1 files changed, 66 insertions, 23 deletions

diff --git a/ssh.c b/ssh.c
index 75a0d9b23..a64f1e2dc 100644
--- a/ssh.c
+++ b/ssh.c
@@ -40,7 +40,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh.c,v 1.249 2005/07/30 01:26:16 djm Exp $");
+RCSID("$OpenBSD: ssh.c,v 1.257 2005/12/20 04:41:07 dtucker Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/err.h>
@@ -158,13 +158,13 @@ usage(void)
 {
         fprintf(stderr,
 "usage: ssh [-1246AaCfgkMNnqsTtVvXxY] [-b bind_address] [-c cipher_spec]\n"
-"           [-D port] [-e escape_char] [-F configfile]\n"
+"           [-D [bind_address:]port] [-e escape_char] [-F configfile]\n"
 "           [-i identity_file] [-L [bind_address:]port:host:hostport]\n"
 "           [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]\n"
 "           [-R [bind_address:]port:host:hostport] [-S ctl_path]\n"
-"           [user@]hostname [command]\n"
+"           [-w tunnel:tunnel] [user@]hostname [command]\n"
         );
-        exit(1);
+        exit(255);
 }
 
 static int ssh_session(void);
@@ -188,6 +188,9 @@ main(int ac, char **av)
         struct servent *sp;
         Forward fwd;
 
+        /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+        sanitise_stdfd();
+
         __progname = ssh_get_progname(av[0]);
         init_rng();
 
@@ -220,7 +223,7 @@ main(int ac, char **av)
         pw = getpwuid(original_real_uid);
         if (!pw) {
                 logit("You don't exist, go away!");
-                exit(1);
+                exit(255);
         }
         /* Take a copy of the returned structure. */
         pw = pwcopy(pw);
@@ -241,7 +244,7 @@ main(int ac, char **av)
 
 again:
         while ((opt = getopt(ac, av,
-            "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:L:MNO:PR:S:TVXY")) != -1) {
+            "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:L:MNO:PR:S:TVw:XY")) != -1) {
                 switch (opt) {
                 case '1':
                         options.protocol = SSH_PROTO_1;
@@ -337,6 +340,15 @@ again:
                         if (opt == 'V')
                                 exit(0);
                         break;
+                case 'w':
+                        if (options.tun_open == -1)
+                                options.tun_open = SSH_TUNMODE_DEFAULT;
+                        options.tun_local = a2tun(optarg, &options.tun_remote);
+                        if (options.tun_local == SSH_TUNID_ERR) {
+                                fprintf(stderr, "Bad tun device '%s'\n", optarg);
+                                exit(255);
+                        }
+                        break;
                 case 'q':
                         if (options.log_level == SYSLOG_LEVEL_QUIET) {
                                 options.log_level = SYSLOG_LEVEL_SILENT;
@@ -357,7 +369,7 @@ again:
                         else {
                                 fprintf(stderr, "Bad escape character '%s'.\n",
                                     optarg);
-                                exit(1);
+                                exit(255);
                         }
                         break;
                 case 'c':
@@ -372,7 +384,7 @@ again:
                                         fprintf(stderr,
                                             "Unknown cipher type '%s'\n",
                                             optarg);
-                                        exit(1);
+                                        exit(255);
                                 }
                                 if (options.cipher == SSH_CIPHER_3DES)
                                         options.ciphers = "3des-cbc";
@@ -388,7 +400,7 @@ again:
                         else {
                                 fprintf(stderr, "Unknown mac type '%s'\n",
                                     optarg);
-                                exit(1);
+                                exit(255);
                         }
                         break;
                 case 'M':
@@ -401,7 +413,7 @@ again:
                         options.port = a2port(optarg);
                         if (options.port == 0) {
                                 fprintf(stderr, "Bad port '%s'\n", optarg);
-                                exit(1);
+                                exit(255);
                         }
                         break;
                 case 'l':
@@ -415,7 +427,7 @@ again:
                                 fprintf(stderr,
                                     "Bad local forwarding specification '%s'\n",
                                     optarg);
-                                exit(1);
+                                exit(255);
                         }
                         break;
 
@@ -426,7 +438,7 @@ again:
                                 fprintf(stderr,
                                     "Bad remote forwarding specification "
                                     "'%s'\n", optarg);
-                                exit(1);
+                                exit(255);
                         }
                         break;
 
@@ -437,7 +449,7 @@ again:
                         if ((fwd.listen_host = hpdelim(&cp)) == NULL) {
                                 fprintf(stderr, "Bad dynamic forwarding "
                                     "specification '%.100s'\n", optarg);
-                                exit(1);
+                                exit(255);
                         }
                         if (cp != NULL) {
                                 fwd.listen_port = a2port(cp);
@@ -450,7 +462,7 @@ again:
                         if (fwd.listen_port == 0) {
                                 fprintf(stderr, "Bad dynamic port '%s'\n",
                                     optarg);
-                                exit(1);
+                                exit(255);
                         }
                         add_local_forward(&options, &fwd);
                         xfree(p);
@@ -471,7 +483,7 @@ again:
                         line = xstrdup(optarg);
                         if (process_config_line(&options, host ? host : "",
                             line, "command-line", 0, &dummy) != 0)
-                                exit(1);
+                                exit(255);
                         xfree(line);
                         break;
                 case 's':
@@ -647,7 +659,7 @@ again:
             original_effective_uid == 0 && options.use_privileged_port,
 #endif
             options.proxy_command) != 0)
-                exit(1);
+                exit(255);
 
         /*
          * If we successfully made the connection, load the host private key
@@ -700,7 +712,7 @@ again:
 
         /*
          * Now that we are back to our own permissions, create ~/.ssh
-         * directory if it doesn\'t already exist.
+         * directory if it doesn't already exist.
          */
         snprintf(buf, sizeof buf, "%.100s%s%.100s", pw->pw_dir, strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR);
         if (stat(buf, &st) < 0)
@@ -796,8 +808,7 @@ ssh_init_forwarding(void)
                 debug("Remote connections from %.200s:%d forwarded to "
                     "local address %.200s:%d",
                     (options.remote_forwards[i].listen_host == NULL) ?
-                    (options.gateway_ports ? "*" : "LOCALHOST") :
-                    options.remote_forwards[i].listen_host,
+                    "LOCALHOST" : options.remote_forwards[i].listen_host,
                     options.remote_forwards[i].listen_port,
                     options.remote_forwards[i].connect_host,
                     options.remote_forwards[i].connect_port);
@@ -813,7 +824,7 @@ static void
 check_agent_present(void)
 {
         if (options.forward_agent) {
-                /* Clear agent forwarding if we don\'t have an agent. */
+                /* Clear agent forwarding if we don't have an agent. */
                 if (!ssh_agent_present())
                         options.forward_agent = 0;
         }
@@ -1015,7 +1026,7 @@ ssh_control_listener(void)
                 fatal("ControlPath too long");
 
         if ((control_fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
-                fatal("%s socket(): %s\n", __func__, strerror(errno));
+                fatal("%s socket(): %s", __func__, strerror(errno));
 
         old_umask = umask(0177);
         if (bind(control_fd, (struct sockaddr*)&addr, addr_len) == -1) {
@@ -1024,12 +1035,12 @@ ssh_control_listener(void)
                         fatal("ControlSocket %s already exists",
                             options.control_path);
                 else
-                        fatal("%s bind(): %s\n", __func__, strerror(errno));
+                        fatal("%s bind(): %s", __func__, strerror(errno));
         }
         umask(old_umask);
 
         if (listen(control_fd, 64) == -1)
-                fatal("%s listen(): %s\n", __func__, strerror(errno));
+                fatal("%s listen(): %s", __func__, strerror(errno));
 
         set_nonblock(control_fd);
 }
@@ -1062,6 +1073,33 @@ ssh_session2_setup(int id, void *arg)
                 packet_send();
         }
 
+        if (options.tun_open != SSH_TUNMODE_NO) {
+                Channel *c;
+                int fd;
+
+                debug("Requesting tun.");
+                if ((fd = tun_open(options.tun_local,
+                    options.tun_open)) >= 0) {
+                        c = channel_new("tun", SSH_CHANNEL_OPENING, fd, fd, -1,
+                            CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
+                            0, "tun", 1);
+                        c->datagram = 1;
+#if defined(SSH_TUN_FILTER)
+                        if (options.tun_open == SSH_TUNMODE_POINTOPOINT)
+                                channel_register_filter(c->self, sys_tun_infilter,
+                                    sys_tun_outfilter);
+#endif
+                        packet_start(SSH2_MSG_CHANNEL_OPEN);
+                        packet_put_cstring("tun@openssh.com");
+                        packet_put_int(c->self);
+                        packet_put_int(c->local_window_max);
+                        packet_put_int(c->local_maxpacket);
+                        packet_put_int(options.tun_open);
+                        packet_put_int(options.tun_remote);
+                        packet_send();
+                }
+        }
+
         client_session2_setup(id, tty_flag, subsystem_flag, getenv("TERM"),
             NULL, fileno(stdin), &command, environ, &ssh_subsystem_reply);
 
@@ -1126,6 +1164,11 @@ ssh_session2(void)
         if (!no_shell_flag || (datafellows & SSH_BUG_DUMMYCHAN))
                 id = ssh_session2_open();
 
+        /* Execute a local command */
+        if (options.local_command != NULL &&
+            options.permit_local_command)
+                ssh_local_cmd(options.local_command);
+
         /* If requested, let ssh continue in the background. */
         if (fork_after_authentication_flag)
                 if (daemon(1, 1) < 0)