/*

 * sftp.c - Secure FTP functions

 *

 * This file is part of the SSH Library

 *

 * Copyright (c) 2005-2008 by Aris Adamantiadis

 * Copyright (c) 2008-2018 by Andreas Schneider <asn@cryptomilk.org>

 *

 * The SSH Library is free software; you can redistribute it and/or modify

 * it under the terms of the GNU Lesser General Public License as published by

 * the Free Software Foundation; either version 2.1 of the License, or (at your

 * option) any later version.

 *

 * The SSH Library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY

 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public

 * License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with the SSH Library; see the file COPYING.  If not, write to

 * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,

 * MA 02111-1307, USA.

 */

/* This file contains code written by Nick Zitzmann */

#include "config.h"

#include <stdbool.h>

#include <errno.h>

#include <ctype.h>

#include <fcntl.h>

#include <stdio.h>

#include <stdint.h>

#include <sys/types.h>

#include <sys/stat.h>

#include <limits.h>

#ifndef _WIN32

#include <netinet/in.h>

#include <arpa/inet.h>

#endif

#include "libssh/priv.h"

#include "libssh/ssh2.h"

#include "libssh/sftp.h"

#include "libssh/sftp_priv.h"

#include "libssh/buffer.h"

#include "libssh/channels.h"

#include "libssh/session.h"

#include "libssh/misc.h"

#include "libssh/bytearray.h"

#ifdef WITH_SFTP

/* Buffer size maximum is 256M */

#define SFTP_PACKET_SIZE_MAX 0x10000000

#define SFTP_BUFFER_SIZE_MAX 16384

struct sftp_ext_struct {

  uint32_t count;

  char **name;

  char **data;

};

/* functions */

static int sftp_enqueue(sftp_session session, sftp_message msg);

static void sftp_message_free(sftp_message msg);

static void sftp_set_error(sftp_session sftp, int errnum);

static void status_msg_free(sftp_status_message status);

static sftp_ext sftp_ext_new(void) {

  sftp_ext ext;

  ext = calloc(1, sizeof(struct sftp_ext_struct));

  if (ext == NULL) {

    return NULL;

  }

  return ext;

}

static void sftp_ext_free(sftp_ext ext)

{

    size_t i;

    if (ext == NULL) {

        return;

    }

    if (ext->count > 0) {

        if (ext->name != NULL) {

            for (i = 0; i < ext->count; i++) {

                SAFE_FREE(ext->name[i]);

            }

            SAFE_FREE(ext->name);

        }

        if (ext->data != NULL) {

            for (i = 0; i < ext->count; i++) {

                SAFE_FREE(ext->data[i]);

            }

            SAFE_FREE(ext->data);

        }

    }

    SAFE_FREE(ext);

}

sftp_session sftp_new(ssh_session session)

{

    sftp_session sftp;

    if (session == NULL) {

        return NULL;

    }

    sftp = calloc(1, sizeof(struct sftp_session_struct));

    if (sftp == NULL) {

        ssh_set_error_oom(session);

        return NULL;

    }

    sftp->ext = sftp_ext_new();

    if (sftp->ext == NULL) {

        ssh_set_error_oom(session);

        goto error;

    }

    sftp->read_packet = calloc(1, sizeof(struct sftp_packet_struct));

    if (sftp->read_packet == NULL) {

        ssh_set_error_oom(session);

        goto error;

    }

    sftp->read_packet->payload = ssh_buffer_new();

    if (sftp->read_packet->payload == NULL) {

        ssh_set_error_oom(session);

        goto error;

    }

    sftp->session = session;

    sftp->channel = ssh_channel_new(session);

    if (sftp->channel == NULL) {

        ssh_set_error_oom(session);

        goto error;

    }

    if (ssh_channel_open_session(sftp->channel)) {

        goto error;

    }

    if (ssh_channel_request_sftp(sftp->channel)) {

        goto error;

    }

    return sftp;

error:

    if (sftp->ext != NULL) {

        sftp_ext_free(sftp->ext);

    }

    if (sftp->channel != NULL) {

        ssh_channel_free(sftp->channel);

    }

    if (sftp->read_packet != NULL) {

        if (sftp->read_packet->payload != NULL) {

            SSH_BUFFER_FREE(sftp->read_packet->payload);

        }

        SAFE_FREE(sftp->read_packet);

    }

    SAFE_FREE(sftp);

    return NULL;

}

sftp_session sftp_new_channel(ssh_session session, ssh_channel channel){

  sftp_session sftp;

  if (session == NULL) {

    return NULL;

  }

  sftp = calloc(1, sizeof(struct sftp_session_struct));

  if (sftp == NULL) {

    ssh_set_error_oom(session);

    return NULL;

  }

  sftp->ext = sftp_ext_new();

  if (sftp->ext == NULL) {

    ssh_set_error_oom(session);

    SAFE_FREE(sftp);

    return NULL;

  }

  sftp->session = session;

  sftp->channel = channel;

  return sftp;

}

#ifdef WITH_SERVER

sftp_session sftp_server_new(ssh_session session, ssh_channel chan){

  sftp_session sftp = NULL;

  sftp = calloc(1, sizeof(struct sftp_session_struct));

  if (sftp == NULL) {

    ssh_set_error_oom(session);

    return NULL;

  }

  sftp->read_packet = calloc(1, sizeof(struct sftp_packet_struct));

  if (sftp->read_packet == NULL) {

    goto error;

  }

  sftp->read_packet->payload = ssh_buffer_new();

  if (sftp->read_packet->payload == NULL) {

    goto error;

  }

  sftp->session = session;

  sftp->channel = chan;

  return sftp;

error:

  ssh_set_error_oom(session);

  if (sftp->read_packet != NULL) {

    if (sftp->read_packet->payload != NULL) {

      SSH_BUFFER_FREE(sftp->read_packet->payload);

    }

    SAFE_FREE(sftp->read_packet);

  }

  SAFE_FREE(sftp);

  return NULL;

}

int sftp_server_init(sftp_session sftp){

  ssh_session session = sftp->session;

  sftp_packet packet = NULL;

  ssh_buffer reply = NULL;

  uint32_t version;

  int rc;

  packet = sftp_packet_read(sftp);

  if (packet == NULL) {

    return -1;

  }

  if (packet->type != SSH_FXP_INIT) {

    ssh_set_error(session, SSH_FATAL,

        "Packet read of type %d instead of SSH_FXP_INIT",

        packet->type);

    return -1;

  }

  SSH_LOG(SSH_LOG_PACKET, "Received SSH_FXP_INIT");

  ssh_buffer_get_u32(packet->payload, &version);

  version = ntohl(version);

  SSH_LOG(SSH_LOG_PACKET, "Client version: %d", version);

  sftp->client_version = (int)version;

  reply = ssh_buffer_new();

  if (reply == NULL) {

    ssh_set_error_oom(session);

    return -1;

  }

  rc = ssh_buffer_pack(reply, "dssss",

                      LIBSFTP_VERSION,

                      "posix-rename@openssh.com",

                      "1",

                      "hardlink@openssh.com",

                      "1");

  if (rc != SSH_OK) {

    ssh_set_error_oom(session);

    SSH_BUFFER_FREE(reply);

    return -1;

  }

  if (sftp_packet_write(sftp, SSH_FXP_VERSION, reply) < 0) {

    SSH_BUFFER_FREE(reply);

    return -1;

  }

  SSH_BUFFER_FREE(reply);

  SSH_LOG(SSH_LOG_PROTOCOL, "Server version sent");

  if (version > LIBSFTP_VERSION) {

    sftp->version = LIBSFTP_VERSION;

  } else {

    sftp->version = (int)version;

  }

  return 0;

}

void sftp_server_free(sftp_session sftp)

{

    sftp_request_queue ptr;

    if (sftp == NULL) {

        return;

    }

    ptr = sftp->queue;

    while(ptr) {

        sftp_request_queue old;

        sftp_message_free(ptr->message);

        old = ptr->next;

        SAFE_FREE(ptr);

        ptr = old;

    }

    SAFE_FREE(sftp->handles);

    SSH_BUFFER_FREE(sftp->read_packet->payload);

    SAFE_FREE(sftp->read_packet);

    sftp_ext_free(sftp->ext);

    SAFE_FREE(sftp);

}

#endif /* WITH_SERVER */

void sftp_free(sftp_session sftp)

{

    sftp_request_queue ptr;

    if (sftp == NULL) {

        return;

    }

    if (sftp->channel != NULL) {

        ssh_channel_send_eof(sftp->channel);

        ptr = sftp->queue;

        while(ptr) {

            sftp_request_queue old;

            sftp_message_free(ptr->message);

            old = ptr->next;

            SAFE_FREE(ptr);

            ptr = old;

        }

        ssh_channel_free(sftp->channel);

        sftp->channel = NULL;

    }

    SAFE_FREE(sftp->handles);

    SSH_BUFFER_FREE(sftp->read_packet->payload);

    SAFE_FREE(sftp->read_packet);

    sftp_ext_free(sftp->ext);

    SAFE_FREE(sftp);

}

ssize_t sftp_packet_write(sftp_session sftp, uint8_t type, ssh_buffer payload)

{

    uint8_t header[5] = {0};

    uint32_t payload_size;

    ssize_t size;

    int rc;

    /* Add size of type */

    payload_size = ssh_buffer_get_len(payload) + sizeof(uint8_t);

    PUSH_BE_U32(header, 0, payload_size);

    PUSH_BE_U8(header, 4, type);

    rc = ssh_buffer_prepend_data(payload, header, sizeof(header));

    if (rc < 0) {

        ssh_set_error_oom(sftp->session);

        sftp_set_error(sftp, SSH_FX_FAILURE);

        return -1;

    }

    size = ssh_channel_write(sftp->channel,

                             ssh_buffer_get(payload),

                             ssh_buffer_get_len(payload));

    if (size < 0) {

        sftp_set_error(sftp, SSH_FX_FAILURE);

        return -1;

    }

    if ((uint32_t)size != ssh_buffer_get_len(payload)) {

        SSH_LOG(SSH_LOG_PACKET,

                "Had to write %d bytes, wrote only %zd",

                ssh_buffer_get_len(payload),

                size);

    }

    return size;

}

sftp_packet sftp_packet_read(sftp_session sftp)

{

    uint8_t buffer[SFTP_BUFFER_SIZE_MAX];

    sftp_packet packet = sftp->read_packet;

    uint32_t size;

    int nread;

    bool is_eof;

    int rc;

    packet->sftp = sftp;

    /*

     * If the packet has a payload, then just reinit the buffer, otherwise

     * allocate a new one.

     */

    if (packet->payload != NULL) {

        rc = ssh_buffer_reinit(packet->payload);

        if (rc != 0) {

            ssh_set_error_oom(sftp->session);

            sftp_set_error(sftp, SSH_FX_FAILURE);

            return NULL;

        }

    } else {

        packet->payload = ssh_buffer_new();

        if (packet->payload == NULL) {

            ssh_set_error_oom(sftp->session);

            sftp_set_error(sftp, SSH_FX_FAILURE);

            return NULL;

        }

    }

    nread = 0;

    do {

        int s;

        // read from channel until 4 bytes have been read or an error occurs

        s = ssh_channel_read(sftp->channel, buffer + nread, 4 - nread, 0);

        if (s < 0) {

            goto error;

        } else if (s == 0) {

            is_eof = ssh_channel_is_eof(sftp->channel);

            if (is_eof) {

                ssh_set_error(sftp->session,

                              SSH_FATAL,

                              "Received EOF while reading sftp packet size");

                sftp_set_error(sftp, SSH_FX_EOF);

                goto error;

            }

        } else {

            nread += s;

        }

    } while (nread < 4);

    size = PULL_BE_U32(buffer, 0);

    if (size == 0 || size > SFTP_PACKET_SIZE_MAX) {

        ssh_set_error(sftp->session, SSH_FATAL, "Invalid sftp packet size!");

        sftp_set_error(sftp, SSH_FX_FAILURE);

        goto error;

    }

    do {

        nread = ssh_channel_read(sftp->channel, buffer, 1, 0);

        if (nread < 0) {

            goto error;

        } else if (nread == 0) {

            is_eof = ssh_channel_is_eof(sftp->channel);

            if (is_eof) {

                ssh_set_error(sftp->session,

                              SSH_FATAL,

                              "Received EOF while reading sftp packet type");

                sftp_set_error(sftp, SSH_FX_EOF);

                goto error;

            }

        }

    } while (nread < 1);

    packet->type = buffer[0];

    /* Remove the packet type size */

    size -= sizeof(uint8_t);

    nread = ssh_buffer_allocate_size(packet->payload, size);

    if (nread < 0) {

        ssh_set_error_oom(sftp->session);

        sftp_set_error(sftp, SSH_FX_FAILURE);

        goto error;

    }

    while (size > 0 && size < SFTP_PACKET_SIZE_MAX) {

        nread = ssh_channel_read(sftp->channel,

                             buffer,

                             sizeof(buffer) > size ? size : sizeof(buffer),

                             0);

        if (nread < 0) {

            /* TODO: check if there are cases where an error needs to be set here */

            goto error;

        }

        if (nread > 0) {

            rc = ssh_buffer_add_data(packet->payload, buffer, nread);

            if (rc != 0) {

                ssh_set_error_oom(sftp->session);

                sftp_set_error(sftp, SSH_FX_FAILURE);

                goto error;

            }

        } else { /* nread == 0 */

            /* Retry the reading unless the remote was closed */

            is_eof = ssh_channel_is_eof(sftp->channel);

            if (is_eof) {

                ssh_set_error(sftp->session,

                              SSH_REQUEST_DENIED,

                              "Received EOF while reading sftp packet");

                sftp_set_error(sftp, SSH_FX_EOF);

                goto error;

            }

        }

        size -= nread;

    }

    return packet;

error:

    ssh_buffer_reinit(packet->payload);

    return NULL;

}

static void sftp_set_error(sftp_session sftp, int errnum) {

  if (sftp != NULL) {

    sftp->errnum = errnum;

  }

}

/* Get the last sftp error */

int sftp_get_error(sftp_session sftp) {

  if (sftp == NULL) {

    return -1;

  }

  return sftp->errnum;

}

static void sftp_message_free(sftp_message msg)

{

    if (msg == NULL) {

        return;

    }

    SSH_BUFFER_FREE(msg->payload);

    SAFE_FREE(msg);

}

static sftp_message sftp_get_message(sftp_packet packet)

{

    sftp_session sftp = packet->sftp;

    sftp_message msg = NULL;

    int rc;

    switch(packet->type) {

    case SSH_FXP_STATUS:

    case SSH_FXP_HANDLE:

    case SSH_FXP_DATA:

    case SSH_FXP_ATTRS:

    case SSH_FXP_NAME:

    case SSH_FXP_EXTENDED_REPLY:

        break;

    default:

        ssh_set_error(packet->sftp->session,

                      SSH_FATAL,

                      "Unknown packet type %d",

                      packet->type);

        sftp_set_error(packet->sftp, SSH_FX_FAILURE);

        return NULL;

    }

    msg = calloc(1, sizeof(struct sftp_message_struct));

    if (msg == NULL) {

        ssh_set_error_oom(sftp->session);

        sftp_set_error(packet->sftp, SSH_FX_FAILURE);

        return NULL;

    }

    msg->sftp = packet->sftp;

    msg->packet_type = packet->type;

    /* Move the payload from the packet to the message */

    msg->payload = packet->payload;

    packet->payload = NULL;

    rc = ssh_buffer_unpack(msg->payload, "d", &msg->id);

    if (rc != SSH_OK) {

        ssh_set_error(packet->sftp->session, SSH_FATAL,

                "Invalid packet %d: no ID", packet->type);

        sftp_message_free(msg);

        sftp_set_error(packet->sftp, SSH_FX_FAILURE);

        return NULL;

    }

    SSH_LOG(SSH_LOG_PACKET,

            "Packet with id %d type %d",

            msg->id,

            msg->packet_type);

    return msg;

}

static int sftp_read_and_dispatch(sftp_session sftp)

{

    sftp_packet packet = NULL;

    sftp_message msg = NULL;

    packet = sftp_packet_read(sftp);

    if (packet == NULL) {

        /* something nasty happened reading the packet */

        return -1;

    }

    msg = sftp_get_message(packet);

    if (msg == NULL) {

        return -1;

    }

    if (sftp_enqueue(sftp, msg) < 0) {

        sftp_message_free(msg);

        return -1;

    }

    return 0;

}

void sftp_packet_free(sftp_packet packet)

{

  if (packet == NULL) {

    return;

  }

  SSH_BUFFER_FREE(packet->payload);

  free(packet);

}

/* Initialize the sftp session with the server. */

int sftp_init(sftp_session sftp) {

  sftp_packet packet = NULL;

  ssh_buffer buffer = NULL;

  char *ext_name = NULL;

  char *ext_data = NULL;

  uint32_t version;

  int rc;

  buffer = ssh_buffer_new();

  if (buffer == NULL) {

    ssh_set_error_oom(sftp->session);

    sftp_set_error(sftp, SSH_FX_FAILURE);

    return -1;

  }

  rc = ssh_buffer_pack(buffer, "d", LIBSFTP_VERSION);

  if (rc != SSH_OK) {

    ssh_set_error_oom(sftp->session);

    SSH_BUFFER_FREE(buffer);

    sftp_set_error(sftp, SSH_FX_FAILURE);

    return -1;

  }

  if (sftp_packet_write(sftp, SSH_FXP_INIT, buffer) < 0) {

    SSH_BUFFER_FREE(buffer);

    return -1;

  }

  SSH_BUFFER_FREE(buffer);

  packet = sftp_packet_read(sftp);

  if (packet == NULL) {

    return -1;

  }

  if (packet->type != SSH_FXP_VERSION) {

    ssh_set_error(sftp->session, SSH_FATAL,

        "Received a %d messages instead of SSH_FXP_VERSION", packet->type);

    return -1;

  }

  /* TODO: are we sure there are 4 bytes ready? */

  rc = ssh_buffer_unpack(packet->payload, "d", &version);

  if (rc != SSH_OK){

      sftp_set_error(sftp, SSH_FX_FAILURE);

      return -1;

  }

  SSH_LOG(SSH_LOG_PROTOCOL,

      "SFTP server version %d",

      version);

  rc = ssh_buffer_unpack(packet->payload, "s", &ext_name);

  while (rc == SSH_OK) {

    uint32_t count = sftp->ext->count;

    char **tmp;

    rc = ssh_buffer_unpack(packet->payload, "s", &ext_data);

    if (rc == SSH_ERROR) {

      break;

    }

    SSH_LOG(SSH_LOG_PROTOCOL,

        "SFTP server extension: %s, version: %s",

        ext_name, ext_data);

    count++;

    tmp = realloc(sftp->ext->name, count * sizeof(char *));

    if (tmp == NULL) {

      ssh_set_error_oom(sftp->session);

      SAFE_FREE(ext_name);

      SAFE_FREE(ext_data);

      sftp_set_error(sftp, SSH_FX_FAILURE);

      return -1;

    }

    tmp[count - 1] = ext_name;

    sftp->ext->name = tmp;

    tmp = realloc(sftp->ext->data, count * sizeof(char *));

    if (tmp == NULL) {

      ssh_set_error_oom(sftp->session);

      SAFE_FREE(ext_name);

      SAFE_FREE(ext_data);

      sftp_set_error(sftp, SSH_FX_FAILURE);

      return -1;

    }

    tmp[count - 1] = ext_data;

    sftp->ext->data = tmp;

    sftp->ext->count = count;

    rc = ssh_buffer_unpack(packet->payload, "s", &ext_name);

  }

  sftp->version = sftp->server_version = (int)version;

  return 0;

}

unsigned int sftp_extensions_get_count(sftp_session sftp) {

  if (sftp == NULL || sftp->ext == NULL) {

    return 0;

  }

  return sftp->ext->count;

}

const char *sftp_extensions_get_name(sftp_session sftp, unsigned int idx) {

  if (sftp == NULL)

    return NULL;

  if (sftp->ext == NULL || sftp->ext->name == NULL) {

    ssh_set_error_invalid(sftp->session);

    return NULL;

  }

  if (idx > sftp->ext->count) {

    ssh_set_error_invalid(sftp->session);

    return NULL;

  }

  return sftp->ext->name[idx];

}

const char *sftp_extensions_get_data(sftp_session sftp, unsigned int idx) {

  if (sftp == NULL)

    return NULL;

  if (sftp->ext == NULL || sftp->ext->name == NULL) {

    ssh_set_error_invalid(sftp->session);

    return NULL;

  }

  if (idx > sftp->ext->count) {

    ssh_set_error_invalid(sftp->session);

    return NULL;

  }

  return sftp->ext->data[idx];

}

int sftp_extension_supported(sftp_session sftp, const char *name,

    const char *data) {

  size_t i, n;

  if (sftp == NULL || name == NULL || data == NULL) {

    return 0;

  }

  n = sftp_extensions_get_count(sftp);

  for (i = 0; i < n; i++) {

    const char *ext_name = sftp_extensions_get_name(sftp, i);

    const char *ext_data = sftp_extensions_get_data(sftp, i);

    if (ext_name != NULL && ext_data != NULL &&

        strcmp(ext_name, name) == 0 &&

        strcmp(ext_data, data) == 0) {

      return 1;

    }

  }

  return 0;

}

static sftp_request_queue request_queue_new(sftp_message msg) {

  sftp_request_queue queue = NULL;

  queue = calloc(1, sizeof(struct sftp_request_queue_struct));

  if (queue == NULL) {

    ssh_set_error_oom(msg->sftp->session);

    sftp_set_error(msg->sftp, SSH_FX_FAILURE);

    return NULL;

  }

  queue->message = msg;

  return queue;

}

static void request_queue_free(sftp_request_queue queue) {

  if (queue == NULL) {

    return;

  }

  ZERO_STRUCTP(queue);

  SAFE_FREE(queue);

}

static int sftp_enqueue(sftp_session sftp, sftp_message msg) {

  sftp_request_queue queue = NULL;

  sftp_request_queue ptr;

  queue = request_queue_new(msg);

  if (queue == NULL) {

    return -1;

  }

  SSH_LOG(SSH_LOG_PACKET,

      "Queued msg id %d type %d",

      msg->id, msg->packet_type);

  if(sftp->queue == NULL) {

    sftp->queue = queue;

  } else {

    ptr = sftp->queue;

    while(ptr->next) {

      ptr=ptr->next; /* find end of linked list */

    }

    ptr->next = queue; /* add it on bottom */

  }

  return 0;

}

/*

 * Pulls of a message from the queue based on the ID.

 * Returns NULL if no message has been found.

 */

static sftp_message sftp_dequeue(sftp_session sftp, uint32_t id){

  sftp_request_queue prev = NULL;

  sftp_request_queue queue;

  sftp_message msg;

  if(sftp->queue == NULL) {

    return NULL;

  }

  queue = sftp->queue;

  while (queue) {

    if(queue->message->id == id) {

      /* remove from queue */

      if (prev == NULL) {

        sftp->queue = queue->next;

      } else {

        prev->next = queue->next;

      }

      msg = queue->message;

      request_queue_free(queue);

      SSH_LOG(SSH_LOG_PACKET,

          "Dequeued msg id %d type %d",

          msg->id,

          msg->packet_type);

      return msg;

    }

    prev = queue;

    queue = queue->next;

  }