static int remotecmd(char *rhost, char *luser, char *ruser, char *cmd) { int desc; #if defined(DIRECT_RCMD) static int port = -1; #endif /* DIRECT_RCMD */ debugmsg(DM_MISC, "local user = %s remote user = %s\n", luser, ruser); debugmsg(DM_MISC, "Remote command = '%s'\n", cmd); (void) fflush(stdout); (void) fflush(stderr); (void) signal(SIGALRM, sighandler); (void) alarm(RTIMEOUT); #if defined(DIRECT_RCMD) (void) signal(SIGPIPE, sighandler); if (port < 0) { struct servent *sp; if ((sp = getservbyname("shell", "tcp")) == NULL) fatalerr("shell/tcp: unknown service"); port = sp->s_port; } if (becomeroot() != 0) exit(1); desc = rcmd(&rhost, port, luser, ruser, cmd, 0); if (becomeuser() != 0) exit(1); #else /* !DIRECT_RCMD */ debugmsg(DM_MISC, "Remote shell command = '%s'\n", path_remsh ? path_remsh : "default"); (void) signal(SIGPIPE, SIG_IGN); desc = rcmdsh(&rhost, -1, luser, ruser, cmd, path_remsh); if (desc > 0) (void) signal(SIGPIPE, sighandler); #endif /* DIRECT_RCMD */ (void) alarm(0); return(desc); }
int rcmd_af(char **ahost, int rport, const char *locuser, const char *remuser, const char *cmd, int *fd2p, int af) { struct addrinfo hints, *res, *ai; struct sockaddr_storage from; fd_set reads; sigset_t oldmask, newmask; pid_t pid; int s, aport, lport, timo, error; char c, *p; int refused, nres; char num[8]; static char canonnamebuf[MAXDNAME]; /* is it proper here? */ /* call rcmdsh() with specified remote shell if appropriate. */ if (!issetugid() && (p = getenv("RSH"))) { struct servent *sp = getservbyname("shell", "tcp"); if (sp && sp->s_port == rport) return (rcmdsh(ahost, rport, locuser, remuser, cmd, p)); } /* use rsh(1) if non-root and remote port is shell. */ if (geteuid()) { struct servent *sp = getservbyname("shell", "tcp"); if (sp && sp->s_port == rport) return (rcmdsh(ahost, rport, locuser, remuser, cmd, NULL)); } pid = getpid(); memset(&hints, 0, sizeof(hints)); hints.ai_flags = AI_CANONNAME; hints.ai_family = af; hints.ai_socktype = SOCK_STREAM; hints.ai_protocol = 0; snprintf(num, sizeof(num), "%d", ntohs(rport)); error = getaddrinfo(*ahost, num, &hints, &res); if (error) { fprintf(stderr, "rcmd: getaddrinfo: %s\n", gai_strerror(error)); if (error == EAI_SYSTEM) fprintf(stderr, "rcmd: getaddrinfo: %s\n", strerror(errno)); return (-1); } if (res->ai_canonname && strlen(res->ai_canonname) + 1 < sizeof(canonnamebuf)) { strncpy(canonnamebuf, res->ai_canonname, sizeof(canonnamebuf)); *ahost = canonnamebuf; } nres = 0; for (ai = res; ai; ai = ai->ai_next) nres++; ai = res; refused = 0; sigemptyset(&newmask); sigaddset(&newmask, SIGURG); _sigprocmask(SIG_BLOCK, (const sigset_t *)&newmask, &oldmask); for (timo = 1, lport = IPPORT_RESERVED - 1;;) { s = rresvport_af(&lport, ai->ai_family); if (s < 0) { if (errno != EAGAIN && ai->ai_next) { ai = ai->ai_next; continue; } if (errno == EAGAIN) fprintf(stderr, "rcmd: socket: All ports in use\n"); else fprintf(stderr, "rcmd: socket: %s\n", strerror(errno)); freeaddrinfo(res); _sigprocmask(SIG_SETMASK, (const sigset_t *)&oldmask, NULL); return (-1); } _fcntl(s, F_SETOWN, pid); if (_connect(s, ai->ai_addr, ai->ai_addrlen) >= 0) break; _close(s); if (errno == EADDRINUSE) { lport--; continue; } if (errno == ECONNREFUSED) refused = 1; if (ai->ai_next == NULL && (!refused || timo > 16)) { fprintf(stderr, "%s: %s\n", *ahost, strerror(errno)); freeaddrinfo(res); _sigprocmask(SIG_SETMASK, (const sigset_t *)&oldmask, NULL); return (-1); } if (nres > 1) { int oerrno = errno; getnameinfo(ai->ai_addr, ai->ai_addrlen, paddr, sizeof(paddr), NULL, 0, NI_NUMERICHOST); fprintf(stderr, "connect to address %s: ", paddr); errno = oerrno; perror(0); } if ((ai = ai->ai_next) == NULL) { /* refused && timo <= 16 */ struct timespec time_to_sleep, time_remaining; time_to_sleep.tv_sec = timo; time_to_sleep.tv_nsec = 0; _nanosleep(&time_to_sleep, &time_remaining); timo *= 2; ai = res; refused = 0; } if (nres > 1) { getnameinfo(ai->ai_addr, ai->ai_addrlen, paddr, sizeof(paddr), NULL, 0, NI_NUMERICHOST); fprintf(stderr, "Trying %s...\n", paddr); } } lport--; if (fd2p == 0) { _write(s, "", 1); lport = 0; } else { int s2 = rresvport_af(&lport, ai->ai_family), s3; socklen_t len = ai->ai_addrlen; int nfds; if (s2 < 0) goto bad; _listen(s2, 1); snprintf(num, sizeof(num), "%d", lport); if (_write(s, num, strlen(num)+1) != strlen(num)+1) { fprintf(stderr, "rcmd: write (setting up stderr): %s\n", strerror(errno)); _close(s2); goto bad; } nfds = max(s, s2)+1; if(nfds > FD_SETSIZE) { fprintf(stderr, "rcmd: too many files\n"); _close(s2); goto bad; } again: FD_ZERO(&reads); FD_SET(s, &reads); FD_SET(s2, &reads); errno = 0; if (_select(nfds, &reads, 0, 0, 0) < 1 || !FD_ISSET(s2, &reads)){ if (errno != 0) fprintf(stderr, "rcmd: select (setting up stderr): %s\n", strerror(errno)); else fprintf(stderr, "select: protocol failure in circuit setup\n"); _close(s2); goto bad; } s3 = _accept(s2, (struct sockaddr *)&from, &len); switch (from.ss_family) { case AF_INET: aport = ntohs(((struct sockaddr_in *)&from)->sin_port); break; #ifdef INET6 case AF_INET6: aport = ntohs(((struct sockaddr_in6 *)&from)->sin6_port); break; #endif default: aport = 0; /* error */ break; } /* * XXX careful for ftp bounce attacks. If discovered, shut them * down and check for the real auxiliary channel to connect. */ if (aport == 20) { _close(s3); goto again; } _close(s2); if (s3 < 0) { fprintf(stderr, "rcmd: accept: %s\n", strerror(errno)); lport = 0; goto bad; } *fd2p = s3; if (aport >= IPPORT_RESERVED || aport < IPPORT_RESERVED / 2) { fprintf(stderr, "socket: protocol failure in circuit setup.\n"); goto bad2; } } _write(s, locuser, strlen(locuser)+1); _write(s, remuser, strlen(remuser)+1); _write(s, cmd, strlen(cmd)+1); if (_read(s, &c, 1) != 1) { fprintf(stderr, "rcmd: %s: %s\n", *ahost, strerror(errno)); goto bad2; } if (c != 0) { while (_read(s, &c, 1) == 1) { _write(STDERR_FILENO, &c, 1); if (c == '\n') break; } goto bad2; } _sigprocmask(SIG_SETMASK, (const sigset_t *)&oldmask, NULL); freeaddrinfo(res); return (s); bad2: if (lport) _close(*fd2p); bad: _close(s); _sigprocmask(SIG_SETMASK, (const sigset_t *)&oldmask, NULL); freeaddrinfo(res); return (-1); }
int rcmd_af(char **ahost, int porta, const char *locuser, const char *remuser, const char *cmd, int *fd2p, int af) { static char hbuf[HOST_NAME_MAX+1]; char pbuf[NI_MAXSERV]; struct addrinfo hints, *res, *r; int error; struct sockaddr_storage from; sigset_t oldmask, mask; pid_t pid; int s, lport; struct timespec timo; char c, *p; int refused; in_port_t rport = porta; int numread; /* call rcmdsh() with specified remote shell if appropriate. */ if (!issetugid() && (p = getenv("RSH")) && *p) { struct servent *sp = getservbyname("shell", "tcp"); if (sp && sp->s_port == rport) return (rcmdsh(ahost, rport, locuser, remuser, cmd, p)); } /* use rsh(1) if non-root and remote port is shell. */ if (geteuid()) { struct servent *sp = getservbyname("shell", "tcp"); if (sp && sp->s_port == rport) return (rcmdsh(ahost, rport, locuser, remuser, cmd, NULL)); } pid = getpid(); snprintf(pbuf, sizeof(pbuf), "%u", ntohs(rport)); memset(&hints, 0, sizeof(hints)); hints.ai_family = af; hints.ai_socktype = SOCK_STREAM; hints.ai_flags = AI_CANONNAME; error = getaddrinfo(*ahost, pbuf, &hints, &res); if (error) { (void)fprintf(stderr, "rcmd: %s: %s\n", *ahost, gai_strerror(error)); return (-1); } if (res->ai_canonname) { strlcpy(hbuf, res->ai_canonname, sizeof(hbuf)); *ahost = hbuf; } else ; /*XXX*/ r = res; refused = 0; timespecclear(&timo); sigemptyset(&mask); sigaddset(&mask, SIGURG); sigprocmask(SIG_BLOCK, &mask, &oldmask); for (timo.tv_sec = 1, lport = IPPORT_RESERVED - 1;;) { s = rresvport_af(&lport, r->ai_family); if (s < 0) { if (errno == EAGAIN) (void)fprintf(stderr, "rcmd: socket: All ports in use\n"); else (void)fprintf(stderr, "rcmd: socket: %s\n", strerror(errno)); if (r->ai_next) { r = r->ai_next; continue; } else { sigprocmask(SIG_SETMASK, &oldmask, NULL); freeaddrinfo(res); return (-1); } } fcntl(s, F_SETOWN, pid); if (connect(s, r->ai_addr, r->ai_addrlen) >= 0) break; (void)close(s); if (errno == EADDRINUSE) { lport--; continue; } if (errno == ECONNREFUSED) refused++; if (r->ai_next) { int oerrno = errno; char hbuf[NI_MAXHOST]; const int niflags = NI_NUMERICHOST; hbuf[0] = '\0'; if (getnameinfo(r->ai_addr, r->ai_addrlen, hbuf, sizeof(hbuf), NULL, 0, niflags) != 0) strlcpy(hbuf, "(invalid)", sizeof hbuf); (void)fprintf(stderr, "connect to address %s: ", hbuf); errno = oerrno; perror(0); r = r->ai_next; hbuf[0] = '\0'; if (getnameinfo(r->ai_addr, r->ai_addrlen, hbuf, sizeof(hbuf), NULL, 0, niflags) != 0) strlcpy(hbuf, "(invalid)", sizeof hbuf); (void)fprintf(stderr, "Trying %s...\n", hbuf); continue; } if (refused && timo.tv_sec <= 16) { (void)nanosleep(&timo, NULL); timo.tv_sec *= 2; r = res; refused = 0; continue; } (void)fprintf(stderr, "%s: %s\n", res->ai_canonname, strerror(errno)); sigprocmask(SIG_SETMASK, &oldmask, NULL); freeaddrinfo(res); return (-1); } /* given "af" can be PF_UNSPEC, we need the real af for "s" */ af = r->ai_family; freeaddrinfo(res); if (fd2p == 0) { write(s, "", 1); lport = 0; } else { struct pollfd pfd[2]; char num[8]; int s2 = rresvport_af(&lport, af), s3; socklen_t len = sizeof(from); if (s2 < 0) goto bad; listen(s2, 1); (void)snprintf(num, sizeof(num), "%d", lport); if (write(s, num, strlen(num)+1) != strlen(num)+1) { (void)fprintf(stderr, "rcmd: write (setting up stderr): %s\n", strerror(errno)); (void)close(s2); goto bad; } again: pfd[0].fd = s; pfd[0].events = POLLIN; pfd[1].fd = s2; pfd[1].events = POLLIN; errno = 0; if (poll(pfd, 2, INFTIM) < 1 || (pfd[1].revents & (POLLIN|POLLHUP)) == 0) { if (errno != 0) (void)fprintf(stderr, "rcmd: poll (setting up stderr): %s\n", strerror(errno)); else (void)fprintf(stderr, "poll: protocol failure in circuit setup\n"); (void)close(s2); goto bad; } s3 = accept(s2, (struct sockaddr *)&from, &len); if (s3 < 0) { (void)fprintf(stderr, "rcmd: accept: %s\n", strerror(errno)); lport = 0; close(s2); goto bad; } /* * XXX careful for ftp bounce attacks. If discovered, shut them * down and check for the real auxiliary channel to connect. */ switch (from.ss_family) { case AF_INET: case AF_INET6: if (getnameinfo((struct sockaddr *)&from, len, NULL, 0, num, sizeof(num), NI_NUMERICSERV) == 0 && atoi(num) != 20) { break; } close(s3); goto again; default: break; } (void)close(s2); *fd2p = s3; switch (from.ss_family) { case AF_INET: case AF_INET6: if (getnameinfo((struct sockaddr *)&from, len, NULL, 0, num, sizeof(num), NI_NUMERICSERV) != 0 || (atoi(num) >= IPPORT_RESERVED || atoi(num) < IPPORT_RESERVED / 2)) { (void)fprintf(stderr, "socket: protocol failure in circuit setup.\n"); goto bad2; } break; default: break; } } (void)write(s, locuser, strlen(locuser)+1); (void)write(s, remuser, strlen(remuser)+1); (void)write(s, cmd, strlen(cmd)+1); if ((numread = read(s, &c, 1)) != 1) { (void)fprintf(stderr, "rcmd: %s: %s\n", *ahost, numread == -1 ? strerror(errno) : "Short read"); goto bad2; } if (c != 0) { while (read(s, &c, 1) == 1) { (void)write(STDERR_FILENO, &c, 1); if (c == '\n') break; } goto bad2; } sigprocmask(SIG_SETMASK, &oldmask, NULL); return (s); bad2: if (lport) (void)close(*fd2p); bad: (void)close(s); sigprocmask(SIG_SETMASK, &oldmask, NULL); return (-1); }
int rcmd_af(char **ahost, int porta, const char *locuser, const char *remuser, const char *cmd, int *fd2p, int af) { static char hbuf[MAXHOSTNAMELEN]; char pbuf[NI_MAXSERV]; struct addrinfo hints, *res, *r; int error; struct sockaddr_storage from; fd_set *readsp = NULL; sigset_t oldmask, mask; pid_t pid; int s, lport, timo; char c, *p; int refused; in_port_t rport = porta; /* call rcmdsh() with specified remote shell if appropriate. */ if (!issetugid() && (p = getenv("RSH")) && *p) { struct servent *sp = getservbyname("shell", "tcp"); if (sp && sp->s_port == rport) return (rcmdsh(ahost, rport, locuser, remuser, cmd, p)); } /* use rsh(1) if non-root and remote port is shell. */ if (geteuid()) { struct servent *sp = getservbyname("shell", "tcp"); if (sp && sp->s_port == rport) return (rcmdsh(ahost, rport, locuser, remuser, cmd, NULL)); } pid = getpid(); snprintf(pbuf, sizeof(pbuf), "%u", ntohs(rport)); memset(&hints, 0, sizeof(hints)); hints.ai_family = af; hints.ai_socktype = SOCK_STREAM; hints.ai_flags = AI_CANONNAME; error = getaddrinfo(*ahost, pbuf, &hints, &res); if (error) { #if 0 warnx("%s: %s", *ahost, gai_strerror(error)); #endif return (-1); } if (res->ai_canonname) { strlcpy(hbuf, res->ai_canonname, sizeof(hbuf)); *ahost = hbuf; } else ; /*XXX*/ r = res; refused = 0; sigemptyset(&mask); sigaddset(&mask, SIGURG); sigprocmask(SIG_BLOCK, &mask, &oldmask); for (timo = 1, lport = IPPORT_RESERVED - 1;;) { s = rresvport_af(&lport, r->ai_family); if (s < 0) { if (errno == EAGAIN) (void)fprintf(stderr, "rcmd: socket: All ports in use\n"); else (void)fprintf(stderr, "rcmd: socket: %s\n", strerror(errno)); if (r->ai_next) { r = r->ai_next; continue; } else { sigprocmask(SIG_SETMASK, &oldmask, NULL); freeaddrinfo(res); return (-1); } } fcntl(s, F_SETOWN, pid); if (connect(s, r->ai_addr, r->ai_addrlen) >= 0) break; (void)close(s); if (errno == EADDRINUSE) { lport--; continue; } if (errno == ECONNREFUSED) refused++; if (r->ai_next) { int oerrno = errno; char hbuf[NI_MAXHOST]; const int niflags = NI_NUMERICHOST; hbuf[0] = '\0'; if (getnameinfo(r->ai_addr, r->ai_addrlen, hbuf, sizeof(hbuf), NULL, 0, niflags) != 0) strlcpy(hbuf, "(invalid)", sizeof hbuf); (void)fprintf(stderr, "connect to address %s: ", hbuf); errno = oerrno; perror(0); r = r->ai_next; hbuf[0] = '\0'; if (getnameinfo(r->ai_addr, r->ai_addrlen, hbuf, sizeof(hbuf), NULL, 0, niflags) != 0) strlcpy(hbuf, "(invalid)", sizeof hbuf); (void)fprintf(stderr, "Trying %s...\n", hbuf); continue; } if (refused && timo <= 16) { (void)sleep(timo); timo *= 2; r = res; refused = 0; continue; } (void)fprintf(stderr, "%s: %s\n", res->ai_canonname, strerror(errno)); sigprocmask(SIG_SETMASK, &oldmask, NULL); freeaddrinfo(res); return (-1); } /* given "af" can be PF_UNSPEC, we need the real af for "s" */ af = r->ai_family; freeaddrinfo(res); #if 0 /* * try to rresvport() to the same port. This will make rresvport() * fail it's first bind, resulting in it choosing a random port. */ lport--; #endif if (fd2p == 0) { write(s, "", 1); lport = 0; } else { char num[8]; int s2 = rresvport_af(&lport, af), s3; socklen_t len = sizeof(from); int fdssize = howmany(MAX(s, s2)+1, NFDBITS) * sizeof(fd_mask); if (s2 < 0) goto bad; readsp = (fd_set *)malloc(fdssize); if (readsp == NULL) { close(s2); goto bad; } listen(s2, 1); (void)snprintf(num, sizeof(num), "%d", lport); if (write(s, num, strlen(num)+1) != strlen(num)+1) { (void)fprintf(stderr, "rcmd: write (setting up stderr): %s\n", strerror(errno)); (void)close(s2); goto bad; } again: bzero(readsp, fdssize); FD_SET(s, readsp); FD_SET(s2, readsp); errno = 0; if (select(MAX(s, s2) + 1, readsp, 0, 0, 0) < 1 || !FD_ISSET(s2, readsp)) { if (errno != 0) (void)fprintf(stderr, "rcmd: select (setting up stderr): %s\n", strerror(errno)); else (void)fprintf(stderr, "select: protocol failure in circuit setup\n"); (void)close(s2); goto bad; } s3 = accept(s2, (struct sockaddr *)&from, &len); if (s3 < 0) { (void)fprintf(stderr, "rcmd: accept: %s\n", strerror(errno)); lport = 0; close(s2); goto bad; } /* * XXX careful for ftp bounce attacks. If discovered, shut them * down and check for the real auxiliary channel to connect. */ switch (from.ss_family) { case AF_INET: case AF_INET6: if (getnameinfo((struct sockaddr *)&from, len, NULL, 0, num, sizeof(num), NI_NUMERICSERV) == 0 && atoi(num) != 20) { break; } close(s3); goto again; default: break; } (void)close(s2); *fd2p = s3; switch (from.ss_family) { case AF_INET: case AF_INET6: if (getnameinfo((struct sockaddr *)&from, len, NULL, 0, num, sizeof(num), NI_NUMERICSERV) != 0 || (atoi(num) >= IPPORT_RESERVED || atoi(num) < IPPORT_RESERVED / 2)) { (void)fprintf(stderr, "socket: protocol failure in circuit setup.\n"); goto bad2; } break; default: break; } } (void)write(s, locuser, strlen(locuser)+1); (void)write(s, remuser, strlen(remuser)+1); (void)write(s, cmd, strlen(cmd)+1); if (read(s, &c, 1) != 1) { (void)fprintf(stderr, "rcmd: %s: %s\n", *ahost, strerror(errno)); goto bad2; } if (c != 0) { while (read(s, &c, 1) == 1) { (void)write(STDERR_FILENO, &c, 1); if (c == '\n') break; } goto bad2; } sigprocmask(SIG_SETMASK, &oldmask, NULL); free(readsp); return (s); bad2: if (lport) (void)close(*fd2p); bad: if (readsp) free(readsp); (void)close(s); sigprocmask(SIG_SETMASK, &oldmask, NULL); return (-1); }