rsh: reject an invalid RSH_PORT

A garbage or out-of-range port silently fell back to 22 and connected
to the wrong place; fail loud instead.

1 files changed, 19 insertions, 8 deletions

diff --git a/rsh/main.go b/rsh/main.go
index 0204a6b..dfcea0b 100644
--- a/rsh/main.go
+++ b/rsh/main.go
@@ -120,6 +120,10 @@ func scan(target string, out io.Writer) error {
 	if user == "" {
 		return errors.New("scan target must be USER@HOST")
 	}
+	port, err := sshPort()
+	if err != nil {
+		return err
+	}
 	var hostKey ssh.PublicKey
 	capture := func(_ string, _ net.Addr, key ssh.PublicKey) error {
 		hostKey = key
@@ -131,7 +135,7 @@ func scan(target string, out io.Writer) error {
 	}
 	client.Close()
 
-	addr := knownhosts.Normalize(net.JoinHostPort(host, strconv.Itoa(sshPort())))
+	addr := knownhosts.Normalize(net.JoinHostPort(host, strconv.Itoa(port)))
 	line := knownhosts.Line([]string{addr}, hostKey)
 	fmt.Fprintf(out, "%s\n%s\n", ssh.FingerprintSHA256(hostKey), line)
 	return nil
@@ -188,13 +192,17 @@ func dial(user, host string, hostKey ssh.HostKeyCallback) (*ssh.Client, error) {
 	if err != nil {
 		return nil, err
 	}
+	port, err := sshPort()
+	if err != nil {
+		return nil, err
+	}
 	cfg := &ssh.ClientConfig{
 		User:            user,
 		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
 		HostKeyCallback: hostKey,
 		Timeout:         dialTimeout,
 	}
-	addr := net.JoinHostPort(host, strconv.Itoa(sshPort()))
+	addr := net.JoinHostPort(host, strconv.Itoa(port))
 	return ssh.Dial("tcp", addr, cfg)
 }
 
@@ -239,13 +247,16 @@ func splitUserHost(s string) (user, host string) {
 	return "", s
 }
 
-func sshPort() int {
-	if s := os.Getenv("RSH_PORT"); s != "" {
-		if p, err := strconv.Atoi(s); err == nil && p > 0 {
-			return p
-		}
+func sshPort() (int, error) {
+	s := os.Getenv("RSH_PORT")
+	if s == "" {
+		return 22, nil
+	}
+	p, err := strconv.Atoi(s)
+	if err != nil || p < 1 || p > 65535 {
+		return 0, fmt.Errorf("invalid RSH_PORT %q", s)
 	}
-	return 22
+	return p, nil
 }
 
 // keepAlive pings the server so a long transfer is not dropped by an idle NAT.