[openssh.git] / auth-options.c

/* $OpenBSD: auth-options.c,v 1.41 2008/03/26 21:28:14 djm Exp $ */
/*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 *                    All rights reserved
 * As far as I am concerned, the code I have written for this software
 * can be used freely for any purpose.  Any derived versions of this
 * software must be clearly marked as such, and if the derived work is
 * incompatible with the protocol description in the RFC file, it must be
 * called by a name other than "ssh" or "Secure Shell".
 */

#include "includes.h"

#include <sys/types.h>

#include <netdb.h>
#include <pwd.h>
#include <string.h>
#include <stdio.h>
#include <stdarg.h>

#include "xmalloc.h"
#include "match.h"
#include "log.h"
#include "canohost.h"
#include "buffer.h"
#include "channels.h"
#include "auth-options.h"
#include "servconf.h"
#include "misc.h"
#include "key.h"
#include "hostfile.h"
#include "auth.h"
#ifdef GSSAPI
#include "ssh-gss.h"
#endif
#include "monitor_wrap.h"

/* Flags set authorized_keys flags */
int no_port_forwarding_flag = 0;
int no_agent_forwarding_flag = 0;
int no_x11_forwarding_flag = 0;
int no_pty_flag = 0;
int no_user_rc = 0;

/* "command=" option. */
char *forced_command = NULL;

/* "environment=" options. */
struct envstring *custom_environment = NULL;

/* "tunnel=" option. */
int forced_tun_device = -1;

extern ServerOptions options;

void
auth_clear_options(void)
{
	no_agent_forwarding_flag = 0;
	no_port_forwarding_flag = 0;
	no_pty_flag = 0;
	no_x11_forwarding_flag = 0;
	no_user_rc = 0;
	while (custom_environment) {
		struct envstring *ce = custom_environment;
		custom_environment = ce->next;
		xfree(ce->s);
		xfree(ce);
	}
	if (forced_command) {
		xfree(forced_command);
		forced_command = NULL;
	}
	forced_tun_device = -1;
	channel_clear_permitted_opens();
	auth_debug_reset();
}

/*
 * return 1 if access is granted, 0 if not.
 * side effect: sets key option flags
 */
int
auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
{
	const char *cp;
	int i;

	/* reset options */
	auth_clear_options();

	if (!opts)
		return 1;

	while (*opts && *opts != ' ' && *opts != '\t') {
		cp = "no-port-forwarding";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			auth_debug_add("Port forwarding disabled.");
			no_port_forwarding_flag = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "no-agent-forwarding";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			auth_debug_add("Agent forwarding disabled.");
			no_agent_forwarding_flag = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "no-X11-forwarding";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			auth_debug_add("X11 forwarding disabled.");
			no_x11_forwarding_flag = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "no-pty";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			auth_debug_add("Pty allocation disabled.");
			no_pty_flag = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "no-user-rc";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			auth_debug_add("User rc file execution disabled.");
			no_user_rc = 1;
			opts += strlen(cp);
			goto next_option;
		}
		cp = "command=\"";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			opts += strlen(cp);
			forced_command = xmalloc(strlen(opts) + 1);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				if (*opts == '\\' && opts[1] == '"') {
					opts += 2;
					forced_command[i++] = '"';
					continue;
				}
				forced_command[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				auth_debug_add("%.100s, line %lu: missing end quote",
				    file, linenum);
				xfree(forced_command);
				forced_command = NULL;
				goto bad_option;
			}
			forced_command[i] = '\0';
			auth_debug_add("Forced command: %.900s", forced_command);
			opts++;
			goto next_option;
		}
		cp = "environment=\"";
		if (options.permit_user_env &&
		    strncasecmp(opts, cp, strlen(cp)) == 0) {
			char *s;
			struct envstring *new_envstring;

			opts += strlen(cp);
			s = xmalloc(strlen(opts) + 1);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				if (*opts == '\\' && opts[1] == '"') {
					opts += 2;
					s[i++] = '"';
					continue;
				}
				s[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				auth_debug_add("%.100s, line %lu: missing end quote",
				    file, linenum);
				xfree(s);
				goto bad_option;
			}
			s[i] = '\0';
			auth_debug_add("Adding to environment: %.900s", s);
			debug("Adding to environment: %.900s", s);
			opts++;
			new_envstring = xmalloc(sizeof(struct envstring));
			new_envstring->s = s;
			new_envstring->next = custom_environment;
			custom_environment = new_envstring;
			goto next_option;
		}
		cp = "from=\"";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			const char *remote_ip = get_remote_ipaddr();
			const char *remote_host = get_canonical_hostname(
			    options.use_dns);
			char *patterns = xmalloc(strlen(opts) + 1);

			opts += strlen(cp);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				if (*opts == '\\' && opts[1] == '"') {
					opts += 2;
					patterns[i++] = '"';
					continue;
				}
				patterns[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				auth_debug_add("%.100s, line %lu: missing end quote",
				    file, linenum);
				xfree(patterns);
				goto bad_option;
			}
			patterns[i] = '\0';
			opts++;
			if (match_host_and_ip(remote_host, remote_ip,
			    patterns) != 1) {
				xfree(patterns);
				logit("Authentication tried for %.100s with "
				    "correct key but not from a permitted "
				    "host (host=%.200s, ip=%.200s).",
				    pw->pw_name, remote_host, remote_ip);
				auth_debug_add("Your host '%.200s' is not "
				    "permitted to use this key for login.",
				    remote_host);
				/* deny access */
				return 0;
			}
			xfree(patterns);
			/* Host name matches. */
			goto next_option;
		}
		cp = "permitopen=\"";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			char *host, *p;
			u_short port;
			char *patterns = xmalloc(strlen(opts) + 1);

			opts += strlen(cp);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				if (*opts == '\\' && opts[1] == '"') {
					opts += 2;
					patterns[i++] = '"';
					continue;
				}
				patterns[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				auth_debug_add("%.100s, line %lu: missing "
				    "end quote", file, linenum);
				xfree(patterns);
				goto bad_option;
			}
			patterns[i] = '\0';
			opts++;
			p = patterns;
			host = hpdelim(&p);
			if (host == NULL || strlen(host) >= NI_MAXHOST) {
				debug("%.100s, line %lu: Bad permitopen "
				    "specification <%.100s>", file, linenum,
				    patterns);
				auth_debug_add("%.100s, line %lu: "
				    "Bad permitopen specification", file,
				    linenum);
				xfree(patterns);
				goto bad_option;
			}
			host = cleanhostname(host);
			if (p == NULL || (port = a2port(p)) == 0) {
				debug("%.100s, line %lu: Bad permitopen port "
				    "<%.100s>", file, linenum, p ? p : "");
				auth_debug_add("%.100s, line %lu: "
				    "Bad permitopen port", file, linenum);
				xfree(patterns);
				goto bad_option;
			}
			if (options.allow_tcp_forwarding)
				channel_add_permitted_opens(host, port);
			xfree(patterns);
			goto next_option;
		}
		cp = "tunnel=\"";
		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
			char *tun = NULL;
			opts += strlen(cp);
			tun = xmalloc(strlen(opts) + 1);
			i = 0;
			while (*opts) {
				if (*opts == '"')
					break;
				tun[i++] = *opts++;
			}
			if (!*opts) {
				debug("%.100s, line %lu: missing end quote",
				    file, linenum);
				auth_debug_add("%.100s, line %lu: missing end quote",
				    file, linenum);
				xfree(tun);
				forced_tun_device = -1;
				goto bad_option;
			}
			tun[i] = '\0';
			forced_tun_device = a2tun(tun, NULL);
			xfree(tun);
			if (forced_tun_device == SSH_TUNID_ERR) {
				debug("%.100s, line %lu: invalid tun device",
				    file, linenum);
				auth_debug_add("%.100s, line %lu: invalid tun device",
				    file, linenum);
				forced_tun_device = -1;
				goto bad_option;
			}
			auth_debug_add("Forced tun device: %d", forced_tun_device);
			opts++;
			goto next_option;
		}
next_option:
		/*
		 * Skip the comma, and move to the next option
		 * (or break out if there are no more).
		 */
		if (!*opts)
			fatal("Bugs in auth-options.c option processing.");
		if (*opts == ' ' || *opts == '\t')
			break;		/* End of options. */
		if (*opts != ',')
			goto bad_option;
		opts++;
		/* Process the next option. */
	}

	if (!use_privsep)
		auth_debug_send();

	/* grant access */
	return 1;

bad_option:
	logit("Bad options in %.100s file, line %lu: %.50s",
	    file, linenum, opts);
	auth_debug_add("Bad options in %.100s file, line %lu: %.50s",
	    file, linenum, opts);

	if (!use_privsep)
		auth_debug_send();

	/* deny access */
	return 0;
}
Commit	Line	Data
8c03e768	1	/* $OpenBSD: auth-options.c,v 1.41 2008/03/26 21:28:14 djm Exp $ */
bcbf86ec	2	/*
	3	* Author: Tatu Ylonen <ylo@cs.hut.fi>
	4	* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
	5	* All rights reserved
bcbf86ec	6	* As far as I am concerned, the code I have written for this software
	7	* can be used freely for any purpose. Any derived versions of this
	8	* software must be clearly marked as such, and if the derived work is
	9	* incompatible with the protocol description in the RFC file, it must be
	10	* called by a name other than "ssh" or "Secure Shell".
	11	*/
	12
38c295d6	13	#include "includes.h"
38c295d6	14
b1842393	15	#include <sys/types.h>
b1842393	16
28cb0a43	17	#include <netdb.h>
b1842393	18	#include <pwd.h>
00146caa	19	#include <string.h>
31652869	20	#include <stdio.h>
31652869	21	#include <stdarg.h>
b1842393	22
38c295d6	23	#include "xmalloc.h"
38c295d6	24	#include "match.h"
42f11eb2	25	#include "log.h"
42f11eb2	26	#include "canohost.h"
31652869	27	#include "buffer.h"
a5efa1bb	28	#include "channels.h"
42f11eb2	29	#include "auth-options.h"
61e96248	30	#include "servconf.h"
ed787d14	31	#include "misc.h"
31652869	32	#include "key.h"
31652869	33	#include "hostfile.h"
01dafcb5	34	#include "auth.h"
31652869	35	#ifdef GSSAPI
	36	#include "ssh-gss.h"
	37	#endif
	38	#include "monitor_wrap.h"
38c295d6	39
	40	/* Flags set authorized_keys flags */
	41	int no_port_forwarding_flag = 0;
	42	int no_agent_forwarding_flag = 0;
	43	int no_x11_forwarding_flag = 0;
	44	int no_pty_flag = 0;
8c03e768	45	int no_user_rc = 0;
38c295d6	46
	47	/* "command=" option. */
	48	char *forced_command = NULL;
	49
	50	/* "environment=" options. */
	51	struct envstring *custom_environment = NULL;
	52
d20f3c9e	53	/* "tunnel=" option. */
	54	int forced_tun_device = -1;
	55
61e96248	56	extern ServerOptions options;
61e96248	57
94ec8c6b	58	void
	59	auth_clear_options(void)
	60	{
	61	no_agent_forwarding_flag = 0;
	62	no_port_forwarding_flag = 0;
	63	no_pty_flag = 0;
	64	no_x11_forwarding_flag = 0;
8c03e768	65	no_user_rc = 0;
94ec8c6b	66	while (custom_environment) {
	67	struct envstring *ce = custom_environment;
	68	custom_environment = ce->next;
	69	xfree(ce->s);
	70	xfree(ce);
	71	}
	72	if (forced_command) {
	73	xfree(forced_command);
	74	forced_command = NULL;
	75	}
d20f3c9e	76	forced_tun_device = -1;
01794848	77	channel_clear_permitted_opens();
01dafcb5	78	auth_debug_reset();
94ec8c6b	79	}
94ec8c6b	80
42f11eb2	81	/*
	82	* return 1 if access is granted, 0 if not.
	83	* side effect: sets key option flags
	84	*/
38c295d6	85	int
61e96248	86	auth_parse_options(struct passwd pw, char opts, char *file, u_long linenum)
38c295d6	87	{
38c295d6	88	const char *cp;
01794848	89	int i;
94ec8c6b	90
	91	/* reset options */
	92	auth_clear_options();
	93
e0b2cf6b	94	if (!opts)
	95	return 1;
	96
61e96248	97	while (opts && opts != ' ' && *opts != '\t') {
38c295d6	98	cp = "no-port-forwarding";
61e96248	99	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
01dafcb5	100	auth_debug_add("Port forwarding disabled.");
38c295d6	101	no_port_forwarding_flag = 1;
61e96248	102	opts += strlen(cp);
38c295d6	103	goto next_option;
	104	}
	105	cp = "no-agent-forwarding";
61e96248	106	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
01dafcb5	107	auth_debug_add("Agent forwarding disabled.");
38c295d6	108	no_agent_forwarding_flag = 1;
61e96248	109	opts += strlen(cp);
38c295d6	110	goto next_option;
	111	}
	112	cp = "no-X11-forwarding";
61e96248	113	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
01dafcb5	114	auth_debug_add("X11 forwarding disabled.");
38c295d6	115	no_x11_forwarding_flag = 1;
61e96248	116	opts += strlen(cp);
38c295d6	117	goto next_option;
	118	}
	119	cp = "no-pty";
61e96248	120	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
01dafcb5	121	auth_debug_add("Pty allocation disabled.");
38c295d6	122	no_pty_flag = 1;
61e96248	123	opts += strlen(cp);
38c295d6	124	goto next_option;
38c295d6	125	}
8c03e768	126	cp = "no-user-rc";
	127	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
	128	auth_debug_add("User rc file execution disabled.");
	129	no_user_rc = 1;
	130	opts += strlen(cp);
	131	goto next_option;
	132	}
38c295d6	133	cp = "command=\"";
61e96248	134	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
61e96248	135	opts += strlen(cp);
61e96248	136	forced_command = xmalloc(strlen(opts) + 1);
38c295d6	137	i = 0;
61e96248	138	while (*opts) {
61e96248	139	if (*opts == '"')
38c295d6	140	break;
61e96248	141	if (*opts == '\\' && opts[1] == '"') {
61e96248	142	opts += 2;
38c295d6	143	forced_command[i++] = '"';
	144	continue;
	145	}
61e96248	146	forced_command[i++] = *opts++;
38c295d6	147	}
61e96248	148	if (!*opts) {
38c295d6	149	debug("%.100s, line %lu: missing end quote",
42f11eb2	150	file, linenum);
01dafcb5	151	auth_debug_add("%.100s, line %lu: missing end quote",
42f11eb2	152	file, linenum);
acc9d6d7	153	xfree(forced_command);
	154	forced_command = NULL;
	155	goto bad_option;
38c295d6	156	}
774de098	157	forced_command[i] = '\0';
01dafcb5	158	auth_debug_add("Forced command: %.900s", forced_command);
61e96248	159	opts++;
38c295d6	160	goto next_option;
	161	}
	162	cp = "environment=\"";
f00bab84	163	if (options.permit_user_env &&
f00bab84	164	strncasecmp(opts, cp, strlen(cp)) == 0) {
38c295d6	165	char *s;
38c295d6	166	struct envstring *new_envstring;
01794848	167
61e96248	168	opts += strlen(cp);
61e96248	169	s = xmalloc(strlen(opts) + 1);
38c295d6	170	i = 0;
61e96248	171	while (*opts) {
61e96248	172	if (*opts == '"')
38c295d6	173	break;
61e96248	174	if (*opts == '\\' && opts[1] == '"') {
61e96248	175	opts += 2;
38c295d6	176	s[i++] = '"';
	177	continue;
	178	}
61e96248	179	s[i++] = *opts++;
38c295d6	180	}
61e96248	181	if (!*opts) {
38c295d6	182	debug("%.100s, line %lu: missing end quote",
42f11eb2	183	file, linenum);
01dafcb5	184	auth_debug_add("%.100s, line %lu: missing end quote",
42f11eb2	185	file, linenum);
acc9d6d7	186	xfree(s);
acc9d6d7	187	goto bad_option;
38c295d6	188	}
774de098	189	s[i] = '\0';
01dafcb5	190	auth_debug_add("Adding to environment: %.900s", s);
38c295d6	191	debug("Adding to environment: %.900s", s);
61e96248	192	opts++;
38c295d6	193	new_envstring = xmalloc(sizeof(struct envstring));
	194	new_envstring->s = s;
	195	new_envstring->next = custom_environment;
	196	custom_environment = new_envstring;
	197	goto next_option;
	198	}
	199	cp = "from=\"";
61e96248	200	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
61e96248	201	const char *remote_ip = get_remote_ipaddr();
61e96248	202	const char *remote_host = get_canonical_hostname(
c5a7d788	203	options.use_dns);
61e96248	204	char *patterns = xmalloc(strlen(opts) + 1);
01794848	205
61e96248	206	opts += strlen(cp);
38c295d6	207	i = 0;
61e96248	208	while (*opts) {
61e96248	209	if (*opts == '"')
38c295d6	210	break;
61e96248	211	if (*opts == '\\' && opts[1] == '"') {
61e96248	212	opts += 2;
38c295d6	213	patterns[i++] = '"';
	214	continue;
	215	}
61e96248	216	patterns[i++] = *opts++;
38c295d6	217	}
61e96248	218	if (!*opts) {
38c295d6	219	debug("%.100s, line %lu: missing end quote",
42f11eb2	220	file, linenum);
01dafcb5	221	auth_debug_add("%.100s, line %lu: missing end quote",
42f11eb2	222	file, linenum);
acc9d6d7	223	xfree(patterns);
acc9d6d7	224	goto bad_option;
38c295d6	225	}
774de098	226	patterns[i] = '\0';
61e96248	227	opts++;
2cee8a25	228	if (match_host_and_ip(remote_host, remote_ip,
	229	patterns) != 1) {
	230	xfree(patterns);
bbe88b6d	231	logit("Authentication tried for %.100s with "
61e96248	232	"correct key but not from a permitted "
	233	"host (host=%.200s, ip=%.200s).",
	234	pw->pw_name, remote_host, remote_ip);
01dafcb5	235	auth_debug_add("Your host '%.200s' is not "
61e96248	236	"permitted to use this key for login.",
61e96248	237	remote_host);
38c295d6	238	/* deny access */
	239	return 0;
	240	}
2cee8a25	241	xfree(patterns);
38c295d6	242	/* Host name matches. */
	243	goto next_option;
	244	}
01794848	245	cp = "permitopen=\"";
01794848	246	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
3867aa0a	247	char host, p;
01794848	248	u_short port;
01794848	249	char *patterns = xmalloc(strlen(opts) + 1);
	250
	251	opts += strlen(cp);
	252	i = 0;
	253	while (*opts) {
	254	if (*opts == '"')
	255	break;
	256	if (*opts == '\\' && opts[1] == '"') {
	257	opts += 2;
	258	patterns[i++] = '"';
	259	continue;
	260	}
	261	patterns[i++] = *opts++;
	262	}
	263	if (!*opts) {
	264	debug("%.100s, line %lu: missing end quote",
	265	file, linenum);
3867aa0a	266	auth_debug_add("%.100s, line %lu: missing "
3867aa0a	267	"end quote", file, linenum);
01794848	268	xfree(patterns);
	269	goto bad_option;
	270	}
774de098	271	patterns[i] = '\0';
01794848	272	opts++;
3867aa0a	273	p = patterns;
	274	host = hpdelim(&p);
	275	if (host == NULL \|\| strlen(host) >= NI_MAXHOST) {
	276	debug("%.100s, line %lu: Bad permitopen "
16d3d2bc	277	"specification <%.100s>", file, linenum,
3867aa0a	278	patterns);
01dafcb5	279	auth_debug_add("%.100s, line %lu: "
3867aa0a	280	"Bad permitopen specification", file,
3867aa0a	281	linenum);
01794848	282	xfree(patterns);
	283	goto bad_option;
	284	}
f8cc7664	285	host = cleanhostname(host);
f8cc7664	286	if (p == NULL \|\| (port = a2port(p)) == 0) {
3867aa0a	287	debug("%.100s, line %lu: Bad permitopen port "
3867aa0a	288	"<%.100s>", file, linenum, p ? p : "");
01dafcb5	289	auth_debug_add("%.100s, line %lu: "
ed787d14	290	"Bad permitopen port", file, linenum);
01794848	291	xfree(patterns);
	292	goto bad_option;
	293	}
b1ed8313	294	if (options.allow_tcp_forwarding)
ed787d14	295	channel_add_permitted_opens(host, port);
01794848	296	xfree(patterns);
	297	goto next_option;
	298	}
d20f3c9e	299	cp = "tunnel=\"";
	300	if (strncasecmp(opts, cp, strlen(cp)) == 0) {
	301	char *tun = NULL;
	302	opts += strlen(cp);
	303	tun = xmalloc(strlen(opts) + 1);
	304	i = 0;
	305	while (*opts) {
	306	if (*opts == '"')
	307	break;
	308	tun[i++] = *opts++;
	309	}
	310	if (!*opts) {
	311	debug("%.100s, line %lu: missing end quote",
	312	file, linenum);
	313	auth_debug_add("%.100s, line %lu: missing end quote",
	314	file, linenum);
	315	xfree(tun);
	316	forced_tun_device = -1;
	317	goto bad_option;
	318	}
774de098	319	tun[i] = '\0';
d20f3c9e	320	forced_tun_device = a2tun(tun, NULL);
d20f3c9e	321	xfree(tun);
a4f24bf8	322	if (forced_tun_device == SSH_TUNID_ERR) {
d20f3c9e	323	debug("%.100s, line %lu: invalid tun device",
	324	file, linenum);
	325	auth_debug_add("%.100s, line %lu: invalid tun device",
	326	file, linenum);
	327	forced_tun_device = -1;
	328	goto bad_option;
	329	}
	330	auth_debug_add("Forced tun device: %d", forced_tun_device);
	331	opts++;
	332	goto next_option;
	333	}
38c295d6	334	next_option:
	335	/*
	336	* Skip the comma, and move to the next option
	337	* (or break out if there are no more).
	338	*/
61e96248	339	if (!*opts)
38c295d6	340	fatal("Bugs in auth-options.c option processing.");
61e96248	341	if (opts == ' ' \|\| opts == '\t')
38c295d6	342	break; /* End of options. */
61e96248	343	if (*opts != ',')
38c295d6	344	goto bad_option;
61e96248	345	opts++;
38c295d6	346	/* Process the next option. */
38c295d6	347	}
1853d1ef	348
1853d1ef	349	if (!use_privsep)
01dafcb5	350	auth_debug_send();
1853d1ef	351
38c295d6	352	/* grant access */
	353	return 1;
	354
	355	bad_option:
bbe88b6d	356	logit("Bad options in %.100s file, line %lu: %.50s",
61e96248	357	file, linenum, opts);
01dafcb5	358	auth_debug_add("Bad options in %.100s file, line %lu: %.50s",
61e96248	359	file, linenum, opts);
1853d1ef	360
1853d1ef	361	if (!use_privsep)
01dafcb5	362	auth_debug_send();
1853d1ef	363
38c295d6	364	/* deny access */
	365	return 0;
	366	}