svn commit: r881338 - in /mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/server: channel/ChannelDirectTcpip.java session/TcpipForwardSupport.java

[sp...@apache.org]

Author: spearce
Date: Tue Nov 17 15:35:36 2009
New Revision: 881338

URL: http://svn.apache.org/viewvc?rev=881338&view=rev
Log:
Treat invalid port forwarding as administratively prohibited

A client may request a port outside of the range [0, 65535] as
the protocol uses a 32 bit integer to transfer the port number.
Any value outside of the standard range causes InetSocketAddress
to throw IllegalArgumentException, so trap the exception and fail
with the return code SSH_OPEN_ADMINISTRATIVELY_PROHIBITED.

We might be running with a SecurityManager enabled and be denied
access to the host's resolved IP address.  If this occurs we will
also now catch the SecurityException and convert it into the same
SSH_OPEN_ADMINISTRATIVELY_PROHIBITED return code.

Modified:
    mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelDirectTcpip.java
    mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/server/session/TcpipForwardSupport.java

Modified: mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelDirectTcpip.java
URL: http://svn.apache.org/viewvc/mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelDirectTcpip.java?rev=881338&r1=881337&r2=881338&view=diff
==============================================================================
--- mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelDirectTcpip.java (original)
+++ mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/server/channel/ChannelDirectTcpip.java Tue Nov 17 15:35:36 2009
@@ -74,11 +74,17 @@
         final OpenFuture f = new DefaultOpenFuture(this);
         String hostToConnect = buffer.getString();
         int portToConnect = buffer.getInt();
-        InetSocketAddress address = new InetSocketAddress(hostToConnect, portToConnect);
+        InetSocketAddress address;
+
+        try {
+            address = new InetSocketAddress(hostToConnect, portToConnect);
+        } catch (RuntimeException e) {
+            address = null;
+        }
 
         final ServerSession serverSession = (ServerSession)getSession();
         final TcpIpForwardFilter filter = serverSession.getServerFactoryManager().getTcpIpForwardFilter();
-        if (filter == null || !filter.canConnect(address, serverSession)) {
+        if (address == null || filter == null || !filter.canConnect(address, serverSession)) {
             super.close(true);
             f.setException(new OpenChannelException(SshConstants.SSH_OPEN_ADMINISTRATIVELY_PROHIBITED, "connect denied"));
             return f;

Modified: mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/server/session/TcpipForwardSupport.java
URL: http://svn.apache.org/viewvc/mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/server/session/TcpipForwardSupport.java?rev=881338&r1=881337&r2=881338&view=diff
==============================================================================
--- mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/server/session/TcpipForwardSupport.java (original)
+++ mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/server/session/TcpipForwardSupport.java Tue Nov 17 15:35:36 2009
@@ -72,10 +72,16 @@
     synchronized void request(Buffer buffer, boolean wantReply) throws IOException {
         String address = buffer.getString();
         int port = buffer.getInt();
-        InetSocketAddress addr = new InetSocketAddress(address, port);
+        InetSocketAddress addr;
+
+        try {
+            addr = new InetSocketAddress(address, port);
+        } catch (RuntimeException e) {
+            addr = null;
+        }
 
         final TcpIpForwardFilter filter = session.getServerFactoryManager().getTcpIpForwardFilter();
-        if (filter == null || !filter.canListen(addr, session)) {
+        if (addr == null || filter == null || !filter.canListen(addr, session)) {
             if (wantReply) {
                 buffer = session.createBuffer(SshConstants.Message.SSH_MSG_REQUEST_FAILURE);
                 session.writePacket(buffer);