[openssh.git] / auth-options.c

/*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 *                    All rights reserved
 * As far as I am concerned, the code I have written for this software
 * can be used freely for any purpose.  Any derived versions of this
 * software must be clearly marked as such, and if the derived work is
 * incompatible with the protocol description in the RFC file, it must be
 * called by a name other than "ssh" or "Secure Shell".
 */

#include "includes.h"
RCSID("$OpenBSD: auth-options.c,v 1.23 2002/03/19 10:35:39 markus Exp $");

#include "packet.h"
#include "xmalloc.h"
#include "match.h"
#include "log.h"
#include "canohost.h"
#include "channels.h"
#include "auth-options.h"
#include "servconf.h"
#include "bufaux.h"
#include "misc.h"
#include "monitor_wrap.h"

/* Debugging messages */
Buffer auth_debug;
int auth_debug_init;

/* Flags set authorized_keys flags */
int no_port_forwarding_flag = 0;
int no_agent_forwarding_flag = 0;
int no_x11_forwarding_flag = 0;
int no_pty_flag = 0;

/* "command=" option. */
char *forced_command = NULL;

/* "environment=" options. */
struct envstring *custom_environment = NULL;

extern ServerOptions options;

static void
auth_send_debug(Buffer *m)
{
	char *msg;

	while (buffer_len(m)) {
		msg = buffer_get_string(m, NULL);
		packet_send_debug("%s", msg);
		xfree(msg);
	}
}

void
auth_clear_options(void)
{
	if (auth_debug_init)
		buffer_clear(&auth_debug);
	else {
		buffer_init(&auth_debug);
		auth_debug_init = 1;
	}

	no_agent_forwarding_flag = 0;
	no_port_forwarding_flag = 0;
	no_pty_flag = 0;
	no_x11_forwarding_flag = 0;
	while (custom_environment) {
		struct envstring *ce = custom_environment;
		custom_environment = ce->next;
		xfree(ce->s);
		xfree(ce);
	}
	if (forced_command) {
		xfree(forced_command);
		forced_command = NULL;
	}
	channel_clear_permitted_opens();
}

/*
 * return 1 if access is granted, 0 if not.
 * side effect: sets key option flags
 */
int
auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
{
	char tmp[1024];
	const char *cp;
	int i;

	/* reset options */
	auth_clear_options();

	if (!opts)
		return 1;

	while (*opts && *opts != ' ' && *opts != '\t') {
		cp = "no-port-forwarding";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			snprintf(tmp, sizeof(tmp), "Port forwarding disabled.");
			buffer_put_cstring(&auth_debug, tmp);
			no_port_forwarding_flag = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "no-agent-forwarding";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			snprintf(tmp, sizeof(tmp), "Agent forwarding disabled.");
			buffer_put_cstring(&auth_debug, tmp);
			no_agent_forwarding_flag = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "no-X11-forwarding";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			snprintf(tmp, sizeof(tmp), "X11 forwarding disabled.");
			buffer_put_cstring(&auth_debug, tmp);
			no_x11_forwarding_flag = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "no-pty";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			snprintf(tmp, sizeof(tmp), "Pty allocation disabled.");
			buffer_put_cstring(&auth_debug, tmp);
			no_pty_flag = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "command=\"";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			opts += strlen(cp);
			forced_command = xmalloc(strlen(opts) + 1);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				if (*opts == '\\' && opts[1] == '"') {
					opts += 2;
					forced_command[i++] = '"';
					continue;
				}
				forced_command[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				snprintf(tmp, sizeof(tmp), "%.100s, line %lu: missing end quote",
				    file, linenum);
				buffer_put_cstring(&auth_debug, tmp);
				xfree(forced_command);
				forced_command = NULL;
				goto bad_option;
			}
			forced_command[i] = 0;
			snprintf(tmp, sizeof(tmp), "Forced command: %.900s", forced_command);
			buffer_put_cstring(&auth_debug, tmp);
			opts++;
			goto next_option;
		}
		cp = "environment=\"";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			char *s;
			struct envstring *new_envstring;

			opts += strlen(cp);
			s = xmalloc(strlen(opts) + 1);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				if (*opts == '\\' && opts[1] == '"') {
					opts += 2;
					s[i++] = '"';
					continue;
				}
				s[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				snprintf(tmp, sizeof(tmp), "%.100s, line %lu: missing end quote",
				    file, linenum);
				buffer_put_cstring(&auth_debug, tmp);
				xfree(s);
				goto bad_option;
			}
			s[i] = 0;
			snprintf(tmp, sizeof(tmp), "Adding to environment: %.900s", s);
			buffer_put_cstring(&auth_debug, tmp);
			debug("Adding to environment: %.900s", s);
			opts++;
			new_envstring = xmalloc(sizeof(struct envstring));
			new_envstring->s = s;
			new_envstring->next = custom_environment;
			custom_environment = new_envstring;
			goto next_option;
		}
		cp = "from=\"";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			const char *remote_ip = get_remote_ipaddr();
			const char *remote_host = get_canonical_hostname(
			    options.verify_reverse_mapping);
			char *patterns = xmalloc(strlen(opts) + 1);

			opts += strlen(cp);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				if (*opts == '\\' && opts[1] == '"') {
					opts += 2;
					patterns[i++] = '"';
					continue;
				}
				patterns[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				snprintf(tmp, sizeof(tmp), "%.100s, line %lu: missing end quote",
				    file, linenum);
				buffer_put_cstring(&auth_debug, tmp);
				xfree(patterns);
				goto bad_option;
			}
			patterns[i] = 0;
			opts++;
			if (match_host_and_ip(remote_host, remote_ip,
			    patterns) != 1) {
				xfree(patterns);
				log("Authentication tried for %.100s with "
				    "correct key but not from a permitted "
				    "host (host=%.200s, ip=%.200s).",
				    pw->pw_name, remote_host, remote_ip);
				snprintf(tmp, sizeof(tmp),
				    "Your host '%.200s' is not "
				    "permitted to use this key for login.",
				    remote_host);
				buffer_put_cstring(&auth_debug, tmp);
				/* deny access */
				return 0;
			}
			xfree(patterns);
			/* Host name matches. */
			goto next_option;
		}
		cp = "permitopen=\"";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			char host[256], sport[6];
			u_short port;
			char *patterns = xmalloc(strlen(opts) + 1);

			opts += strlen(cp);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				if (*opts == '\\' && opts[1] == '"') {
					opts += 2;
					patterns[i++] = '"';
					continue;
				}
				patterns[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				snprintf(tmp, sizeof(tmp), "%.100s, line %lu: missing end quote",
				    file, linenum);
				buffer_put_cstring(&auth_debug, tmp);
				xfree(patterns);
				goto bad_option;
			}
			patterns[i] = 0;
			opts++;
			if (sscanf(patterns, "%255[^:]:%5[0-9]", host, sport) != 2 &&
			    sscanf(patterns, "%255[^/]/%5[0-9]", host, sport) != 2) {
				debug("%.100s, line %lu: Bad permitopen specification "
				    "<%.100s>", file, linenum, patterns);
				snprintf(tmp, sizeof(tmp), "%.100s, line %lu: "
				    "Bad permitopen specification", file, linenum);
				buffer_put_cstring(&auth_debug, tmp);
				xfree(patterns);
				goto bad_option;
			}
			if ((port = a2port(sport)) == 0) {
				debug("%.100s, line %lu: Bad permitopen port <%.100s>",
				    file, linenum, sport);
				snprintf(tmp, sizeof(tmp), "%.100s, line %lu: "
				    "Bad permitopen port", file, linenum);
				buffer_put_cstring(&auth_debug, tmp);
				xfree(patterns);
				goto bad_option;
			}
			if (options.allow_tcp_forwarding)
				channel_add_permitted_opens(host, port);
			xfree(patterns);
			goto next_option;
		}
next_option:
		/*
		 * Skip the comma, and move to the next option
		 * (or break out if there are no more).
		 */
		if (!*opts)
			fatal("Bugs in auth-options.c option processing.");
		if (*opts == ' ' || *opts == '\t')
			break;		/* End of options. */
		if (*opts != ',')
			goto bad_option;
		opts++;
		/* Process the next option. */
	}

	if (!use_privsep)
		auth_send_debug(&auth_debug);

	/* grant access */
	return 1;

bad_option:
	log("Bad options in %.100s file, line %lu: %.50s",
	    file, linenum, opts);
	snprintf(tmp, sizeof(tmp),
	    "Bad options in %.100s file, line %lu: %.50s",
	    file, linenum, opts);
	buffer_put_cstring(&auth_debug, tmp);

	if (!use_privsep)
		auth_send_debug(&auth_debug);

	/* deny access */
	return 0;
}
Commit	Line	Data
bcbf86ec	1	/*
	2	* Author: Tatu Ylonen <ylo@cs.hut.fi>
	3	* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
	4	* All rights reserved
bcbf86ec	5	* As far as I am concerned, the code I have written for this software
	6	* can be used freely for any purpose. Any derived versions of this
	7	* software must be clearly marked as such, and if the derived work is
	8	* incompatible with the protocol description in the RFC file, it must be
	9	* called by a name other than "ssh" or "Secure Shell".
	10	*/
	11
38c295d6	12	#include "includes.h"
51aeb639	13	RCSID("$OpenBSD: auth-options.c,v 1.23 2002/03/19 10:35:39 markus Exp $");
38c295d6	14
38c295d6	15	#include "packet.h"
	16	#include "xmalloc.h"
	17	#include "match.h"
42f11eb2	18	#include "log.h"
42f11eb2	19	#include "canohost.h"
a5efa1bb	20	#include "channels.h"
42f11eb2	21	#include "auth-options.h"
61e96248	22	#include "servconf.h"
1853d1ef	23	#include "bufaux.h"
ed787d14	24	#include "misc.h"
1853d1ef	25	#include "monitor_wrap.h"
	26
	27	/* Debugging messages */
	28	Buffer auth_debug;
	29	int auth_debug_init;
38c295d6	30
	31	/* Flags set authorized_keys flags */
	32	int no_port_forwarding_flag = 0;
	33	int no_agent_forwarding_flag = 0;
	34	int no_x11_forwarding_flag = 0;
	35	int no_pty_flag = 0;
	36
	37	/* "command=" option. */
	38	char *forced_command = NULL;
	39
	40	/* "environment=" options. */
	41	struct envstring *custom_environment = NULL;
	42
61e96248	43	extern ServerOptions options;
61e96248	44
51aeb639	45	static void
1853d1ef	46	auth_send_debug(Buffer *m)
	47	{
	48	char *msg;
	49
	50	while (buffer_len(m)) {
	51	msg = buffer_get_string(m, NULL);
	52	packet_send_debug("%s", msg);
	53	xfree(msg);
	54	}
	55	}
	56
94ec8c6b	57	void
	58	auth_clear_options(void)
	59	{
1853d1ef	60	if (auth_debug_init)
	61	buffer_clear(&auth_debug);
	62	else {
	63	buffer_init(&auth_debug);
	64	auth_debug_init = 1;
	65	}
	66
94ec8c6b	67	no_agent_forwarding_flag = 0;
	68	no_port_forwarding_flag = 0;
	69	no_pty_flag = 0;
	70	no_x11_forwarding_flag = 0;
	71	while (custom_environment) {
	72	struct envstring *ce = custom_environment;
	73	custom_environment = ce->next;
	74	xfree(ce->s);
	75	xfree(ce);
	76	}
	77	if (forced_command) {
	78	xfree(forced_command);
	79	forced_command = NULL;
	80	}
01794848	81	channel_clear_permitted_opens();
94ec8c6b	82	}
94ec8c6b	83
42f11eb2	84	/*
	85	* return 1 if access is granted, 0 if not.
	86	* side effect: sets key option flags
	87	*/
38c295d6	88	int
61e96248	89	auth_parse_options(struct passwd pw, char opts, char *file, u_long linenum)
38c295d6	90	{
1853d1ef	91	char tmp[1024];
38c295d6	92	const char *cp;
01794848	93	int i;
94ec8c6b	94
	95	/* reset options */
	96	auth_clear_options();
	97
e0b2cf6b	98	if (!opts)
	99	return 1;
	100
61e96248	101	while (opts && opts != ' ' && *opts != '\t') {
38c295d6	102	cp = "no-port-forwarding";
61e96248	103	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
1853d1ef	104	snprintf(tmp, sizeof(tmp), "Port forwarding disabled.");
1853d1ef	105	buffer_put_cstring(&auth_debug, tmp);
38c295d6	106	no_port_forwarding_flag = 1;
61e96248	107	opts += strlen(cp);
38c295d6	108	goto next_option;
	109	}
	110	cp = "no-agent-forwarding";
61e96248	111	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
1853d1ef	112	snprintf(tmp, sizeof(tmp), "Agent forwarding disabled.");
1853d1ef	113	buffer_put_cstring(&auth_debug, tmp);
38c295d6	114	no_agent_forwarding_flag = 1;
61e96248	115	opts += strlen(cp);
38c295d6	116	goto next_option;
	117	}
	118	cp = "no-X11-forwarding";
61e96248	119	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
1853d1ef	120	snprintf(tmp, sizeof(tmp), "X11 forwarding disabled.");
1853d1ef	121	buffer_put_cstring(&auth_debug, tmp);
38c295d6	122	no_x11_forwarding_flag = 1;
61e96248	123	opts += strlen(cp);
38c295d6	124	goto next_option;
	125	}
	126	cp = "no-pty";
61e96248	127	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
1853d1ef	128	snprintf(tmp, sizeof(tmp), "Pty allocation disabled.");
1853d1ef	129	buffer_put_cstring(&auth_debug, tmp);
38c295d6	130	no_pty_flag = 1;
61e96248	131	opts += strlen(cp);
38c295d6	132	goto next_option;
	133	}
	134	cp = "command=\"";
61e96248	135	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
61e96248	136	opts += strlen(cp);
61e96248	137	forced_command = xmalloc(strlen(opts) + 1);
38c295d6	138	i = 0;
61e96248	139	while (*opts) {
61e96248	140	if (*opts == '"')
38c295d6	141	break;
61e96248	142	if (*opts == '\\' && opts[1] == '"') {
61e96248	143	opts += 2;
38c295d6	144	forced_command[i++] = '"';
	145	continue;
	146	}
61e96248	147	forced_command[i++] = *opts++;
38c295d6	148	}
61e96248	149	if (!*opts) {
38c295d6	150	debug("%.100s, line %lu: missing end quote",
42f11eb2	151	file, linenum);
1853d1ef	152	snprintf(tmp, sizeof(tmp), "%.100s, line %lu: missing end quote",
42f11eb2	153	file, linenum);
1853d1ef	154	buffer_put_cstring(&auth_debug, tmp);
acc9d6d7	155	xfree(forced_command);
	156	forced_command = NULL;
	157	goto bad_option;
38c295d6	158	}
38c295d6	159	forced_command[i] = 0;
1853d1ef	160	snprintf(tmp, sizeof(tmp), "Forced command: %.900s", forced_command);
1853d1ef	161	buffer_put_cstring(&auth_debug, tmp);
61e96248	162	opts++;
38c295d6	163	goto next_option;
	164	}
	165	cp = "environment=\"";
61e96248	166	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
38c295d6	167	char *s;
38c295d6	168	struct envstring *new_envstring;
01794848	169
61e96248	170	opts += strlen(cp);
61e96248	171	s = xmalloc(strlen(opts) + 1);
38c295d6	172	i = 0;
61e96248	173	while (*opts) {
61e96248	174	if (*opts == '"')
38c295d6	175	break;
61e96248	176	if (*opts == '\\' && opts[1] == '"') {
61e96248	177	opts += 2;
38c295d6	178	s[i++] = '"';
	179	continue;
	180	}
61e96248	181	s[i++] = *opts++;
38c295d6	182	}
61e96248	183	if (!*opts) {
38c295d6	184	debug("%.100s, line %lu: missing end quote",
42f11eb2	185	file, linenum);
1853d1ef	186	snprintf(tmp, sizeof(tmp), "%.100s, line %lu: missing end quote",
42f11eb2	187	file, linenum);
1853d1ef	188	buffer_put_cstring(&auth_debug, tmp);
acc9d6d7	189	xfree(s);
acc9d6d7	190	goto bad_option;
38c295d6	191	}
38c295d6	192	s[i] = 0;
1853d1ef	193	snprintf(tmp, sizeof(tmp), "Adding to environment: %.900s", s);
1853d1ef	194	buffer_put_cstring(&auth_debug, tmp);
38c295d6	195	debug("Adding to environment: %.900s", s);
61e96248	196	opts++;
38c295d6	197	new_envstring = xmalloc(sizeof(struct envstring));
	198	new_envstring->s = s;
	199	new_envstring->next = custom_environment;
	200	custom_environment = new_envstring;
	201	goto next_option;
	202	}
	203	cp = "from=\"";
61e96248	204	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
61e96248	205	const char *remote_ip = get_remote_ipaddr();
61e96248	206	const char *remote_host = get_canonical_hostname(
bf4c5edc	207	options.verify_reverse_mapping);
61e96248	208	char *patterns = xmalloc(strlen(opts) + 1);
01794848	209
61e96248	210	opts += strlen(cp);
38c295d6	211	i = 0;
61e96248	212	while (*opts) {
61e96248	213	if (*opts == '"')
38c295d6	214	break;
61e96248	215	if (*opts == '\\' && opts[1] == '"') {
61e96248	216	opts += 2;
38c295d6	217	patterns[i++] = '"';
	218	continue;
	219	}
61e96248	220	patterns[i++] = *opts++;
38c295d6	221	}
61e96248	222	if (!*opts) {
38c295d6	223	debug("%.100s, line %lu: missing end quote",
42f11eb2	224	file, linenum);
1853d1ef	225	snprintf(tmp, sizeof(tmp), "%.100s, line %lu: missing end quote",
42f11eb2	226	file, linenum);
1853d1ef	227	buffer_put_cstring(&auth_debug, tmp);
acc9d6d7	228	xfree(patterns);
acc9d6d7	229	goto bad_option;
38c295d6	230	}
38c295d6	231	patterns[i] = 0;
61e96248	232	opts++;
2cee8a25	233	if (match_host_and_ip(remote_host, remote_ip,
	234	patterns) != 1) {
	235	xfree(patterns);
61e96248	236	log("Authentication tried for %.100s with "
	237	"correct key but not from a permitted "
	238	"host (host=%.200s, ip=%.200s).",
	239	pw->pw_name, remote_host, remote_ip);
1853d1ef	240	snprintf(tmp, sizeof(tmp),
1853d1ef	241	"Your host '%.200s' is not "
61e96248	242	"permitted to use this key for login.",
61e96248	243	remote_host);
1853d1ef	244	buffer_put_cstring(&auth_debug, tmp);
38c295d6	245	/* deny access */
	246	return 0;
	247	}
2cee8a25	248	xfree(patterns);
38c295d6	249	/* Host name matches. */
	250	goto next_option;
	251	}
01794848	252	cp = "permitopen=\"";
01794848	253	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
ed787d14	254	char host[256], sport[6];
01794848	255	u_short port;
01794848	256	char *patterns = xmalloc(strlen(opts) + 1);
	257
	258	opts += strlen(cp);
	259	i = 0;
	260	while (*opts) {
	261	if (*opts == '"')
	262	break;
	263	if (*opts == '\\' && opts[1] == '"') {
	264	opts += 2;
	265	patterns[i++] = '"';
	266	continue;
	267	}
	268	patterns[i++] = *opts++;
	269	}
	270	if (!*opts) {
	271	debug("%.100s, line %lu: missing end quote",
	272	file, linenum);
1853d1ef	273	snprintf(tmp, sizeof(tmp), "%.100s, line %lu: missing end quote",
01794848	274	file, linenum);
1853d1ef	275	buffer_put_cstring(&auth_debug, tmp);
01794848	276	xfree(patterns);
	277	goto bad_option;
	278	}
	279	patterns[i] = 0;
	280	opts++;
ed787d14	281	if (sscanf(patterns, "%255[^:]:%5[0-9]", host, sport) != 2 &&
	282	sscanf(patterns, "%255[^/]/%5[0-9]", host, sport) != 2) {
	283	debug("%.100s, line %lu: Bad permitopen specification "
	284	"<%.100s>", file, linenum, patterns);
1853d1ef	285	snprintf(tmp, sizeof(tmp), "%.100s, line %lu: "
ed787d14	286	"Bad permitopen specification", file, linenum);
1853d1ef	287	buffer_put_cstring(&auth_debug, tmp);
01794848	288	xfree(patterns);
	289	goto bad_option;
	290	}
ed787d14	291	if ((port = a2port(sport)) == 0) {
	292	debug("%.100s, line %lu: Bad permitopen port <%.100s>",
	293	file, linenum, sport);
1853d1ef	294	snprintf(tmp, sizeof(tmp), "%.100s, line %lu: "
ed787d14	295	"Bad permitopen port", file, linenum);
1853d1ef	296	buffer_put_cstring(&auth_debug, tmp);
01794848	297	xfree(patterns);
	298	goto bad_option;
	299	}
b1ed8313	300	if (options.allow_tcp_forwarding)
ed787d14	301	channel_add_permitted_opens(host, port);
01794848	302	xfree(patterns);
	303	goto next_option;
	304	}
38c295d6	305	next_option:
	306	/*
	307	* Skip the comma, and move to the next option
	308	* (or break out if there are no more).
	309	*/
61e96248	310	if (!*opts)
38c295d6	311	fatal("Bugs in auth-options.c option processing.");
61e96248	312	if (opts == ' ' \|\| opts == '\t')
38c295d6	313	break; /* End of options. */
61e96248	314	if (*opts != ',')
38c295d6	315	goto bad_option;
61e96248	316	opts++;
38c295d6	317	/* Process the next option. */
38c295d6	318	}
1853d1ef	319
	320	if (!use_privsep)
	321	auth_send_debug(&auth_debug);
	322
38c295d6	323	/* grant access */
	324	return 1;
	325
	326	bad_option:
	327	log("Bad options in %.100s file, line %lu: %.50s",
61e96248	328	file, linenum, opts);
1853d1ef	329	snprintf(tmp, sizeof(tmp),
1853d1ef	330	"Bad options in %.100s file, line %lu: %.50s",
61e96248	331	file, linenum, opts);
1853d1ef	332	buffer_put_cstring(&auth_debug, tmp);
	333
	334	if (!use_privsep)
	335	auth_send_debug(&auth_debug);
	336
38c295d6	337	/* deny access */
	338	return 0;
	339	}