Mercurial > dropbear

comparison svr-tcpfwd.c @ 391:00fcf5045160

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
propagate from branch 'au.asn.ucc.matt.ltc.dropbear' (head c1db4398d56c56c6d06ae1e20c1e0d04dbb598ed) to branch 'au.asn.ucc.matt.dropbear' (head d26d5eb2837f46b56a33fb0e7573aa0201abd4d5)
author Matt Johnston <matt@ucc.asn.au>
date Thu, 11 Jan 2007 04:29:08 +0000
parents 454a34b2dfd1
children b895f91c2ee6
comparison
equal deleted inserted replaced
390:d8e44bef7917 391:00fcf5045160
1 /*
2 * Dropbear SSH
3 *
4 * Copyright (c) 2002,2003 Matt Johnston
5 * Copyright (c) 2004 by Mihnea Stoenescu
6 * All rights reserved.
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
21 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
24 * SOFTWARE. */
25
26 #include "includes.h"
27 #include "ssh.h"
28 #include "tcpfwd.h"
29 #include "dbutil.h"
30 #include "session.h"
31 #include "buffer.h"
32 #include "packet.h"
33 #include "listener.h"
34 #include "runopts.h"
35
36 #ifdef ENABLE_SVR_REMOTETCPFWD
37
38 static void send_msg_request_success();
39 static void send_msg_request_failure();
40 static int svr_cancelremotetcp();
41 static int svr_remotetcpreq();
42 static int newtcpdirect(struct Channel * channel);
43
44
45 const struct ChanType svr_chan_tcpdirect = {
46 1, /* sepfds */
47 "direct-tcpip",
48 newtcpdirect, /* init */
49 NULL, /* checkclose */
50 NULL, /* reqhandler */
51 NULL /* closehandler */
52 };
53
54 static const struct ChanType svr_chan_tcpremote = {
55 1, /* sepfds */
56 "forwarded-tcpip",
57 NULL,
58 NULL,
59 NULL,
60 NULL
61 };
62
63 /* At the moment this is completely used for tcp code (with the name reflecting
64 * that). If new request types are added, this should be replaced with code
65 * similar to the request-switching in chansession.c */
66 void recv_msg_global_request_remotetcp() {
67
68 unsigned char* reqname = NULL;
69 unsigned int namelen;
70 unsigned int wantreply = 0;
71 int ret = DROPBEAR_FAILURE;
72
73 TRACE(("enter recv_msg_global_request_remotetcp"))
74
75 if (svr_opts.noremotetcp) {
76 TRACE(("leave recv_msg_global_request_remotetcp: remote tcp forwarding disabled"))
77 goto out;
78 }
79
80 reqname = buf_getstring(ses.payload, &namelen);
81 wantreply = buf_getbool(ses.payload);
82
83 if (namelen > MAX_NAME_LEN) {
84 TRACE(("name len is wrong: %d", namelen))
85 goto out;
86 }
87
88 if (strcmp("tcpip-forward", reqname) == 0) {
89 ret = svr_remotetcpreq();
90 } else if (strcmp("cancel-tcpip-forward", reqname) == 0) {
91 ret = svr_cancelremotetcp();
92 } else {
93 TRACE(("reqname isn't tcpip-forward: '%s'", reqname))
94 }
95
96 out:
97 if (wantreply) {
98 if (ret == DROPBEAR_SUCCESS) {
99 send_msg_request_success();
100 } else {
101 send_msg_request_failure();
102 }
103 }
104
105 m_free(reqname);
106
107 TRACE(("leave recv_msg_global_request"))
108 }
109
110
111 static void send_msg_request_success() {
112
113 CHECKCLEARTOWRITE();
114 buf_putbyte(ses.writepayload, SSH_MSG_REQUEST_SUCCESS);
115 encrypt_packet();
116
117 }
118
119 static void send_msg_request_failure() {
120
121 CHECKCLEARTOWRITE();
122 buf_putbyte(ses.writepayload, SSH_MSG_REQUEST_FAILURE);
123 encrypt_packet();
124
125 }
126
127 static int matchtcp(void* typedata1, void* typedata2) {
128
129 const struct TCPListener *info1 = (struct TCPListener*)typedata1;
130 const struct TCPListener *info2 = (struct TCPListener*)typedata2;
131
132 return (info1->listenport == info2->listenport)
133 && (info1->chantype == info2->chantype)
134 && (strcmp(info1->listenaddr, info2->listenaddr) == 0);
135 }
136
137 static int svr_cancelremotetcp() {
138
139 int ret = DROPBEAR_FAILURE;
140 unsigned char * bindaddr = NULL;
141 unsigned int addrlen;
142 unsigned int port;
143 struct Listener * listener = NULL;
144 struct TCPListener tcpinfo;
145
146 TRACE(("enter cancelremotetcp"))
147
148 bindaddr = buf_getstring(ses.payload, &addrlen);
149 if (addrlen > MAX_IP_LEN) {
150 TRACE(("addr len too long: %d", addrlen))
151 goto out;
152 }
153
154 port = buf_getint(ses.payload);
155
156 tcpinfo.sendaddr = NULL;
157 tcpinfo.sendport = 0;
158 tcpinfo.listenaddr = bindaddr;
159 tcpinfo.listenport = port;
160 listener = get_listener(CHANNEL_ID_TCPFORWARDED, &tcpinfo, matchtcp);
161 if (listener) {
162 remove_listener( listener );
163 ret = DROPBEAR_SUCCESS;
164 }
165
166 out:
167 m_free(bindaddr);
168 TRACE(("leave cancelremotetcp"))
169 return ret;
170 }
171
172 static int svr_remotetcpreq() {
173
174 int ret = DROPBEAR_FAILURE;
175 unsigned char * bindaddr = NULL;
176 unsigned int addrlen;
177 struct TCPListener *tcpinfo = NULL;
178 unsigned int port;
179
180 TRACE(("enter remotetcpreq"))
181
182 bindaddr = buf_getstring(ses.payload, &addrlen);
183 if (addrlen > MAX_IP_LEN) {
184 TRACE(("addr len too long: %d", addrlen))
185 goto out;
186 }
187
188 port = buf_getint(ses.payload);
189
190 if (port == 0) {
191 dropbear_log(LOG_INFO, "Server chosen tcpfwd ports are unsupported");
192 goto out;
193 }
194
195 if (port < 1 || port > 65535) {
196 TRACE(("invalid port: %d", port))
197 goto out;
198 }
199
200 if (!ses.allowprivport && port < IPPORT_RESERVED) {
201 TRACE(("can't assign port < 1024 for non-root"))
202 goto out;
203 }
204
205 tcpinfo = (struct TCPListener*)m_malloc(sizeof(struct TCPListener));
206 tcpinfo->sendaddr = NULL;
207 tcpinfo->sendport = 0;
208 tcpinfo->listenaddr = bindaddr;
209 tcpinfo->listenport = port;
210 tcpinfo->chantype = &svr_chan_tcpremote;
211 tcpinfo->tcp_type = forwarded;
212
213 ret = listen_tcpfwd(tcpinfo);
214
215 out:
216 if (ret == DROPBEAR_FAILURE) {
217 /* we only free it if a listener wasn't created, since the listener
218 * has to remember it if it's to be cancelled */
219 m_free(bindaddr);
220 m_free(tcpinfo);
221 }
222 TRACE(("leave remotetcpreq"))
223 return ret;
224 }
225
226 /* Called upon creating a new direct tcp channel (ie we connect out to an
227 * address */
228 static int newtcpdirect(struct Channel * channel) {
229
230 unsigned char* desthost = NULL;
231 unsigned int destport;
232 unsigned char* orighost = NULL;
233 unsigned int origport;
234 char portstring[NI_MAXSERV];
235 int sock;
236 int len;
237 int err = SSH_OPEN_ADMINISTRATIVELY_PROHIBITED;
238
239 if (svr_opts.nolocaltcp) {
240 TRACE(("leave newtcpdirect: local tcp forwarding disabled"))
241 goto out;
242 }
243
244 desthost = buf_getstring(ses.payload, &len);
245 if (len > MAX_HOST_LEN) {
246 TRACE(("leave newtcpdirect: desthost too long"))
247 goto out;
248 }
249
250 destport = buf_getint(ses.payload);
251
252 orighost = buf_getstring(ses.payload, &len);
253 if (len > MAX_HOST_LEN) {
254 TRACE(("leave newtcpdirect: orighost too long"))
255 goto out;
256 }
257
258 origport = buf_getint(ses.payload);
259
260 /* best be sure */
261 if (origport > 65535 || destport > 65535) {
262 TRACE(("leave newtcpdirect: port > 65535"))
263 goto out;
264 }
265
266 snprintf(portstring, sizeof(portstring), "%d", destport);
267 sock = connect_remote(desthost, portstring, 1, NULL);
268 if (sock < 0) {
269 err = SSH_OPEN_CONNECT_FAILED;
270 TRACE(("leave newtcpdirect: sock failed"))
271 goto out;
272 }
273
274 ses.maxfd = MAX(ses.maxfd, sock);
275
276 /* We don't set readfd, that will get set after the connection's
277 * progress succeeds */
278 channel->writefd = sock;
279 channel->initconn = 1;
280
281 err = SSH_OPEN_IN_PROGRESS;
282
283 out:
284 m_free(desthost);
285 m_free(orighost);
286 TRACE(("leave newtcpdirect: err %d", err))
287 return err;
288 }
289
290 #endif