diff options
author | djm@openbsd.org <djm@openbsd.org> | 2020-04-03 02:40:32 +0000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2020-04-03 13:42:33 +1100 |
commit | 663e84bb53de2a60e56a44d538d25b8152b5c1cc (patch) | |
tree | 2b8a180730e1bd4e130f1af40800b0393beb818e /ssh.c | |
parent | ed833da176611a39d3376d62154eb88eb440d31c (diff) |
upstream: make failures when establishing "Tunnel" forwarding terminate
the connection when ExitOnForwardFailure is enabled; bz3116; ok dtucker
OpenBSD-Commit-ID: ef4b4808de0a419c17579b1081da768625c1d735
Diffstat (limited to 'ssh.c')
-rw-r--r-- | ssh.c | 62 |
1 files changed, 39 insertions, 23 deletions
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: ssh.c,v 1.522 2020/04/03 02:27:12 dtucker Exp $ */ | 1 | /* $OpenBSD: ssh.c,v 1.523 2020/04/03 02:40:32 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -197,7 +197,7 @@ struct sshbuf *command; | |||
197 | int subsystem_flag = 0; | 197 | int subsystem_flag = 0; |
198 | 198 | ||
199 | /* # of replies received for global requests */ | 199 | /* # of replies received for global requests */ |
200 | static int remote_forward_confirms_received = 0; | 200 | static int forward_confirms_pending = -1; |
201 | 201 | ||
202 | /* mux.c */ | 202 | /* mux.c */ |
203 | extern int muxserver_sock; | 203 | extern int muxserver_sock; |
@@ -1673,6 +1673,16 @@ fork_postauth(void) | |||
1673 | fatal("daemon() failed: %.200s", strerror(errno)); | 1673 | fatal("daemon() failed: %.200s", strerror(errno)); |
1674 | } | 1674 | } |
1675 | 1675 | ||
1676 | static void | ||
1677 | forwarding_success(void) | ||
1678 | { | ||
1679 | if (forward_confirms_pending > 0 && --forward_confirms_pending == 0) { | ||
1680 | debug("All forwarding requests processed"); | ||
1681 | if (fork_after_authentication_flag) | ||
1682 | fork_postauth(); | ||
1683 | } | ||
1684 | } | ||
1685 | |||
1676 | /* Callback for remote forward global requests */ | 1686 | /* Callback for remote forward global requests */ |
1677 | static void | 1687 | static void |
1678 | ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt) | 1688 | ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt) |
@@ -1732,11 +1742,7 @@ ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt) | |||
1732 | "for listen port %d", rfwd->listen_port); | 1742 | "for listen port %d", rfwd->listen_port); |
1733 | } | 1743 | } |
1734 | } | 1744 | } |
1735 | if (++remote_forward_confirms_received == options.num_remote_forwards) { | 1745 | forwarding_success(); |
1736 | debug("All remote forwarding requests processed"); | ||
1737 | if (fork_after_authentication_flag) | ||
1738 | fork_postauth(); | ||
1739 | } | ||
1740 | } | 1746 | } |
1741 | 1747 | ||
1742 | static void | 1748 | static void |
@@ -1754,6 +1760,19 @@ ssh_stdio_confirm(struct ssh *ssh, int id, int success, void *arg) | |||
1754 | } | 1760 | } |
1755 | 1761 | ||
1756 | static void | 1762 | static void |
1763 | ssh_tun_confirm(struct ssh *ssh, int id, int success, void *arg) | ||
1764 | { | ||
1765 | if (!success) { | ||
1766 | error("Tunnel forwarding failed"); | ||
1767 | if (options.exit_on_forward_failure) | ||
1768 | cleanup_exit(255); | ||
1769 | } | ||
1770 | |||
1771 | debug("%s: tunnel forward established, id=%d", __func__, id); | ||
1772 | forwarding_success(); | ||
1773 | } | ||
1774 | |||
1775 | static void | ||
1757 | ssh_init_stdio_forwarding(struct ssh *ssh) | 1776 | ssh_init_stdio_forwarding(struct ssh *ssh) |
1758 | { | 1777 | { |
1759 | Channel *c; | 1778 | Channel *c; |
@@ -1816,32 +1835,29 @@ ssh_init_forwarding(struct ssh *ssh, char **ifname) | |||
1816 | options.remote_forwards[i].connect_path : | 1835 | options.remote_forwards[i].connect_path : |
1817 | options.remote_forwards[i].connect_host, | 1836 | options.remote_forwards[i].connect_host, |
1818 | options.remote_forwards[i].connect_port); | 1837 | options.remote_forwards[i].connect_port); |
1819 | options.remote_forwards[i].handle = | 1838 | if ((options.remote_forwards[i].handle = |
1820 | channel_request_remote_forwarding(ssh, | 1839 | channel_request_remote_forwarding(ssh, |
1821 | &options.remote_forwards[i]); | 1840 | &options.remote_forwards[i])) >= 0) { |
1822 | if (options.remote_forwards[i].handle < 0) { | ||
1823 | if (options.exit_on_forward_failure) | ||
1824 | fatal("Could not request remote forwarding."); | ||
1825 | else | ||
1826 | logit("Warning: Could not request remote " | ||
1827 | "forwarding."); | ||
1828 | } else { | ||
1829 | client_register_global_confirm( | 1841 | client_register_global_confirm( |
1830 | ssh_confirm_remote_forward, | 1842 | ssh_confirm_remote_forward, |
1831 | &options.remote_forwards[i]); | 1843 | &options.remote_forwards[i]); |
1832 | } | 1844 | forward_confirms_pending++; |
1845 | } else if (options.exit_on_forward_failure) | ||
1846 | fatal("Could not request remote forwarding."); | ||
1847 | else | ||
1848 | logit("Warning: Could not request remote forwarding."); | ||
1833 | } | 1849 | } |
1834 | 1850 | ||
1835 | /* Initiate tunnel forwarding. */ | 1851 | /* Initiate tunnel forwarding. */ |
1836 | if (options.tun_open != SSH_TUNMODE_NO) { | 1852 | if (options.tun_open != SSH_TUNMODE_NO) { |
1837 | if ((*ifname = client_request_tun_fwd(ssh, | 1853 | if ((*ifname = client_request_tun_fwd(ssh, |
1838 | options.tun_open, options.tun_local, | 1854 | options.tun_open, options.tun_local, |
1839 | options.tun_remote)) == NULL) { | 1855 | options.tun_remote, ssh_tun_confirm, NULL)) != NULL) |
1840 | if (options.exit_on_forward_failure) | 1856 | forward_confirms_pending++; |
1841 | fatal("Could not request tunnel forwarding."); | 1857 | else if (options.exit_on_forward_failure) |
1842 | else | 1858 | fatal("Could not request tunnel forwarding."); |
1843 | error("Could not request tunnel forwarding."); | 1859 | else |
1844 | } | 1860 | error("Could not request tunnel forwarding."); |
1845 | } | 1861 | } |
1846 | } | 1862 | } |
1847 | 1863 | ||