Attachment #2025 for bug #1513

View | Details | Raw Unified | Return to bug 1513
Collapse All | Expand All

Lines 280-291 Link Here

(-)openssh-5.8p1.orig/auth-options.c (-5 / +37 lines)
280	xfree(patterns);	280	xfree(patterns);
281	/* Host name matches. */	281	/* Host name matches. */
282	goto next_option;	282	goto next_option;
283	case -1:	283	case -2:
284	debug("%.100s, line %lu: invalid criteria",	284	debug("%.100s, line %lu: invalid criteria",
285	file, linenum);	285	file, linenum);
286	auth_debug_add("%.100s, line %lu: "	286	auth_debug_add("%.100s, line %lu: "
287	"invalid criteria", file, linenum);	287	"invalid criteria", file, linenum);
288	/* FALLTHROUGH */	288	/* FALLTHROUGH */
		289	case -1:
289	case 0:	290	case 0:
290	xfree(patterns);	291	xfree(patterns);
291	logit("Authentication tried for %.100s with "	292	logit("Authentication tried for %.100s with "
Lines 303-309 Link Here
303	cp = "permitopen=\"";	304	cp = "permitopen=\"";
304	if (strncasecmp(opts, cp, strlen(cp)) == 0) {	305	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
305	char host, p;	306	char host, p;
306	int port;	307	char buf[512];
		308	int min_port;
		309	int max_port;
307	char *patterns = xmalloc(strlen(opts) + 1);	310	char *patterns = xmalloc(strlen(opts) + 1);
308		311
309	opts += strlen(cp);	312	opts += strlen(cp);
Lines 341-356 Link Here
341	goto bad_option;	344	goto bad_option;
342	}	345	}
343	host = cleanhostname(host);	346	host = cleanhostname(host);
344	if (p == NULL \|\| (port = a2port(p)) <= 0) {	347	if (p == NULL) {
345	debug("%.100s, line %lu: Bad permitopen port "	348	debug("%.100s, line %lu: Bad permitopen port "
346	"<%.100s>", file, linenum, p ? p : "");	349	"<%.100s>", file, linenum, p ? p : "");
347	auth_debug_add("%.100s, line %lu: "	350	auth_debug_add("%.100s, line %lu: "
348	"Bad permitopen port", file, linenum);	351	"Bad permitopen port", file, linenum);
349	xfree(patterns);	352	xfree(patterns);
350	goto bad_option;	353	goto bad_option;
		354	} else {
		355	strncpy(buf, host, sizeof(buf) - 1);
		356	/*
		357	* After this hpdelim, if a cidr mask was specified, then
		358	* host will contain the cidr mask and p will be the port
		359	* if there wasn't a cidr mask, host will contain the port
		360	* and p will be null.
		361	*/
		362	host = hpdelim(&p);
		363	if (p == NULL && (a2portrange(host, &min_port, &max_port)) <= 0) {
		364	debug("%.100s, line %lu: Bad permitopen port "
		365	"<%.100s>", file, linenum, p ? p : "");
		366	auth_debug_add("%.100s, line %lu: "
		367	"Bad permitopen port", file, linenum);
		368	xfree(patterns);
		369	goto bad_option;
		370	} else if (p != NULL) { /* Both a CIDR mask and a port were specified */
		371	strncat(buf, "/", sizeof(buf) - strlen(buf) - 1);
		372	if (strlen(host) + 1 > sizeof(buf) - strlen(host)) { // host contains a CIDR mask
		373	debug("%.100s, line %lu: Bad permitopen port "
		374	"<%.100s>", file, linenum, p ? p : "");
		375	auth_debug_add("%.100s, line %lu: "
		376	"Bad permitopen port", file, linenum);
		377	xfree(patterns);
		378	goto bad_option;
		379	}
		380	strncat(buf, host, sizeof(buf) - strlen(buf) - 1);
		381	a2portrange(p, &min_port, &max_port); // p has the port
		382	}
		383	if (options.allow_tcp_forwarding)
		384	channel_add_permitted_opens(buf, min_port, max_port);
351	}	385	}
352	if (options.allow_tcp_forwarding)
353	channel_add_permitted_opens(host, port);
354	xfree(patterns);	386	xfree(patterns);
355	goto next_option;	387	goto next_option;
356	}	388	}




#include "key.h"
#include "authfd.h"
#include "pathnames.h"
#include "match.h"

/* -- channel core */


 */
typedef struct {
	char *host_to_connect;		/* Connect to 'host'. */
	u_short min_port_to_connect;	/* Connect to 'port' (minimum). */
	u_short max_port_to_connect;	/* Connect to 'port' (maximum). */
	u_short listen_port;		/* Remote side should listen port number. */
} ForwardPermission;


		permitted_opens = xrealloc(permitted_opens,
		    num_permitted_opens + 1, sizeof(*permitted_opens));
		permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
		permitted_opens[num_permitted_opens].min_port_to_connect = port_to_connect;
		permitted_opens[num_permitted_opens].max_port_to_connect = port_to_connect;
		permitted_opens[num_permitted_opens].listen_port = listen_port;
		num_permitted_opens++;
	}

	packet_send();

	permitted_opens[i].listen_port = 0;
	permitted_opens[i].min_port_to_connect = 0;
	permitted_opens[i].max_port_to_connect = 0;
	xfree(permitted_opens[i].host_to_connect);
	permitted_opens[i].host_to_connect = NULL;
}

}

void
channel_add_permitted_opens(char *host, int min_port, int max_port)
{
	if (min_port == max_port) {
		debug("allow port forwarding to host %s port %d", host, min_port);
	} else {
		if (min_port > max_port) {
			// xor swap the ports
			min_port ^= max_port;
			max_port ^= min_port;
			min_port ^= max_port;
		}
		debug("allow port forwarding to host %s ports %d through %d", host, min_port, max_port);
	}

	permitted_opens = xrealloc(permitted_opens,
	    num_permitted_opens + 1, sizeof(*permitted_opens));
	permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host);
	permitted_opens[num_permitted_opens].min_port_to_connect = min_port;
	permitted_opens[num_permitted_opens].min_port_to_connect = max_port;
	num_permitted_opens++;

	all_opens_permitted = 0;
}

int
channel_add_adm_permitted_opens(char *host, int min_port, int max_port)
{
	if (min_port == max_port) {
		debug("config allows port forwarding to host %s port %d", host, min_port);
	} else {
		if (min_port > max_port) {
			// xor swap the ports
			min_port ^= max_port;
			max_port ^= min_port;
			min_port ^= max_port;
		}
		debug("config allows port forwarding to host %s ports %d through %d", host, min_port, max_port);
	}

	permitted_adm_opens = xrealloc(permitted_adm_opens,
	    num_adm_permitted_opens + 1, sizeof(*permitted_adm_opens));
	permitted_adm_opens[num_adm_permitted_opens].host_to_connect
	     = xstrdup(host);
	permitted_adm_opens[num_adm_permitted_opens].min_port_to_connect = min_port;
	permitted_adm_opens[num_adm_permitted_opens].max_port_to_connect = max_port;
	return ++num_adm_permitted_opens;
}


		return;
	}
	for (i = 0; i < num_adm_permitted_opens; i++)
		if (permitted_adm_opens[i].host_to_connect != NULL) {
			if (permitted_adm_opens[i].min_port_to_connect ==
			    permitted_adm_opens[i].max_port_to_connect) {
				printf(" %s:%d", permitted_adm_opens[i].host_to_connect,
				    permitted_adm_opens[i].min_port_to_connect);
			} else {
				printf(" %s:%d-%d", permitted_adm_opens[i].host_to_connect,
				    permitted_adm_opens[i].min_port_to_connect,
				    permitted_adm_opens[i].max_port_to_connect);
			}
		}
	printf("\n");
}


			error("connect_next: getnameinfo failed");
			continue;
		}
		if (channel_is_connect_to_permitted(cctx) == 0)
			continue;
		if ((sock = socket(cctx->ai->ai_family, cctx->ai->ai_socktype,
		    cctx->ai->ai_protocol)) == -1) {
			if (cctx->ai->ai_next == NULL)

		    permitted_opens[i].listen_port == listen_port) {
			return connect_to(
			    permitted_opens[i].host_to_connect,
			    permitted_opens[i].min_port_to_connect, ctype, rname);
		}
	}
	error("WARNING: Server requests forwarding for unknown listen_port %d",

	return NULL;
}

/* Check if connecting to that port is permitted */
int
channel_is_connect_to_permitted(const struct channel_connect *cctx)
{
	int r, i, permit, permit_adm = 1;
	char ipaddr[128]; // probably overkill size-wise

	/* Get an ip address string for match_host_and_ip */
	inet_ntop(cctx->ai->ai_family, &((const struct sockaddr_in *)cctx->ai->ai_addr)->sin_addr, ipaddr, cctx->ai->ai_addrlen);

	debug2("checking with ip %.100s for %.100s", ipaddr, cctx->host);

	permit = all_opens_permitted;
	if (!permit) {
		for (i = 0; i < num_permitted_opens; i++) {
			debug2("checking ports %d => %d <= %d", permitted_opens[i].min_port_to_connect, cctx->port, permitted_opens[i].max_port_to_connect);
			if (permitted_opens[i].host_to_connect != NULL &&
			    permitted_opens[i].min_port_to_connect <= cctx->port &&
			    permitted_opens[i].max_port_to_connect >= cctx->port) {
				debug2("checking %.100s, %.100s, %.100s", cctx->host, ipaddr, permitted_opens[i].host_to_connect);
				r = match_host_and_ip(cctx->host, ipaddr, permitted_opens[i].host_to_connect);
				if (r == -1) { /* negated match - this attempt is blocked */
					debug2("denied %.100s:%d by %.100s:%d-%d", cctx->host, cctx->port,
						permitted_opens[i].host_to_connect,
						permitted_opens[i].min_port_to_connect,
						permitted_opens[i].max_port_to_connect);
					permit = 0;
					break;
				} else if (r == 1) {
					debug2("permited %.100s:%d by %.100s:%d-%d", cctx->host, cctx->port,
						permitted_opens[i].host_to_connect,
						permitted_opens[i].min_port_to_connect,
						permitted_opens[i].max_port_to_connect);
					permit = 1;
				}
			}
		}
	}

	if (num_adm_permitted_opens > 0) {
		permit_adm = 0;
		for (i = 0; i < num_adm_permitted_opens; i++) {
			if (permitted_adm_opens[i].host_to_connect != NULL &&
			    permitted_adm_opens[i].min_port_to_connect <= cctx->port &&
			    permitted_adm_opens[i].max_port_to_connect >= cctx->port) {
				debug2("checking %.100s, %.100s, %.100s", cctx->host, ipaddr, permitted_adm_opens[i].host_to_connect);
				r = match_host_and_ip(cctx->host, ipaddr, permitted_adm_opens[i].host_to_connect);
				if (r == -1) { /* negated match - this attempt is blocked */
					debug2("server config denied %.100s:%d by %.100s:%d-%d", cctx->host, cctx->port,
						permitted_adm_opens[i].host_to_connect,
						permitted_adm_opens[i].min_port_to_connect,
						permitted_adm_opens[i].max_port_to_connect);
					permit_adm = 0;
					break;
				} else if (r == 1) {
					debug2("server config permited %.100s:%d by %.100s:%d-%d", cctx->host, cctx->port,
						permitted_adm_opens[i].host_to_connect,
						permitted_adm_opens[i].min_port_to_connect,
						permitted_adm_opens[i].max_port_to_connect);
					permit_adm = 1;
				}
			}
		}
	}

	if (!permit || !permit_adm) {
		logit("Received request to connect to host %.100s port %d, "
		    "but the request was denied.", cctx->host, cctx->port);
		return 0;
	}
	return 1;
}
/* Check if connecting to that port is permitted and connect. */
Channel *
channel_connect_to(const char *host, u_short port, char *ctype, char *rname)
{
	return connect_to(host, port, ctype, rname); /* XXX replace calls to channel_connect_to */
}

void

Lines 248-255 Link Here

(-)openssh-5.8p1.orig/channels.h (-2 / +3 lines)
248	/* tcp forwarding */	248	/* tcp forwarding */
249	void channel_set_af(int af);	249	void channel_set_af(int af);
250	void channel_permit_all_opens(void);	250	void channel_permit_all_opens(void);
251	void channel_add_permitted_opens(char *, int);	251	void channel_add_permitted_opens(char *, int, int);
252	int channel_add_adm_permitted_opens(char *, int);	252	int channel_add_adm_permitted_opens(char *, int, int);
		253	int channel_is_connect_to_permitted(const struct channel_connect *);
253	void channel_clear_permitted_opens(void);	254	void channel_clear_permitted_opens(void);
254	void channel_clear_adm_permitted_opens(void);	255	void channel_clear_adm_permitted_opens(void);
255	void channel_print_adm_permitted_opens(void);	256	void channel_print_adm_permitted_opens(void);




}

/*
 * returns -1 if we get a negative match for the hostname or the ip.
 * returns 0 if we get no match at all.  returns -2 on error, or 1 on
 * successful match.
 */
int

	int mhost, mip;

	/* error in ipaddr match */
	if ((mip = addr_match_list(ipaddr, patterns)) < 0)
		return mip;
	else if (mip == -1) /* negative ip address match */
		return 0;

	/* negative hostname match */
	if ((mhost = match_hostname(host, patterns, strlen(patterns))) < 0)
		return mhost;
	/* no match at all */
	if (mhost == 0 && mip == 0)
		return 0;




	return (int)port;
}

/*
 * Convert ASCII string to a range of TCP/IP port numbers.
 * Ports must be >=0 and <=65535.
 * A single port will give itself as both the min and max
 * A '*' will give a range of 0 to 65535
 * Return 2 if a range is found
 * Return 1 if a single port is found
 * Return -1 if invalid.
 */
int
a2portrange(const char *s, int *min_port, int *max_port)
{
	char b1[16];
	char *b2;
	b2 = b1;
	strncpy(b1, s, sizeof(b1) - 1);
	b1[sizeof(b1) - 1] = '\0';
	
	if (!strcmp(b1, "*") || !strcmp(b1, "any")) {
		*min_port = 1;
		*max_port = 65535;
		return 2;
	}

	if ((b2 = strrchr(b1, '-')) != NULL) {
		*b2 = '\0';
		b2++;
		*min_port = a2port(b1);
		*max_port = a2port(b2);
		if (*min_port <= 0 || *max_port <= 0)
			return -1;
		return 2;
	}

	*min_port = *max_port = a2port(b1);
	if (*min_port <= 0)
		return -1;
	
	return 1;
}

int
a2tun(const char *s, int *remote)
{

Lines 23-28 Link Here

(-)openssh-5.8p1.orig/misc.h (+1 lines)
23	int unset_nonblock(int);	23	int unset_nonblock(int);
24	void set_nodelay(int);	24	void set_nodelay(int);
25	int a2port(const char *);	25	int a2port(const char *);
		26	int a2portrange(const char , int , int *);
26	int a2tun(const char , int );	27	int a2tun(const char , int );
27	char put_host_port(const char , u_short);	28	char put_host_port(const char , u_short);
28	char hpdelim(char *);	29	char hpdelim(char *);




    const char *host, const char *address)
{
	char *cp, **charptr, *arg, *p;
	char buf[512];
	int cmdline = 0, *intptr, value, value2, n;
	SyslogFacility *log_facility_ptr;
	LogLevel *log_level_ptr;
	ServerOpCodes opcode;
	int port;
	int min_port, max_port;
	u_int i, flags = 0;
	size_t len;


				fatal("%s line %d: missing host in PermitOpen",
				    filename, linenum);
			p = cleanhostname(p);
			if (arg == NULL) {
				fatal("%s line %d: missing port specification in "
				    "PermitOpen", filename, linenum);
			} else {
				strncpy(buf, p, sizeof(buf) - 1);
				p = hpdelim(&arg);
				if (arg == NULL && (a2portrange(p, &min_port, &max_port)) <= 0) {
					fatal("%s line %d: bad port specification in "
				    		"PermitOpen", filename, linenum);
				} else if (arg != NULL) { /* Both a CIDR mask and a port were specified */
					strncat(buf, "/", sizeof(buf) - strlen(buf) - 1);
					if (strlen(p) + 1 > sizeof(buf) - strlen(p))
						fatal("%s line %d: argument too long in "
							"PermitOpen", filename, linenum);
					strncat(buf, p, sizeof(buf) - strlen(buf) - 1);
					a2portrange(arg, &min_port, &max_port);
				}
				if (*activep) {
					options->num_permitted_opens =
				    		channel_add_adm_permitted_opens(buf, min_port, max_port);
				}
			}
		}
		break;


Return to bug 1513

Lines 182-189 Link Here

(-)openssh-5.8p1.orig/match.c (-8 / +6 lines)
182	}	182	}
183		183
184	/*	184	/*
185	* returns 0 if we get a negative match for the hostname or the ip	185	* returns -1 if we get a negative match for the hostname or the ip.
186	* or if we get no match at all. returns -1 on error, or 1 on	186	* returns 0 if we get no match at all. returns -2 on error, or 1 on
187	* successful match.	187	* successful match.
188	*/	188	*/
189	int	189	int
Lines 193-206 Link Here
193	int mhost, mip;	193	int mhost, mip;
194		194
195	/* error in ipaddr match */	195	/* error in ipaddr match */
196	if ((mip = addr_match_list(ipaddr, patterns)) == -2)	196	if ((mip = addr_match_list(ipaddr, patterns)) < 0)
197	return -1;	197	return mip;
198	else if (mip == -1) /* negative ip address match */
199	return 0;
200		198
201	/* negative hostname match */	199	/* negative hostname match */
202	if ((mhost = match_hostname(host, patterns, strlen(patterns))) == -1)	200	if ((mhost = match_hostname(host, patterns, strlen(patterns))) < 0)
203	return 0;	201	return mhost;
204	/* no match at all */	202	/* no match at all */
205	if (mhost == 0 && mip == 0)	203	if (mhost == 0 && mip == 0)
206	return 0;	204	return 0;

Lines 681-691 Link Here

(-)openssh-5.8p1.orig/servconf.c (-5 / +23 lines)
681	const char host, const char address)	681	const char host, const char address)
682	{	682	{
683	char cp, charptr, arg, *p;	683	char cp, charptr, arg, *p;
		684	char buf[512];
684	int cmdline = 0, *intptr, value, value2, n;	685	int cmdline = 0, *intptr, value, value2, n;
685	SyslogFacility *log_facility_ptr;	686	SyslogFacility *log_facility_ptr;
686	LogLevel *log_level_ptr;	687	LogLevel *log_level_ptr;
687	ServerOpCodes opcode;	688	ServerOpCodes opcode;
688	int port;	689	int port;
		690	int min_port, max_port;
689	u_int i, flags = 0;	691	u_int i, flags = 0;
690	size_t len;	692	size_t len;
691		693
Lines 1344-1355 Link Here
1344	fatal("%s line %d: missing host in PermitOpen",	1346	fatal("%s line %d: missing host in PermitOpen",
1345	filename, linenum);	1347	filename, linenum);
1346	p = cleanhostname(p);	1348	p = cleanhostname(p);
1347	if (arg == NULL \|\| (port = a2port(arg)) <= 0)	1349	if (arg == NULL) {
1348	fatal("%s line %d: bad port number in "	1350	fatal("%s line %d: missing port specification in "
1349	"PermitOpen", filename, linenum);	1351	"PermitOpen", filename, linenum);
1350	if (*activep && n == -1)	1352	} else {
1351	options->num_permitted_opens =	1353	strncpy(buf, p, sizeof(buf) - 1);
1352	channel_add_adm_permitted_opens(p, port);	1354	p = hpdelim(&arg);
		1355	if (arg == NULL && (a2portrange(p, &min_port, &max_port)) <= 0) {
		1356	fatal("%s line %d: bad port specification in "
		1357	"PermitOpen", filename, linenum);
		1358	} else if (arg != NULL) { /* Both a CIDR mask and a port were specified */
		1359	strncat(buf, "/", sizeof(buf) - strlen(buf) - 1);
		1360	if (strlen(p) + 1 > sizeof(buf) - strlen(p))
		1361	fatal("%s line %d: argument too long in "
		1362	"PermitOpen", filename, linenum);
		1363	strncat(buf, p, sizeof(buf) - strlen(buf) - 1);
		1364	a2portrange(arg, &min_port, &max_port);
		1365	}
		1366	if (*activep) {
		1367	options->num_permitted_opens =
		1368	channel_add_adm_permitted_opens(buf, min_port, max_port);
		1369	}
		1370	}
1353	}	1371	}
1354	break;	1372	break;
1355		1373

Lines 77-82 Link Here

(-)openssh-5.8p1.orig/channels.c (-29 / +111 lines)
77	#include "key.h"	77	#include "key.h"
78	#include "authfd.h"	78	#include "authfd.h"
79	#include "pathnames.h"	79	#include "pathnames.h"
		80	#include "match.h"
80		81
81	/* -- channel core */	82	/* -- channel core */
82		83
Lines 109-115 Link Here
109	*/	110	*/
110	typedef struct {	111	typedef struct {
111	char host_to_connect; / Connect to 'host'. */	112	char host_to_connect; / Connect to 'host'. */
112	u_short port_to_connect; /* Connect to 'port'. */	113	u_short min_port_to_connect; /* Connect to 'port' (minimum). */
		114	u_short max_port_to_connect; /* Connect to 'port' (maximum). */
113	u_short listen_port; /* Remote side should listen port number. */	115	u_short listen_port; /* Remote side should listen port number. */
114	} ForwardPermission;	116	} ForwardPermission;
115		117
Lines 2906-2912 Link Here
2906	permitted_opens = xrealloc(permitted_opens,	2908	permitted_opens = xrealloc(permitted_opens,
2907	num_permitted_opens + 1, sizeof(*permitted_opens));	2909	num_permitted_opens + 1, sizeof(*permitted_opens));
2908	permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);	2910	permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
2909	permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;	2911	permitted_opens[num_permitted_opens].min_port_to_connect = port_to_connect;
		2912	permitted_opens[num_permitted_opens].max_port_to_connect = port_to_connect;
2910	permitted_opens[num_permitted_opens].listen_port = listen_port;	2913	permitted_opens[num_permitted_opens].listen_port = listen_port;
2911	num_permitted_opens++;	2914	num_permitted_opens++;
2912	}	2915	}
Lines 2942-2948 Link Here
2942	packet_send();	2945	packet_send();
2943		2946
2944	permitted_opens[i].listen_port = 0;	2947	permitted_opens[i].listen_port = 0;
2945	permitted_opens[i].port_to_connect = 0;	2948	permitted_opens[i].min_port_to_connect = 0;
		2949	permitted_opens[i].max_port_to_connect = 0;
2946	xfree(permitted_opens[i].host_to_connect);	2950	xfree(permitted_opens[i].host_to_connect);
2947	permitted_opens[i].host_to_connect = NULL;	2951	permitted_opens[i].host_to_connect = NULL;
2948	}	2952	}
Lines 3000-3028 Link Here
3000	}	3004	}
3001		3005
3002	void	3006	void
3003	channel_add_permitted_opens(char *host, int port)	3007	channel_add_permitted_opens(char *host, int min_port, int max_port)
3004	{	3008	{
3005	debug("allow port forwarding to host %s port %d", host, port);	3009	if (min_port == max_port) {
		3010	debug("allow port forwarding to host %s port %d", host, min_port);
		3011	} else {
		3012	if (min_port > max_port) {
		3013	// xor swap the ports
		3014	min_port ^= max_port;
		3015	max_port ^= min_port;
		3016	min_port ^= max_port;
		3017	}
		3018	debug("allow port forwarding to host %s ports %d through %d", host, min_port, max_port);
		3019	}
3006		3020
3007	permitted_opens = xrealloc(permitted_opens,	3021	permitted_opens = xrealloc(permitted_opens,
3008	num_permitted_opens + 1, sizeof(*permitted_opens));	3022	num_permitted_opens + 1, sizeof(*permitted_opens));
3009	permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host);	3023	permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host);
3010	permitted_opens[num_permitted_opens].port_to_connect = port;	3024	permitted_opens[num_permitted_opens].min_port_to_connect = min_port;
		3025	permitted_opens[num_permitted_opens].min_port_to_connect = max_port;
3011	num_permitted_opens++;	3026	num_permitted_opens++;
3012		3027
3013	all_opens_permitted = 0;	3028	all_opens_permitted = 0;
3014	}	3029	}
3015		3030
3016	int	3031	int
3017	channel_add_adm_permitted_opens(char *host, int port)	3032	channel_add_adm_permitted_opens(char *host, int min_port, int max_port)
3018	{	3033	{
3019	debug("config allows port forwarding to host %s port %d", host, port);	3034	if (min_port == max_port) {
		3035	debug("config allows port forwarding to host %s port %d", host, min_port);
		3036	} else {
		3037	if (min_port > max_port) {
		3038	// xor swap the ports
		3039	min_port ^= max_port;
		3040	max_port ^= min_port;
		3041	min_port ^= max_port;
		3042	}
		3043	debug("config allows port forwarding to host %s ports %d through %d", host, min_port, max_port);
		3044	}
3020		3045
3021	permitted_adm_opens = xrealloc(permitted_adm_opens,	3046	permitted_adm_opens = xrealloc(permitted_adm_opens,
3022	num_adm_permitted_opens + 1, sizeof(*permitted_adm_opens));	3047	num_adm_permitted_opens + 1, sizeof(*permitted_adm_opens));
3023	permitted_adm_opens[num_adm_permitted_opens].host_to_connect	3048	permitted_adm_opens[num_adm_permitted_opens].host_to_connect
3024	= xstrdup(host);	3049	= xstrdup(host);
3025	permitted_adm_opens[num_adm_permitted_opens].port_to_connect = port;	3050	permitted_adm_opens[num_adm_permitted_opens].min_port_to_connect = min_port;
		3051	permitted_adm_opens[num_adm_permitted_opens].max_port_to_connect = max_port;
3026	return ++num_adm_permitted_opens;	3052	return ++num_adm_permitted_opens;
3027	}	3053	}
3028		3054
Lines 3067-3075 Link Here
3067	return;	3093	return;
3068	}	3094	}
3069	for (i = 0; i < num_adm_permitted_opens; i++)	3095	for (i = 0; i < num_adm_permitted_opens; i++)
3070	if (permitted_adm_opens[i].host_to_connect != NULL)	3096	if (permitted_adm_opens[i].host_to_connect != NULL) {
3071	printf(" %s:%d", permitted_adm_opens[i].host_to_connect,	3097	if (permitted_adm_opens[i].min_port_to_connect ==
3072	permitted_adm_opens[i].port_to_connect);	3098	permitted_adm_opens[i].max_port_to_connect) {
		3099	printf(" %s:%d", permitted_adm_opens[i].host_to_connect,
		3100	permitted_adm_opens[i].min_port_to_connect);
		3101	} else {
		3102	printf(" %s:%d-%d", permitted_adm_opens[i].host_to_connect,
		3103	permitted_adm_opens[i].min_port_to_connect,
		3104	permitted_adm_opens[i].max_port_to_connect);
		3105	}
		3106	}
3073	printf("\n");	3107	printf("\n");
3074	}	3108	}
3075		3109
Lines 3090-3095 Link Here
3090	error("connect_next: getnameinfo failed");	3124	error("connect_next: getnameinfo failed");
3091	continue;	3125	continue;
3092	}	3126	}
		3127	if (channel_is_connect_to_permitted(cctx) == 0)
		3128	continue;
3093	if ((sock = socket(cctx->ai->ai_family, cctx->ai->ai_socktype,	3129	if ((sock = socket(cctx->ai->ai_family, cctx->ai->ai_socktype,
3094	cctx->ai->ai_protocol)) == -1) {	3130	cctx->ai->ai_protocol)) == -1) {
3095	if (cctx->ai->ai_next == NULL)	3131	if (cctx->ai->ai_next == NULL)
Lines 3178-3184 Link Here
3178	permitted_opens[i].listen_port == listen_port) {	3214	permitted_opens[i].listen_port == listen_port) {
3179	return connect_to(	3215	return connect_to(
3180	permitted_opens[i].host_to_connect,	3216	permitted_opens[i].host_to_connect,
3181	permitted_opens[i].port_to_connect, ctype, rname);	3217	permitted_opens[i].min_port_to_connect, ctype, rname);
3182	}	3218	}
3183	}	3219	}
3184	error("WARNING: Server requests forwarding for unknown listen_port %d",	3220	error("WARNING: Server requests forwarding for unknown listen_port %d",
Lines 3186-3222 Link Here
3186	return NULL;	3222	return NULL;
3187	}	3223	}
3188		3224
3189	/* Check if connecting to that port is permitted and connect. */	3225	/* Check if connecting to that port is permitted */
3190	Channel *	3226	int
3191	channel_connect_to(const char host, u_short port, char ctype, char *rname)	3227	channel_is_connect_to_permitted(const struct channel_connect *cctx)
3192	{	3228	{
3193	int i, permit, permit_adm = 1;	3229	int r, i, permit, permit_adm = 1;
		3230	char ipaddr[128]; // probably overkill size-wise
		3231
		3232	/* Get an ip address string for match_host_and_ip */
		3233	inet_ntop(cctx->ai->ai_family, &((const struct sockaddr_in *)cctx->ai->ai_addr)->sin_addr, ipaddr, cctx->ai->ai_addrlen);
		3234
		3235	debug2("checking with ip %.100s for %.100s", ipaddr, cctx->host);
3194		3236
3195	permit = all_opens_permitted;	3237	permit = all_opens_permitted;
3196	if (!permit) {	3238	if (!permit) {
3197	for (i = 0; i < num_permitted_opens; i++)	3239	for (i = 0; i < num_permitted_opens; i++) {
		3240	debug2("checking ports %d => %d <= %d", permitted_opens[i].min_port_to_connect, cctx->port, permitted_opens[i].max_port_to_connect);
3198	if (permitted_opens[i].host_to_connect != NULL &&	3241	if (permitted_opens[i].host_to_connect != NULL &&
3199	permitted_opens[i].port_to_connect == port &&	3242	permitted_opens[i].min_port_to_connect <= cctx->port &&
3200	strcmp(permitted_opens[i].host_to_connect, host) == 0)	3243	permitted_opens[i].max_port_to_connect >= cctx->port) {
3201	permit = 1;	3244	debug2("checking %.100s, %.100s, %.100s", cctx->host, ipaddr, permitted_opens[i].host_to_connect);
		3245	r = match_host_and_ip(cctx->host, ipaddr, permitted_opens[i].host_to_connect);
		3246	if (r == -1) { /* negated match - this attempt is blocked */
		3247	debug2("denied %.100s:%d by %.100s:%d-%d", cctx->host, cctx->port,
		3248	permitted_opens[i].host_to_connect,
		3249	permitted_opens[i].min_port_to_connect,
		3250	permitted_opens[i].max_port_to_connect);
		3251	permit = 0;
		3252	break;
		3253	} else if (r == 1) {
		3254	debug2("permited %.100s:%d by %.100s:%d-%d", cctx->host, cctx->port,
		3255	permitted_opens[i].host_to_connect,
		3256	permitted_opens[i].min_port_to_connect,
		3257	permitted_opens[i].max_port_to_connect);
		3258	permit = 1;
		3259	}
		3260	}
		3261	}
3202	}	3262	}
3203		3263
3204	if (num_adm_permitted_opens > 0) {	3264	if (num_adm_permitted_opens > 0) {
3205	permit_adm = 0;	3265	permit_adm = 0;
3206	for (i = 0; i < num_adm_permitted_opens; i++)	3266	for (i = 0; i < num_adm_permitted_opens; i++) {
3207	if (permitted_adm_opens[i].host_to_connect != NULL &&	3267	if (permitted_adm_opens[i].host_to_connect != NULL &&
3208	permitted_adm_opens[i].port_to_connect == port &&	3268	permitted_adm_opens[i].min_port_to_connect <= cctx->port &&
3209	strcmp(permitted_adm_opens[i].host_to_connect, host)	3269	permitted_adm_opens[i].max_port_to_connect >= cctx->port) {
3210	== 0)	3270	debug2("checking %.100s, %.100s, %.100s", cctx->host, ipaddr, permitted_adm_opens[i].host_to_connect);
3211	permit_adm = 1;	3271	r = match_host_and_ip(cctx->host, ipaddr, permitted_adm_opens[i].host_to_connect);
		3272	if (r == -1) { /* negated match - this attempt is blocked */
		3273	debug2("server config denied %.100s:%d by %.100s:%d-%d", cctx->host, cctx->port,
		3274	permitted_adm_opens[i].host_to_connect,
		3275	permitted_adm_opens[i].min_port_to_connect,
		3276	permitted_adm_opens[i].max_port_to_connect);
		3277	permit_adm = 0;
		3278	break;
		3279	} else if (r == 1) {
		3280	debug2("server config permited %.100s:%d by %.100s:%d-%d", cctx->host, cctx->port,
		3281	permitted_adm_opens[i].host_to_connect,
		3282	permitted_adm_opens[i].min_port_to_connect,
		3283	permitted_adm_opens[i].max_port_to_connect);
		3284	permit_adm = 1;
		3285	}
		3286	}
		3287	}
3212	}	3288	}
3213		3289
3214	if (!permit \|\| !permit_adm) {	3290	if (!permit \|\| !permit_adm) {
3215	logit("Received request to connect to host %.100s port %d, "	3291	logit("Received request to connect to host %.100s port %d, "
3216	"but the request was denied.", host, port);	3292	"but the request was denied.", cctx->host, cctx->port);
3217	return NULL;	3293	return 0;
3218	}	3294	}
3219	return connect_to(host, port, ctype, rname);	3295	return 1;
		3296	}
		3297	/* Check if connecting to that port is permitted and connect. */
		3298	Channel *
		3299	channel_connect_to(const char host, u_short port, char ctype, char *rname)
		3300	{
		3301	return connect_to(host, port, ctype, rname); /* XXX replace calls to channel_connect_to */
3220	}	3302	}
3221		3303
3222	void	3304	void

Lines 240-245 Link Here

(-)openssh-5.8p1.orig/misc.c (+41 lines)
240	return (int)port;	240	return (int)port;
241	}	241	}
242		242
		243	/*
		244	* Convert ASCII string to a range of TCP/IP port numbers.
		245	* Ports must be >=0 and <=65535.
		246	* A single port will give itself as both the min and max
		247	* A '*' will give a range of 0 to 65535
		248	* Return 2 if a range is found
		249	* Return 1 if a single port is found
		250	* Return -1 if invalid.
		251	*/
		252	int
		253	a2portrange(const char s, int min_port, int *max_port)
		254	{
		255	char b1[16];
		256	char *b2;
		257	b2 = b1;
		258	strncpy(b1, s, sizeof(b1) - 1);
		259	b1[sizeof(b1) - 1] = '\0';
		260
		261	if (!strcmp(b1, "*") \|\| !strcmp(b1, "any")) {
		262	*min_port = 1;
		263	*max_port = 65535;
		264	return 2;
		265	}
		266
		267	if ((b2 = strrchr(b1, '-')) != NULL) {
		268	*b2 = '\0';
		269	b2++;
		270	*min_port = a2port(b1);
		271	*max_port = a2port(b2);
		272	if (min_port <= 0 \|\| max_port <= 0)
		273	return -1;
		274	return 2;
		275	}
		276
		277	min_port = max_port = a2port(b1);
		278	if (*min_port <= 0)
		279	return -1;
		280
		281	return 1;
		282	}
		283
243	int	284	int
244	a2tun(const char s, int remote)	285	a2tun(const char s, int remote)
245	{	286	{