sftp->session, SSH_FATAL,

"Not a ssh_fxp_handle message passed in!");

return NULL;

}

file = calloc(1, sizeof(struct sftp_file_struct));

if (file == NULL) {

ssh_set_error_oom(msg->sftp->session);

sftp_set_error(msg->sftp, SSH_FX_FAILURE);

return NULL;

}

file->handle = ssh_buffer_get_ssh_string(msg->payload);

if (file->handle == NULL) {

ssh_set_error(msg->sftp->session, SSH_FATAL,

"Invalid SSH_FXP_HANDLE message");

SAFE_FREE(file);

sftp_set_error(msg->sftp, SSH_FX_FAILURE);

return NULL;

}

file->sftp = msg->sftp;

file->offset = 0;

file->eof = 0;

return file;

}

sftp_dir sftp_opendir(sftp_session sftp, const char *path)

{

sftp_message msg = NULL;

sftp_file file = NULL;

sftp_dir dir = NULL;

sftp_status_message status;

ssh_buffer payload;

uint32_t id;

int rc;

if (sftp == NULL) {