Mercurial > dropbear
annotate svr-tcpfwd.c @ 619:35d27c1d0ee7
Fix leak found by Klocwork
author | Matt Johnston <matt@ucc.asn.au> |
---|---|
date | Thu, 07 Apr 2011 13:38:27 +0000 |
parents | 69e98c45db7c |
children | 79d48028457c |
rev | line source |
---|---|
74
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
1 /* |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
2 * Dropbear SSH |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
3 * |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
4 * Copyright (c) 2002,2003 Matt Johnston |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
5 * Copyright (c) 2004 by Mihnea Stoenescu |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
6 * All rights reserved. |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
7 * |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
8 * Permission is hereby granted, free of charge, to any person obtaining a copy |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
9 * of this software and associated documentation files (the "Software"), to deal |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
10 * in the Software without restriction, including without limitation the rights |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
12 * copies of the Software, and to permit persons to whom the Software is |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
13 * furnished to do so, subject to the following conditions: |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
14 * |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
15 * The above copyright notice and this permission notice shall be included in |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
16 * all copies or substantial portions of the Software. |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
17 * |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
21 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
24 * SOFTWARE. */ |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
70
diff
changeset
|
25 |
62 | 26 #include "includes.h" |
27 #include "ssh.h" | |
64 | 28 #include "tcpfwd.h" |
62 | 29 #include "dbutil.h" |
30 #include "session.h" | |
31 #include "buffer.h" | |
32 #include "packet.h" | |
33 #include "listener.h" | |
34 #include "runopts.h" | |
475
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
410
diff
changeset
|
35 #include "auth.h" |
62 | 36 |
156
8c2b3506f112
Rearrange preprocessor parts so that compilation with various options
Matt Johnston <matt@ucc.asn.au>
parents:
74
diff
changeset
|
37 #ifdef ENABLE_SVR_REMOTETCPFWD |
62 | 38 |
39 static void send_msg_request_success(); | |
40 static void send_msg_request_failure(); | |
41 static int svr_cancelremotetcp(); | |
42 static int svr_remotetcpreq(); | |
64 | 43 static int newtcpdirect(struct Channel * channel); |
62 | 44 |
45 | |
46 const struct ChanType svr_chan_tcpdirect = { | |
47 1, /* sepfds */ | |
48 "direct-tcpip", | |
49 newtcpdirect, /* init */ | |
50 NULL, /* checkclose */ | |
51 NULL, /* reqhandler */ | |
52 NULL /* closehandler */ | |
53 }; | |
54 | |
55 static const struct ChanType svr_chan_tcpremote = { | |
56 1, /* sepfds */ | |
57 "forwarded-tcpip", | |
58 NULL, | |
59 NULL, | |
60 NULL, | |
61 NULL | |
62 }; | |
63 | |
64 /* At the moment this is completely used for tcp code (with the name reflecting | |
65 * that). If new request types are added, this should be replaced with code | |
66 * similar to the request-switching in chansession.c */ | |
67 void recv_msg_global_request_remotetcp() { | |
68 | |
69 unsigned char* reqname = NULL; | |
70 unsigned int namelen; | |
71 unsigned int wantreply = 0; | |
72 int ret = DROPBEAR_FAILURE; | |
73 | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
74 TRACE(("enter recv_msg_global_request_remotetcp")) |
62 | 75 |
475
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
410
diff
changeset
|
76 if (svr_opts.noremotetcp || !svr_pubkey_allows_tcpfwd()) { |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
77 TRACE(("leave recv_msg_global_request_remotetcp: remote tcp forwarding disabled")) |
62 | 78 goto out; |
79 } | |
80 | |
81 reqname = buf_getstring(ses.payload, &namelen); | |
179
161557a9dde8
* fix longstanding bug with connections being closed on failure to
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
82 wantreply = buf_getbool(ses.payload); |
62 | 83 |
267
7ce577234a10
* svr-tcpfwd.c: should be MAX_NAME_LEN not MAXNAMLEN
Matt Johnston <matt@ucc.asn.au>
parents:
259
diff
changeset
|
84 if (namelen > MAX_NAME_LEN) { |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
85 TRACE(("name len is wrong: %d", namelen)) |
62 | 86 goto out; |
87 } | |
88 | |
89 if (strcmp("tcpip-forward", reqname) == 0) { | |
90 ret = svr_remotetcpreq(); | |
91 } else if (strcmp("cancel-tcpip-forward", reqname) == 0) { | |
92 ret = svr_cancelremotetcp(); | |
93 } else { | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
94 TRACE(("reqname isn't tcpip-forward: '%s'", reqname)) |
62 | 95 } |
96 | |
97 out: | |
98 if (wantreply) { | |
99 if (ret == DROPBEAR_SUCCESS) { | |
100 send_msg_request_success(); | |
101 } else { | |
102 send_msg_request_failure(); | |
103 } | |
104 } | |
105 | |
106 m_free(reqname); | |
107 | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
108 TRACE(("leave recv_msg_global_request")) |
62 | 109 } |
110 | |
111 | |
112 static void send_msg_request_success() { | |
113 | |
114 CHECKCLEARTOWRITE(); | |
115 buf_putbyte(ses.writepayload, SSH_MSG_REQUEST_SUCCESS); | |
116 encrypt_packet(); | |
117 | |
118 } | |
119 | |
120 static void send_msg_request_failure() { | |
121 | |
122 CHECKCLEARTOWRITE(); | |
123 buf_putbyte(ses.writepayload, SSH_MSG_REQUEST_FAILURE); | |
124 encrypt_packet(); | |
125 | |
126 } | |
127 | |
128 static int matchtcp(void* typedata1, void* typedata2) { | |
129 | |
130 const struct TCPListener *info1 = (struct TCPListener*)typedata1; | |
131 const struct TCPListener *info2 = (struct TCPListener*)typedata2; | |
132 | |
258
306499676384
* add -g (dbclient) and -a (dropbear) options for allowing non-local
Matt Johnston <matt@ucc.asn.au>
parents:
253
diff
changeset
|
133 return (info1->listenport == info2->listenport) |
62 | 134 && (info1->chantype == info2->chantype) |
258
306499676384
* add -g (dbclient) and -a (dropbear) options for allowing non-local
Matt Johnston <matt@ucc.asn.au>
parents:
253
diff
changeset
|
135 && (strcmp(info1->listenaddr, info2->listenaddr) == 0); |
62 | 136 } |
137 | |
138 static int svr_cancelremotetcp() { | |
139 | |
140 int ret = DROPBEAR_FAILURE; | |
141 unsigned char * bindaddr = NULL; | |
142 unsigned int addrlen; | |
143 unsigned int port; | |
144 struct Listener * listener = NULL; | |
145 struct TCPListener tcpinfo; | |
146 | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
147 TRACE(("enter cancelremotetcp")) |
62 | 148 |
149 bindaddr = buf_getstring(ses.payload, &addrlen); | |
150 if (addrlen > MAX_IP_LEN) { | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
151 TRACE(("addr len too long: %d", addrlen)) |
62 | 152 goto out; |
153 } | |
154 | |
155 port = buf_getint(ses.payload); | |
156 | |
258
306499676384
* add -g (dbclient) and -a (dropbear) options for allowing non-local
Matt Johnston <matt@ucc.asn.au>
parents:
253
diff
changeset
|
157 tcpinfo.sendaddr = NULL; |
306499676384
* add -g (dbclient) and -a (dropbear) options for allowing non-local
Matt Johnston <matt@ucc.asn.au>
parents:
253
diff
changeset
|
158 tcpinfo.sendport = 0; |
306499676384
* add -g (dbclient) and -a (dropbear) options for allowing non-local
Matt Johnston <matt@ucc.asn.au>
parents:
253
diff
changeset
|
159 tcpinfo.listenaddr = bindaddr; |
306499676384
* add -g (dbclient) and -a (dropbear) options for allowing non-local
Matt Johnston <matt@ucc.asn.au>
parents:
253
diff
changeset
|
160 tcpinfo.listenport = port; |
62 | 161 listener = get_listener(CHANNEL_ID_TCPFORWARDED, &tcpinfo, matchtcp); |
162 if (listener) { | |
163 remove_listener( listener ); | |
164 ret = DROPBEAR_SUCCESS; | |
165 } | |
166 | |
167 out: | |
168 m_free(bindaddr); | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
169 TRACE(("leave cancelremotetcp")) |
62 | 170 return ret; |
171 } | |
172 | |
173 static int svr_remotetcpreq() { | |
174 | |
175 int ret = DROPBEAR_FAILURE; | |
176 unsigned char * bindaddr = NULL; | |
177 unsigned int addrlen; | |
178 struct TCPListener *tcpinfo = NULL; | |
179 unsigned int port; | |
180 | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
181 TRACE(("enter remotetcpreq")) |
62 | 182 |
183 bindaddr = buf_getstring(ses.payload, &addrlen); | |
184 if (addrlen > MAX_IP_LEN) { | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
185 TRACE(("addr len too long: %d", addrlen)) |
62 | 186 goto out; |
187 } | |
188 | |
189 port = buf_getint(ses.payload); | |
190 | |
191 if (port == 0) { | |
192 dropbear_log(LOG_INFO, "Server chosen tcpfwd ports are unsupported"); | |
193 goto out; | |
194 } | |
195 | |
196 if (port < 1 || port > 65535) { | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
197 TRACE(("invalid port: %d", port)) |
62 | 198 goto out; |
199 } | |
200 | |
201 if (!ses.allowprivport && port < IPPORT_RESERVED) { | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
202 TRACE(("can't assign port < 1024 for non-root")) |
62 | 203 goto out; |
204 } | |
205 | |
206 tcpinfo = (struct TCPListener*)m_malloc(sizeof(struct TCPListener)); | |
258
306499676384
* add -g (dbclient) and -a (dropbear) options for allowing non-local
Matt Johnston <matt@ucc.asn.au>
parents:
253
diff
changeset
|
207 tcpinfo->sendaddr = NULL; |
306499676384
* add -g (dbclient) and -a (dropbear) options for allowing non-local
Matt Johnston <matt@ucc.asn.au>
parents:
253
diff
changeset
|
208 tcpinfo->sendport = 0; |
64 | 209 tcpinfo->listenport = port; |
62 | 210 tcpinfo->chantype = &svr_chan_tcpremote; |
259
c049490e43fe
* fix -L forwarding on the client, broke last rev
Matt Johnston <matt@ucc.asn.au>
parents:
258
diff
changeset
|
211 tcpinfo->tcp_type = forwarded; |
62 | 212 |
577
69e98c45db7c
- Progress for allowing specifying a listenaddr for tcp forwards
Matt Johnston <matt@ucc.asn.au>
parents:
475
diff
changeset
|
213 if (!opts.listen_fwd_all |
69e98c45db7c
- Progress for allowing specifying a listenaddr for tcp forwards
Matt Johnston <matt@ucc.asn.au>
parents:
475
diff
changeset
|
214 || (strcmp(tcpinfo->listenaddr, "localhost") == 0) ) { |
69e98c45db7c
- Progress for allowing specifying a listenaddr for tcp forwards
Matt Johnston <matt@ucc.asn.au>
parents:
475
diff
changeset
|
215 // NULL means "localhost only" |
619 | 216 m_free(bindaddr); |
217 bindaddr = NULL; | |
577
69e98c45db7c
- Progress for allowing specifying a listenaddr for tcp forwards
Matt Johnston <matt@ucc.asn.au>
parents:
475
diff
changeset
|
218 } |
619 | 219 tcpinfo->listenaddr = bindaddr; |
577
69e98c45db7c
- Progress for allowing specifying a listenaddr for tcp forwards
Matt Johnston <matt@ucc.asn.au>
parents:
475
diff
changeset
|
220 |
62 | 221 ret = listen_tcpfwd(tcpinfo); |
222 | |
223 out: | |
224 if (ret == DROPBEAR_FAILURE) { | |
225 /* we only free it if a listener wasn't created, since the listener | |
226 * has to remember it if it's to be cancelled */ | |
340 | 227 m_free(bindaddr); |
62 | 228 m_free(tcpinfo); |
229 } | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
230 TRACE(("leave remotetcpreq")) |
62 | 231 return ret; |
232 } | |
64 | 233 |
234 /* Called upon creating a new direct tcp channel (ie we connect out to an | |
235 * address */ | |
236 static int newtcpdirect(struct Channel * channel) { | |
237 | |
238 unsigned char* desthost = NULL; | |
239 unsigned int destport; | |
240 unsigned char* orighost = NULL; | |
241 unsigned int origport; | |
242 char portstring[NI_MAXSERV]; | |
243 int sock; | |
244 int len; | |
70
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
64
diff
changeset
|
245 int err = SSH_OPEN_ADMINISTRATIVELY_PROHIBITED; |
64 | 246 |
475
52a644e7b8e1
* Patch from Frédéric Moulins adding options to authorized_keys.
Matt Johnston <matt@ucc.asn.au>
parents:
410
diff
changeset
|
247 if (svr_opts.nolocaltcp || !svr_pubkey_allows_tcpfwd()) { |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
248 TRACE(("leave newtcpdirect: local tcp forwarding disabled")) |
64 | 249 goto out; |
250 } | |
251 | |
252 desthost = buf_getstring(ses.payload, &len); | |
253 if (len > MAX_HOST_LEN) { | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
254 TRACE(("leave newtcpdirect: desthost too long")) |
64 | 255 goto out; |
256 } | |
257 | |
258 destport = buf_getint(ses.payload); | |
259 | |
260 orighost = buf_getstring(ses.payload, &len); | |
261 if (len > MAX_HOST_LEN) { | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
262 TRACE(("leave newtcpdirect: orighost too long")) |
64 | 263 goto out; |
264 } | |
265 | |
266 origport = buf_getint(ses.payload); | |
267 | |
268 /* best be sure */ | |
269 if (origport > 65535 || destport > 65535) { | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
270 TRACE(("leave newtcpdirect: port > 65535")) |
64 | 271 goto out; |
272 } | |
273 | |
274 snprintf(portstring, sizeof(portstring), "%d", destport); | |
275 sock = connect_remote(desthost, portstring, 1, NULL); | |
276 if (sock < 0) { | |
70
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
64
diff
changeset
|
277 err = SSH_OPEN_CONNECT_FAILED; |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
278 TRACE(("leave newtcpdirect: sock failed")) |
64 | 279 goto out; |
280 } | |
281 | |
282 ses.maxfd = MAX(ses.maxfd, sock); | |
283 | |
253
84925eceeb13
* rename infd/outfd to writefd/readfd, to avoid confusion
Matt Johnston <matt@ucc.asn.au>
parents:
179
diff
changeset
|
284 /* We don't set readfd, that will get set after the connection's |
64 | 285 * progress succeeds */ |
253
84925eceeb13
* rename infd/outfd to writefd/readfd, to avoid confusion
Matt Johnston <matt@ucc.asn.au>
parents:
179
diff
changeset
|
286 channel->writefd = sock; |
64 | 287 channel->initconn = 1; |
288 | |
70
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
64
diff
changeset
|
289 err = SSH_OPEN_IN_PROGRESS; |
64 | 290 |
291 out: | |
292 m_free(desthost); | |
293 m_free(orighost); | |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
156
diff
changeset
|
294 TRACE(("leave newtcpdirect: err %d", err)) |
70
b0316ce64e4b
Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents:
64
diff
changeset
|
295 return err; |
64 | 296 } |
297 | |
62 | 298 #endif |