You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mina.apache.org by lg...@apache.org on 2016/01/07 11:35:11 UTC
mina-sshd git commit: [SSHD-309] ForwardingFilter/TcpipForwarder
should have a nicer way to reject local port forwarding requests
Repository: mina-sshd
Updated Branches:
refs/heads/master 8959fdd30 -> bacd1d53a
[SSHD-309] ForwardingFilter/TcpipForwarder should have a nicer way to reject local port forwarding requests
Project: http://git-wip-us.apache.org/repos/asf/mina-sshd/repo
Commit: http://git-wip-us.apache.org/repos/asf/mina-sshd/commit/bacd1d53
Tree: http://git-wip-us.apache.org/repos/asf/mina-sshd/tree/bacd1d53
Diff: http://git-wip-us.apache.org/repos/asf/mina-sshd/diff/bacd1d53
Branch: refs/heads/master
Commit: bacd1d53a0917dd9e6c11da1e183a89ba119fbd6
Parents: 8959fdd
Author: Lyor Goldstein <lg...@vmware.com>
Authored: Thu Jan 7 12:35:02 2016 +0200
Committer: Lyor Goldstein <lg...@vmware.com>
Committed: Thu Jan 7 12:35:02 2016 +0200
----------------------------------------------------------------------
.../apache/sshd/common/forward/DefaultTcpipForwarder.java | 3 ++-
.../java/org/apache/sshd/common/forward/TcpipForwarder.java | 2 +-
.../java/org/apache/sshd/server/channel/ChannelSession.java | 4 +---
.../org/apache/sshd/server/forward/ForwardingFilter.java | 6 +++---
.../org/apache/sshd/server/global/TcpipForwardHandler.java | 8 ++++++--
5 files changed, 13 insertions(+), 10 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/mina-sshd/blob/bacd1d53/sshd-core/src/main/java/org/apache/sshd/common/forward/DefaultTcpipForwarder.java
----------------------------------------------------------------------
diff --git a/sshd-core/src/main/java/org/apache/sshd/common/forward/DefaultTcpipForwarder.java b/sshd-core/src/main/java/org/apache/sshd/common/forward/DefaultTcpipForwarder.java
index c94a380..3115e80 100644
--- a/sshd-core/src/main/java/org/apache/sshd/common/forward/DefaultTcpipForwarder.java
+++ b/sshd-core/src/main/java/org/apache/sshd/common/forward/DefaultTcpipForwarder.java
@@ -303,8 +303,9 @@ public class DefaultTcpipForwarder
if (log.isDebugEnabled()) {
log.debug("localPortForwardingRequested(" + session + ")[" + local + "][haveFilter=" + (filter != null) + "] rejected");
}
- throw new IOException("Rejected address: " + local);
+ return null;
}
+
InetSocketAddress bound = doBind(local, staticIoHandlerFactory);
SshdSocketAddress result = new SshdSocketAddress(bound.getHostString(), bound.getPort());
if (log.isDebugEnabled()) {
http://git-wip-us.apache.org/repos/asf/mina-sshd/blob/bacd1d53/sshd-core/src/main/java/org/apache/sshd/common/forward/TcpipForwarder.java
----------------------------------------------------------------------
diff --git a/sshd-core/src/main/java/org/apache/sshd/common/forward/TcpipForwarder.java b/sshd-core/src/main/java/org/apache/sshd/common/forward/TcpipForwarder.java
index 843b333..e19da1e 100644
--- a/sshd-core/src/main/java/org/apache/sshd/common/forward/TcpipForwarder.java
+++ b/sshd-core/src/main/java/org/apache/sshd/common/forward/TcpipForwarder.java
@@ -103,7 +103,7 @@ public interface TcpipForwarder extends Closeable {
* Called when the other side requested a remote port forward.
*
* @param local The request address
- * @return The bound local addresses
+ * @return The bound local {@link SshdSocketAddress} - {@code null} if not allowed to forward
* @throws IOException If failed to handle request
*/
SshdSocketAddress localPortForwardingRequested(SshdSocketAddress local) throws IOException;
http://git-wip-us.apache.org/repos/asf/mina-sshd/blob/bacd1d53/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelSession.java
----------------------------------------------------------------------
diff --git a/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelSession.java b/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelSession.java
index 791fccd..ca8ba28 100644
--- a/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelSession.java
+++ b/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelSession.java
@@ -589,9 +589,7 @@ public class ChannelSession extends AbstractServerChannel {
}
protected RequestHandler.Result handleX11Forwarding(Buffer buffer, boolean wantReply) throws IOException {
- Session session = getSession();
- ValidateUtils.checkTrue(session instanceof ServerSession, "Session not a server one");
-
+ ServerSession session = getServerSession();
boolean singleConnection = buffer.getBoolean();
String authProtocol = buffer.getString();
String authCookie = buffer.getString();
http://git-wip-us.apache.org/repos/asf/mina-sshd/blob/bacd1d53/sshd-core/src/main/java/org/apache/sshd/server/forward/ForwardingFilter.java
----------------------------------------------------------------------
diff --git a/sshd-core/src/main/java/org/apache/sshd/server/forward/ForwardingFilter.java b/sshd-core/src/main/java/org/apache/sshd/server/forward/ForwardingFilter.java
index adb01a7..0a9f0a4 100644
--- a/sshd-core/src/main/java/org/apache/sshd/server/forward/ForwardingFilter.java
+++ b/sshd-core/src/main/java/org/apache/sshd/server/forward/ForwardingFilter.java
@@ -44,7 +44,7 @@ public interface ForwardingFilter {
* variable.
* </p>
*
- * @param session session requesting permission to forward the agent.
+ * @param session The {@link Session} requesting permission to forward the agent.
* @return true if the agent forwarding is permitted, false if denied.
*/
boolean canForwardAgent(Session session);
@@ -60,7 +60,7 @@ public interface ForwardingFilter {
* user's X11 display server.
* </p>
*
- * @param session session requesting permission to forward X11 connections.
+ * @param session The {@link Session} requesting permission to forward X11 connections.
* @return true if the X11 forwarding is permitted, false if denied.
*/
boolean canForwardX11(Session session);
@@ -80,7 +80,7 @@ public interface ForwardingFilter {
*
* @param address address the client has requested this server listen
* for inbound connections on, and relay them through the client.
- * @param session session requesting permission to listen for connections.
+ * @param session The {@link Session} requesting permission to listen for connections.
* @return true if the socket is permitted; false if it must be denied.
*/
boolean canListen(SshdSocketAddress address, Session session);
http://git-wip-us.apache.org/repos/asf/mina-sshd/blob/bacd1d53/sshd-core/src/main/java/org/apache/sshd/server/global/TcpipForwardHandler.java
----------------------------------------------------------------------
diff --git a/sshd-core/src/main/java/org/apache/sshd/server/global/TcpipForwardHandler.java b/sshd-core/src/main/java/org/apache/sshd/server/global/TcpipForwardHandler.java
index 8541276..3b4618b 100644
--- a/sshd-core/src/main/java/org/apache/sshd/server/global/TcpipForwardHandler.java
+++ b/sshd-core/src/main/java/org/apache/sshd/server/global/TcpipForwardHandler.java
@@ -59,8 +59,12 @@ public class TcpipForwardHandler extends AbstractConnectionServiceRequestHandler
TcpipForwarder forwarder = connectionService.getTcpipForwarder();
SshdSocketAddress bound = forwarder.localPortForwardingRequested(socketAddress);
if (log.isDebugEnabled()) {
- log.debug("process({})[{}] {} => {}, reply={}",
- connectionService, request, socketAddress, bound, wantReply);
+ log.debug("process({})[{}][want-reply-{}] {} => {}",
+ connectionService, request, wantReply, socketAddress, bound);
+ }
+
+ if (bound == null) {
+ return Result.ReplyFailure;
}
port = bound.getPort();