mirror of
https://git.tartarus.org/simon/putty.git
synced 2025-01-09 17:38:00 +00:00
c8f83979a3
When anyone connects to a PuTTY tool's listening socket - whether it's a user of a local->remote port forwarding, a connection-sharing downstream or a client of Pageant - we'd like to log as much information as we can find out about where the connection came from. To that end, I've implemented a function sk_peer_info() in the socket abstraction, which returns a freeform text string as best it can (or NULL, if it can't get anything at all) describing the thing at the other end of the connection. For TCP connections, this is done using getpeername() to get an IP address and port in the obvious way; for Unix-domain sockets, we attempt SO_PEERCRED (conditionalised on some moderately hairy autoconfery) to get the pid and owner of the peer. I haven't implemented anything for Windows named pipes, but I will if I hear of anything useful.
652 lines
17 KiB
C
652 lines
17 KiB
C
/*
|
|
* SSH port forwarding.
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
|
|
#include "putty.h"
|
|
#include "ssh.h"
|
|
|
|
#ifndef FALSE
|
|
#define FALSE 0
|
|
#endif
|
|
#ifndef TRUE
|
|
#define TRUE 1
|
|
#endif
|
|
|
|
struct PortForwarding {
|
|
const struct plug_function_table *fn;
|
|
/* the above variable absolutely *must* be the first in this structure */
|
|
struct ssh_channel *c; /* channel structure held by ssh.c */
|
|
void *backhandle; /* instance of SSH backend itself */
|
|
/* Note that backhandle need not be filled in if c is non-NULL */
|
|
Socket s;
|
|
int throttled, throttle_override;
|
|
int ready;
|
|
/*
|
|
* `dynamic' does double duty. It's set to 0 for an ordinary
|
|
* forwarded port, and nonzero for SOCKS-style dynamic port
|
|
* forwarding; but the nonzero values are also a state machine
|
|
* tracking where the SOCKS exchange has got to.
|
|
*/
|
|
int dynamic;
|
|
/*
|
|
* `hostname' and `port' are the real hostname and port, once
|
|
* we know what we're connecting to.
|
|
*/
|
|
char *hostname;
|
|
int port;
|
|
/*
|
|
* `socksbuf' is the buffer we use to accumulate a SOCKS request.
|
|
*/
|
|
char *socksbuf;
|
|
int sockslen, sockssize;
|
|
/*
|
|
* When doing dynamic port forwarding, we can receive
|
|
* connection data before we are actually able to send it; so
|
|
* we may have to temporarily hold some in a dynamically
|
|
* allocated buffer here.
|
|
*/
|
|
void *buffer;
|
|
int buflen;
|
|
};
|
|
|
|
struct PortListener {
|
|
const struct plug_function_table *fn;
|
|
/* the above variable absolutely *must* be the first in this structure */
|
|
void *backhandle; /* instance of SSH backend itself */
|
|
Socket s;
|
|
/*
|
|
* `dynamic' is set to 0 for an ordinary forwarded port, and
|
|
* nonzero for SOCKS-style dynamic port forwarding.
|
|
*/
|
|
int dynamic;
|
|
/*
|
|
* `hostname' and `port' are the real hostname and port, for
|
|
* ordinary forwardings.
|
|
*/
|
|
char *hostname;
|
|
int port;
|
|
};
|
|
|
|
static struct PortForwarding *new_portfwd_state(void)
|
|
{
|
|
struct PortForwarding *pf = snew(struct PortForwarding);
|
|
pf->hostname = NULL;
|
|
pf->socksbuf = NULL;
|
|
pf->sockslen = pf->sockssize = 0;
|
|
pf->buffer = NULL;
|
|
return pf;
|
|
}
|
|
|
|
static void free_portfwd_state(struct PortForwarding *pf)
|
|
{
|
|
if (!pf)
|
|
return;
|
|
sfree(pf->hostname);
|
|
sfree(pf->socksbuf);
|
|
sfree(pf->buffer);
|
|
sfree(pf);
|
|
}
|
|
|
|
static struct PortListener *new_portlistener_state(void)
|
|
{
|
|
struct PortListener *pl = snew(struct PortListener);
|
|
pl->hostname = NULL;
|
|
return pl;
|
|
}
|
|
|
|
static void free_portlistener_state(struct PortListener *pl)
|
|
{
|
|
if (!pl)
|
|
return;
|
|
sfree(pl->hostname);
|
|
sfree(pl);
|
|
}
|
|
|
|
static void pfd_log(Plug plug, int type, SockAddr addr, int port,
|
|
const char *error_msg, int error_code)
|
|
{
|
|
/* we have to dump these since we have no interface to logging.c */
|
|
}
|
|
|
|
static void pfl_log(Plug plug, int type, SockAddr addr, int port,
|
|
const char *error_msg, int error_code)
|
|
{
|
|
/* we have to dump these since we have no interface to logging.c */
|
|
}
|
|
|
|
static int pfd_closing(Plug plug, const char *error_msg, int error_code,
|
|
int calling_back)
|
|
{
|
|
struct PortForwarding *pf = (struct PortForwarding *) plug;
|
|
|
|
if (error_msg) {
|
|
/*
|
|
* Socket error. Slam the connection instantly shut.
|
|
*/
|
|
if (pf->c) {
|
|
sshfwd_unclean_close(pf->c, error_msg);
|
|
} else {
|
|
/*
|
|
* We might not have an SSH channel, if a socket error
|
|
* occurred during SOCKS negotiation. If not, we must
|
|
* clean ourself up without sshfwd_unclean_close's call
|
|
* back to pfd_close.
|
|
*/
|
|
pfd_close(pf);
|
|
}
|
|
} else {
|
|
/*
|
|
* Ordinary EOF received on socket. Send an EOF on the SSH
|
|
* channel.
|
|
*/
|
|
if (pf->c)
|
|
sshfwd_write_eof(pf->c);
|
|
}
|
|
|
|
return 1;
|
|
}
|
|
|
|
static int pfl_closing(Plug plug, const char *error_msg, int error_code,
|
|
int calling_back)
|
|
{
|
|
struct PortListener *pl = (struct PortListener *) plug;
|
|
pfl_terminate(pl);
|
|
return 1;
|
|
}
|
|
|
|
static void wrap_send_port_open(void *channel, const char *hostname, int port,
|
|
Socket s)
|
|
{
|
|
char *peerinfo, *description;
|
|
peerinfo = sk_peer_info(s);
|
|
if (peerinfo) {
|
|
description = dupprintf("forwarding from %s", peerinfo);
|
|
sfree(peerinfo);
|
|
} else {
|
|
description = dupstr("forwarding");
|
|
}
|
|
ssh_send_port_open(channel, hostname, port, description);
|
|
sfree(description);
|
|
}
|
|
|
|
static int pfd_receive(Plug plug, int urgent, char *data, int len)
|
|
{
|
|
struct PortForwarding *pf = (struct PortForwarding *) plug;
|
|
if (pf->dynamic) {
|
|
while (len--) {
|
|
if (pf->sockslen >= pf->sockssize) {
|
|
pf->sockssize = pf->sockslen * 5 / 4 + 256;
|
|
pf->socksbuf = sresize(pf->socksbuf, pf->sockssize, char);
|
|
}
|
|
pf->socksbuf[pf->sockslen++] = *data++;
|
|
|
|
/*
|
|
* Now check what's in the buffer to see if it's a
|
|
* valid and complete message in the SOCKS exchange.
|
|
*/
|
|
if ((pf->dynamic == 1 || (pf->dynamic >> 12) == 4) &&
|
|
pf->socksbuf[0] == 4) {
|
|
/*
|
|
* SOCKS 4.
|
|
*/
|
|
if (pf->dynamic == 1)
|
|
pf->dynamic = 0x4000;
|
|
if (pf->sockslen < 2)
|
|
continue; /* don't have command code yet */
|
|
if (pf->socksbuf[1] != 1) {
|
|
/* Not CONNECT. */
|
|
/* Send back a SOCKS 4 error before closing. */
|
|
char data[8];
|
|
memset(data, 0, sizeof(data));
|
|
data[1] = 91; /* generic `request rejected' */
|
|
sk_write(pf->s, data, 8);
|
|
pfd_close(pf);
|
|
return 1;
|
|
}
|
|
if (pf->sockslen <= 8)
|
|
continue; /* haven't started user/hostname */
|
|
if (pf->socksbuf[pf->sockslen-1] != 0)
|
|
continue; /* haven't _finished_ user/hostname */
|
|
/*
|
|
* Now we have a full SOCKS 4 request. Check it to
|
|
* see if it's a SOCKS 4A request.
|
|
*/
|
|
if (pf->socksbuf[4] == 0 && pf->socksbuf[5] == 0 &&
|
|
pf->socksbuf[6] == 0 && pf->socksbuf[7] != 0) {
|
|
/*
|
|
* It's SOCKS 4A. So if we haven't yet
|
|
* collected the host name, we should continue
|
|
* waiting for data in order to do so; if we
|
|
* have, we can go ahead.
|
|
*/
|
|
int len;
|
|
if (pf->dynamic == 0x4000) {
|
|
pf->dynamic = 0x4001;
|
|
pf->sockslen = 8; /* reset buffer to overwrite name */
|
|
continue;
|
|
}
|
|
pf->socksbuf[0] = 0; /* reply version code */
|
|
pf->socksbuf[1] = 90; /* request granted */
|
|
sk_write(pf->s, pf->socksbuf, 8);
|
|
len = pf->sockslen - 8;
|
|
pf->port = GET_16BIT_MSB_FIRST(pf->socksbuf+2);
|
|
pf->hostname = snewn(len+1, char);
|
|
pf->hostname[len] = '\0';
|
|
memcpy(pf->hostname, pf->socksbuf + 8, len);
|
|
goto connect;
|
|
} else {
|
|
/*
|
|
* It's SOCKS 4, which means we should format
|
|
* the IP address into the hostname string and
|
|
* then just go.
|
|
*/
|
|
pf->socksbuf[0] = 0; /* reply version code */
|
|
pf->socksbuf[1] = 90; /* request granted */
|
|
sk_write(pf->s, pf->socksbuf, 8);
|
|
pf->port = GET_16BIT_MSB_FIRST(pf->socksbuf+2);
|
|
pf->hostname = dupprintf("%d.%d.%d.%d",
|
|
(unsigned char)pf->socksbuf[4],
|
|
(unsigned char)pf->socksbuf[5],
|
|
(unsigned char)pf->socksbuf[6],
|
|
(unsigned char)pf->socksbuf[7]);
|
|
goto connect;
|
|
}
|
|
}
|
|
|
|
if ((pf->dynamic == 1 || (pf->dynamic >> 12) == 5) &&
|
|
pf->socksbuf[0] == 5) {
|
|
/*
|
|
* SOCKS 5.
|
|
*/
|
|
if (pf->dynamic == 1)
|
|
pf->dynamic = 0x5000;
|
|
|
|
if (pf->dynamic == 0x5000) {
|
|
int i, method;
|
|
char data[2];
|
|
/*
|
|
* We're receiving a set of method identifiers.
|
|
*/
|
|
if (pf->sockslen < 2)
|
|
continue; /* no method count yet */
|
|
if (pf->sockslen < 2 + (unsigned char)pf->socksbuf[1])
|
|
continue; /* no methods yet */
|
|
method = 0xFF; /* invalid */
|
|
for (i = 0; i < (unsigned char)pf->socksbuf[1]; i++)
|
|
if (pf->socksbuf[2+i] == 0) {
|
|
method = 0;/* no auth */
|
|
break;
|
|
}
|
|
data[0] = 5;
|
|
data[1] = method;
|
|
sk_write(pf->s, data, 2);
|
|
pf->dynamic = 0x5001;
|
|
pf->sockslen = 0; /* re-empty the buffer */
|
|
continue;
|
|
}
|
|
|
|
if (pf->dynamic == 0x5001) {
|
|
/*
|
|
* We're receiving a SOCKS request.
|
|
*/
|
|
unsigned char reply[10]; /* SOCKS5 atyp=1 reply */
|
|
int atype, alen = 0;
|
|
|
|
/*
|
|
* Pre-fill reply packet.
|
|
* In all cases, we set BND.{HOST,ADDR} to 0.0.0.0:0
|
|
* (atyp=1) in the reply; if we succeed, we don't know
|
|
* the right answers, and if we fail, they should be
|
|
* ignored.
|
|
*/
|
|
memset(reply, 0, lenof(reply));
|
|
reply[0] = 5; /* VER */
|
|
reply[3] = 1; /* ATYP = 1 (IPv4, 0.0.0.0:0) */
|
|
|
|
if (pf->sockslen < 6) continue;
|
|
atype = (unsigned char)pf->socksbuf[3];
|
|
if (atype == 1) /* IPv4 address */
|
|
alen = 4;
|
|
if (atype == 4) /* IPv6 address */
|
|
alen = 16;
|
|
if (atype == 3) /* domain name has leading length */
|
|
alen = 1 + (unsigned char)pf->socksbuf[4];
|
|
if (pf->sockslen < 6 + alen) continue;
|
|
if (pf->socksbuf[1] != 1 || pf->socksbuf[2] != 0) {
|
|
/* Not CONNECT or reserved field nonzero - error */
|
|
reply[1] = 1; /* generic failure */
|
|
sk_write(pf->s, (char *) reply, lenof(reply));
|
|
pfd_close(pf);
|
|
return 1;
|
|
}
|
|
/*
|
|
* Now we have a viable connect request. Switch
|
|
* on atype.
|
|
*/
|
|
pf->port = GET_16BIT_MSB_FIRST(pf->socksbuf+4+alen);
|
|
if (atype == 1) {
|
|
/* REP=0 (success) already */
|
|
sk_write(pf->s, (char *) reply, lenof(reply));
|
|
pf->hostname = dupprintf("%d.%d.%d.%d",
|
|
(unsigned char)pf->socksbuf[4],
|
|
(unsigned char)pf->socksbuf[5],
|
|
(unsigned char)pf->socksbuf[6],
|
|
(unsigned char)pf->socksbuf[7]);
|
|
goto connect;
|
|
} else if (atype == 3) {
|
|
/* REP=0 (success) already */
|
|
sk_write(pf->s, (char *) reply, lenof(reply));
|
|
pf->hostname = snewn(alen, char);
|
|
pf->hostname[alen-1] = '\0';
|
|
memcpy(pf->hostname, pf->socksbuf + 5, alen-1);
|
|
goto connect;
|
|
} else {
|
|
/*
|
|
* Unknown address type. (FIXME: support IPv6!)
|
|
*/
|
|
reply[1] = 8; /* atype not supported */
|
|
sk_write(pf->s, (char *) reply, lenof(reply));
|
|
pfd_close(pf);
|
|
return 1;
|
|
}
|
|
}
|
|
}
|
|
|
|
/*
|
|
* If we get here without either having done `continue'
|
|
* or `goto connect', it must be because there is no
|
|
* sensible interpretation of what's in our buffer. So
|
|
* close the connection rudely.
|
|
*/
|
|
pfd_close(pf);
|
|
return 1;
|
|
}
|
|
return 1;
|
|
|
|
/*
|
|
* We come here when we're ready to make an actual
|
|
* connection.
|
|
*/
|
|
connect:
|
|
sfree(pf->socksbuf);
|
|
pf->socksbuf = NULL;
|
|
|
|
/*
|
|
* Freeze the socket until the SSH server confirms the
|
|
* connection.
|
|
*/
|
|
sk_set_frozen(pf->s, 1);
|
|
|
|
pf->c = new_sock_channel(pf->backhandle, pf);
|
|
if (pf->c == NULL) {
|
|
pfd_close(pf);
|
|
return 1;
|
|
} else {
|
|
/* asks to forward to the specified host/port for this */
|
|
wrap_send_port_open(pf->c, pf->hostname, pf->port, pf->s);
|
|
}
|
|
pf->dynamic = 0;
|
|
|
|
/*
|
|
* If there's any data remaining in our current buffer,
|
|
* save it to be sent on pfd_confirm().
|
|
*/
|
|
if (len > 0) {
|
|
pf->buffer = snewn(len, char);
|
|
memcpy(pf->buffer, data, len);
|
|
pf->buflen = len;
|
|
}
|
|
}
|
|
if (pf->ready) {
|
|
if (sshfwd_write(pf->c, data, len) > 0) {
|
|
pf->throttled = 1;
|
|
sk_set_frozen(pf->s, 1);
|
|
}
|
|
}
|
|
return 1;
|
|
}
|
|
|
|
static void pfd_sent(Plug plug, int bufsize)
|
|
{
|
|
struct PortForwarding *pf = (struct PortForwarding *) plug;
|
|
|
|
if (pf->c)
|
|
sshfwd_unthrottle(pf->c, bufsize);
|
|
}
|
|
|
|
/*
|
|
* Called when receiving a PORT OPEN from the server to make a
|
|
* connection to a destination host.
|
|
*
|
|
* On success, returns NULL and fills in *pf_ret. On error, returns a
|
|
* dynamically allocated error message string.
|
|
*/
|
|
char *pfd_connect(struct PortForwarding **pf_ret, char *hostname,int port,
|
|
void *c, Conf *conf, int addressfamily)
|
|
{
|
|
static const struct plug_function_table fn_table = {
|
|
pfd_log,
|
|
pfd_closing,
|
|
pfd_receive,
|
|
pfd_sent,
|
|
NULL
|
|
};
|
|
|
|
SockAddr addr;
|
|
const char *err;
|
|
char *dummy_realhost;
|
|
struct PortForwarding *pf;
|
|
|
|
/*
|
|
* Try to find host.
|
|
*/
|
|
addr = name_lookup(hostname, port, &dummy_realhost, conf, addressfamily);
|
|
if ((err = sk_addr_error(addr)) != NULL) {
|
|
char *err_ret = dupstr(err);
|
|
sk_addr_free(addr);
|
|
sfree(dummy_realhost);
|
|
return err_ret;
|
|
}
|
|
|
|
/*
|
|
* Open socket.
|
|
*/
|
|
pf = *pf_ret = new_portfwd_state();
|
|
pf->fn = &fn_table;
|
|
pf->throttled = pf->throttle_override = 0;
|
|
pf->ready = 1;
|
|
pf->c = c;
|
|
pf->backhandle = NULL; /* we shouldn't need this */
|
|
pf->dynamic = 0;
|
|
|
|
pf->s = new_connection(addr, dummy_realhost, port,
|
|
0, 1, 0, 0, (Plug) pf, conf);
|
|
sfree(dummy_realhost);
|
|
if ((err = sk_socket_error(pf->s)) != NULL) {
|
|
char *err_ret = dupstr(err);
|
|
sk_close(pf->s);
|
|
free_portfwd_state(pf);
|
|
*pf_ret = NULL;
|
|
return err_ret;
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
/*
|
|
called when someone connects to the local port
|
|
*/
|
|
|
|
static int pfl_accepting(Plug p, accept_fn_t constructor, accept_ctx_t ctx)
|
|
{
|
|
static const struct plug_function_table fn_table = {
|
|
pfd_log,
|
|
pfd_closing,
|
|
pfd_receive,
|
|
pfd_sent,
|
|
NULL
|
|
};
|
|
struct PortForwarding *pf;
|
|
struct PortListener *pl;
|
|
Socket s;
|
|
const char *err;
|
|
|
|
pl = (struct PortListener *)p;
|
|
pf = new_portfwd_state();
|
|
pf->fn = &fn_table;
|
|
|
|
pf->c = NULL;
|
|
pf->backhandle = pl->backhandle;
|
|
|
|
pf->s = s = constructor(ctx, (Plug) pf);
|
|
if ((err = sk_socket_error(s)) != NULL) {
|
|
free_portfwd_state(pf);
|
|
return err != NULL;
|
|
}
|
|
|
|
pf->throttled = pf->throttle_override = 0;
|
|
pf->ready = 0;
|
|
|
|
if (pl->dynamic) {
|
|
pf->dynamic = 1;
|
|
pf->port = 0; /* "hostname" buffer is so far empty */
|
|
sk_set_frozen(s, 0); /* we want to receive SOCKS _now_! */
|
|
} else {
|
|
pf->dynamic = 0;
|
|
pf->hostname = dupstr(pl->hostname);
|
|
pf->port = pl->port;
|
|
pf->c = new_sock_channel(pl->backhandle, pf);
|
|
|
|
if (pf->c == NULL) {
|
|
free_portfwd_state(pf);
|
|
return 1;
|
|
} else {
|
|
/* asks to forward to the specified host/port for this */
|
|
wrap_send_port_open(pf->c, pf->hostname, pf->port, s);
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
/*
|
|
* Add a new port-forwarding listener from srcaddr:port -> desthost:destport.
|
|
*
|
|
* On success, returns NULL and fills in *pl_ret. On error, returns a
|
|
* dynamically allocated error message string.
|
|
*/
|
|
char *pfl_listen(char *desthost, int destport, char *srcaddr,
|
|
int port, void *backhandle, Conf *conf,
|
|
struct PortListener **pl_ret, int address_family)
|
|
{
|
|
static const struct plug_function_table fn_table = {
|
|
pfl_log,
|
|
pfl_closing,
|
|
NULL, /* recv */
|
|
NULL, /* send */
|
|
pfl_accepting
|
|
};
|
|
|
|
const char *err;
|
|
struct PortListener *pl;
|
|
|
|
/*
|
|
* Open socket.
|
|
*/
|
|
pl = *pl_ret = new_portlistener_state();
|
|
pl->fn = &fn_table;
|
|
if (desthost) {
|
|
pl->hostname = dupstr(desthost);
|
|
pl->port = destport;
|
|
pl->dynamic = 0;
|
|
} else
|
|
pl->dynamic = 1;
|
|
pl->backhandle = backhandle;
|
|
|
|
pl->s = new_listener(srcaddr, port, (Plug) pl,
|
|
!conf_get_int(conf, CONF_lport_acceptall),
|
|
conf, address_family);
|
|
if ((err = sk_socket_error(pl->s)) != NULL) {
|
|
char *err_ret = dupstr(err);
|
|
sk_close(pl->s);
|
|
free_portlistener_state(pl);
|
|
*pl_ret = NULL;
|
|
return err_ret;
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
void pfd_close(struct PortForwarding *pf)
|
|
{
|
|
if (!pf)
|
|
return;
|
|
|
|
sk_close(pf->s);
|
|
free_portfwd_state(pf);
|
|
}
|
|
|
|
/*
|
|
* Terminate a listener.
|
|
*/
|
|
void pfl_terminate(struct PortListener *pl)
|
|
{
|
|
if (!pl)
|
|
return;
|
|
|
|
sk_close(pl->s);
|
|
free_portlistener_state(pl);
|
|
}
|
|
|
|
void pfd_unthrottle(struct PortForwarding *pf)
|
|
{
|
|
if (!pf)
|
|
return;
|
|
|
|
pf->throttled = 0;
|
|
sk_set_frozen(pf->s, pf->throttled || pf->throttle_override);
|
|
}
|
|
|
|
void pfd_override_throttle(struct PortForwarding *pf, int enable)
|
|
{
|
|
if (!pf)
|
|
return;
|
|
|
|
pf->throttle_override = enable;
|
|
sk_set_frozen(pf->s, pf->throttled || pf->throttle_override);
|
|
}
|
|
|
|
/*
|
|
* Called to send data down the raw connection.
|
|
*/
|
|
int pfd_send(struct PortForwarding *pf, char *data, int len)
|
|
{
|
|
if (pf == NULL)
|
|
return 0;
|
|
return sk_write(pf->s, data, len);
|
|
}
|
|
|
|
void pfd_send_eof(struct PortForwarding *pf)
|
|
{
|
|
sk_write_eof(pf->s);
|
|
}
|
|
|
|
void pfd_confirm(struct PortForwarding *pf)
|
|
{
|
|
if (pf == NULL)
|
|
return;
|
|
|
|
pf->ready = 1;
|
|
sk_set_frozen(pf->s, 0);
|
|
sk_write(pf->s, NULL, 0);
|
|
if (pf->buffer) {
|
|
sshfwd_write(pf->c, pf->buffer, pf->buflen);
|
|
sfree(pf->buffer);
|
|
pf->buffer = NULL;
|
|
}
|
|
}
|