static int
remotecmd(char *rhost, char *luser, char *ruser, char *cmd)
{
int desc;
#if defined(DIRECT_RCMD)
static int port = -1;
#endif /* DIRECT_RCMD */
debugmsg(DM_MISC, "local user = %s remote user = %s\n", luser, ruser);
debugmsg(DM_MISC, "Remote command = '%s'\n", cmd);
(void) fflush(stdout);
(void) fflush(stderr);
(void) signal(SIGALRM, sighandler);
(void) alarm(RTIMEOUT);
#if defined(DIRECT_RCMD)
(void) signal(SIGPIPE, sighandler);
if (port < 0) {
struct servent *sp;
if ((sp = getservbyname("shell", "tcp")) == NULL)
fatalerr("shell/tcp: unknown service");
port = sp->s_port;
}
if (becomeroot() != 0)
exit(1);
desc = rcmd(&rhost, port, luser, ruser, cmd, 0);
if (becomeuser() != 0)
exit(1);
#else /* !DIRECT_RCMD */
debugmsg(DM_MISC, "Remote shell command = '%s'\n",
path_remsh ? path_remsh : "default");
(void) signal(SIGPIPE, SIG_IGN);
desc = rcmdsh(&rhost, -1, luser, ruser, cmd, path_remsh);
if (desc > 0)
(void) signal(SIGPIPE, sighandler);
#endif /* DIRECT_RCMD */
(void) alarm(0);
return(desc);
}
int
rcmd_af(char **ahost, int rport, const char *locuser, const char *remuser,
const char *cmd, int *fd2p, int af)
{
struct addrinfo hints, *res, *ai;
struct sockaddr_storage from;
fd_set reads;
sigset_t oldmask, newmask;
pid_t pid;
int s, aport, lport, timo, error;
char c, *p;
int refused, nres;
char num[8];
static char canonnamebuf[MAXDNAME]; /* is it proper here? */
/* call rcmdsh() with specified remote shell if appropriate. */
if (!issetugid() && (p = getenv("RSH"))) {
struct servent *sp = getservbyname("shell", "tcp");
if (sp && sp->s_port == rport)
return (rcmdsh(ahost, rport, locuser, remuser,
cmd, p));
}
/* use rsh(1) if non-root and remote port is shell. */
if (geteuid()) {
struct servent *sp = getservbyname("shell", "tcp");
if (sp && sp->s_port == rport)
return (rcmdsh(ahost, rport, locuser, remuser,
cmd, NULL));
}
pid = getpid();
memset(&hints, 0, sizeof(hints));
hints.ai_flags = AI_CANONNAME;
hints.ai_family = af;
hints.ai_socktype = SOCK_STREAM;
hints.ai_protocol = 0;
snprintf(num, sizeof(num), "%d", ntohs(rport));
error = getaddrinfo(*ahost, num, &hints, &res);
if (error) {
fprintf(stderr, "rcmd: getaddrinfo: %s\n",
gai_strerror(error));
if (error == EAI_SYSTEM)
fprintf(stderr, "rcmd: getaddrinfo: %s\n",
strerror(errno));
return (-1);
}
if (res->ai_canonname &&
strlen(res->ai_canonname) + 1 < sizeof(canonnamebuf)) {
strncpy(canonnamebuf, res->ai_canonname, sizeof(canonnamebuf));
*ahost = canonnamebuf;
}
nres = 0;
for (ai = res; ai; ai = ai->ai_next)
nres++;
ai = res;
refused = 0;
sigemptyset(&newmask);
sigaddset(&newmask, SIGURG);
_sigprocmask(SIG_BLOCK, (const sigset_t *)&newmask, &oldmask);
for (timo = 1, lport = IPPORT_RESERVED - 1;;) {
s = rresvport_af(&lport, ai->ai_family);
if (s < 0) {
if (errno != EAGAIN && ai->ai_next) {
ai = ai->ai_next;
continue;
}
if (errno == EAGAIN)
fprintf(stderr,
"rcmd: socket: All ports in use\n");
else
fprintf(stderr, "rcmd: socket: %s\n",
strerror(errno));
freeaddrinfo(res);
_sigprocmask(SIG_SETMASK, (const sigset_t *)&oldmask,
NULL);
return (-1);
}
_fcntl(s, F_SETOWN, pid);
if (_connect(s, ai->ai_addr, ai->ai_addrlen) >= 0)
break;
_close(s);
if (errno == EADDRINUSE) {
lport--;
continue;
}
if (errno == ECONNREFUSED)
refused = 1;
if (ai->ai_next == NULL && (!refused || timo > 16)) {
fprintf(stderr, "%s: %s\n", *ahost, strerror(errno));
freeaddrinfo(res);
_sigprocmask(SIG_SETMASK, (const sigset_t *)&oldmask,
NULL);
return (-1);
}
if (nres > 1) {
int oerrno = errno;
getnameinfo(ai->ai_addr, ai->ai_addrlen, paddr,
sizeof(paddr), NULL, 0, NI_NUMERICHOST);
fprintf(stderr, "connect to address %s: ", paddr);
errno = oerrno;
perror(0);
}
if ((ai = ai->ai_next) == NULL) {
/* refused && timo <= 16 */
struct timespec time_to_sleep, time_remaining;
time_to_sleep.tv_sec = timo;
time_to_sleep.tv_nsec = 0;
_nanosleep(&time_to_sleep, &time_remaining);
timo *= 2;
ai = res;
refused = 0;
}
if (nres > 1) {
getnameinfo(ai->ai_addr, ai->ai_addrlen, paddr,
sizeof(paddr), NULL, 0, NI_NUMERICHOST);
fprintf(stderr, "Trying %s...\n", paddr);
}
}
lport--;
if (fd2p == 0) {
_write(s, "", 1);
lport = 0;
} else {
int s2 = rresvport_af(&lport, ai->ai_family), s3;
socklen_t len = ai->ai_addrlen;
int nfds;
if (s2 < 0)
goto bad;
_listen(s2, 1);
snprintf(num, sizeof(num), "%d", lport);
if (_write(s, num, strlen(num)+1) != strlen(num)+1) {
fprintf(stderr,
"rcmd: write (setting up stderr): %s\n",
strerror(errno));
_close(s2);
goto bad;
}
nfds = max(s, s2)+1;
if(nfds > FD_SETSIZE) {
fprintf(stderr, "rcmd: too many files\n");
_close(s2);
goto bad;
}
again:
FD_ZERO(&reads);
FD_SET(s, &reads);
FD_SET(s2, &reads);
errno = 0;
if (_select(nfds, &reads, 0, 0, 0) < 1 || !FD_ISSET(s2, &reads)){
if (errno != 0)
fprintf(stderr,
"rcmd: select (setting up stderr): %s\n",
strerror(errno));
else
fprintf(stderr,
"select: protocol failure in circuit setup\n");
_close(s2);
goto bad;
}
s3 = _accept(s2, (struct sockaddr *)&from, &len);
switch (from.ss_family) {
case AF_INET:
aport = ntohs(((struct sockaddr_in *)&from)->sin_port);
break;
#ifdef INET6
case AF_INET6:
aport = ntohs(((struct sockaddr_in6 *)&from)->sin6_port);
break;
#endif
default:
aport = 0; /* error */
break;
}
/*
* XXX careful for ftp bounce attacks. If discovered, shut them
* down and check for the real auxiliary channel to connect.
*/
if (aport == 20) {
_close(s3);
goto again;
}
_close(s2);
if (s3 < 0) {
fprintf(stderr,
"rcmd: accept: %s\n", strerror(errno));
lport = 0;
goto bad;
}
*fd2p = s3;
if (aport >= IPPORT_RESERVED || aport < IPPORT_RESERVED / 2) {
fprintf(stderr,
"socket: protocol failure in circuit setup.\n");
goto bad2;
}
}
_write(s, locuser, strlen(locuser)+1);
_write(s, remuser, strlen(remuser)+1);
_write(s, cmd, strlen(cmd)+1);
if (_read(s, &c, 1) != 1) {
fprintf(stderr,
"rcmd: %s: %s\n", *ahost, strerror(errno));
goto bad2;
}
if (c != 0) {
while (_read(s, &c, 1) == 1) {
_write(STDERR_FILENO, &c, 1);
if (c == '\n')
break;
}
goto bad2;
}
_sigprocmask(SIG_SETMASK, (const sigset_t *)&oldmask, NULL);
freeaddrinfo(res);
return (s);
bad2:
if (lport)
_close(*fd2p);
bad:
_close(s);
_sigprocmask(SIG_SETMASK, (const sigset_t *)&oldmask, NULL);
freeaddrinfo(res);
return (-1);
}
int
rcmd_af(char **ahost, int porta, const char *locuser, const char *remuser,
const char *cmd, int *fd2p, int af)
{
static char hbuf[HOST_NAME_MAX+1];
char pbuf[NI_MAXSERV];
struct addrinfo hints, *res, *r;
int error;
struct sockaddr_storage from;
sigset_t oldmask, mask;
pid_t pid;
int s, lport;
struct timespec timo;
char c, *p;
int refused;
in_port_t rport = porta;
int numread;
/* call rcmdsh() with specified remote shell if appropriate. */
if (!issetugid() && (p = getenv("RSH")) && *p) {
struct servent *sp = getservbyname("shell", "tcp");
if (sp && sp->s_port == rport)
return (rcmdsh(ahost, rport, locuser, remuser,
cmd, p));
}
/* use rsh(1) if non-root and remote port is shell. */
if (geteuid()) {
struct servent *sp = getservbyname("shell", "tcp");
if (sp && sp->s_port == rport)
return (rcmdsh(ahost, rport, locuser, remuser,
cmd, NULL));
}
pid = getpid();
snprintf(pbuf, sizeof(pbuf), "%u", ntohs(rport));
memset(&hints, 0, sizeof(hints));
hints.ai_family = af;
hints.ai_socktype = SOCK_STREAM;
hints.ai_flags = AI_CANONNAME;
error = getaddrinfo(*ahost, pbuf, &hints, &res);
if (error) {
(void)fprintf(stderr, "rcmd: %s: %s\n", *ahost,
gai_strerror(error));
return (-1);
}
if (res->ai_canonname) {
strlcpy(hbuf, res->ai_canonname, sizeof(hbuf));
*ahost = hbuf;
} else
; /*XXX*/
r = res;
refused = 0;
timespecclear(&timo);
sigemptyset(&mask);
sigaddset(&mask, SIGURG);
sigprocmask(SIG_BLOCK, &mask, &oldmask);
for (timo.tv_sec = 1, lport = IPPORT_RESERVED - 1;;) {
s = rresvport_af(&lport, r->ai_family);
if (s < 0) {
if (errno == EAGAIN)
(void)fprintf(stderr,
"rcmd: socket: All ports in use\n");
else
(void)fprintf(stderr, "rcmd: socket: %s\n",
strerror(errno));
if (r->ai_next) {
r = r->ai_next;
continue;
} else {
sigprocmask(SIG_SETMASK, &oldmask, NULL);
freeaddrinfo(res);
return (-1);
}
}
fcntl(s, F_SETOWN, pid);
if (connect(s, r->ai_addr, r->ai_addrlen) >= 0)
break;
(void)close(s);
if (errno == EADDRINUSE) {
lport--;
continue;
}
if (errno == ECONNREFUSED)
refused++;
if (r->ai_next) {
int oerrno = errno;
char hbuf[NI_MAXHOST];
const int niflags = NI_NUMERICHOST;
hbuf[0] = '\0';
if (getnameinfo(r->ai_addr, r->ai_addrlen,
hbuf, sizeof(hbuf), NULL, 0, niflags) != 0)
strlcpy(hbuf, "(invalid)", sizeof hbuf);
(void)fprintf(stderr, "connect to address %s: ", hbuf);
errno = oerrno;
perror(0);
r = r->ai_next;
hbuf[0] = '\0';
if (getnameinfo(r->ai_addr, r->ai_addrlen,
hbuf, sizeof(hbuf), NULL, 0, niflags) != 0)
strlcpy(hbuf, "(invalid)", sizeof hbuf);
(void)fprintf(stderr, "Trying %s...\n", hbuf);
continue;
}
if (refused && timo.tv_sec <= 16) {
(void)nanosleep(&timo, NULL);
timo.tv_sec *= 2;
r = res;
refused = 0;
continue;
}
(void)fprintf(stderr, "%s: %s\n", res->ai_canonname,
strerror(errno));
sigprocmask(SIG_SETMASK, &oldmask, NULL);
freeaddrinfo(res);
return (-1);
}
/* given "af" can be PF_UNSPEC, we need the real af for "s" */
af = r->ai_family;
freeaddrinfo(res);
if (fd2p == 0) {
write(s, "", 1);
lport = 0;
} else {
struct pollfd pfd[2];
char num[8];
int s2 = rresvport_af(&lport, af), s3;
socklen_t len = sizeof(from);
if (s2 < 0)
goto bad;
listen(s2, 1);
(void)snprintf(num, sizeof(num), "%d", lport);
if (write(s, num, strlen(num)+1) != strlen(num)+1) {
(void)fprintf(stderr,
"rcmd: write (setting up stderr): %s\n",
strerror(errno));
(void)close(s2);
goto bad;
}
again:
pfd[0].fd = s;
pfd[0].events = POLLIN;
pfd[1].fd = s2;
pfd[1].events = POLLIN;
errno = 0;
if (poll(pfd, 2, INFTIM) < 1 ||
(pfd[1].revents & (POLLIN|POLLHUP)) == 0) {
if (errno != 0)
(void)fprintf(stderr,
"rcmd: poll (setting up stderr): %s\n",
strerror(errno));
else
(void)fprintf(stderr,
"poll: protocol failure in circuit setup\n");
(void)close(s2);
goto bad;
}
s3 = accept(s2, (struct sockaddr *)&from, &len);
if (s3 < 0) {
(void)fprintf(stderr,
"rcmd: accept: %s\n", strerror(errno));
lport = 0;
close(s2);
goto bad;
}
/*
* XXX careful for ftp bounce attacks. If discovered, shut them
* down and check for the real auxiliary channel to connect.
*/
switch (from.ss_family) {
case AF_INET:
case AF_INET6:
if (getnameinfo((struct sockaddr *)&from, len,
NULL, 0, num, sizeof(num), NI_NUMERICSERV) == 0 &&
atoi(num) != 20) {
break;
}
close(s3);
goto again;
default:
break;
}
(void)close(s2);
*fd2p = s3;
switch (from.ss_family) {
case AF_INET:
case AF_INET6:
if (getnameinfo((struct sockaddr *)&from, len,
NULL, 0, num, sizeof(num), NI_NUMERICSERV) != 0 ||
(atoi(num) >= IPPORT_RESERVED ||
atoi(num) < IPPORT_RESERVED / 2)) {
(void)fprintf(stderr,
"socket: protocol failure in circuit setup.\n");
goto bad2;
}
break;
default:
break;
}
}
(void)write(s, locuser, strlen(locuser)+1);
(void)write(s, remuser, strlen(remuser)+1);
(void)write(s, cmd, strlen(cmd)+1);
if ((numread = read(s, &c, 1)) != 1) {
(void)fprintf(stderr,
"rcmd: %s: %s\n", *ahost,
numread == -1 ? strerror(errno) : "Short read");
goto bad2;
}
if (c != 0) {
while (read(s, &c, 1) == 1) {
(void)write(STDERR_FILENO, &c, 1);
if (c == '\n')
break;
}
goto bad2;
}
sigprocmask(SIG_SETMASK, &oldmask, NULL);
return (s);
bad2:
if (lport)
(void)close(*fd2p);
bad:
(void)close(s);
sigprocmask(SIG_SETMASK, &oldmask, NULL);
return (-1);
}
int
rcmd_af(char **ahost, int porta, const char *locuser, const char *remuser,
const char *cmd, int *fd2p, int af)
{
static char hbuf[MAXHOSTNAMELEN];
char pbuf[NI_MAXSERV];
struct addrinfo hints, *res, *r;
int error;
struct sockaddr_storage from;
fd_set *readsp = NULL;
sigset_t oldmask, mask;
pid_t pid;
int s, lport, timo;
char c, *p;
int refused;
in_port_t rport = porta;
/* call rcmdsh() with specified remote shell if appropriate. */
if (!issetugid() && (p = getenv("RSH")) && *p) {
struct servent *sp = getservbyname("shell", "tcp");
if (sp && sp->s_port == rport)
return (rcmdsh(ahost, rport, locuser, remuser,
cmd, p));
}
/* use rsh(1) if non-root and remote port is shell. */
if (geteuid()) {
struct servent *sp = getservbyname("shell", "tcp");
if (sp && sp->s_port == rport)
return (rcmdsh(ahost, rport, locuser, remuser,
cmd, NULL));
}
pid = getpid();
snprintf(pbuf, sizeof(pbuf), "%u", ntohs(rport));
memset(&hints, 0, sizeof(hints));
hints.ai_family = af;
hints.ai_socktype = SOCK_STREAM;
hints.ai_flags = AI_CANONNAME;
error = getaddrinfo(*ahost, pbuf, &hints, &res);
if (error) {
#if 0
warnx("%s: %s", *ahost, gai_strerror(error));
#endif
return (-1);
}
if (res->ai_canonname) {
strlcpy(hbuf, res->ai_canonname, sizeof(hbuf));
*ahost = hbuf;
} else
; /*XXX*/
r = res;
refused = 0;
sigemptyset(&mask);
sigaddset(&mask, SIGURG);
sigprocmask(SIG_BLOCK, &mask, &oldmask);
for (timo = 1, lport = IPPORT_RESERVED - 1;;) {
s = rresvport_af(&lport, r->ai_family);
if (s < 0) {
if (errno == EAGAIN)
(void)fprintf(stderr,
"rcmd: socket: All ports in use\n");
else
(void)fprintf(stderr, "rcmd: socket: %s\n",
strerror(errno));
if (r->ai_next) {
r = r->ai_next;
continue;
} else {
sigprocmask(SIG_SETMASK, &oldmask, NULL);
freeaddrinfo(res);
return (-1);
}
}
fcntl(s, F_SETOWN, pid);
if (connect(s, r->ai_addr, r->ai_addrlen) >= 0)
break;
(void)close(s);
if (errno == EADDRINUSE) {
lport--;
continue;
}
if (errno == ECONNREFUSED)
refused++;
if (r->ai_next) {
int oerrno = errno;
char hbuf[NI_MAXHOST];
const int niflags = NI_NUMERICHOST;
hbuf[0] = '\0';
if (getnameinfo(r->ai_addr, r->ai_addrlen,
hbuf, sizeof(hbuf), NULL, 0, niflags) != 0)
strlcpy(hbuf, "(invalid)", sizeof hbuf);
(void)fprintf(stderr, "connect to address %s: ", hbuf);
errno = oerrno;
perror(0);
r = r->ai_next;
hbuf[0] = '\0';
if (getnameinfo(r->ai_addr, r->ai_addrlen,
hbuf, sizeof(hbuf), NULL, 0, niflags) != 0)
strlcpy(hbuf, "(invalid)", sizeof hbuf);
(void)fprintf(stderr, "Trying %s...\n", hbuf);
continue;
}
if (refused && timo <= 16) {
(void)sleep(timo);
timo *= 2;
r = res;
refused = 0;
continue;
}
(void)fprintf(stderr, "%s: %s\n", res->ai_canonname,
strerror(errno));
sigprocmask(SIG_SETMASK, &oldmask, NULL);
freeaddrinfo(res);
return (-1);
}
/* given "af" can be PF_UNSPEC, we need the real af for "s" */
af = r->ai_family;
freeaddrinfo(res);
#if 0
/*
* try to rresvport() to the same port. This will make rresvport()
* fail it's first bind, resulting in it choosing a random port.
*/
lport--;
#endif
if (fd2p == 0) {
write(s, "", 1);
lport = 0;
} else {
char num[8];
int s2 = rresvport_af(&lport, af), s3;
socklen_t len = sizeof(from);
int fdssize = howmany(MAX(s, s2)+1, NFDBITS) * sizeof(fd_mask);
if (s2 < 0)
goto bad;
readsp = (fd_set *)malloc(fdssize);
if (readsp == NULL) {
close(s2);
goto bad;
}
listen(s2, 1);
(void)snprintf(num, sizeof(num), "%d", lport);
if (write(s, num, strlen(num)+1) != strlen(num)+1) {
(void)fprintf(stderr,
"rcmd: write (setting up stderr): %s\n",
strerror(errno));
(void)close(s2);
goto bad;
}
again:
bzero(readsp, fdssize);
FD_SET(s, readsp);
FD_SET(s2, readsp);
errno = 0;
if (select(MAX(s, s2) + 1, readsp, 0, 0, 0) < 1 ||
!FD_ISSET(s2, readsp)) {
if (errno != 0)
(void)fprintf(stderr,
"rcmd: select (setting up stderr): %s\n",
strerror(errno));
else
(void)fprintf(stderr,
"select: protocol failure in circuit setup\n");
(void)close(s2);
goto bad;
}
s3 = accept(s2, (struct sockaddr *)&from, &len);
if (s3 < 0) {
(void)fprintf(stderr,
"rcmd: accept: %s\n", strerror(errno));
lport = 0;
close(s2);
goto bad;
}
/*
* XXX careful for ftp bounce attacks. If discovered, shut them
* down and check for the real auxiliary channel to connect.
*/
switch (from.ss_family) {
case AF_INET:
case AF_INET6:
if (getnameinfo((struct sockaddr *)&from, len,
NULL, 0, num, sizeof(num), NI_NUMERICSERV) == 0 &&
atoi(num) != 20) {
break;
}
close(s3);
goto again;
default:
break;
}
(void)close(s2);
*fd2p = s3;
switch (from.ss_family) {
case AF_INET:
case AF_INET6:
if (getnameinfo((struct sockaddr *)&from, len,
NULL, 0, num, sizeof(num), NI_NUMERICSERV) != 0 ||
(atoi(num) >= IPPORT_RESERVED ||
atoi(num) < IPPORT_RESERVED / 2)) {
(void)fprintf(stderr,
"socket: protocol failure in circuit setup.\n");
goto bad2;
}
break;
default:
break;
}
}
(void)write(s, locuser, strlen(locuser)+1);
(void)write(s, remuser, strlen(remuser)+1);
(void)write(s, cmd, strlen(cmd)+1);
if (read(s, &c, 1) != 1) {
(void)fprintf(stderr,
"rcmd: %s: %s\n", *ahost, strerror(errno));
goto bad2;
}
if (c != 0) {
while (read(s, &c, 1) == 1) {
(void)write(STDERR_FILENO, &c, 1);
if (c == '\n')
break;
}
goto bad2;
}
sigprocmask(SIG_SETMASK, &oldmask, NULL);
free(readsp);
return (s);
bad2:
if (lport)
(void)close(*fd2p);
bad:
if (readsp)
free(readsp);
(void)close(s);
sigprocmask(SIG_SETMASK, &oldmask, NULL);
return (-1);
}
