release/src/router/dropbear/svr-tcpfwd.c

   1 /*
   2  * Dropbear SSH
   3  *
   4  * Copyright (c) 2002,2003 Matt Johnston
   5  * Copyright (c) 2004 by Mihnea Stoenescu
   6  * All rights reserved.
   7  *
   8  * Permission is hereby granted, free of charge, to any person obtaining a copy
   9  * of this software and associated documentation files (the "Software"), to deal
  10  * in the Software without restriction, including without limitation the rights
  11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  12  * copies of the Software, and to permit persons to whom the Software is
  13  * furnished to do so, subject to the following conditions:
  14  *
  15  * The above copyright notice and this permission notice shall be included in
  16  * all copies or substantial portions of the Software.
  17  *
  18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  21  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  24  * SOFTWARE. */
  25
  26 #include "includes.h"
  27 #include "ssh.h"
  28 #include "tcpfwd.h"
  29 #include "dbutil.h"
  30 #include "session.h"
  31 #include "buffer.h"
  32 #include "packet.h"
  33 #include "listener.h"
  34 #include "runopts.h"
  35 #include "auth.h"
  36
  37 #ifdef ENABLE_SVR_REMOTETCPFWD
  38
  39 static void send_msg_request_success();
  40 static void send_msg_request_failure();
  41 static int svr_cancelremotetcp();
  42 static int svr_remotetcpreq();
  43 static int newtcpdirect(struct Channel * channel);
  44
  45
  46 const struct ChanType svr_chan_tcpdirect = {
  47         1, /* sepfds */
  48         "direct-tcpip",
  49         newtcpdirect, /* init */
  50         NULL, /* checkclose */
  51         NULL, /* reqhandler */
  52         NULL /* closehandler */
  53 };
  54
  55 static const struct ChanType svr_chan_tcpremote = {
  56         1, /* sepfds */
  57         "forwarded-tcpip",
  58         NULL,
  59         NULL,
  60         NULL,
  61         NULL
  62 };
  63
  64 /* At the moment this is completely used for tcp code (with the name reflecting
  65  * that). If new request types are added, this should be replaced with code
  66  * similar to the request-switching in chansession.c */
  67 void recv_msg_global_request_remotetcp() {
  68
  69         unsigned char* reqname = NULL;
  70         unsigned int namelen;
  71         unsigned int wantreply = 0;
  72         int ret = DROPBEAR_FAILURE;
  73
  74         TRACE(("enter recv_msg_global_request_remotetcp"))
  75
  76         if (svr_opts.noremotetcp || !svr_pubkey_allows_tcpfwd()) {
  77                 TRACE(("leave recv_msg_global_request_remotetcp: remote tcp forwarding disabled"))
  78                 goto out;
  79         }
  80
  81         reqname = buf_getstring(ses.payload, &namelen);
  82         wantreply = buf_getbool(ses.payload);
  83
  84         if (namelen > MAX_NAME_LEN) {
  85                 TRACE(("name len is wrong: %d", namelen))
  86                 goto out;
  87         }
  88
  89         if (strcmp("tcpip-forward", reqname) == 0) {
  90                 ret = svr_remotetcpreq();
  91         } else if (strcmp("cancel-tcpip-forward", reqname) == 0) {
  92                 ret = svr_cancelremotetcp();
  93         } else {
  94                 TRACE(("reqname isn't tcpip-forward: '%s'", reqname))
  95         }
  96
  97 out:
  98         if (wantreply) {
  99                 if (ret == DROPBEAR_SUCCESS) {
 100                         send_msg_request_success();
 101                 } else {
 102                         send_msg_request_failure();
 103                 }
 104         }
 105
 106         m_free(reqname);
 107
 108         TRACE(("leave recv_msg_global_request"))
 109 }
 110
 111
 112 static void send_msg_request_success() {
 113
 114         CHECKCLEARTOWRITE();
 115         buf_putbyte(ses.writepayload, SSH_MSG_REQUEST_SUCCESS);
 116         encrypt_packet();
 117
 118 }
 119
 120 static void send_msg_request_failure() {
 121
 122         CHECKCLEARTOWRITE();
 123         buf_putbyte(ses.writepayload, SSH_MSG_REQUEST_FAILURE);
 124         encrypt_packet();
 125
 126 }
 127
 128 static int matchtcp(void* typedata1, void* typedata2) {
 129
 130         const struct TCPListener *info1 = (struct TCPListener*)typedata1;
 131         const struct TCPListener *info2 = (struct TCPListener*)typedata2;
 132
 133         return (info1->listenport == info2->listenport)
 134                         && (info1->chantype == info2->chantype)
 135                         && (strcmp(info1->listenaddr, info2->listenaddr) == 0);
 136 }
 137
 138 static int svr_cancelremotetcp() {
 139
 140         int ret = DROPBEAR_FAILURE;
 141         unsigned char * bindaddr = NULL;
 142         unsigned int addrlen;
 143         unsigned int port;
 144         struct Listener * listener = NULL;
 145         struct TCPListener tcpinfo;
 146
 147         TRACE(("enter cancelremotetcp"))
 148
 149         bindaddr = buf_getstring(ses.payload, &addrlen);
 150         if (addrlen > MAX_IP_LEN) {
 151                 TRACE(("addr len too long: %d", addrlen))
 152                 goto out;
 153         }
 154
 155         port = buf_getint(ses.payload);
 156
 157         tcpinfo.sendaddr = NULL;
 158         tcpinfo.sendport = 0;
 159         tcpinfo.listenaddr = bindaddr;
 160         tcpinfo.listenport = port;
 161         listener = get_listener(CHANNEL_ID_TCPFORWARDED, &tcpinfo, matchtcp);
 162         if (listener) {
 163                 remove_listener( listener );
 164                 ret = DROPBEAR_SUCCESS;
 165         }
 166
 167 out:
 168         m_free(bindaddr);
 169         TRACE(("leave cancelremotetcp"))
 170         return ret;
 171 }
 172
 173 static int svr_remotetcpreq() {
 174
 175         int ret = DROPBEAR_FAILURE;
 176         unsigned char * bindaddr = NULL;
 177         unsigned int addrlen;
 178         struct TCPListener *tcpinfo = NULL;
 179         unsigned int port;
 180
 181         TRACE(("enter remotetcpreq"))
 182
 183         bindaddr = buf_getstring(ses.payload, &addrlen);
 184         if (addrlen > MAX_IP_LEN) {
 185                 TRACE(("addr len too long: %d", addrlen))
 186                 goto out;
 187         }
 188
 189         port = buf_getint(ses.payload);
 190
 191         if (port == 0) {
 192                 dropbear_log(LOG_INFO, "Server chosen tcpfwd ports are unsupported");
 193                 goto out;
 194         }
 195
 196         if (port < 1 || port > 65535) {
 197                 TRACE(("invalid port: %d", port))
 198                 goto out;
 199         }
 200
 201         if (!ses.allowprivport && port < IPPORT_RESERVED) {
 202                 TRACE(("can't assign port < 1024 for non-root"))
 203                 goto out;
 204         }
 205
 206         tcpinfo = (struct TCPListener*)m_malloc(sizeof(struct TCPListener));
 207         tcpinfo->sendaddr = NULL;
 208         tcpinfo->sendport = 0;
 209         tcpinfo->listenport = port;
 210         tcpinfo->chantype = &svr_chan_tcpremote;
 211         tcpinfo->tcp_type = forwarded;
 212
 213         if (!opts.listen_fwd_all || (strcmp(bindaddr, "localhost") == 0) ) {
 214                 // NULL means "localhost only"
 215                 tcpinfo->listenaddr = NULL;
 216         }
 217         else {
 218                 tcpinfo->listenaddr = bindaddr;
 219         }
 220
 221         ret = listen_tcpfwd(tcpinfo);
 222
 223 out:
 224         if (ret == DROPBEAR_FAILURE) {
 225                 /* we only free it if a listener wasn't created, since the listener
 226                  * has to remember it if it's to be cancelled */
 227                 m_free(bindaddr);
 228                 m_free(tcpinfo);
 229         }
 230         TRACE(("leave remotetcpreq"))
 231         return ret;
 232 }
 233
 234 /* Called upon creating a new direct tcp channel (ie we connect out to an
 235  * address */
 236 static int newtcpdirect(struct Channel * channel) {
 237
 238         unsigned char* desthost = NULL;
 239         unsigned int destport;
 240         unsigned char* orighost = NULL;
 241         unsigned int origport;
 242         char portstring[NI_MAXSERV];
 243         int sock;
 244         int len;
 245         int err = SSH_OPEN_ADMINISTRATIVELY_PROHIBITED;
 246
 247         if (svr_opts.nolocaltcp || !svr_pubkey_allows_tcpfwd()) {
 248                 TRACE(("leave newtcpdirect: local tcp forwarding disabled"))
 249                 goto out;
 250         }
 251
 252         desthost = buf_getstring(ses.payload, &len);
 253         if (len > MAX_HOST_LEN) {
 254                 TRACE(("leave newtcpdirect: desthost too long"))
 255                 goto out;
 256         }
 257
 258         destport = buf_getint(ses.payload);
 259
 260         orighost = buf_getstring(ses.payload, &len);
 261         if (len > MAX_HOST_LEN) {
 262                 TRACE(("leave newtcpdirect: orighost too long"))
 263                 goto out;
 264         }
 265
 266         origport = buf_getint(ses.payload);
 267
 268         /* best be sure */
 269         if (origport > 65535 || destport > 65535) {
 270                 TRACE(("leave newtcpdirect: port > 65535"))
 271                 goto out;
 272         }
 273
 274         snprintf(portstring, sizeof(portstring), "%d", destport);
 275         sock = connect_remote(desthost, portstring, 1, NULL);
 276         if (sock < 0) {
 277                 err = SSH_OPEN_CONNECT_FAILED;
 278                 TRACE(("leave newtcpdirect: sock failed"))
 279                 goto out;
 280         }
 281
 282         ses.maxfd = MAX(ses.maxfd, sock);
 283
 284          /* We don't set readfd, that will get set after the connection's
 285          * progress succeeds */
 286         channel->writefd = sock;
 287         channel->initconn = 1;
 288
 289         err = SSH_OPEN_IN_PROGRESS;
 290
 291 out:
 292         m_free(desthost);
 293         m_free(orighost);
 294         TRACE(("leave newtcpdirect: err %d", err))
 295         return err;
 296 }
 297
 298 #endif