diff options
-rw-r--r-- | networking/telnetd.c | 231 |
1 files changed, 120 insertions, 111 deletions
diff --git a/networking/telnetd.c b/networking/telnetd.c index 2fbdc3bb3..68fccdca8 100644 --- a/networking/telnetd.c +++ b/networking/telnetd.c | |||
@@ -91,107 +91,133 @@ struct globals { | |||
91 | } while (0) | 91 | } while (0) |
92 | 92 | ||
93 | 93 | ||
94 | /* | 94 | /* Write some buf1 data to pty, processing IAC's. |
95 | Remove all IAC's from buf1 (received IACs are ignored and must be removed | 95 | * Update wridx1 and size1. Return < 0 on error. |
96 | so as to not be interpreted by the terminal). Make an uninterrupted | 96 | * Buggy if IAC is present but incomplete: skips them. |
97 | string of characters fit for the terminal. Do this by packing | 97 | */ |
98 | all characters meant for the terminal sequentially towards the end of buf. | 98 | static ssize_t |
99 | safe_write_to_pty_decode_iac(struct tsession *ts) | ||
100 | { | ||
101 | unsigned wr; | ||
102 | ssize_t rc; | ||
103 | unsigned char *buf; | ||
104 | unsigned char *found; | ||
105 | |||
106 | buf = TS_BUF1(ts) + ts->wridx1; | ||
107 | wr = MIN(BUFSIZE - ts->wridx1, ts->size1); | ||
108 | found = memchr(buf, IAC, wr); | ||
109 | if (found != buf) { | ||
110 | /* There is a "prefix" of non-IAC chars. | ||
111 | * Write only them, and return. | ||
112 | */ | ||
113 | if (found) | ||
114 | wr = found - buf; | ||
99 | 115 | ||
100 | Return a pointer to the beginning of the characters meant for the terminal | 116 | /* We map \r\n ==> \r for pragmatic reasons: |
101 | and make *num_totty the number of characters that should be sent to | 117 | * many client implementations send \r\n when |
102 | the terminal. | 118 | * the user hits the CarriageReturn key. |
119 | * See RFC 1123 3.3.1 Telnet End-of-Line Convention. | ||
120 | */ | ||
121 | rc = wr; | ||
122 | found = memchr(buf, '\r', wr); | ||
123 | if (found) | ||
124 | rc = found - buf + 1; | ||
125 | rc = safe_write(ts->ptyfd, buf, rc); | ||
126 | if (rc <= 0) | ||
127 | return rc; | ||
128 | if (rc < wr && (buf[rc] == '\n' || buf[rc] == '\0')) | ||
129 | rc++; | ||
103 | 130 | ||
104 | Note - if an IAC (3 byte quantity) starts before (bf + len) but extends | 131 | goto update_and_return; |
105 | past (bf + len) then that IAC will be left unprocessed and *processed | 132 | } |
106 | will be less than len. | ||
107 | 133 | ||
108 | CR-LF ->'s CR mapping is also done here, for convenience. | 134 | /* buf starts with IAC char. Process that sequence. |
135 | * Example: we get this from our own (bbox) telnet client: | ||
136 | * read(5, "\377\374\1""\377\373\37""\377\372\37\0\262\0@\377\360""\377\375\1""\377\375\3") = 21 | ||
137 | */ | ||
138 | if (wr <= 1) { | ||
139 | /* Only the beginning of the IAC is in the | ||
140 | * buffer we were asked to process, we can't | ||
141 | * process this char */ | ||
142 | rc = 1; | ||
143 | goto update_and_return; | ||
144 | } | ||
109 | 145 | ||
110 | NB: may fail to remove iacs which wrap around buffer! | 146 | if (buf[1] == IAC) { /* Literal IAC (emacs M-DEL) */ |
111 | */ | 147 | rc = safe_write(ts->ptyfd, buf, 1); |
112 | static unsigned char * | 148 | if (rc <= 0) |
113 | remove_iacs(struct tsession *ts, int *pnum_totty) | 149 | return rc; |
114 | { | 150 | rc = 2; |
115 | unsigned char *ptr0 = TS_BUF1(ts) + ts->wridx1; | 151 | goto update_and_return; |
116 | unsigned char *ptr = ptr0; | 152 | } |
117 | unsigned char *totty = ptr; | ||
118 | unsigned char *end = ptr + MIN(BUFSIZE - ts->wridx1, ts->size1); | ||
119 | int num_totty; | ||
120 | |||
121 | while (ptr < end) { | ||
122 | if (*ptr != IAC) { | ||
123 | char c = *ptr; | ||
124 | |||
125 | *totty++ = c; | ||
126 | ptr++; | ||
127 | /* We map \r\n ==> \r for pragmatic reasons. | ||
128 | * Many client implementations send \r\n when | ||
129 | * the user hits the CarriageReturn key. | ||
130 | * See RFC 1123 3.3.1 Telnet End-of-Line Convention. | ||
131 | */ | ||
132 | if (c == '\r' && ptr < end && (*ptr == '\n' || *ptr == '\0')) | ||
133 | ptr++; | ||
134 | continue; | ||
135 | } | ||
136 | 153 | ||
137 | if ((ptr+1) >= end) | 154 | if (buf[1] == NOP) { /* NOP. Ignore (putty keepalive, etc) */ |
138 | break; | 155 | rc = 2; |
139 | if (ptr[1] == NOP) { /* Ignore? (putty keepalive, etc.) */ | 156 | goto update_and_return; |
140 | ptr += 2; | 157 | } |
141 | continue; | ||
142 | } | ||
143 | if (ptr[1] == IAC) { /* Literal IAC? (emacs M-DEL) */ | ||
144 | *totty++ = ptr[1]; | ||
145 | ptr += 2; | ||
146 | continue; | ||
147 | } | ||
148 | 158 | ||
149 | /* | 159 | if (wr <= 2) { |
150 | * TELOPT_NAWS support! | 160 | rc = 2; |
151 | */ | 161 | goto update_and_return; |
152 | if ((ptr+2) >= end) { | 162 | } |
153 | /* Only the beginning of the IAC is in the | 163 | |
154 | buffer we were asked to process, we can't | 164 | /* TELOPT_NAWS support */ |
155 | process this char */ | 165 | /* IAC, SB, TELOPT_NAWS, 4-byte, IAC, SE */ |
156 | break; | 166 | if (buf[1] == SB && buf[2] == TELOPT_NAWS) { |
157 | } | 167 | struct winsize ws; |
158 | /* | 168 | if (wr <= 8) { |
159 | * IAC -> SB -> TELOPT_NAWS -> 4-byte -> IAC -> SE | 169 | rc = wr; /* incomplete, can't process */ |
160 | */ | 170 | goto update_and_return; |
161 | if (ptr[1] == SB && ptr[2] == TELOPT_NAWS) { | ||
162 | struct winsize ws; | ||
163 | if ((ptr+8) >= end) | ||
164 | break; /* incomplete, can't process */ | ||
165 | ws.ws_col = (ptr[3] << 8) | ptr[4]; | ||
166 | ws.ws_row = (ptr[5] << 8) | ptr[6]; | ||
167 | ioctl(ts->ptyfd, TIOCSWINSZ, (char *)&ws); | ||
168 | ptr += 9; | ||
169 | continue; | ||
170 | } | 171 | } |
171 | /* skip 3-byte IAC non-SB cmd */ | 172 | memset(&ws, 0, sizeof(ws)); |
173 | ws.ws_col = (buf[3] << 8) | buf[4]; | ||
174 | ws.ws_row = (buf[5] << 8) | buf[6]; | ||
175 | ioctl(ts->ptyfd, TIOCSWINSZ, (char *)&ws); | ||
176 | rc = 9; | ||
177 | goto update_and_return; | ||
178 | } | ||
179 | /* Skip 3-byte IAC non-SB cmds */ | ||
172 | #if DEBUG | 180 | #if DEBUG |
173 | fprintf(stderr, "Ignoring IAC %s,%s\n", | 181 | fprintf(stderr, "Ignoring IAC %s,%s\n", |
174 | TELCMD(ptr[1]), TELOPT(ptr[2])); | 182 | TELCMD(buf[1]), TELOPT(buf[2])); |
175 | #endif | 183 | #endif |
176 | ptr += 3; | 184 | rc = 3; |
185 | |||
186 | update_and_return: | ||
187 | ts->wridx1 += rc; | ||
188 | if (ts->wridx1 >= BUFSIZE) /* actually == BUFSIZE */ | ||
189 | ts->wridx1 = 0; | ||
190 | ts->size1 -= rc; | ||
191 | /* | ||
192 | * Hack. We cannot process iacs which wrap around buffer's end. | ||
193 | * Since properly fixing it requires writing bigger code, | ||
194 | * we rely instead on this code making it virtually impossible | ||
195 | * to have wrapped iac (people don't type at 2k/second). | ||
196 | * It also allows for bigger reads in common case. | ||
197 | */ | ||
198 | if (ts->size1 == 0) { /* very typical */ | ||
199 | //bb_error_msg("zero size1"); | ||
200 | ts->rdidx1 = 0; | ||
201 | ts->wridx1 = 0; | ||
202 | return rc; | ||
177 | } | 203 | } |
178 | 204 | wr = ts->wridx1; | |
179 | num_totty = totty - ptr0; | 205 | if (wr != 0 && wr < ts->rdidx1) { |
180 | *pnum_totty = num_totty; | 206 | /* Buffer is not wrapped yet. |
181 | /* The difference between ptr and totty is number of iacs | 207 | * We can easily move it to the beginning. |
182 | we removed from the stream. Adjust buf1 accordingly */ | 208 | */ |
183 | if ((ptr - totty) == 0) /* 99.999% of cases */ | 209 | //bb_error_msg("moved %d", wr); |
184 | return ptr0; | 210 | memmove(TS_BUF1(ts), TS_BUF1(ts) + wr, ts->size1); |
185 | ts->wridx1 += ptr - totty; | 211 | ts->rdidx1 -= wr; |
186 | ts->size1 -= ptr - totty; | 212 | ts->wridx1 = 0; |
187 | /* Move chars meant for the terminal towards the end of the buffer */ | 213 | } |
188 | return memmove(ptr - num_totty, ptr0, num_totty); | 214 | return rc; |
189 | } | 215 | } |
190 | 216 | ||
191 | /* | 217 | /* |
192 | * Converting single IAC into double on output | 218 | * Converting single IAC into double on output |
193 | */ | 219 | */ |
194 | static size_t iac_safe_write(int fd, const char *buf, size_t count) | 220 | static size_t safe_write_double_iac(int fd, const char *buf, size_t count) |
195 | { | 221 | { |
196 | const char *IACptr; | 222 | const char *IACptr; |
197 | size_t wr, rc, total; | 223 | size_t wr, rc, total; |
@@ -298,7 +324,7 @@ make_new_session( | |||
298 | IAC, WILL, TELOPT_ECHO, | 324 | IAC, WILL, TELOPT_ECHO, |
299 | IAC, WILL, TELOPT_SGA | 325 | IAC, WILL, TELOPT_SGA |
300 | }; | 326 | }; |
301 | /* This confuses iac_safe_write(), it will try to duplicate | 327 | /* This confuses safe_write_double_iac(), it will try to duplicate |
302 | * each IAC... */ | 328 | * each IAC... */ |
303 | //memcpy(TS_BUF2(ts), iacs_to_send, sizeof(iacs_to_send)); | 329 | //memcpy(TS_BUF2(ts), iacs_to_send, sizeof(iacs_to_send)); |
304 | //ts->rdidx2 = sizeof(iacs_to_send); | 330 | //ts->rdidx2 = sizeof(iacs_to_send); |
@@ -649,51 +675,34 @@ int telnetd_main(int argc UNUSED_PARAM, char **argv) | |||
649 | struct tsession *next = ts->next; /* in case we free ts */ | 675 | struct tsession *next = ts->next; /* in case we free ts */ |
650 | 676 | ||
651 | if (/*ts->size1 &&*/ FD_ISSET(ts->ptyfd, &wrfdset)) { | 677 | if (/*ts->size1 &&*/ FD_ISSET(ts->ptyfd, &wrfdset)) { |
652 | int num_totty; | ||
653 | unsigned char *ptr; | ||
654 | /* Write to pty from buffer 1 */ | 678 | /* Write to pty from buffer 1 */ |
655 | ptr = remove_iacs(ts, &num_totty); | 679 | count = safe_write_to_pty_decode_iac(ts); |
656 | count = safe_write(ts->ptyfd, ptr, num_totty); | ||
657 | if (count < 0) { | 680 | if (count < 0) { |
658 | if (errno == EAGAIN) | 681 | if (errno == EAGAIN) |
659 | goto skip1; | 682 | goto skip1; |
660 | goto kill_session; | 683 | goto kill_session; |
661 | } | 684 | } |
662 | ts->size1 -= count; | ||
663 | ts->wridx1 += count; | ||
664 | if (ts->wridx1 >= BUFSIZE) /* actually == BUFSIZE */ | ||
665 | ts->wridx1 = 0; | ||
666 | } | 685 | } |
667 | skip1: | 686 | skip1: |
668 | if (/*ts->size2 &&*/ FD_ISSET(ts->sockfd_write, &wrfdset)) { | 687 | if (/*ts->size2 &&*/ FD_ISSET(ts->sockfd_write, &wrfdset)) { |
669 | /* Write to socket from buffer 2 */ | 688 | /* Write to socket from buffer 2 */ |
670 | count = MIN(BUFSIZE - ts->wridx2, ts->size2); | 689 | count = MIN(BUFSIZE - ts->wridx2, ts->size2); |
671 | count = iac_safe_write(ts->sockfd_write, (void*)(TS_BUF2(ts) + ts->wridx2), count); | 690 | count = safe_write_double_iac(ts->sockfd_write, (void*)(TS_BUF2(ts) + ts->wridx2), count); |
672 | if (count < 0) { | 691 | if (count < 0) { |
673 | if (errno == EAGAIN) | 692 | if (errno == EAGAIN) |
674 | goto skip2; | 693 | goto skip2; |
675 | goto kill_session; | 694 | goto kill_session; |
676 | } | 695 | } |
677 | ts->size2 -= count; | ||
678 | ts->wridx2 += count; | 696 | ts->wridx2 += count; |
679 | if (ts->wridx2 >= BUFSIZE) /* actually == BUFSIZE */ | 697 | if (ts->wridx2 >= BUFSIZE) /* actually == BUFSIZE */ |
680 | ts->wridx2 = 0; | 698 | ts->wridx2 = 0; |
699 | ts->size2 -= count; | ||
700 | if (ts->size2 == 0) { | ||
701 | ts->rdidx2 = 0; | ||
702 | ts->wridx2 = 0; | ||
703 | } | ||
681 | } | 704 | } |
682 | skip2: | 705 | skip2: |
683 | /* Should not be needed, but... remove_iacs is actually buggy | ||
684 | * (it cannot process iacs which wrap around buffer's end)! | ||
685 | * Since properly fixing it requires writing bigger code, | ||
686 | * we rely instead on this code making it virtually impossible | ||
687 | * to have wrapped iac (people don't type at 2k/second). | ||
688 | * It also allows for bigger reads in common case. */ | ||
689 | if (ts->size1 == 0) { | ||
690 | ts->rdidx1 = 0; | ||
691 | ts->wridx1 = 0; | ||
692 | } | ||
693 | if (ts->size2 == 0) { | ||
694 | ts->rdidx2 = 0; | ||
695 | ts->wridx2 = 0; | ||
696 | } | ||
697 | 706 | ||
698 | if (/*ts->size1 < BUFSIZE &&*/ FD_ISSET(ts->sockfd_read, &rdfdset)) { | 707 | if (/*ts->size1 < BUFSIZE &&*/ FD_ISSET(ts->sockfd_read, &rdfdset)) { |
699 | /* Read from socket to buffer 1 */ | 708 | /* Read from socket to buffer 1 */ |