summaryrefslogtreecommitdiff
path: root/networking
diff options
context:
space:
mode:
authorRon Yorston <rmy@pobox.com>2016-10-19 17:07:41 +0100
committerRon Yorston <rmy@pobox.com>2016-10-19 17:07:41 +0100
commit03aa1e26b8885cd0ae28b676bed0e646e93433fb (patch)
tree6ea4dd81cc9fb84c7da3a42731363144ee7ff0c3 /networking
parent2e04fb569646e1882496f7175a1f5da6f33e36e1 (diff)
parent6bbb48fadf2265c7ed806027781da8039e561865 (diff)
downloadbusybox-w32-03aa1e26b8885cd0ae28b676bed0e646e93433fb.tar.gz
busybox-w32-03aa1e26b8885cd0ae28b676bed0e646e93433fb.tar.bz2
busybox-w32-03aa1e26b8885cd0ae28b676bed0e646e93433fb.zip
Merge branch 'busybox' into merge
Diffstat (limited to 'networking')
-rw-r--r--networking/ifupdown.c43
-rw-r--r--networking/tcpudp.c69
-rw-r--r--networking/telnet.c7
-rw-r--r--networking/telnetd.IAC_test.sh87
-rw-r--r--networking/telnetd.c289
5 files changed, 357 insertions, 138 deletions
diff --git a/networking/ifupdown.c b/networking/ifupdown.c
index b0bc0d70f..1d0fc53cf 100644
--- a/networking/ifupdown.c
+++ b/networking/ifupdown.c
@@ -56,6 +56,7 @@
56#endif 56#endif
57 57
58#define UDHCPC_CMD_OPTIONS CONFIG_IFUPDOWN_UDHCPC_CMD_OPTIONS 58#define UDHCPC_CMD_OPTIONS CONFIG_IFUPDOWN_UDHCPC_CMD_OPTIONS
59#define IFSTATE_FILE_PATH CONFIG_IFUPDOWN_IFSTATE_PATH
59 60
60#define debug_noise(args...) /*fprintf(stderr, args)*/ 61#define debug_noise(args...) /*fprintf(stderr, args)*/
61 62
@@ -1200,7 +1201,7 @@ static llist_t *find_iface_state(llist_t *state_list, const char *iface)
1200static llist_t *read_iface_state(void) 1201static llist_t *read_iface_state(void)
1201{ 1202{
1202 llist_t *state_list = NULL; 1203 llist_t *state_list = NULL;
1203 FILE *state_fp = fopen_for_read(CONFIG_IFUPDOWN_IFSTATE_PATH); 1204 FILE *state_fp = fopen_for_read(IFSTATE_FILE_PATH);
1204 1205
1205 if (state_fp) { 1206 if (state_fp) {
1206 char *start, *end_ptr; 1207 char *start, *end_ptr;
@@ -1215,6 +1216,38 @@ static llist_t *read_iface_state(void)
1215 return state_list; 1216 return state_list;
1216} 1217}
1217 1218
1219/* read the previous state from the state file */
1220static FILE *open_new_state_file(void)
1221{
1222 int fd, flags, cnt;
1223
1224 cnt = 0;
1225 flags = (O_WRONLY | O_CREAT | O_EXCL);
1226 for (;;) {
1227 fd = open(IFSTATE_FILE_PATH".new", flags, 0666);
1228 if (fd >= 0)
1229 break;
1230 if (errno != EEXIST
1231 || flags == (O_WRONLY | O_CREAT | O_TRUNC)
1232 ) {
1233 bb_perror_msg_and_die("can't open '%s'",
1234 IFSTATE_FILE_PATH".new");
1235 }
1236 /* Someone else created the .new file */
1237 if (cnt > 30 * 1000) {
1238 /* Waited for 30*30/2 = 450 milliseconds, still EEXIST.
1239 * Assuming a stale file, rewriting it.
1240 */
1241 flags = (O_WRONLY | O_CREAT | O_TRUNC);
1242 continue;
1243 }
1244 usleep(cnt);
1245 cnt += 1000;
1246 }
1247
1248 return xfdopen_for_write(fd);
1249}
1250
1218 1251
1219int ifupdown_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE; 1252int ifupdown_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
1220int ifupdown_main(int argc UNUSED_PARAM, char **argv) 1253int ifupdown_main(int argc UNUSED_PARAM, char **argv)
@@ -1348,7 +1381,7 @@ int ifupdown_main(int argc UNUSED_PARAM, char **argv)
1348 any_failures = 1; 1381 any_failures = 1;
1349 } else if (!NO_ACT) { 1382 } else if (!NO_ACT) {
1350 /* update the state file */ 1383 /* update the state file */
1351 FILE *state_fp; 1384 FILE *new_state_fp = open_new_state_file();
1352 llist_t *state; 1385 llist_t *state;
1353 llist_t *state_list = read_iface_state(); 1386 llist_t *state_list = read_iface_state();
1354 llist_t *iface_state = find_iface_state(state_list, iface); 1387 llist_t *iface_state = find_iface_state(state_list, iface);
@@ -1368,15 +1401,15 @@ int ifupdown_main(int argc UNUSED_PARAM, char **argv)
1368 } 1401 }
1369 1402
1370 /* Actually write the new state */ 1403 /* Actually write the new state */
1371 state_fp = xfopen_for_write(CONFIG_IFUPDOWN_IFSTATE_PATH);
1372 state = state_list; 1404 state = state_list;
1373 while (state) { 1405 while (state) {
1374 if (state->data) { 1406 if (state->data) {
1375 fprintf(state_fp, "%s\n", state->data); 1407 fprintf(new_state_fp, "%s\n", state->data);
1376 } 1408 }
1377 state = state->link; 1409 state = state->link;
1378 } 1410 }
1379 fclose(state_fp); 1411 fclose(new_state_fp);
1412 xrename(IFSTATE_FILE_PATH".new", IFSTATE_FILE_PATH);
1380 llist_free(state_list, free); 1413 llist_free(state_list, free);
1381 } 1414 }
1382 next: 1415 next:
diff --git a/networking/tcpudp.c b/networking/tcpudp.c
index fbd1f1c45..b27cf3ea9 100644
--- a/networking/tcpudp.c
+++ b/networking/tcpudp.c
@@ -34,37 +34,56 @@
34/* with not-implemented options: */ 34/* with not-implemented options: */
35/* //usage: "[-hpEvv] [-c N] [-C N[:MSG]] [-b N] [-u USER] [-l NAME] [-i DIR|-x CDB] [-t SEC] IP PORT PROG" */ 35/* //usage: "[-hpEvv] [-c N] [-C N[:MSG]] [-b N] [-u USER] [-l NAME] [-i DIR|-x CDB] [-t SEC] IP PORT PROG" */
36//usage:#define tcpsvd_full_usage "\n\n" 36//usage:#define tcpsvd_full_usage "\n\n"
37//usage: "Create TCP socket, bind to IP:PORT and listen\n" 37//usage: "Create TCP socket, bind to IP:PORT and listen for incoming connections.\n"
38//usage: "for incoming connection. Run PROG for each connection.\n" 38//usage: "Run PROG for each connection.\n"
39//usage: "\n IP IP to listen on, 0 = all" 39//usage: "\n IP PORT IP:PORT to listen on"
40//usage: "\n PORT Port to listen on"
41//usage: "\n PROG ARGS Program to run" 40//usage: "\n PROG ARGS Program to run"
42//usage: "\n -l NAME Local hostname (else looks up local hostname in DNS)"
43//usage: "\n -u USER[:GRP] Change to user/group after bind" 41//usage: "\n -u USER[:GRP] Change to user/group after bind"
44//usage: "\n -c N Handle up to N connections simultaneously" 42//usage: "\n -c N Up to N connections simultaneously (default 30)"
45//usage: "\n -b N Allow a backlog of approximately N TCP SYNs" 43//usage: "\n -b N Allow backlog of approximately N TCP SYNs (default 20)"
46//usage: "\n -C N[:MSG] Allow only up to N connections from the same IP" 44//usage: "\n -C N[:MSG] Allow only up to N connections from the same IP:"
47//usage: "\n New connections from this IP address are closed" 45//usage: "\n new connections from this IP address are closed"
48//usage: "\n immediately. MSG is written to the peer before close" 46//usage: "\n immediately, MSG is written to the peer before close"
47//usage: "\n -E Don't set up environment"
49//usage: "\n -h Look up peer's hostname" 48//usage: "\n -h Look up peer's hostname"
50//usage: "\n -E Don't set up environment variables" 49//usage: "\n -l NAME Local hostname (else look up local hostname in DNS)"
51//usage: "\n -v Verbose" 50//usage: "\n -v Verbose"
51//usage: "\n"
52//usage: "\nEnvironment if no -E:"
53//usage: "\nPROTO='TCP'"
54//usage: "\nTCPREMOTEADDR='ip:port'" IF_FEATURE_IPV6(" ('[ip]:port' for IPv6)")
55//usage: "\nTCPLOCALADDR='ip:port'"
56//usage: "\nTCPORIGDSTADDR='ip:port' of destination before firewall"
57//usage: "\n Useful for REDIRECTed-to-local connections:"
58//usage: "\n iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to 8080"
59//usage: "\nTCPCONCURRENCY=num_of_connects_from_this_ip"
60//usage: "\nIf -h:"
61//usage: "\nTCPLOCALHOST='hostname' (-l NAME is used if specified)"
62//usage: "\nTCPREMOTEHOST='hostname'"
63
52//usage: 64//usage:
53//usage:#define udpsvd_trivial_usage 65//usage:#define udpsvd_trivial_usage
54//usage: "[-hEv] [-c N] [-u USER] [-l NAME] IP PORT PROG" 66//usage: "[-hEv] [-c N] [-u USER] [-l NAME] IP PORT PROG"
55//usage:#define udpsvd_full_usage "\n\n" 67//usage:#define udpsvd_full_usage "\n\n"
56//usage: "Create UDP socket, bind to IP:PORT and wait\n" 68//usage: "Create UDP socket, bind to IP:PORT and wait for incoming packets.\n"
57//usage: "for incoming packets. Run PROG for each packet,\n" 69//usage: "Run PROG for each packet, redirecting all further packets with same\n"
58//usage: "redirecting all further packets with same peer ip:port to it.\n" 70//usage: "peer ip:port to it.\n"
59//usage: "\n IP IP to listen on, 0 = all" 71//usage: "\n IP PORT IP:PORT to listen on"
60//usage: "\n PORT Port to listen on"
61//usage: "\n PROG ARGS Program to run" 72//usage: "\n PROG ARGS Program to run"
62//usage: "\n -l NAME Local hostname (else looks up local hostname in DNS)"
63//usage: "\n -u USER[:GRP] Change to user/group after bind" 73//usage: "\n -u USER[:GRP] Change to user/group after bind"
64//usage: "\n -c N Handle up to N connections simultaneously" 74//usage: "\n -c N Up to N connections simultaneously (default 30)"
75//usage: "\n -E Don't set up environment"
65//usage: "\n -h Look up peer's hostname" 76//usage: "\n -h Look up peer's hostname"
66//usage: "\n -E Don't set up environment variables" 77//usage: "\n -l NAME Local hostname (else look up local hostname in DNS)"
67//usage: "\n -v Verbose" 78//usage: "\n -v Verbose"
79//usage: "\n"
80//usage: "\nEnvironment if no -E:"
81//usage: "\nPROTO='UDP'"
82//usage: "\nUDPREMOTEADDR='ip:port'" IF_FEATURE_IPV6(" ('[ip]:port' for IPv6)")
83//usage: "\nUDPLOCALADDR='ip:port'"
84//usage: "\nIf -h:"
85//usage: "\nUDPLOCALHOST='hostname' (-l NAME is used if specified)"
86//usage: "\nUDPREMOTEHOST='hostname'"
68 87
69#include "libbb.h" 88#include "libbb.h"
70#include "common_bufsiz.h" 89#include "common_bufsiz.h"
@@ -240,7 +259,7 @@ int tcpudpsvd_main(int argc UNUSED_PARAM, char **argv)
240 ); 259 );
241#else 260#else
242 /* "+": stop on first non-option */ 261 /* "+": stop on first non-option */
243 opts = getopt32(argv, "+c:C:i:x:u:l:Eb:hpt:v", 262 opts = getopt32(argv, "+c:+C:i:x:u:l:Eb:hpt:v",
244 &cmax, &str_C, &instructs, &instructs, &user, &preset_local_hostname, 263 &cmax, &str_C, &instructs, &instructs, &user, &preset_local_hostname,
245 &backlog, &str_t, &verbose 264 &backlog, &str_t, &verbose
246 ); 265 );
@@ -349,16 +368,20 @@ int tcpudpsvd_main(int argc UNUSED_PARAM, char **argv)
349 again: 368 again:
350 hccp = NULL; 369 hccp = NULL;
351 370
371 again1:
372 close(0);
373 /* It's important to close(0) _before_ wait loop:
374 * fd#0 can be a shared connection fd.
375 * If kept open by us, peer can't detect PROG closing it.
376 */
352 while (cnum >= cmax) 377 while (cnum >= cmax)
353 wait_for_any_sig(); /* expecting SIGCHLD */ 378 wait_for_any_sig(); /* expecting SIGCHLD */
354 379
355 /* Accept a connection to fd #0 */
356 again1:
357 close(0);
358 again2: 380 again2:
359 sig_unblock(SIGCHLD); 381 sig_unblock(SIGCHLD);
360 local.len = remote.len = sa_len; 382 local.len = remote.len = sa_len;
361 if (tcp) { 383 if (tcp) {
384 /* Accept a connection to fd #0 */
362 conn = accept(sock, &remote.u.sa, &remote.len); 385 conn = accept(sock, &remote.u.sa, &remote.len);
363 } else { 386 } else {
364 /* In case recv_from_to won't be able to recover local addr. 387 /* In case recv_from_to won't be able to recover local addr.
diff --git a/networking/telnet.c b/networking/telnet.c
index d2daf5c8c..1a6986b94 100644
--- a/networking/telnet.c
+++ b/networking/telnet.c
@@ -311,15 +311,16 @@ static void put_iac(int c)
311 G.iacbuf[G.iaclen++] = c; 311 G.iacbuf[G.iaclen++] = c;
312} 312}
313 313
314static void put_iac2(byte wwdd, byte c) 314static void put_iac2_merged(unsigned wwdd_and_c)
315{ 315{
316 if (G.iaclen + 3 > IACBUFSIZE) 316 if (G.iaclen + 3 > IACBUFSIZE)
317 iac_flush(); 317 iac_flush();
318 318
319 put_iac(IAC); 319 put_iac(IAC);
320 put_iac(wwdd); 320 put_iac(wwdd_and_c >> 8);
321 put_iac(c); 321 put_iac(wwdd_and_c & 0xff);
322} 322}
323#define put_iac2(wwdd,c) put_iac2_merged(((wwdd)<<8) + (c))
323 324
324#if ENABLE_FEATURE_TELNET_TTYPE 325#if ENABLE_FEATURE_TELNET_TTYPE
325static void put_iac_subopt(byte c, char *str) 326static void put_iac_subopt(byte c, char *str)
diff --git a/networking/telnetd.IAC_test.sh b/networking/telnetd.IAC_test.sh
new file mode 100644
index 000000000..a36ee3aa0
--- /dev/null
+++ b/networking/telnetd.IAC_test.sh
@@ -0,0 +1,87 @@
1#!/bin/sh
2# Testcase for IAC input processing.
3# The bug also required a small and odd BUFSIZE ("enum { BUFSIZE = 37 };")
4# in telnetd.c to trigger easily.
5
6echo "\
7Run telnetd like this:
8 busybox telnetd -l./save.sh -F
9where save.sh is
10 #!/bin/sh
11 stty -echo
12 exec cat >save.dat
13Now I'll try to connect to it and feed it 2048 0xff bytes.
14Check that save.dat does contain 2048 0xff bytes.
15"
16
17ff()
18{
19echo -en \
20'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
21'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
22'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
23'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
24'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
25'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
26'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
27'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
28'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
29'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
30'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
31'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
32'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
33'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
34'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
35'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
36'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
37'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
38'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
39'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
40'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
41'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
42'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
43'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
44'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
45'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
46'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
47'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
48'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
49'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
50'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
51'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
52'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
53'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
54'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
55'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
56'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
57'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
58'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
59'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
60'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
61'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
62'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
63'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
64'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
65'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
66'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
67'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
68'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
69'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
70'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
71'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
72'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
73'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
74'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
75'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
76'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
77'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
78'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
79'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
80'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
81'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
82'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
83'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'\
84'\r\n'; }
85
86ff | wc -c
87{ ff; sleep 2; } | busybox telnet 127.0.0.1
diff --git a/networking/telnetd.c b/networking/telnetd.c
index 2fbdc3bb3..303ef1be7 100644
--- a/networking/telnetd.c
+++ b/networking/telnetd.c
@@ -60,6 +60,7 @@ struct tsession {
60 int sockfd_read; 60 int sockfd_read;
61 int sockfd_write; 61 int sockfd_write;
62 int ptyfd; 62 int ptyfd;
63 smallint buffered_IAC_for_pty;
63 64
64 /* two circular buffers */ 65 /* two circular buffers */
65 /*char *buf1, *buf2;*/ 66 /*char *buf1, *buf2;*/
@@ -91,107 +92,197 @@ struct globals {
91} while (0) 92} while (0)
92 93
93 94
94/* 95/* Write some buf1 data to pty, processing IACs.
95 Remove all IAC's from buf1 (received IACs are ignored and must be removed 96 * Update wridx1 and size1. Return < 0 on error.
96 so as to not be interpreted by the terminal). Make an uninterrupted 97 * Buggy if IAC is present but incomplete: skips them.
97 string of characters fit for the terminal. Do this by packing
98 all characters meant for the terminal sequentially towards the end of buf.
99
100 Return a pointer to the beginning of the characters meant for the terminal
101 and make *num_totty the number of characters that should be sent to
102 the terminal.
103
104 Note - if an IAC (3 byte quantity) starts before (bf + len) but extends
105 past (bf + len) then that IAC will be left unprocessed and *processed
106 will be less than len.
107
108 CR-LF ->'s CR mapping is also done here, for convenience.
109
110 NB: may fail to remove iacs which wrap around buffer!
111 */ 98 */
112static unsigned char * 99static ssize_t
113remove_iacs(struct tsession *ts, int *pnum_totty) 100safe_write_to_pty_decode_iac(struct tsession *ts)
114{ 101{
115 unsigned char *ptr0 = TS_BUF1(ts) + ts->wridx1; 102 unsigned wr;
116 unsigned char *ptr = ptr0; 103 ssize_t rc;
117 unsigned char *totty = ptr; 104 unsigned char *buf;
118 unsigned char *end = ptr + MIN(BUFSIZE - ts->wridx1, ts->size1); 105 unsigned char *found;
119 int num_totty; 106
120 107 buf = TS_BUF1(ts) + ts->wridx1;
121 while (ptr < end) { 108 wr = MIN(BUFSIZE - ts->wridx1, ts->size1);
122 if (*ptr != IAC) { 109 /* wr is at least 1 here */
123 char c = *ptr; 110
124 111 if (ts->buffered_IAC_for_pty) {
125 *totty++ = c; 112 /* Last time we stopped on a "dangling" IAC byte.
126 ptr++; 113 * We removed it from the buffer back then.
127 /* We map \r\n ==> \r for pragmatic reasons. 114 * Now pretend it's still there, and jump to IAC processing.
128 * Many client implementations send \r\n when 115 */
129 * the user hits the CarriageReturn key. 116 ts->buffered_IAC_for_pty = 0;
130 * See RFC 1123 3.3.1 Telnet End-of-Line Convention. 117 wr++;
131 */ 118 ts->size1++;
132 if (c == '\r' && ptr < end && (*ptr == '\n' || *ptr == '\0')) 119 buf--; /* Yes, this can point before the buffer. It's ok */
133 ptr++; 120 ts->wridx1--;
134 continue; 121 goto handle_iac;
135 } 122 }
136 123
137 if ((ptr+1) >= end) 124 found = memchr(buf, IAC, wr);
138 break; 125 if (found != buf) {
139 if (ptr[1] == NOP) { /* Ignore? (putty keepalive, etc.) */ 126 /* There is a "prefix" of non-IAC chars.
140 ptr += 2; 127 * Write only them, and return.
141 continue; 128 */
142 } 129 if (found)
143 if (ptr[1] == IAC) { /* Literal IAC? (emacs M-DEL) */ 130 wr = found - buf;
144 *totty++ = ptr[1];
145 ptr += 2;
146 continue;
147 }
148 131
149 /* 132 /* We map \r\n ==> \r for pragmatic reasons:
150 * TELOPT_NAWS support! 133 * many client implementations send \r\n when
134 * the user hits the CarriageReturn key.
135 * See RFC 1123 3.3.1 Telnet End-of-Line Convention.
151 */ 136 */
152 if ((ptr+2) >= end) { 137 rc = wr;
153 /* Only the beginning of the IAC is in the 138 found = memchr(buf, '\r', wr);
154 buffer we were asked to process, we can't 139 if (found)
155 process this char */ 140 rc = found - buf + 1;
156 break; 141 rc = safe_write(ts->ptyfd, buf, rc);
142 if (rc <= 0)
143 return rc;
144 if (rc < wr /* don't look past available data */
145 && buf[rc-1] == '\r' /* need this: imagine that write was _short_ */
146 && (buf[rc] == '\n' || buf[rc] == '\0')
147 ) {
148 rc++;
157 } 149 }
150 goto update_and_return;
151 }
152
153 /* buf starts with IAC char. Process that sequence.
154 * Example: we get this from our own (bbox) telnet client:
155 * read(5, "\377\374\1""\377\373\37""\377\372\37\0\262\0@\377\360""\377\375\1""\377\375\3"):
156 * IAC WONT ECHO, IAC WILL NAWS, IAC SB NAWS <cols> <rows> IAC SE, IAC DO SGA
157 * Another example (telnet-0.17 from old-netkit):
158 * read(4, "\377\375\3""\377\373\30""\377\373\37""\377\373 ""\377\373!""\377\373\"""\377\373'"
159 * "\377\375\5""\377\373#""\377\374\1""\377\372\37\0\257\0I\377\360""\377\375\1"):
160 * IAC DO SGA, IAC WILL TTYPE, IAC WILL NAWS, IAC WILL TSPEED, IAC WILL LFLOW, IAC WILL LINEMODE, IAC WILL NEW_ENVIRON,
161 * IAC DO STATUS, IAC WILL XDISPLOC, IAC WONT ECHO, IAC SB NAWS <cols> <rows> IAC SE, IAC DO ECHO
162 */
163 if (wr <= 1) {
164 /* Only the single IAC byte is in the buffer, eat it
165 * and set a flag "process the rest of the sequence
166 * next time we are here".
167 */
168 //bb_error_msg("dangling IAC!");
169 ts->buffered_IAC_for_pty = 1;
170 rc = 1;
171 goto update_and_return;
172 }
173
174 handle_iac:
175 /* 2-byte commands (240..250 and 255):
176 * IAC IAC (255) Literal 255. Supported.
177 * IAC SE (240) End of subnegotiation. Treated as NOP.
178 * IAC NOP (241) NOP. Supported.
179 * IAC BRK (243) Break. Like serial line break. TODO via tcsendbreak()?
180 * IAC AYT (246) Are you there. Send back evidence that AYT was seen. TODO (send NOP back)?
181 * These don't look useful:
182 * IAC DM (242) Data mark. What is this?
183 * IAC IP (244) Suspend, interrupt or abort the process. (Ancient cousin of ^C).
184 * IAC AO (245) Abort output. "You can continue running, but do not send me the output".
185 * IAC EC (247) Erase character. The receiver should delete the last received char.
186 * IAC EL (248) Erase line. The receiver should delete everything up tp last newline.
187 * IAC GA (249) Go ahead. For half-duplex lines: "now you talk".
188 * Implemented only as part of NAWS:
189 * IAC SB (250) Subnegotiation of an option follows.
190 */
191 if (buf[1] == IAC) {
192 /* Literal 255 (emacs M-DEL) */
193 //bb_error_msg("255!");
194 rc = safe_write(ts->ptyfd, &buf[1], 1);
158 /* 195 /*
159 * IAC -> SB -> TELOPT_NAWS -> 4-byte -> IAC -> SE 196 * If we went through buffered_IAC_for_pty==1 path,
197 * bailing out on error like below messes up the buffer.
198 * EAGAIN is highly unlikely here, other errors will be
199 * repeated on next write, let's just skip error check.
160 */ 200 */
161 if (ptr[1] == SB && ptr[2] == TELOPT_NAWS) { 201#if 0
202 if (rc <= 0)
203 return rc;
204#endif
205 rc = 2;
206 goto update_and_return;
207 }
208 if (buf[1] >= 240 && buf[1] <= 249) {
209 /* NOP (241). Ignore (putty keepalive, etc) */
210 /* All other 2-byte commands also treated as NOPs here */
211 rc = 2;
212 goto update_and_return;
213 }
214
215 if (wr <= 2) {
216/* BUG: only 2 bytes of the IAC is in the buffer, we just eat them.
217 * This is not a practical problem since >2 byte IACs are seen only
218 * in initial negotiation, when buffer is empty
219 */
220 rc = 2;
221 goto update_and_return;
222 }
223
224 if (buf[1] == SB) {
225 if (buf[2] == TELOPT_NAWS) {
226 /* IAC SB, TELOPT_NAWS, 4-byte, IAC SE */
162 struct winsize ws; 227 struct winsize ws;
163 if ((ptr+8) >= end) 228 if (wr <= 6) {
164 break; /* incomplete, can't process */ 229/* BUG: incomplete, can't process */
165 ws.ws_col = (ptr[3] << 8) | ptr[4]; 230 rc = wr;
166 ws.ws_row = (ptr[5] << 8) | ptr[6]; 231 goto update_and_return;
232 }
233 memset(&ws, 0, sizeof(ws)); /* pixel sizes are set to 0 */
234 ws.ws_col = (buf[3] << 8) | buf[4];
235 ws.ws_row = (buf[5] << 8) | buf[6];
167 ioctl(ts->ptyfd, TIOCSWINSZ, (char *)&ws); 236 ioctl(ts->ptyfd, TIOCSWINSZ, (char *)&ws);
168 ptr += 9; 237 rc = 7;
169 continue; 238 /* trailing IAC SE will be eaten separately, as 2-byte NOP */
239 goto update_and_return;
170 } 240 }
171 /* skip 3-byte IAC non-SB cmd */ 241 /* else: other subnegs not supported yet */
242 }
243
244 /* Assume it is a 3-byte WILL/WONT/DO/DONT 251..254 command and skip it */
172#if DEBUG 245#if DEBUG
173 fprintf(stderr, "Ignoring IAC %s,%s\n", 246 fprintf(stderr, "Ignoring IAC %s,%s\n",
174 TELCMD(ptr[1]), TELOPT(ptr[2])); 247 TELCMD(buf[1]), TELOPT(buf[2]));
175#endif 248#endif
176 ptr += 3; 249 rc = 3;
250
251 update_and_return:
252 ts->wridx1 += rc;
253 if (ts->wridx1 >= BUFSIZE) /* actually == BUFSIZE */
254 ts->wridx1 = 0;
255 ts->size1 -= rc;
256 /*
257 * Hack. We cannot process IACs which wrap around buffer's end.
258 * Since properly fixing it requires writing bigger code,
259 * we rely instead on this code making it virtually impossible
260 * to have wrapped IAC (people don't type at 2k/second).
261 * It also allows for bigger reads in common case.
262 */
263 if (ts->size1 == 0) { /* very typical */
264 //bb_error_msg("zero size1");
265 ts->rdidx1 = 0;
266 ts->wridx1 = 0;
267 return rc;
177 } 268 }
178 269 wr = ts->wridx1;
179 num_totty = totty - ptr0; 270 if (wr != 0 && wr < ts->rdidx1) {
180 *pnum_totty = num_totty; 271 /* Buffer is not wrapped yet.
181 /* The difference between ptr and totty is number of iacs 272 * We can easily move it to the beginning.
182 we removed from the stream. Adjust buf1 accordingly */ 273 */
183 if ((ptr - totty) == 0) /* 99.999% of cases */ 274 //bb_error_msg("moved %d", wr);
184 return ptr0; 275 memmove(TS_BUF1(ts), TS_BUF1(ts) + wr, ts->size1);
185 ts->wridx1 += ptr - totty; 276 ts->rdidx1 -= wr;
186 ts->size1 -= ptr - totty; 277 ts->wridx1 = 0;
187 /* Move chars meant for the terminal towards the end of the buffer */ 278 }
188 return memmove(ptr - num_totty, ptr0, num_totty); 279 return rc;
189} 280}
190 281
191/* 282/*
192 * Converting single IAC into double on output 283 * Converting single IAC into double on output
193 */ 284 */
194static size_t iac_safe_write(int fd, const char *buf, size_t count) 285static size_t safe_write_double_iac(int fd, const char *buf, size_t count)
195{ 286{
196 const char *IACptr; 287 const char *IACptr;
197 size_t wr, rc, total; 288 size_t wr, rc, total;
@@ -203,6 +294,7 @@ static size_t iac_safe_write(int fd, const char *buf, size_t count)
203 if (*buf == (char)IAC) { 294 if (*buf == (char)IAC) {
204 static const char IACIAC[] ALIGN1 = { IAC, IAC }; 295 static const char IACIAC[] ALIGN1 = { IAC, IAC };
205 rc = safe_write(fd, IACIAC, 2); 296 rc = safe_write(fd, IACIAC, 2);
297/* BUG: if partial write was only 1 byte long, we end up emitting just one IAC */
206 if (rc != 2) 298 if (rc != 2)
207 break; 299 break;
208 buf++; 300 buf++;
@@ -298,7 +390,7 @@ make_new_session(
298 IAC, WILL, TELOPT_ECHO, 390 IAC, WILL, TELOPT_ECHO,
299 IAC, WILL, TELOPT_SGA 391 IAC, WILL, TELOPT_SGA
300 }; 392 };
301 /* This confuses iac_safe_write(), it will try to duplicate 393 /* This confuses safe_write_double_iac(), it will try to duplicate
302 * each IAC... */ 394 * each IAC... */
303 //memcpy(TS_BUF2(ts), iacs_to_send, sizeof(iacs_to_send)); 395 //memcpy(TS_BUF2(ts), iacs_to_send, sizeof(iacs_to_send));
304 //ts->rdidx2 = sizeof(iacs_to_send); 396 //ts->rdidx2 = sizeof(iacs_to_send);
@@ -649,51 +741,34 @@ int telnetd_main(int argc UNUSED_PARAM, char **argv)
649 struct tsession *next = ts->next; /* in case we free ts */ 741 struct tsession *next = ts->next; /* in case we free ts */
650 742
651 if (/*ts->size1 &&*/ FD_ISSET(ts->ptyfd, &wrfdset)) { 743 if (/*ts->size1 &&*/ FD_ISSET(ts->ptyfd, &wrfdset)) {
652 int num_totty;
653 unsigned char *ptr;
654 /* Write to pty from buffer 1 */ 744 /* Write to pty from buffer 1 */
655 ptr = remove_iacs(ts, &num_totty); 745 count = safe_write_to_pty_decode_iac(ts);
656 count = safe_write(ts->ptyfd, ptr, num_totty);
657 if (count < 0) { 746 if (count < 0) {
658 if (errno == EAGAIN) 747 if (errno == EAGAIN)
659 goto skip1; 748 goto skip1;
660 goto kill_session; 749 goto kill_session;
661 } 750 }
662 ts->size1 -= count;
663 ts->wridx1 += count;
664 if (ts->wridx1 >= BUFSIZE) /* actually == BUFSIZE */
665 ts->wridx1 = 0;
666 } 751 }
667 skip1: 752 skip1:
668 if (/*ts->size2 &&*/ FD_ISSET(ts->sockfd_write, &wrfdset)) { 753 if (/*ts->size2 &&*/ FD_ISSET(ts->sockfd_write, &wrfdset)) {
669 /* Write to socket from buffer 2 */ 754 /* Write to socket from buffer 2 */
670 count = MIN(BUFSIZE - ts->wridx2, ts->size2); 755 count = MIN(BUFSIZE - ts->wridx2, ts->size2);
671 count = iac_safe_write(ts->sockfd_write, (void*)(TS_BUF2(ts) + ts->wridx2), count); 756 count = safe_write_double_iac(ts->sockfd_write, (void*)(TS_BUF2(ts) + ts->wridx2), count);
672 if (count < 0) { 757 if (count < 0) {
673 if (errno == EAGAIN) 758 if (errno == EAGAIN)
674 goto skip2; 759 goto skip2;
675 goto kill_session; 760 goto kill_session;
676 } 761 }
677 ts->size2 -= count;
678 ts->wridx2 += count; 762 ts->wridx2 += count;
679 if (ts->wridx2 >= BUFSIZE) /* actually == BUFSIZE */ 763 if (ts->wridx2 >= BUFSIZE) /* actually == BUFSIZE */
680 ts->wridx2 = 0; 764 ts->wridx2 = 0;
765 ts->size2 -= count;
766 if (ts->size2 == 0) {
767 ts->rdidx2 = 0;
768 ts->wridx2 = 0;
769 }
681 } 770 }
682 skip2: 771 skip2:
683 /* Should not be needed, but... remove_iacs is actually buggy
684 * (it cannot process iacs which wrap around buffer's end)!
685 * Since properly fixing it requires writing bigger code,
686 * we rely instead on this code making it virtually impossible
687 * to have wrapped iac (people don't type at 2k/second).
688 * It also allows for bigger reads in common case. */
689 if (ts->size1 == 0) {
690 ts->rdidx1 = 0;
691 ts->wridx1 = 0;
692 }
693 if (ts->size2 == 0) {
694 ts->rdidx2 = 0;
695 ts->wridx2 = 0;
696 }
697 772
698 if (/*ts->size1 < BUFSIZE &&*/ FD_ISSET(ts->sockfd_read, &rdfdset)) { 773 if (/*ts->size1 < BUFSIZE &&*/ FD_ISSET(ts->sockfd_read, &rdfdset)) {
699 /* Read from socket to buffer 1 */ 774 /* Read from socket to buffer 1 */
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-14 08:39:03 +0000