release/src/router/dropbear/svr-tcpfwd.c

   1 /*
   2  * Dropbear SSH
   3  *
   4  * Copyright (c) 2002,2003 Matt Johnston
   5  * Copyright (c) 2004 by Mihnea Stoenescu
   6  * All rights reserved.
   7  *
   8  * Permission is hereby granted, free of charge, to any person obtaining a copy
   9  * of this software and associated documentation files (the "Software"), to deal
  10  * in the Software without restriction, including without limitation the rights
  11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  12  * copies of the Software, and to permit persons to whom the Software is
  13  * furnished to do so, subject to the following conditions:
  14  *
  15  * The above copyright notice and this permission notice shall be included in
  16  * all copies or substantial portions of the Software.
  17  *
  18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  21  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  24  * SOFTWARE. */
  25
  26 #include "includes.h"
  27 #include "ssh.h"
  28 #include "tcpfwd.h"
  29 #include "dbutil.h"
  30 #include "session.h"
  31 #include "buffer.h"
  32 #include "packet.h"
  33 #include "listener.h"
  34 #include "runopts.h"
  35 #include "auth.h"
  36
  37 static void send_msg_request_failure();
  38
  39 static void send_msg_request_failure() {
  40         CHECKCLEARTOWRITE();
  41         buf_putbyte(ses.writepayload, SSH_MSG_REQUEST_FAILURE);
  42         encrypt_packet();
  43 }
  44
  45 #ifndef ENABLE_SVR_REMOTETCPFWD
  46
  47 /* This is better than SSH_MSG_UNIMPLEMENTED */
  48 void recv_msg_global_request_remotetcp() {
  49                 TRACE(("recv_msg_global_request_remotetcp: remote tcp forwarding not compiled in"))
  50                 send_msg_request_failure();
  51 }
  52
  53 /* */
  54 #endif /* !ENABLE_SVR_REMOTETCPFWD */
  55
  56 static void send_msg_request_success();
  57 static int svr_cancelremotetcp();
  58 static int svr_remotetcpreq();
  59 static int newtcpdirect(struct Channel * channel);
  60
  61 #ifdef ENABLE_SVR_REMOTETCPFWD
  62 static const struct ChanType svr_chan_tcpremote = {
  63         1, /* sepfds */
  64         "forwarded-tcpip",
  65         NULL,
  66         NULL,
  67         NULL,
  68         NULL
  69 };
  70
  71 /* At the moment this is completely used for tcp code (with the name reflecting
  72  * that). If new request types are added, this should be replaced with code
  73  * similar to the request-switching in chansession.c */
  74 void recv_msg_global_request_remotetcp() {
  75
  76         unsigned char* reqname = NULL;
  77         unsigned int namelen;
  78         unsigned int wantreply = 0;
  79         int ret = DROPBEAR_FAILURE;
  80
  81         TRACE(("enter recv_msg_global_request_remotetcp"))
  82
  83         if (svr_opts.noremotetcp || !svr_pubkey_allows_tcpfwd()) {
  84                 TRACE(("leave recv_msg_global_request_remotetcp: remote tcp forwarding disabled"))
  85                 goto out;
  86         }
  87
  88         reqname = buf_getstring(ses.payload, &namelen);
  89         wantreply = buf_getbool(ses.payload);
  90
  91         if (namelen > MAX_NAME_LEN) {
  92                 TRACE(("name len is wrong: %d", namelen))
  93                 goto out;
  94         }
  95
  96         if (strcmp("tcpip-forward", reqname) == 0) {
  97                 ret = svr_remotetcpreq();
  98         } else if (strcmp("cancel-tcpip-forward", reqname) == 0) {
  99                 ret = svr_cancelremotetcp();
 100         } else {
 101                 TRACE(("reqname isn't tcpip-forward: '%s'", reqname))
 102         }
 103
 104 out:
 105         if (wantreply) {
 106                 if (ret == DROPBEAR_SUCCESS) {
 107                         send_msg_request_success();
 108                 } else {
 109                         send_msg_request_failure();
 110                 }
 111         }
 112
 113         m_free(reqname);
 114
 115         TRACE(("leave recv_msg_global_request"))
 116 }
 117
 118
 119 static void send_msg_request_success() {
 120
 121         CHECKCLEARTOWRITE();
 122         buf_putbyte(ses.writepayload, SSH_MSG_REQUEST_SUCCESS);
 123         encrypt_packet();
 124
 125 }
 126
 127 static int matchtcp(void* typedata1, void* typedata2) {
 128
 129         const struct TCPListener *info1 = (struct TCPListener*)typedata1;
 130         const struct TCPListener *info2 = (struct TCPListener*)typedata2;
 131
 132         return (info1->listenport == info2->listenport)
 133                         && (info1->chantype == info2->chantype)
 134                         && (strcmp(info1->listenaddr, info2->listenaddr) == 0);
 135 }
 136
 137 static int svr_cancelremotetcp() {
 138
 139         int ret = DROPBEAR_FAILURE;
 140         unsigned char * bindaddr = NULL;
 141         unsigned int addrlen;
 142         unsigned int port;
 143         struct Listener * listener = NULL;
 144         struct TCPListener tcpinfo;
 145
 146         TRACE(("enter cancelremotetcp"))
 147
 148         bindaddr = buf_getstring(ses.payload, &addrlen);
 149         if (addrlen > MAX_IP_LEN) {
 150                 TRACE(("addr len too long: %d", addrlen))
 151                 goto out;
 152         }
 153
 154         port = buf_getint(ses.payload);
 155
 156         tcpinfo.sendaddr = NULL;
 157         tcpinfo.sendport = 0;
 158         tcpinfo.listenaddr = bindaddr;
 159         tcpinfo.listenport = port;
 160         listener = get_listener(CHANNEL_ID_TCPFORWARDED, &tcpinfo, matchtcp);
 161         if (listener) {
 162                 remove_listener( listener );
 163                 ret = DROPBEAR_SUCCESS;
 164         }
 165
 166 out:
 167         m_free(bindaddr);
 168         TRACE(("leave cancelremotetcp"))
 169         return ret;
 170 }
 171
 172 static int svr_remotetcpreq() {
 173
 174         int ret = DROPBEAR_FAILURE;
 175         unsigned char * request_addr = NULL;
 176         unsigned int addrlen;
 177         struct TCPListener *tcpinfo = NULL;
 178         unsigned int port;
 179
 180         TRACE(("enter remotetcpreq"))
 181
 182         request_addr = buf_getstring(ses.payload, &addrlen);
 183         if (addrlen > MAX_IP_LEN) {
 184                 TRACE(("addr len too long: %d", addrlen))
 185                 goto out;
 186         }
 187
 188         port = buf_getint(ses.payload);
 189
 190         if (port == 0) {
 191                 dropbear_log(LOG_INFO, "Server chosen tcpfwd ports are unsupported");
 192                 goto out;
 193         }
 194
 195         if (port < 1 || port > 65535) {
 196                 TRACE(("invalid port: %d", port))
 197                 goto out;
 198         }
 199
 200         if (!ses.allowprivport && port < IPPORT_RESERVED) {
 201                 TRACE(("can't assign port < 1024 for non-root"))
 202                 goto out;
 203         }
 204
 205         tcpinfo = (struct TCPListener*)m_malloc(sizeof(struct TCPListener));
 206         tcpinfo->sendaddr = NULL;
 207         tcpinfo->sendport = 0;
 208         tcpinfo->listenport = port;
 209         tcpinfo->chantype = &svr_chan_tcpremote;
 210         tcpinfo->tcp_type = forwarded;
 211
 212         tcpinfo->request_listenaddr = request_addr;
 213         if (!opts.listen_fwd_all || (strcmp(request_addr, "localhost") == 0) ) {
 214         /* NULL means "localhost only" */
 215                 tcpinfo->listenaddr = NULL;
 216         }
 217         else
 218         {
 219                 tcpinfo->listenaddr = request_addr;
 220         }
 221
 222         ret = listen_tcpfwd(tcpinfo);
 223
 224 out:
 225         if (ret == DROPBEAR_FAILURE) {
 226                 /* we only free it if a listener wasn't created, since the listener
 227                  * has to remember it if it's to be cancelled */
 228                 m_free(request_addr);
 229                 m_free(tcpinfo);
 230         }
 231         TRACE(("leave remotetcpreq"))
 232         return ret;
 233 }
 234
 235 #endif /* ENABLE_SVR_REMOTETCPFWD */
 236
 237 #ifdef ENABLE_SVR_LOCALTCPFWD
 238
 239 const struct ChanType svr_chan_tcpdirect = {
 240         1, /* sepfds */
 241         "direct-tcpip",
 242         newtcpdirect, /* init */
 243         NULL, /* checkclose */
 244         NULL, /* reqhandler */
 245         NULL /* closehandler */
 246 };
 247
 248 /* Called upon creating a new direct tcp channel (ie we connect out to an
 249  * address */
 250 static int newtcpdirect(struct Channel * channel) {
 251
 252         unsigned char* desthost = NULL;
 253         unsigned int destport;
 254         unsigned char* orighost = NULL;
 255         unsigned int origport;
 256         char portstring[NI_MAXSERV];
 257         int sock;
 258         int len;
 259         int err = SSH_OPEN_ADMINISTRATIVELY_PROHIBITED;
 260
 261         if (svr_opts.nolocaltcp || !svr_pubkey_allows_tcpfwd()) {
 262                 TRACE(("leave newtcpdirect: local tcp forwarding disabled"))
 263                 goto out;
 264         }
 265
 266         desthost = buf_getstring(ses.payload, &len);
 267         if (len > MAX_HOST_LEN) {
 268                 TRACE(("leave newtcpdirect: desthost too long"))
 269                 goto out;
 270         }
 271
 272         destport = buf_getint(ses.payload);
 273
 274         orighost = buf_getstring(ses.payload, &len);
 275         if (len > MAX_HOST_LEN) {
 276                 TRACE(("leave newtcpdirect: orighost too long"))
 277                 goto out;
 278         }
 279
 280         origport = buf_getint(ses.payload);
 281
 282         /* best be sure */
 283         if (origport > 65535 || destport > 65535) {
 284                 TRACE(("leave newtcpdirect: port > 65535"))
 285                 goto out;
 286         }
 287
 288         snprintf(portstring, sizeof(portstring), "%d", destport);
 289         sock = connect_remote(desthost, portstring, 1, NULL);
 290         if (sock < 0) {
 291                 err = SSH_OPEN_CONNECT_FAILED;
 292                 TRACE(("leave newtcpdirect: sock failed"))
 293                 goto out;
 294         }
 295
 296         ses.maxfd = MAX(ses.maxfd, sock);
 297
 298          /* We don't set readfd, that will get set after the connection's
 299          * progress succeeds */
 300         channel->writefd = sock;
 301         channel->initconn = 1;
 302
 303         err = SSH_OPEN_IN_PROGRESS;
 304
 305 out:
 306         m_free(desthost);
 307         m_free(orighost);
 308         TRACE(("leave newtcpdirect: err %d", err))
 309         return err;
 310 }
 311
 312 #endif /* ENABLE_SVR_LOCALTCPFWD */