common-channel.c

/*
 * Dropbear SSH
 *
 * Copyright (c) 2002-2004 Matt Johnston
 * All rights reserved.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE. */

/* Handle the multiplexed channels, such as sessions, x11, agent connections */

#include "includes.h"
#include "session.h"
#include "packet.h"
#include "ssh.h"
#include "buffer.h"
#include "circbuffer.h"
#include "dbutil.h"
#include "channel.h"
#include "ssh.h"
#include "listener.h"
#include "runopts.h"
#include "netio.h"

static void send_msg_channel_open_failure(unsigned int remotechan, int reason,
                                          const char *text, const char *lang);
static void send_msg_channel_open_confirmation(struct Channel *channel,
                                               unsigned int recvwindow,
                                               unsigned int recvmaxpacket);
static int writechannel(struct Channel *channel, int fd, circbuffer *cbuf,
                        const unsigned char *moredata, unsigned int *morelen);
static void send_msg_channel_window_adjust(struct Channel *channel,
                                           unsigned int incr);
static void send_msg_channel_data(struct Channel *channel, int isextended);
static void send_msg_channel_eof(struct Channel *channel);
static void send_msg_channel_close(struct Channel *channel);
static void remove_channel(struct Channel *channel);
static unsigned int write_pending(struct Channel *channel);
static void check_close(struct Channel *channel);
static void close_chan_fd(struct Channel *channel, int fd, int how);

#define FD_UNINIT (-2)
#define FD_CLOSED (-1)

#define ERRFD_IS_READ(channel) ((channel)->extrabuf == NULL)
#define ERRFD_IS_WRITE(channel) (!ERRFD_IS_READ(channel))

/* allow space for:
 * 1 byte  byte      SSH_MSG_CHANNEL_DATA
 * 4 bytes uint32    recipient channel
 * 4 bytes string    data
 */
#define RECV_MAX_CHANNEL_DATA_LEN (RECV_MAX_PAYLOAD_LEN - (1 + 4 + 4))

/* Initialise all the channels */
void chaninitialise(const struct ChanType *chantypes[]) {
  /* may as well create space for a single channel */
  ses.channels = (struct Channel **)m_malloc(sizeof(struct Channel *));
  ses.chansize = 1;
  ses.channels[0] = NULL;
  ses.chancount = 0;

  ses.chantypes = chantypes;

#ifdef USING_LISTENERS
  listeners_initialise();
#endif
}

/* Clean up channels, freeing allocated memory */
void chancleanup() {
  unsigned int i;

  TRACE(("enter chancleanup"))
  for (i = 0; i < ses.chansize; i++) {
    if (ses.channels[i] != NULL) {
      TRACE(("channel %d closing", i))
      remove_channel(ses.channels[i]);
    }
  }
  m_free(ses.channels);
  TRACE(("leave chancleanup"))
}

/* Create a new channel entry, send a reply confirm or failure */
/* If remotechan, transwindow and transmaxpacket are not know (for a new
 * outgoing connection, with them to be filled on confirmation), they should
 * all be set to 0 */
static struct Channel *newchannel(unsigned int remotechan,
                                  const struct ChanType *type,
                                  unsigned int transwindow,
                                  unsigned int transmaxpacket) {
  struct Channel *newchan;
  unsigned int i, j;

  TRACE(("enter newchannel"))

  /* first see if we can use existing channels */
  for (i = 0; i < ses.chansize; i++) {
    if (ses.channels[i] == NULL) {
      break;
    }
  }

  /* otherwise extend the list */
  if (i == ses.chansize) {
    if (ses.chansize >= MAX_CHANNELS) {
      TRACE(("leave newchannel: max chans reached"))
      return NULL;
    }

    /* extend the channels */
    ses.channels = (struct Channel **)m_realloc(
        ses.channels,
        (ses.chansize + CHAN_EXTEND_SIZE) * sizeof(struct Channel *));

    ses.chansize += CHAN_EXTEND_SIZE;

    /* set the new channels to null */
    for (j = i; j < ses.chansize; j++) {
      ses.channels[j] = NULL;
    }
  }

  newchan = (struct Channel *)m_malloc(sizeof(struct Channel));
  newchan->type = type;
  newchan->index = i;
  newchan->sent_close = newchan->recv_close = 0;
  newchan->sent_eof = newchan->recv_eof = 0;
  newchan->close_handler_done = 0;

  newchan->remotechan = remotechan;
  newchan->transwindow = transwindow;
  newchan->transmaxpacket = transmaxpacket;

  newchan->typedata = NULL;
  newchan->writefd = FD_UNINIT;
  newchan->readfd = FD_UNINIT;
  newchan->errfd = FD_CLOSED; /* this isn't always set to start with */
  newchan->await_open = 0;
  newchan->flushing = 0;

  newchan->writebuf = cbuf_new(opts.recv_window);
  newchan->recvwindow = opts.recv_window;

  newchan->extrabuf = NULL; /* The user code can set it up */
  newchan->recvdonelen = 0;
  newchan->recvmaxpacket = RECV_MAX_CHANNEL_DATA_LEN;

  newchan->prio = DROPBEAR_CHANNEL_PRIO_EARLY; /* inithandler sets it */

  ses.channels[i] = newchan;
  ses.chancount++;

  TRACE(("leave newchannel"))

  return newchan;
}

/* Returns the channel structure corresponding to the channel in the current
 * data packet (ses.payload must be positioned appropriately).
 * A valid channel is always returns, it will fail fatally with an unknown
 * channel */
static struct Channel *getchannel_msg(const char *kind) {
  unsigned int chan;

  chan = buf_getint(ses.payload);
  if (chan >= ses.chansize || ses.channels[chan] == NULL) {
    if (kind) {
      dropbear_exit("%s for unknown channel %d", kind, chan);
    } else {
      dropbear_exit("Unknown channel %d", chan);
    }
  }
  return ses.channels[chan];
}

struct Channel *getchannel() {
  return getchannel_msg(NULL);
}

/* Iterate through the channels, performing IO if available */
void channelio(fd_set *readfds, fd_set *writefds) {
  /* Listeners such as TCP, X11, agent-auth */
  struct Channel *channel;
  unsigned int i;

  /* foreach channel */
  for (i = 0; i < ses.chansize; i++) {
    /* Close checking only needs to occur for channels that had IO events */
    int do_check_close = 0;

    channel = ses.channels[i];
    if (channel == NULL) {
      /* only process in-use channels */
      continue;
    }

    /* read data and send it over the wire */
    if (channel->readfd >= 0 && FD_ISSET(channel->readfd, readfds)) {
      TRACE(("send normal readfd"))
      send_msg_channel_data(channel, 0);
      do_check_close = 1;
    }

    /* read stderr data and send it over the wire */
    if (ERRFD_IS_READ(channel) && channel->errfd >= 0 &&
        FD_ISSET(channel->errfd, readfds)) {
      TRACE(("send normal errfd"))
      send_msg_channel_data(channel, 1);
      do_check_close = 1;
    }

    /* write to program/pipe stdin */
    if (channel->writefd >= 0 && FD_ISSET(channel->writefd, writefds)) {
      writechannel(channel, channel->writefd, channel->writebuf, NULL, NULL);
      do_check_close = 1;
    }

    /* stderr for client mode */
    if (ERRFD_IS_WRITE(channel) && channel->errfd >= 0 &&
        FD_ISSET(channel->errfd, writefds)) {
      writechannel(channel, channel->errfd, channel->extrabuf, NULL, NULL);
      do_check_close = 1;
    }

    if (ses.channel_signal_pending) {
      /* SIGCHLD can change channel state for server sessions */
      do_check_close = 1;
    }

    /* handle any channel closing etc */
    if (do_check_close) {
      check_close(channel);
    }
  }

#ifdef USING_LISTENERS
  handle_listeners(readfds);
#endif
}

/* Returns true if there is data remaining to be written to stdin or
 * stderr of a channel's endpoint. */
static unsigned int write_pending(struct Channel *channel) {
  if (channel->writefd >= 0 && cbuf_getused(channel->writebuf) > 0) {
    return 1;
  } else if (channel->errfd >= 0 && channel->extrabuf &&
             cbuf_getused(channel->extrabuf) > 0) {
    return 1;
  }
  return 0;
}

/* EOF/close handling */
static void check_close(struct Channel *channel) {
  int close_allowed = 0;

  TRACE2(
      ("check_close: writefd %d, readfd %d, errfd %d, sent_close %d, "
       "recv_close %d",
       channel->writefd, channel->readfd, channel->errfd, channel->sent_close,
       channel->recv_close))
  TRACE2(("writebuf size %d extrabuf size %d",
          channel->writebuf ? cbuf_getused(channel->writebuf) : 0,
          channel->extrabuf ? cbuf_getused(channel->extrabuf) : 0))

  if (!channel->flushing && !channel->close_handler_done &&
      channel->type->check_close && channel->type->check_close(channel)) {
    channel->flushing = 1;
  }

  /* if a type-specific check_close is defined we will only exit
     once that has been triggered. this is only used for a server "session"
     channel, to ensure that the shell has exited (and the exit status
     retrieved) before we close things up. */
  if (!channel->type->check_close || channel->close_handler_done ||
      channel->type->check_close(channel)) {
    close_allowed = 1;
  }

  if (channel->recv_close && !write_pending(channel) && close_allowed) {
    if (!channel->sent_close) {
      TRACE(("Sending MSG_CHANNEL_CLOSE in response to same."))
      send_msg_channel_close(channel);
    }
    remove_channel(channel);
    return;
  }

  if ((channel->recv_eof && !write_pending(channel))
      /* have a server "session" and child has exited */
      || (channel->type->check_close && close_allowed)) {
    close_chan_fd(channel, channel->writefd, SHUT_WR);
  }

  /* Special handling for flushing read data after an exit. We
     read regardless of whether the select FD was set,
     and if there isn't data available, the channel will get closed. */
  if (channel->flushing) {
    TRACE(("might send data, flushing"))
    if (channel->readfd >= 0 && channel->transwindow > 0) {
      TRACE(("send data readfd"))
      send_msg_channel_data(channel, 0);
    }
    if (ERRFD_IS_READ(channel) && channel->errfd >= 0 &&
        channel->transwindow > 0) {
      TRACE(("send data errfd"))
      send_msg_channel_data(channel, 1);
    }
  }

  /* If we're not going to send any more data, send EOF */
  if (!channel->sent_eof && channel->readfd == FD_CLOSED &&
      (ERRFD_IS_WRITE(channel) || channel->errfd == FD_CLOSED)) {
    send_msg_channel_eof(channel);
  }

  /* And if we can't receive any more data from them either, close up */
  if (channel->readfd == FD_CLOSED && channel->writefd == FD_CLOSED &&
      (ERRFD_IS_WRITE(channel) || channel->errfd == FD_CLOSED) &&
      !channel->sent_close && close_allowed && !write_pending(channel)) {
    TRACE(("sending close, readfd is closed"))
    send_msg_channel_close(channel);
  }
}

/* Check whether a deferred (EINPROGRESS) connect() was successful, and
 * if so, set up the channel properly. Otherwise, the channel is cleaned up, so
 * it is important that the channel reference isn't used after a call to this
 * function */
void channel_connect_done(int result, int sock, void *user_data,
                          const char *UNUSED(errstring)) {
  struct Channel *channel = user_data;

  TRACE(("enter channel_connect_done"))

  if (result == DROPBEAR_SUCCESS) {
    channel->readfd = channel->writefd = sock;
    channel->conn_pending = NULL;
    send_msg_channel_open_confirmation(channel, channel->recvwindow,
                                       channel->recvmaxpacket);
    TRACE(("leave channel_connect_done: success"))
  } else {
    send_msg_channel_open_failure(channel->remotechan, SSH_OPEN_CONNECT_FAILED,
                                  "", "");
    remove_channel(channel);
    TRACE(("leave check_in_progress: fail"))
  }
}

/* Send the close message and set the channel as closed */
static void send_msg_channel_close(struct Channel *channel) {
  TRACE(("enter send_msg_channel_close %p", (void *)channel))
  if (channel->type->closehandler && !channel->close_handler_done) {
    channel->type->closehandler(channel);
    channel->close_handler_done = 1;
  }

  CHECKCLEARTOWRITE();

  buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_CLOSE);
  buf_putint(ses.writepayload, channel->remotechan);

  encrypt_packet();

  channel->sent_eof = 1;
  channel->sent_close = 1;
  close_chan_fd(channel, channel->readfd, SHUT_RD);
  close_chan_fd(channel, channel->errfd, SHUT_RDWR);
  close_chan_fd(channel, channel->writefd, SHUT_WR);
  TRACE(("leave send_msg_channel_close"))
}

/* call this when trans/eof channels are closed */
static void send_msg_channel_eof(struct Channel *channel) {
  TRACE(("enter send_msg_channel_eof"))
  CHECKCLEARTOWRITE();

  buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_EOF);
  buf_putint(ses.writepayload, channel->remotechan);

  encrypt_packet();

  channel->sent_eof = 1;

  TRACE(("leave send_msg_channel_eof"))
}

#ifndef HAVE_WRITEV
static int writechannel_fallback(struct Channel *channel, int fd,
                                 circbuffer *cbuf,
                                 const unsigned char *UNUSED(moredata),
                                 unsigned int *morelen) {
  unsigned char *circ_p1, *circ_p2;
  unsigned int circ_len1, circ_len2;
  ssize_t written;

  if (morelen) {
    /* fallback doesn't consume moredata */
    *morelen = 0;
  }

  /* Write the first portion of the circular buffer */
  cbuf_readptrs(cbuf, &circ_p1, &circ_len1, &circ_p2, &circ_len2);
  written = write(fd, circ_p1, circ_len1);
  if (written < 0) {
    if (errno != EINTR && errno != EAGAIN) {
      TRACE(("channel IO write error fd %d %s", fd, strerror(errno)))
      close_chan_fd(channel, fd, SHUT_WR);
      return DROPBEAR_FAILURE;
    }
  } else {
    cbuf_incrread(cbuf, written);
    channel->recvdonelen += written;
  }
  return DROPBEAR_SUCCESS;
}
#endif /* !HAVE_WRITEV */

#ifdef HAVE_WRITEV
static int writechannel_writev(struct Channel *channel, int fd,
                               circbuffer *cbuf, const unsigned char *moredata,
                               unsigned int *morelen) {
  struct iovec iov[3];
  unsigned char *circ_p1, *circ_p2;
  unsigned int circ_len1, circ_len2;
  int io_count = 0;

  ssize_t written;

  cbuf_readptrs(cbuf, &circ_p1, &circ_len1, &circ_p2, &circ_len2);

  if (circ_len1 > 0) {
    TRACE(("circ1 %d", circ_len1))
    iov[io_count].iov_base = circ_p1;
    iov[io_count].iov_len = circ_len1;
    io_count++;
  }

  if (circ_len2 > 0) {
    TRACE(("circ2 %d", circ_len2))
    iov[io_count].iov_base = circ_p2;
    iov[io_count].iov_len = circ_len2;
    io_count++;
  }

  if (morelen) {
    assert(moredata);
    TRACE(("more %d", *morelen))
    iov[io_count].iov_base = (void *)moredata;
    iov[io_count].iov_len = *morelen;
    io_count++;
  }

  if (io_count == 0) {
    /* writechannel may sometimes be called twice in a main loop iteration.
    From common_recv_msg_channel_data() then channelio().
    The second call may not have any data to write, so we just return. */
    TRACE(("leave writechannel, no data"))
    return DROPBEAR_SUCCESS;
  }

  if (morelen) {
    /* Default return value, none consumed */
    *morelen = 0;
  }

  written = writev(fd, iov, io_count);

  if (written < 0) {
    if (errno != EINTR && errno != EAGAIN) {
      TRACE(("channel IO write error fd %d %s", fd, strerror(errno)))
      close_chan_fd(channel, fd, SHUT_WR);
      return DROPBEAR_FAILURE;
    }
  } else {
    int cbuf_written = MIN(circ_len1 + circ_len2, (unsigned int)written);
    cbuf_incrread(cbuf, cbuf_written);
    if (morelen) {
      *morelen = written - cbuf_written;
    }
    channel->recvdonelen += written;
  }
  return DROPBEAR_SUCCESS;
}
#endif /* HAVE_WRITEV */

/* Called to write data out to the local side of the channel.
   Writes the circular buffer contents and also the "moredata" buffer
   if not null. Will ignore EAGAIN.
   Returns DROPBEAR_FAILURE if writing to fd had an error and the channel is
   being closed, DROPBEAR_SUCCESS otherwise */
static int writechannel(struct Channel *channel, int fd, circbuffer *cbuf,
                        const unsigned char *moredata, unsigned int *morelen) {
  int ret = DROPBEAR_SUCCESS;
  TRACE(("enter writechannel fd %d", fd))
#ifdef HAVE_WRITEV
  ret = writechannel_writev(channel, fd, cbuf, moredata, morelen);
#else
  ret = writechannel_fallback(channel, fd, cbuf, moredata, morelen);
#endif

  /* Window adjust handling */
  if (channel->recvdonelen >= RECV_WINDOWEXTEND) {
    send_msg_channel_window_adjust(channel, channel->recvdonelen);
    channel->recvwindow += channel->recvdonelen;
    channel->recvdonelen = 0;
  }

  dropbear_assert(channel->recvwindow <= opts.recv_window);
  dropbear_assert(channel->recvwindow <= cbuf_getavail(channel->writebuf));
  dropbear_assert(channel->extrabuf == NULL ||
                  channel->recvwindow <= cbuf_getavail(channel->extrabuf));

  TRACE(("leave writechannel"))
  return ret;
}

/* Set the file descriptors for the main select in session.c
 * This avoid channels which don't have any window available, are closed, etc*/
void setchannelfds(fd_set *readfds, fd_set *writefds, int allow_reads) {
  unsigned int i;
  struct Channel *channel;

  for (i = 0; i < ses.chansize; i++) {
    channel = ses.channels[i];
    if (channel == NULL) {
      continue;
    }

    /* Stuff to put over the wire.
    Avoid queueing data to send if we're in the middle of a
    key re-exchange (!dataallowed), but still read from the
    FD if there's the possibility of "~."" to kill an
    interactive session (the read_mangler) */
    if (channel->transwindow > 0 &&
        ((ses.dataallowed && allow_reads) || channel->read_mangler)) {
      if (channel->readfd >= 0) {
        FD_SET(channel->readfd, readfds);
      }

      if (ERRFD_IS_READ(channel) && channel->errfd >= 0) {
        FD_SET(channel->errfd, readfds);
      }
    }

    /* Stuff from the wire */
    if (channel->writefd >= 0 && cbuf_getused(channel->writebuf) > 0) {
      FD_SET(channel->writefd, writefds);
    }

    if (ERRFD_IS_WRITE(channel) && channel->errfd >= 0 &&
        cbuf_getused(channel->extrabuf) > 0) {
      FD_SET(channel->errfd, writefds);
    }

  } /* foreach channel */

#ifdef USING_LISTENERS
  set_listener_fds(readfds);
#endif
}

/* handle the channel EOF event, by closing the channel filedescriptor. The
 * channel isn't closed yet, it is left until the incoming (from the program
 * etc) FD is also EOF */
void recv_msg_channel_eof() {
  struct Channel *channel;

  TRACE(("enter recv_msg_channel_eof"))

  channel = getchannel_msg("EOF");

  channel->recv_eof = 1;

  check_close(channel);
  TRACE(("leave recv_msg_channel_eof"))
}

/* Handle channel closure(), respond in kind and close the channels */
void recv_msg_channel_close() {
  struct Channel *channel;

  TRACE(("enter recv_msg_channel_close"))

  channel = getchannel_msg("Close");

  channel->recv_eof = 1;
  channel->recv_close = 1;

  check_close(channel);
  TRACE(("leave recv_msg_channel_close"))
}

/* Remove a channel entry, this is only executed after both sides have sent
 * channel close */
static void remove_channel(struct Channel *channel) {
  TRACE(("enter remove_channel"))
  TRACE(("channel index is %d", channel->index))

  cbuf_free(channel->writebuf);
  channel->writebuf = NULL;

  if (channel->extrabuf) {
    cbuf_free(channel->extrabuf);
    channel->extrabuf = NULL;
  }

  if (IS_DROPBEAR_SERVER || (channel->writefd != STDOUT_FILENO)) {
    /* close the FDs in case they haven't been done
     * yet (they might have been shutdown etc) */
    TRACE(("CLOSE writefd %d", channel->writefd))
    m_close(channel->writefd);
    TRACE(("CLOSE readfd %d", channel->readfd))
    m_close(channel->readfd);
    TRACE(("CLOSE errfd %d", channel->errfd))
    m_close(channel->errfd);
  }

  if (!channel->close_handler_done && channel->type->closehandler) {
    channel->type->closehandler(channel);
    channel->close_handler_done = 1;
  }

  if (channel->conn_pending) {
    cancel_connect(channel->conn_pending);
  }

  ses.channels[channel->index] = NULL;
  m_free(channel);
  ses.chancount--;

  update_channel_prio();

  TRACE(("leave remove_channel"))
}

/* Handle channel specific requests, passing off to corresponding handlers
 * such as chansession or x11fwd */
void recv_msg_channel_request() {
  struct Channel *channel;

  channel = getchannel();

  TRACE(("enter recv_msg_channel_request %p", (void *)channel))

  if (channel->sent_close) {
    TRACE(("leave recv_msg_channel_request: already closed channel"))
    return;
  }

  if (channel->type->reqhandler && !channel->close_handler_done) {
    channel->type->reqhandler(channel);
  } else {
    int wantreply;
    buf_eatstring(ses.payload);
    wantreply = buf_getbool(ses.payload);
    if (wantreply) {
      send_msg_channel_failure(channel);
    }
  }

  TRACE(("leave recv_msg_channel_request"))
}

/* Reads data from the server's program/shell/etc, and puts it in a
 * channel_data packet to send.
 * chan is the remote channel, isextended is 0 if it is normal data, 1
 * if it is extended data. if it is extended, then the type is in
 * exttype */
static void send_msg_channel_data(struct Channel *channel, int isextended) {
  int len;
  size_t maxlen, size_pos;
  int fd;

  CHECKCLEARTOWRITE();

  TRACE(("enter send_msg_channel_data"))
  dropbear_assert(!channel->sent_close);

  if (isextended) {
    fd = channel->errfd;
  } else {
    fd = channel->readfd;
  }
  TRACE(("enter send_msg_channel_data isextended %d fd %d", isextended, fd))
  dropbear_assert(fd >= 0);

  maxlen = MIN(channel->transwindow, channel->transmaxpacket);
  /* -(1+4+4) is SSH_MSG_CHANNEL_DATA, channel number, string length, and
   * exttype if is extended */
  maxlen =
      MIN(maxlen, ses.writepayload->size - 1 - 4 - 4 - (isextended ? 4 : 0));
  TRACE(("maxlen %zd", maxlen))
  if (maxlen == 0) {
    TRACE(("leave send_msg_channel_data: no window"))
    return;
  }

  buf_putbyte(ses.writepayload, isextended ? SSH_MSG_CHANNEL_EXTENDED_DATA
                                           : SSH_MSG_CHANNEL_DATA);
  buf_putint(ses.writepayload, channel->remotechan);
  if (isextended) {
    buf_putint(ses.writepayload, SSH_EXTENDED_DATA_STDERR);
  }
  /* a dummy size first ...*/
  size_pos = ses.writepayload->pos;
  buf_putint(ses.writepayload, 0);

  /* read the data */
  len = read(fd, buf_getwriteptr(ses.writepayload, maxlen), maxlen);

  if (len <= 0) {
    if (len == 0 || errno != EINTR) {
      /* This will also get hit in the case of EAGAIN. The only
      time we expect to receive EAGAIN is when we're flushing a FD,
      in which case it can be treated the same as EOF */
      close_chan_fd(channel, fd, SHUT_RD);
    }
    buf_setpos(ses.writepayload, 0);
    buf_setlen(ses.writepayload, 0);
    TRACE(("leave send_msg_channel_data: len %d read err %d or EOF for fd %d",
           len, errno, fd))
    return;
  }

  if (channel->read_mangler) {
    channel->read_mangler(channel, buf_getwriteptr(ses.writepayload, len),
                          &len);
    if (len == 0) {
      buf_setpos(ses.writepayload, 0);
      buf_setlen(ses.writepayload, 0);
      return;
    }
  }

  TRACE(("send_msg_channel_data: len %d fd %d", len, fd))
  buf_incrwritepos(ses.writepayload, len);
  /* ... real size here */
  buf_setpos(ses.writepayload, size_pos);
  buf_putint(ses.writepayload, len);

  channel->transwindow -= len;

  encrypt_packet();

  /* If we receive less data than we requested when flushing, we've
     reached the equivalent of EOF */
  if (channel->flushing && len < (ssize_t)maxlen) {
    TRACE(("closing from channel, flushing out."))
    close_chan_fd(channel, fd, SHUT_RD);
  }
  TRACE(("leave send_msg_channel_data"))
}

/* We receive channel data */
void recv_msg_channel_data() {
  struct Channel *channel;

  channel = getchannel();

  common_recv_msg_channel_data(channel, channel->writefd, channel->writebuf);
}

/* Shared for data and stderr data - when we receive data, put it in a buffer
 * for writing to the local file descriptor */
void common_recv_msg_channel_data(struct Channel *channel, int fd,
                                  circbuffer *cbuf) {
  unsigned int datalen;
  unsigned int maxdata;
  unsigned int buflen;
  unsigned int len;
  unsigned int consumed;
  int res;

  TRACE(("enter recv_msg_channel_data"))

  if (channel->recv_eof) {
    dropbear_exit("Received data after eof");
  }

  if (fd < 0 || !cbuf) {
    /* If we have encountered failed write, the far side might still
     * be sending data without having yet received our close notification.
     * We just drop the data. */
    return;
  }

  datalen = buf_getint(ses.payload);
  TRACE(("length %d", datalen))

  maxdata = cbuf_getavail(cbuf);

  /* Whilst the spec says we "MAY ignore data past the end" this could
   * lead to corrupted file transfers etc (chunks missed etc). It's better to
   * just die horribly */
  if (datalen > maxdata) {
    dropbear_exit("Oversized packet");
  }

  dropbear_assert(channel->recvwindow >= datalen);
  channel->recvwindow -= datalen;
  dropbear_assert(channel->recvwindow <= opts.recv_window);

  /* Attempt to write the data immediately without having to put it in the
   * circular buffer */
  consumed = datalen;
  res = writechannel(channel, fd, cbuf, buf_getptr(ses.payload, datalen),
                     &consumed);

  datalen -= consumed;
  buf_incrpos(ses.payload, consumed);

  /* We may have to run throught twice, if the buffer wraps around. Can't
   * just "leave it for next time" like with writechannel, since this
   * is payload data.
   * If the writechannel() failed then remaining data is discarded */
  if (res == DROPBEAR_SUCCESS) {
    len = datalen;
    while (len > 0) {
      buflen = cbuf_writelen(cbuf);
      buflen = MIN(buflen, len);

      memcpy(cbuf_writeptr(cbuf, buflen), buf_getptr(ses.payload, buflen),
             buflen);
      cbuf_incrwrite(cbuf, buflen);
      buf_incrpos(ses.payload, buflen);
      len -= buflen;
    }
  }

  TRACE(("leave recv_msg_channel_data"))
}

/* Increment the outgoing data window for a channel - the remote end limits
 * the amount of data which may be transmitted, this window is decremented
 * as data is sent, and incremented upon receiving window-adjust messages */
void recv_msg_channel_window_adjust() {
  struct Channel *channel;
  unsigned int incr;

  channel = getchannel();

  incr = buf_getint(ses.payload);
  TRACE(("received window increment %d", incr))
  incr = MIN(incr, TRANS_MAX_WIN_INCR);

  channel->transwindow += incr;
  channel->transwindow = MIN(channel->transwindow, TRANS_MAX_WINDOW);
}

/* Increment the incoming data window for a channel, and let the remote
 * end know */
static void send_msg_channel_window_adjust(struct Channel *channel,
                                           unsigned int incr) {
  TRACE(("sending window adjust %d", incr))
  CHECKCLEARTOWRITE();

  buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_WINDOW_ADJUST);
  buf_putint(ses.writepayload, channel->remotechan);
  buf_putint(ses.writepayload, incr);

  encrypt_packet();
}

/* Handle a new channel request, performing any channel-type-specific setup */
void recv_msg_channel_open() {
  char *type;
  unsigned int typelen;
  unsigned int remotechan, transwindow, transmaxpacket;
  struct Channel *channel;
  const struct ChanType **cp;
  const struct ChanType *chantype;
  unsigned int errtype = SSH_OPEN_UNKNOWN_CHANNEL_TYPE;
  int ret;

  TRACE(("enter recv_msg_channel_open"))

  /* get the packet contents */
  type = buf_getstring(ses.payload, &typelen);

  remotechan = buf_getint(ses.payload);
  transwindow = buf_getint(ses.payload);
  transwindow = MIN(transwindow, TRANS_MAX_WINDOW);
  transmaxpacket = buf_getint(ses.payload);
  transmaxpacket = MIN(transmaxpacket, TRANS_MAX_PAYLOAD_LEN);

  /* figure what type of packet it is */
  if (typelen > MAX_NAME_LEN) {
    goto failure;
  }

  /* Get the channel type. Client and server style invokation will set up a
   * different list for ses.chantypes at startup. We just iterate through
   * this list and find the matching name */
  for (cp = &ses.chantypes[0], chantype = (*cp); chantype != NULL;
       cp++, chantype = (*cp)) {
    if (strcmp(type, chantype->name) == 0) {
      break;
    }
  }

  if (chantype == NULL) {
    TRACE(("No matching type for '%s'", type))
    goto failure;
  }

  TRACE(("matched type '%s'", type))

  /* create the channel */
  channel = newchannel(remotechan, chantype, transwindow, transmaxpacket);

  if (channel == NULL) {
    TRACE(("newchannel returned NULL"))
    errtype = SSH_OPEN_RESOURCE_SHORTAGE;
    goto failure;
  }

  if (channel->type->inithandler) {
    ret = channel->type->inithandler(channel);
    if (ret == SSH_OPEN_IN_PROGRESS) {
      /* We'll send the confirmation later */
      goto cleanup;
    }
    if (ret > 0) {
      errtype = ret;
      remove_channel(channel);
      TRACE(("inithandler returned failure %d", ret))
      goto failure;
    }
  }

  if (channel->prio == DROPBEAR_CHANNEL_PRIO_EARLY) {
    channel->prio = DROPBEAR_CHANNEL_PRIO_BULK;
  }

  /* success */
  send_msg_channel_open_confirmation(channel, channel->recvwindow,
                                     channel->recvmaxpacket);
  goto cleanup;

failure:
  TRACE(("recv_msg_channel_open failure"))
  send_msg_channel_open_failure(remotechan, errtype, "", "");

cleanup:
  m_free(type);

  update_channel_prio();

  TRACE(("leave recv_msg_channel_open"))
}

/* Send a failure message */
void send_msg_channel_failure(struct Channel *channel) {
  TRACE(("enter send_msg_channel_failure"))
  CHECKCLEARTOWRITE();

  buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_FAILURE);
  buf_putint(ses.writepayload, channel->remotechan);

  encrypt_packet();
  TRACE(("leave send_msg_channel_failure"))
}

/* Send a success message */
void send_msg_channel_success(struct Channel *channel) {
  TRACE(("enter send_msg_channel_success"))
  CHECKCLEARTOWRITE();

  buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_SUCCESS);
  buf_putint(ses.writepayload, channel->remotechan);

  encrypt_packet();
  TRACE(("leave send_msg_channel_success"))
}

/* Send a channel open failure message, with a corresponding reason
 * code (usually resource shortage or unknown chan type) */
static void send_msg_channel_open_failure(unsigned int remotechan, int reason,
                                          const char *text, const char *lang) {
  TRACE(("enter send_msg_channel_open_failure"))
  CHECKCLEARTOWRITE();

  buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_OPEN_FAILURE);
  buf_putint(ses.writepayload, remotechan);
  buf_putint(ses.writepayload, reason);
  buf_putstring(ses.writepayload, text, strlen(text));
  buf_putstring(ses.writepayload, lang, strlen(lang));

  encrypt_packet();
  TRACE(("leave send_msg_channel_open_failure"))
}

/* Confirm a channel open, and let the remote end know what number we've
 * allocated and the receive parameters */
static void send_msg_channel_open_confirmation(struct Channel *channel,
                                               unsigned int recvwindow,
                                               unsigned int recvmaxpacket) {
  TRACE(("enter send_msg_channel_open_confirmation"))
  CHECKCLEARTOWRITE();

  buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
  buf_putint(ses.writepayload, channel->remotechan);
  buf_putint(ses.writepayload, channel->index);
  buf_putint(ses.writepayload, recvwindow);
  buf_putint(ses.writepayload, recvmaxpacket);

  encrypt_packet();
  TRACE(("leave send_msg_channel_open_confirmation"))
}

/* close a fd, how is SHUT_RD or SHUT_WR */
static void close_chan_fd(struct Channel *channel, int fd, int how) {
  int closein = 0, closeout = 0;

  if (channel->type->sepfds) {
    TRACE(("SHUTDOWN(%d, %d)", fd, how))
    shutdown(fd, how);
    if (how == 0) {
      closeout = 1;
    } else {
      closein = 1;
    }
  } else {
    TRACE(("CLOSE some fd %d", fd))
    m_close(fd);
    closein = closeout = 1;
  }

  if (closeout && (fd == channel->readfd)) {
    channel->readfd = FD_CLOSED;
  }
  if (closeout && ERRFD_IS_READ(channel) && (fd == channel->errfd)) {
    channel->errfd = FD_CLOSED;
  }

  if (closein && fd == channel->writefd) {
    channel->writefd = FD_CLOSED;
  }
  if (closein && ERRFD_IS_WRITE(channel) && (fd == channel->errfd)) {
    channel->errfd = FD_CLOSED;
  }

  /* if we called shutdown on it and all references are gone, then we
   * need to close() it to stop it lingering */
  if (channel->type->sepfds && channel->readfd == FD_CLOSED &&
      channel->writefd == FD_CLOSED && channel->errfd == FD_CLOSED) {
    TRACE(("CLOSE (finally) of %d", fd))
    m_close(fd);
  }
}

#if defined(USING_LISTENERS) || defined(DROPBEAR_CLIENT)
/* Create a new channel, and start the open request. This is intended
 * for X11, agent, tcp forwarding, and should be filled with channel-specific
 * options, with the calling function calling encrypt_packet() after
 * completion. It is mandatory for the caller to encrypt_packet() if
 * a channel is returned. NULL is returned on failure. */
int send_msg_channel_open_init(int fd, const struct ChanType *type) {
  struct Channel *chan;

  TRACE(("enter send_msg_channel_open_init()"))
  chan = newchannel(0, type, 0, 0);
  if (!chan) {
    TRACE(("leave send_msg_channel_open_init() - FAILED in newchannel()"))
    return DROPBEAR_FAILURE;
  }

  /* Outbound opened channels don't make use of in-progress connections,
   * we can set it up straight away */

  /* set fd non-blocking */
  setnonblocking(fd);

  chan->writefd = chan->readfd = fd;
  ses.maxfd = MAX(ses.maxfd, fd);

  chan->await_open = 1;

  /* now open the channel connection */
  CHECKCLEARTOWRITE();

  buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_OPEN);
  buf_putstring(ses.writepayload, type->name, strlen(type->name));
  buf_putint(ses.writepayload, chan->index);
  buf_putint(ses.writepayload, opts.recv_window);
  buf_putint(ses.writepayload, RECV_MAX_CHANNEL_DATA_LEN);

  TRACE(("leave send_msg_channel_open_init()"))
  return DROPBEAR_SUCCESS;
}

/* Confirmation that our channel open request (for forwardings) was
 * successful*/
void recv_msg_channel_open_confirmation() {
  struct Channel *channel;
  int ret;

  TRACE(("enter recv_msg_channel_open_confirmation"))

  channel = getchannel();

  if (!channel->await_open) {
    dropbear_exit("Unexpected channel reply");
  }
  channel->await_open = 0;

  channel->remotechan = buf_getint(ses.payload);
  channel->transwindow = buf_getint(ses.payload);
  channel->transmaxpacket = buf_getint(ses.payload);

  TRACE(("new chan remote %d local %d", channel->remotechan, channel->index))

  /* Run the inithandler callback */
  if (channel->type->inithandler) {
    ret = channel->type->inithandler(channel);
    if (ret > 0) {
      remove_channel(channel);
      TRACE(("inithandler returned failure %d", ret))
      return;
    }
  }

  if (channel->prio == DROPBEAR_CHANNEL_PRIO_EARLY) {
    channel->prio = DROPBEAR_CHANNEL_PRIO_BULK;
  }
  update_channel_prio();

  TRACE(("leave recv_msg_channel_open_confirmation"))
}

/* Notification that our channel open request failed */
void recv_msg_channel_open_failure() {
  struct Channel *channel;

  channel = getchannel();

  if (!channel->await_open) {
    dropbear_exit("Unexpected channel reply");
  }
  channel->await_open = 0;

  remove_channel(channel);
}
#endif /* USING_LISTENERS */

void send_msg_request_success() {
  CHECKCLEARTOWRITE();
  buf_putbyte(ses.writepayload, SSH_MSG_REQUEST_SUCCESS);
  encrypt_packet();
}

void send_msg_request_failure() {
  CHECKCLEARTOWRITE();
  buf_putbyte(ses.writepayload, SSH_MSG_REQUEST_FAILURE);
  encrypt_packet();
}

struct Channel *get_any_ready_channel() {
  size_t i;
  if (ses.chancount == 0) {
    return NULL;
  }
  for (i = 0; i < ses.chansize; i++) {
    struct Channel *chan = ses.channels[i];
    if (chan && !(chan->sent_eof || chan->recv_eof) && !(chan->await_open)) {
      return chan;
    }
  }
  return NULL;
}

void start_send_channel_request(struct Channel *channel, char *type) {
  CHECKCLEARTOWRITE();
  buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_REQUEST);
  buf_putint(ses.writepayload, channel->remotechan);

  buf_putstring(ses.writepayload, type, strlen(type));
}