3 # Copyright (c) 2009,2010 Peter Palfrader
5 # Permission is hereby granted, free of charge, to any person obtaining
6 # a copy of this software and associated documentation files (the
7 # "Software"), to deal in the Software without restriction, including
8 # without limitation the rights to use, copy, modify, merge, publish,
9 # distribute, sublicense, and/or sell copies of the Software, and to
10 # permit persons to whom the Software is furnished to do so, subject to
11 # the following conditions:
13 # The above copyright notice and this permission notice shall be
14 # included in all copies or substantial portions of the Software.
16 # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
17 # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
18 # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
19 # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
20 # LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
21 # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
22 # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
28 MYLOGNAME="`basename "$0"`[$$]"
31 echo "local Usage: $0 <source-host> <local-bind> <allowed-port> [<allowed-port> ...]"
32 echo "via ssh orig command : forward-to <port>"
35 logger -s -p daemon.warn -t "$MYLOGNAME" "$1"
40 if [ -z "${SSH_ORIGINAL_COMMAND:-}" ] ; then
41 echo "Did not find SSH_ORIGINAL_COMMAND" 2>&1
46 if [ "${1-}" = "-h" ] || [ "${1-}" = "--help" ]; then
50 # check/parse local command line
51 if [ "$#" -le 2 ]; then
59 if [[ "$bindaddr" =~ [^0-9.] ]]; then
60 echo "Invalid bindaddr spec" >&2
65 # check/parse remote command line
66 set "dummy" ${SSH_ORIGINAL_COMMAND}
69 # check/parse local command line
70 if [ "$#" != 2 ]; then
74 if [ "$1" != "forward-to" ]; then
75 croak "Expected forward-to as command"
78 if [[ "$port" =~ [^0-9] ]]; then
79 croak "Invalid port spec"
82 for allowed in $allowed_ports ; do
83 if [ "$port" = "$allowed" ]; then
89 if [ "$ok" = "1" ]; then
90 logger -p daemon.info -t "$MYLOGNAME" "Forwarding to port $port for remote host $host"
91 exec /bin/nc -q 600 -s "$bindaddr" 127.0.0.1 "$port"
92 echo "Exec failed" >&2
95 croak "$host requested unallowed port $port"