A source like [-oProxyCommand=CMD]:/path passes the bracket-parsing
check in find_base_path() and ends up as -oProxyCommand=CMD in the
ssh argv. When sftp_server is a path, ssh gets a destination argument
and executes the injected ProxyCommand before connecting.
Reject hostnames starting with - after bracket stripping, and add --
before the hostname in the ssh command line so positional args can't
be misread as options.
A malicious SFTP server can return symlink targets that the local
kernel VFS resolves outside the mount root, enabling local file reads
or writes through ordinary operations like cp following a symlink.
Add a contain_symlinks option (default on) that rejects absolute
symlink targets and any target containing a `..` component, returning
EPERM. Users who need legacy pass-through for trusted servers can opt
out with -o no_contain_symlinks.
The check is purely lexical and deliberately strict: in an adversarial
filesystem the server controls intermediate path components, so any
non-`..` component could be a symlink anywhere, making lexical depth
tracking unreliable. Rejecting absolute and any `..` is the simplest
rule that is provably complete against the threat model.
transform_symlinks composes poorly with containment because transformed
results often contain `..`; a warning is emitted when both are enabled.
Tests cover default-on containment (readlink + open/stat traversal),
opt-out behavior, transform_symlinks interaction (both arms), and
option precedence.
sshfs_release looked up the conntab entry by path, but sshfs_rename
moves that entry to the new path. Closing the original handle after a
rename can miss the entry and dereference NULL.
Store the conntab_entry pointer on sshfs_file and use it for release
and open-failure cleanup. Add a regression test for open -> rename -> close.
On macOS, sshfs.blksize is set to 0. The statfs fallback path
(used when the server lacks the statvfs extension) divides by
f_frsize, which inherits that zero. Use 4096 as the default.
macFUSE will create the mounpoint (in case it does not exist) before
mounting the volume. This allows unprivileged users to mount volumes
under /Volumes.
Windows native OpenSSH has alternative behavior for standard I/O
descriptors, which can be selected through the OPENSSH_STDIO_MODE
environement variable. Setting it to "nonsock" is required for
sshfs compatibility.
See https://github.com/PowerShell/openssh-portable/pull/759
for details.
"sshfs -o vsock=CID:PORT" will cause sshfs to connect directly to the
given vsock, bypassing ssh, and allowing high performance sshfs mounts
of a VM guest.
Added a secondary check so if a mkdir request fails with EPERM an access request will be tried - returning EEXIST if the access was successful. This matches the correct behaviour expected by applications such as git.
Co-authored-by: Peter Belm <peter.belm@dataalchemist.co.uk>
If ssh is configured to use "Match exec" and the previous working
directory is the mount point, then the shell (bash) hangs calling
stat() on OLDPWD.
Unset OLDPWD so that this doesn't happen.
Fixes#206.
The -o max_conns=N option causes multiple SSH processes and response processing threads to
be created. This means that e.g. reading a large file no longer blocks all access to the
filesystem.
The connection is chosen by checking the per-connection statistics:
1. Choose connection with least outstanding requests; if it's a tie,
2. choose connection with least directory handles; if it's a tie,
3. choose connection with least file handles; if it's a tie,
4. choose connection which has already been established.
The implementation assumes that the max_conns values will be small; it
uses linear search.
Example benchmark:
With single connection:
$ sshfs -o max_conns=1,workaround=nobuflimit ebox: mnt
$ cat mnt/tmp/bigfile > /dev/null &
$ time find mnt > /dev/null
real 1m50.432s
user 0m0.133s
sys 0m0.467s
With multiple connections:
$ ~/in-progress/sshfs/build/sshfs -o max_conns=5,workaround=nobuflimit ebox: mnt
$ cat mnt/tmp/bigfile > /dev/null &
$ time find mnt > /dev/null
real 1m15.338s
user 0m0.142s
sys 0m0.491s
This feature was implemented to large extend by Timo Savola <timo.savola@iki.fi>. Thanks
to CEA.fr for sponsoring the remaining work to complete this feature and integrate it into
SSHFS!
Variables of this kind are created in sshfs_open_common() and freed
in sshfs_release(). Since sshfs_release() calls sshfs_flush(), there
can be no pending write requests before at the time of freeing, so
there is no need for reference counting.
* Use logical not for booleans
Fixes a gcc 7.4.0 complaint:
sshfs.c:1743:28: warning: ‘~’ on a boolean expression [-Wbool-operation]
sshfs.c:1743:28: note: did you mean to use logical not?
* strdup argument to keep it alive after function return
Fixes gcc 7.4.0 complaint:
sshfs.c: In function ‘sshfs_opt_proc’:
sshfs.c:3488:50: warning: assignment discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
The standard header for the poll(3) interface is poll.h[0]. This prevents
a warning when building with musl libc:
In file included from sshfs.c:44:
/usr/include/sys/poll.h:1:2: warning: #warning redirecting incorrect #include <sys/poll.h> to <poll.h> [-Wcpp]
#warning redirecting incorrect #include <sys/poll.h> to <poll.h>
^~~~~~~
[0] https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/poll.h.html
When using the "ssh_command" option, commands with multiple spaces in a
row will not be properly parsed. Example:
Properly parsed:
ssh_command = "ssh -o IdentityFile=~/.ssh/id_rsa"
Improperly parsed:
ssh_command = "ssh -o IdentityFile=~/.ssh/id_rsa"
This commit changes the ssh_command parsing logic so that both of the
above examples are considered valid and properly handled.
Fixes: #114.
The current definition of the clean_req() function produces a compiler
warning as it expects 2 parameters but GHRFunc expects 3. This commit
resolves issue #157.
The manpage says that -o idmap=user maps the UID and GID, but it
apparently only mapped the UID. The code was in place to map the GID as
well, but it was hidden behind #ifdef __APPLE__. This commit removes
those #ifdefs, and in a couple of cases the code inside an #else, to
make the option behave as documented.
In libfuse<3, when `fstat_workaround` was true, that meant to always
use the `path` argument to resolve fgetattr instead of the supplied
handle. Before this change, the logic was interpreting
`fstat_workaround` to not use the `path` argument when it was
true. This change reverts to the libfuse<3 behavior.
h4sh