# HG changeset patch # User Matt Johnston # Date 1267027995 0 # Node ID 69e98c45db7c5c8df8d0aea58fcc23739b29700a # Parent ce104c8b0be1ff3f2c2590b7cdc3fd6870c865cd - Progress for allowing specifying a listenaddr for tcp forwards diff -r ce104c8b0be1 -r 69e98c45db7c cli-runopts.c --- a/cli-runopts.c Wed Nov 12 13:13:00 2008 +0000 +++ b/cli-runopts.c Wed Feb 24 16:13:15 2010 +0000 @@ -564,13 +564,15 @@ } #ifdef ENABLE_CLI_ANYTCPFWD -/* Turn a "listenport:remoteaddr:remoteport" string into into a forwarding +/* Turn a "[listenaddr:]listenport:remoteaddr:remoteport" string into into a forwarding * set, and add it to the forwarding list */ static void addforward(const char* origstr, struct TCPFwdList** fwdlist) { + char *part1 = NULL, *part2 = NULL, *part3 = NULL, *part4 = NULL; + char * listenaddr = NULL; char * listenport = NULL; + char * connectaddr = NULL; char * connectport = NULL; - char * connectaddr = NULL; struct TCPFwdList* newfwd = NULL; char * str = NULL; @@ -580,23 +582,41 @@ is never free()d. */ str = m_strdup(origstr); - listenport = str; + part1 = str; - connectaddr = strchr(str, ':'); - if (connectaddr == NULL) { - TRACE(("connectaddr == NULL")) + part2 = strchr(str, ':'); + if (part2 == NULL) { + TRACE(("part2 == NULL")) + goto fail; + } + *part2 = '\0'; + part2++; + + part3 = strchr(part2, ':'); + if (part3 == NULL) { + TRACE(("part3 == NULL")) goto fail; } - *connectaddr = '\0'; - connectaddr++; + *part3 = '\0'; + part3++; + + part4 = strchr(part3, ':'); + if (part4) { + *part4 = '\0'; + part4++; + } - connectport = strchr(connectaddr, ':'); - if (connectport == NULL) { - TRACE(("connectport == NULL")) - goto fail; + if (part4) { + listenaddr = part1; + listenport = part2; + connectaddr = part3; + connectport = part4; + } else { + listenaddr = NULL; + listenport = part1; + connectaddr = part2; + connectport = part3; } - *connectport = '\0'; - connectport++; newfwd = (struct TCPFwdList*)m_malloc(sizeof(struct TCPFwdList)); @@ -612,6 +632,7 @@ goto fail; } + newfwd->listenaddr = listenaddr; newfwd->connectaddr = connectaddr; if (newfwd->listenport > 65535) { diff -r ce104c8b0be1 -r 69e98c45db7c cli-tcpfwd.c --- a/cli-tcpfwd.c Wed Nov 12 13:13:00 2008 +0000 +++ b/cli-tcpfwd.c Wed Feb 24 16:13:15 2010 +0000 @@ -45,7 +45,9 @@ #endif #ifdef ENABLE_CLI_LOCALTCPFWD -static int cli_localtcp(unsigned int listenport, const char* remoteaddr, +static int cli_localtcp(const char* listenaddr, + unsigned int listenport, + const char* remoteaddr, unsigned int remoteport); static const struct ChanType cli_chan_tcplocal = { 1, /* sepfds */ @@ -69,11 +71,14 @@ } while (cli_opts.localfwds != NULL) { - ret = cli_localtcp(cli_opts.localfwds->listenport, + ret = cli_localtcp( + cli_opts.localfwds->listenaddr, + cli_opts.localfwds->listenport, cli_opts.localfwds->connectaddr, cli_opts.localfwds->connectport); if (ret == DROPBEAR_FAILURE) { dropbear_log(LOG_WARNING, "Failed local port forward %d:%s:%d", + cli_opts.localfwds->listenaddr, cli_opts.localfwds->listenport, cli_opts.localfwds->connectaddr, cli_opts.localfwds->connectport); @@ -85,7 +90,9 @@ } -static int cli_localtcp(unsigned int listenport, const char* remoteaddr, +static int cli_localtcp(const char* listenaddr, + unsigned int listenport, + const char* remoteaddr, unsigned int remoteport) { struct TCPListener* tcpinfo = NULL; @@ -99,10 +106,17 @@ tcpinfo->sendaddr = m_strdup(remoteaddr); tcpinfo->sendport = remoteport; - if (opts.listen_fwd_all) { - tcpinfo->listenaddr = m_strdup(""); - } else { - tcpinfo->listenaddr = m_strdup("localhost"); + if (listenaddr) + { + tcpinfo->listenaddr = m_strdup(listenaddr); + } + else + { + if (opts.listen_fwd_all) { + tcpinfo->listenaddr = m_strdup(""); + } else { + tcpinfo->listenaddr = m_strdup("localhost"); + } } tcpinfo->listenport = listenport; @@ -120,7 +134,7 @@ #endif /* ENABLE_CLI_LOCALTCPFWD */ #ifdef ENABLE_CLI_REMOTETCPFWD -static void send_msg_global_request_remotetcp(int port) { +static void send_msg_global_request_remotetcp(const char *addr, int port) { char* listenspec = NULL; TRACE(("enter send_msg_global_request_remotetcp")) @@ -129,13 +143,7 @@ buf_putbyte(ses.writepayload, SSH_MSG_GLOBAL_REQUEST); buf_putstring(ses.writepayload, "tcpip-forward", 13); buf_putbyte(ses.writepayload, 1); /* want_reply */ - if (opts.listen_fwd_all) { - listenspec = ""; - } else { - listenspec = "localhost"; - } - /* TODO: IPv6? */; - buf_putstring(ses.writepayload, listenspec, strlen(listenspec)); + buf_putstring(ses.writepayload, addr, strlen(addr)); buf_putint(ses.writepayload, port); encrypt_packet(); @@ -192,7 +200,17 @@ iter = cli_opts.remotefwds; while (iter != NULL) { - send_msg_global_request_remotetcp(iter->listenport); + if (!iter->listenaddr) + { + // we store the addresses so that we can compare them + // when the server sends them back + if (opts.listen_fwd_all) { + iter->listenaddr = m_strdup(""); + } else { + iter->listenaddr = m_strdup("localhost"); + } + } + send_msg_global_request_remotetcp(iter->listenaddr, iter->listenport); iter = iter->next; } TRACE(("leave setup_remotetcp")) @@ -200,22 +218,22 @@ static int newtcpforwarded(struct Channel * channel) { + char *origaddr = NULL; unsigned int origport; struct TCPFwdList * iter = NULL; char portstring[NI_MAXSERV]; int sock; int err = SSH_OPEN_ADMINISTRATIVELY_PROHIBITED; - /* We don't care what address they connected to */ - buf_eatstring(ses.payload); - + origaddr = buf_getstring(ses.payload, NULL); origport = buf_getint(ses.payload); /* Find which port corresponds */ iter = cli_opts.remotefwds; while (iter != NULL) { - if (origport == iter->listenport) { + if (origport == iter->listenport + && (strcmp(origaddr, iter->listenaddr) == 0)) { break; } iter = iter->next; @@ -223,8 +241,9 @@ if (iter == NULL) { /* We didn't request forwarding on that port */ - dropbear_log(LOG_INFO, "Server send unrequested port, from port %d", - origport); + cleantext(origaddr); + dropbear_log(LOG_INFO, "Server sent unrequested forward from \"%s:%d\"", + origaddr, origport); goto out; } @@ -246,6 +265,7 @@ err = SSH_OPEN_IN_PROGRESS; out: + m_free(origaddr); TRACE(("leave newtcpdirect: err %d", err)) return err; } diff -r ce104c8b0be1 -r 69e98c45db7c svr-tcpfwd.c --- a/svr-tcpfwd.c Wed Nov 12 13:13:00 2008 +0000 +++ b/svr-tcpfwd.c Wed Feb 24 16:13:15 2010 +0000 @@ -206,11 +206,20 @@ tcpinfo = (struct TCPListener*)m_malloc(sizeof(struct TCPListener)); tcpinfo->sendaddr = NULL; tcpinfo->sendport = 0; - tcpinfo->listenaddr = bindaddr; tcpinfo->listenport = port; tcpinfo->chantype = &svr_chan_tcpremote; tcpinfo->tcp_type = forwarded; + if (!opts.listen_fwd_all + || (strcmp(tcpinfo->listenaddr, "localhost") == 0) ) { + // NULL means "localhost only" + tcpinfo->listenaddr = NULL; + } + else + { + tcpinfo->listenaddr = bindaddr; + } + ret = listen_tcpfwd(tcpinfo); out: diff -r ce104c8b0be1 -r 69e98c45db7c tcp-accept.c --- a/tcp-accept.c Wed Nov 12 13:13:00 2008 +0000 +++ b/tcp-accept.c Wed Feb 24 16:13:15 2010 +0000 @@ -104,21 +104,13 @@ struct Listener *listener = NULL; int nsocks; char* errstring = NULL; - /* listen_spec = NULL indicates localhost */ - const char* listen_spec = NULL; TRACE(("enter listen_tcpfwd")) /* first we try to bind, so don't need to do so much cleanup on failure */ snprintf(portstring, sizeof(portstring), "%d", tcpinfo->listenport); - /* a listenaddr of "" will indicate all interfaces */ - if (opts.listen_fwd_all - && (strcmp(tcpinfo->listenaddr, "localhost") != 0) ) { - listen_spec = tcpinfo->listenaddr; - } - - nsocks = dropbear_listen(listen_spec, portstring, socks, + nsocks = dropbear_listen(tcpinfo->listenaddr, portstring, socks, DROPBEAR_MAX_SOCKS, &errstring, &ses.maxfd); if (nsocks < 0) { dropbear_log(LOG_INFO, "TCP forward failed: %s", errstring); diff -r ce104c8b0be1 -r 69e98c45db7c tcpfwd.h --- a/tcpfwd.h Wed Nov 12 13:13:00 2008 +0000 +++ b/tcpfwd.h Wed Feb 24 16:13:15 2010 +0000 @@ -48,6 +48,7 @@ const unsigned char* connectaddr; unsigned int connectport; + const unsigned char* listenaddr; unsigned int listenport; unsigned int have_reply; /* is set to 1 after a reply has been received when setting up the forwarding */