summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ChangeLog8
-rw-r--r--channels.c17
-rw-r--r--channels.h6
-rw-r--r--clientloop.c9
-rw-r--r--readconf.c11
-rw-r--r--readconf.h3
-rw-r--r--session.c8
-rw-r--r--ssh.13
-rw-r--r--ssh.c27
-rw-r--r--ssh_config.513
10 files changed, 79 insertions, 26 deletions
diff --git a/ChangeLog b/ChangeLog
index b5c849806..74bfb0d3b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -23,6 +23,12 @@
23 Only copy the part of environment variable that we actually use. Prevents 23 Only copy the part of environment variable that we actually use. Prevents
24 ssh bailing when SendEnv is used and an environment variable with a really 24 ssh bailing when SendEnv is used and an environment variable with a really
25 long value exists. ok djm@ 25 long value exists. ok djm@
26 - markus@cvs.openbsd.org 2006/07/11 18:50:48
27 [clientloop.c ssh.1 ssh.c channels.c ssh_config.5 readconf.h session.c
28 channels.h readconf.c]
29 add ExitOnForwardFailure: terminate the connection if ssh(1)
30 cannot set up all requested dynamic, local, and remote port
31 forwardings. ok djm, dtucker, stevesk, jmc
26 32
2720060711 3320060711
28 - (dtucker) [configure.ac ssh-keygen.c openbsd-compat/bsd-openpty.c 34 - (dtucker) [configure.ac ssh-keygen.c openbsd-compat/bsd-openpty.c
@@ -4872,4 +4878,4 @@
4872 - (djm) Trim deprecated options from INSTALL. Mention UsePAM 4878 - (djm) Trim deprecated options from INSTALL. Mention UsePAM
4873 - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu 4879 - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
4874 4880
4875$Id: ChangeLog,v 1.4395 2006/07/12 12:16:23 dtucker Exp $ 4881$Id: ChangeLog,v 1.4396 2006/07/12 12:17:10 dtucker Exp $
diff --git a/channels.c b/channels.c
index cd68efded..51718578b 100644
--- a/channels.c
+++ b/channels.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: channels.c,v 1.252 2006/07/10 12:08:08 djm Exp $ */ 1/* $OpenBSD: channels.c,v 1.253 2006/07/11 18:50:47 markus Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -2481,7 +2481,7 @@ channel_setup_remote_fwd_listener(const char *listen_address,
2481 * the secure channel to host:port from local side. 2481 * the secure channel to host:port from local side.
2482 */ 2482 */
2483 2483
2484void 2484int
2485channel_request_remote_forwarding(const char *listen_host, u_short listen_port, 2485channel_request_remote_forwarding(const char *listen_host, u_short listen_port,
2486 const char *host_to_connect, u_short port_to_connect) 2486 const char *host_to_connect, u_short port_to_connect)
2487{ 2487{
@@ -2525,7 +2525,6 @@ channel_request_remote_forwarding(const char *listen_host, u_short listen_port,
2525 success = 1; 2525 success = 1;
2526 break; 2526 break;
2527 case SSH_SMSG_FAILURE: 2527 case SSH_SMSG_FAILURE:
2528 logit("Warning: Server denied remote port forwarding.");
2529 break; 2528 break;
2530 default: 2529 default:
2531 /* Unknown packet */ 2530 /* Unknown packet */
@@ -2539,6 +2538,7 @@ channel_request_remote_forwarding(const char *listen_host, u_short listen_port,
2539 permitted_opens[num_permitted_opens].listen_port = listen_port; 2538 permitted_opens[num_permitted_opens].listen_port = listen_port;
2540 num_permitted_opens++; 2539 num_permitted_opens++;
2541 } 2540 }
2541 return (success ? 0 : -1);
2542} 2542}
2543 2543
2544/* 2544/*
@@ -2578,12 +2578,13 @@ channel_request_rforward_cancel(const char *host, u_short port)
2578/* 2578/*
2579 * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates 2579 * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates
2580 * listening for the port, and sends back a success reply (or disconnect 2580 * listening for the port, and sends back a success reply (or disconnect
2581 * message if there was an error). This never returns if there was an error. 2581 * message if there was an error).
2582 */ 2582 */
2583void 2583int
2584channel_input_port_forward_request(int is_root, int gateway_ports) 2584channel_input_port_forward_request(int is_root, int gateway_ports)
2585{ 2585{
2586 u_short port, host_port; 2586 u_short port, host_port;
2587 int success = 0;
2587 char *hostname; 2588 char *hostname;
2588 2589
2589 /* Get arguments from the packet. */ 2590 /* Get arguments from the packet. */
@@ -2605,11 +2606,13 @@ channel_input_port_forward_request(int is_root, int gateway_ports)
2605#endif 2606#endif
2606 2607
2607 /* Initiate forwarding */ 2608 /* Initiate forwarding */
2608 channel_setup_local_fwd_listener(NULL, port, hostname, 2609 success = channel_setup_local_fwd_listener(NULL, port, hostname,
2609 host_port, gateway_ports); 2610 host_port, gateway_ports);
2610 2611
2611 /* Free the argument string. */ 2612 /* Free the argument string. */
2612 xfree(hostname); 2613 xfree(hostname);
2614
2615 return (success ? 0 : -1);
2613} 2616}
2614 2617
2615/* 2618/*
@@ -2628,7 +2631,7 @@ void
2628channel_add_permitted_opens(char *host, int port) 2631channel_add_permitted_opens(char *host, int port)
2629{ 2632{
2630 if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION) 2633 if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
2631 fatal("channel_request_remote_forwarding: too many forwards"); 2634 fatal("channel_add_permitted_opens: too many forwards");
2632 debug("allow port forwarding to host %s port %d", host, port); 2635 debug("allow port forwarding to host %s port %d", host, port);
2633 2636
2634 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host); 2637 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host);
diff --git a/channels.h b/channels.h
index ee1d260fd..d21319a2b 100644
--- a/channels.h
+++ b/channels.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: channels.h,v 1.84 2006/03/25 22:22:42 djm Exp $ */ 1/* $OpenBSD: channels.h,v 1.85 2006/07/11 18:50:47 markus Exp $ */
2 2
3/* 3/*
4 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -208,10 +208,10 @@ void channel_set_af(int af);
208void channel_permit_all_opens(void); 208void channel_permit_all_opens(void);
209void channel_add_permitted_opens(char *, int); 209void channel_add_permitted_opens(char *, int);
210void channel_clear_permitted_opens(void); 210void channel_clear_permitted_opens(void);
211void channel_input_port_forward_request(int, int); 211int channel_input_port_forward_request(int, int);
212int channel_connect_to(const char *, u_short); 212int channel_connect_to(const char *, u_short);
213int channel_connect_by_listen_address(u_short); 213int channel_connect_by_listen_address(u_short);
214void channel_request_remote_forwarding(const char *, u_short, 214int channel_request_remote_forwarding(const char *, u_short,
215 const char *, u_short); 215 const char *, u_short);
216int channel_setup_local_fwd_listener(const char *, u_short, 216int channel_setup_local_fwd_listener(const char *, u_short,
217 const char *, u_short, int); 217 const char *, u_short, int);
diff --git a/clientloop.c b/clientloop.c
index c59d573c5..6cb2a7ac7 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: clientloop.c,v 1.166 2006/07/08 21:47:12 stevesk Exp $ */ 1/* $OpenBSD: clientloop.c,v 1.167 2006/07/11 18:50:47 markus Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -996,9 +996,12 @@ process_cmdline(void)
996 goto out; 996 goto out;
997 } 997 }
998 } else { 998 } else {
999 channel_request_remote_forwarding(fwd.listen_host, 999 if (channel_request_remote_forwarding(fwd.listen_host,
1000 fwd.listen_port, fwd.connect_host, 1000 fwd.listen_port, fwd.connect_host,
1001 fwd.connect_port); 1001 fwd.connect_port) < 0) {
1002 logit("Port forwarding failed.");
1003 goto out;
1004 }
1002 } 1005 }
1003 1006
1004 logit("Forwarding port."); 1007 logit("Forwarding port.");
diff --git a/readconf.c b/readconf.c
index df5e566a5..d25f93012 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: readconf.c,v 1.152 2006/07/05 02:42:09 stevesk Exp $ */ 1/* $OpenBSD: readconf.c,v 1.153 2006/07/11 18:50:48 markus Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -102,6 +102,7 @@
102typedef enum { 102typedef enum {
103 oBadOption, 103 oBadOption,
104 oForwardAgent, oForwardX11, oForwardX11Trusted, oGatewayPorts, 104 oForwardAgent, oForwardX11, oForwardX11Trusted, oGatewayPorts,
105 oExitOnForwardFailure,
105 oPasswordAuthentication, oRSAAuthentication, 106 oPasswordAuthentication, oRSAAuthentication,
106 oChallengeResponseAuthentication, oXAuthLocation, 107 oChallengeResponseAuthentication, oXAuthLocation,
107 oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward, 108 oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
@@ -132,6 +133,7 @@ static struct {
132 { "forwardagent", oForwardAgent }, 133 { "forwardagent", oForwardAgent },
133 { "forwardx11", oForwardX11 }, 134 { "forwardx11", oForwardX11 },
134 { "forwardx11trusted", oForwardX11Trusted }, 135 { "forwardx11trusted", oForwardX11Trusted },
136 { "exitonforwardfailure", oExitOnForwardFailure },
135 { "xauthlocation", oXAuthLocation }, 137 { "xauthlocation", oXAuthLocation },
136 { "gatewayports", oGatewayPorts }, 138 { "gatewayports", oGatewayPorts },
137 { "useprivilegedport", oUsePrivilegedPort }, 139 { "useprivilegedport", oUsePrivilegedPort },
@@ -386,6 +388,10 @@ parse_flag:
386 intptr = &options->gateway_ports; 388 intptr = &options->gateway_ports;
387 goto parse_flag; 389 goto parse_flag;
388 390
391 case oExitOnForwardFailure:
392 intptr = &options->exit_on_forward_failure;
393 goto parse_flag;
394
389 case oUsePrivilegedPort: 395 case oUsePrivilegedPort:
390 intptr = &options->use_privileged_port; 396 intptr = &options->use_privileged_port;
391 goto parse_flag; 397 goto parse_flag;
@@ -987,6 +993,7 @@ initialize_options(Options * options)
987 options->forward_agent = -1; 993 options->forward_agent = -1;
988 options->forward_x11 = -1; 994 options->forward_x11 = -1;
989 options->forward_x11_trusted = -1; 995 options->forward_x11_trusted = -1;
996 options->exit_on_forward_failure = -1;
990 options->xauth_location = NULL; 997 options->xauth_location = NULL;
991 options->gateway_ports = -1; 998 options->gateway_ports = -1;
992 options->use_privileged_port = -1; 999 options->use_privileged_port = -1;
@@ -1067,6 +1074,8 @@ fill_default_options(Options * options)
1067 options->forward_x11 = 0; 1074 options->forward_x11 = 0;
1068 if (options->forward_x11_trusted == -1) 1075 if (options->forward_x11_trusted == -1)
1069 options->forward_x11_trusted = 0; 1076 options->forward_x11_trusted = 0;
1077 if (options->exit_on_forward_failure == -1)
1078 options->exit_on_forward_failure = 0;
1070 if (options->xauth_location == NULL) 1079 if (options->xauth_location == NULL)
1071 options->xauth_location = _PATH_XAUTH; 1080 options->xauth_location = _PATH_XAUTH;
1072 if (options->gateway_ports == -1) 1081 if (options->gateway_ports == -1)
diff --git a/readconf.h b/readconf.h
index 7fc2ea47c..e99b1ff25 100644
--- a/readconf.h
+++ b/readconf.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: readconf.h,v 1.69 2006/03/25 22:22:43 djm Exp $ */ 1/* $OpenBSD: readconf.h,v 1.70 2006/07/11 18:50:48 markus Exp $ */
2 2
3/* 3/*
4 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -34,6 +34,7 @@ typedef struct {
34 int forward_agent; /* Forward authentication agent. */ 34 int forward_agent; /* Forward authentication agent. */
35 int forward_x11; /* Forward X11 display. */ 35 int forward_x11; /* Forward X11 display. */
36 int forward_x11_trusted; /* Trust Forward X11 display. */ 36 int forward_x11_trusted; /* Trust Forward X11 display. */
37 int exit_on_forward_failure; /* Exit if bind(2) fails for -L/-R */
37 char *xauth_location; /* Location for xauth program */ 38 char *xauth_location; /* Location for xauth program */
38 int gateway_ports; /* Allow remote connects to forwarded ports. */ 39 int gateway_ports; /* Allow remote connects to forwarded ports. */
39 int use_privileged_port; /* Don't use privileged port if false. */ 40 int use_privileged_port; /* Don't use privileged port if false. */
diff --git a/session.c b/session.c
index 0a321be30..33be91545 100644
--- a/session.c
+++ b/session.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: session.c,v 1.207 2006/07/08 21:48:53 stevesk Exp $ */ 1/* $OpenBSD: session.c,v 1.208 2006/07/11 18:50:48 markus Exp $ */
2/* 2/*
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved 4 * All rights reserved
@@ -338,7 +338,11 @@ do_authenticated1(Authctxt *authctxt)
338 break; 338 break;
339 } 339 }
340 debug("Received TCP/IP port forwarding request."); 340 debug("Received TCP/IP port forwarding request.");
341 channel_input_port_forward_request(s->pw->pw_uid == 0, options.gateway_ports); 341 if (channel_input_port_forward_request(s->pw->pw_uid == 0,
342 options.gateway_ports) < 0) {
343 debug("Port forwarding failed.");
344 break;
345 }
342 success = 1; 346 success = 1;
343 break; 347 break;
344 348
diff --git a/ssh.1 b/ssh.1
index f44b6f29a..6e41bcd8b 100644
--- a/ssh.1
+++ b/ssh.1
@@ -34,7 +34,7 @@
34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36.\" 36.\"
37.\" $OpenBSD: ssh.1,v 1.262 2006/07/02 23:01:55 stevesk Exp $ 37.\" $OpenBSD: ssh.1,v 1.263 2006/07/11 18:50:48 markus Exp $
38.Dd September 25, 1999 38.Dd September 25, 1999
39.Dt SSH 1 39.Dt SSH 1
40.Os 40.Os
@@ -449,6 +449,7 @@ For full details of the options listed below, and their possible values, see
449.It ControlPath 449.It ControlPath
450.It DynamicForward 450.It DynamicForward
451.It EscapeChar 451.It EscapeChar
452.It ExitOnForwardFailure
452.It ForwardAgent 453.It ForwardAgent
453.It ForwardX11 454.It ForwardX11
454.It ForwardX11Trusted 455.It ForwardX11Trusted
diff --git a/ssh.c b/ssh.c
index bd92206d4..2e0ef2f9f 100644
--- a/ssh.c
+++ b/ssh.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssh.c,v 1.282 2006/07/11 10:12:07 dtucker Exp $ */ 1/* $OpenBSD: ssh.c,v 1.283 2006/07/11 18:50:48 markus Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -817,6 +817,8 @@ ssh_init_forwarding(void)
817 options.local_forwards[i].connect_port, 817 options.local_forwards[i].connect_port,
818 options.gateway_ports); 818 options.gateway_ports);
819 } 819 }
820 if (i > 0 && success != i && options.exit_on_forward_failure)
821 fatal("Could not request local forwarding.");
820 if (i > 0 && success == 0) 822 if (i > 0 && success == 0)
821 error("Could not request local forwarding."); 823 error("Could not request local forwarding.");
822 824
@@ -829,11 +831,17 @@ ssh_init_forwarding(void)
829 options.remote_forwards[i].listen_port, 831 options.remote_forwards[i].listen_port,
830 options.remote_forwards[i].connect_host, 832 options.remote_forwards[i].connect_host,
831 options.remote_forwards[i].connect_port); 833 options.remote_forwards[i].connect_port);
832 channel_request_remote_forwarding( 834 if (channel_request_remote_forwarding(
833 options.remote_forwards[i].listen_host, 835 options.remote_forwards[i].listen_host,
834 options.remote_forwards[i].listen_port, 836 options.remote_forwards[i].listen_port,
835 options.remote_forwards[i].connect_host, 837 options.remote_forwards[i].connect_host,
836 options.remote_forwards[i].connect_port); 838 options.remote_forwards[i].connect_port) < 0) {
839 if (options.exit_on_forward_failure)
840 fatal("Could not request remote forwarding.");
841 else
842 logit("Warning: Could not request remote "
843 "forwarding.");
844 }
837 } 845 }
838} 846}
839 847
@@ -1015,9 +1023,16 @@ client_global_request_reply_fwd(int type, u_int32_t seq, void *ctxt)
1015 options.remote_forwards[i].listen_port, 1023 options.remote_forwards[i].listen_port,
1016 options.remote_forwards[i].connect_host, 1024 options.remote_forwards[i].connect_host,
1017 options.remote_forwards[i].connect_port); 1025 options.remote_forwards[i].connect_port);
1018 if (type == SSH2_MSG_REQUEST_FAILURE) 1026 if (type == SSH2_MSG_REQUEST_FAILURE) {
1019 logit("Warning: remote port forwarding failed for listen " 1027 if (options.exit_on_forward_failure)
1020 "port %d", options.remote_forwards[i].listen_port); 1028 fatal("Error: remote port forwarding failed for "
1029 "listen port %d",
1030 options.remote_forwards[i].listen_port);
1031 else
1032 logit("Warning: remote port forwarding failed for "
1033 "listen port %d",
1034 options.remote_forwards[i].listen_port);
1035 }
1021} 1036}
1022 1037
1023static void 1038static void
diff --git a/ssh_config.5 b/ssh_config.5
index 68ec311b2..55ca55303 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -34,7 +34,7 @@
34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36.\" 36.\"
37.\" $OpenBSD: ssh_config.5,v 1.95 2006/07/02 17:12:58 stevesk Exp $ 37.\" $OpenBSD: ssh_config.5,v 1.96 2006/07/11 18:50:48 markus Exp $
38.Dd September 25, 1999 38.Dd September 25, 1999
39.Dt SSH_CONFIG 5 39.Dt SSH_CONFIG 5
40.Os 40.Os
@@ -385,6 +385,17 @@ followed by a letter, or
385to disable the escape 385to disable the escape
386character entirely (making the connection transparent for binary 386character entirely (making the connection transparent for binary
387data). 387data).
388.It Cm ExitOnForwardFailure
389Specifies whether
390.Xr ssh 1
391should terminate the connection if it cannot set up all requested
392dynamic, local, and remote port forwardings.
393The argument must be
394.Dq yes
395or
396.Dq no .
397The default is
398.Dq no .
388.It Cm ForwardAgent 399.It Cm ForwardAgent
389Specifies whether the connection to the authentication agent (if any) 400Specifies whether the connection to the authentication agent (if any)
390will be forwarded to the remote machine. 401will be forwarded to the remote machine.