auth-options.c

   1 /* $OpenBSD: auth-options.c,v 1.39 2006/07/22 20:48:22 stevesk Exp $ */
   2 /*
   3  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   5  *                    All rights reserved
   6  * As far as I am concerned, the code I have written for this software
   7  * can be used freely for any purpose.  Any derived versions of this
   8  * software must be clearly marked as such, and if the derived work is
   9  * incompatible with the protocol description in the RFC file, it must be
  10  * called by a name other than "ssh" or "Secure Shell".
  11  */
  12
  13 #include "includes.h"
  14
  15 #include <sys/types.h>
  16
  17 #if defined(HAVE_NETDB_H)
  18 # include <netdb.h>
  19 #endif
  20 #include <pwd.h>
  21 #include <string.h>
  22
  23 #include "xmalloc.h"
  24 #include "match.h"
  25 #include "log.h"
  26 #include "canohost.h"
  27 #include "channels.h"
  28 #include "auth-options.h"
  29 #include "servconf.h"
  30 #include "misc.h"
  31 #include "monitor_wrap.h"
  32 #include "auth.h"
  33
  34 /* Flags set authorized_keys flags */
  35 int no_port_forwarding_flag = 0;
  36 int no_agent_forwarding_flag = 0;
  37 int no_x11_forwarding_flag = 0;
  38 int no_pty_flag = 0;
  39
  40 /* "command=" option. */
  41 char *forced_command = NULL;
  42
  43 /* "environment=" options. */
  44 struct envstring *custom_environment = NULL;
  45
  46 /* "tunnel=" option. */
  47 int forced_tun_device = -1;
  48
  49 extern ServerOptions options;
  50
  51 void
  52 auth_clear_options(void)
  53 {
  54         no_agent_forwarding_flag = 0;
  55         no_port_forwarding_flag = 0;
  56         no_pty_flag = 0;
  57         no_x11_forwarding_flag = 0;
  58         while (custom_environment) {
  59                 struct envstring *ce = custom_environment;
  60                 custom_environment = ce->next;
  61                 xfree(ce->s);
  62                 xfree(ce);
  63         }
  64         if (forced_command) {
  65                 xfree(forced_command);
  66                 forced_command = NULL;
  67         }
  68         forced_tun_device = -1;
  69         channel_clear_permitted_opens();
  70         auth_debug_reset();
  71 }
  72
  73 /*
  74  * return 1 if access is granted, 0 if not.
  75  * side effect: sets key option flags
  76  */
  77 int
  78 auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
  79 {
  80         const char *cp;
  81         int i;
  82
  83         /* reset options */
  84         auth_clear_options();
  85
  86         if (!opts)
  87                 return 1;
  88
  89         while (*opts && *opts != ' ' && *opts != '\t') {
  90                 cp = "no-port-forwarding";
  91                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
  92                         auth_debug_add("Port forwarding disabled.");
  93                         no_port_forwarding_flag = 1;
  94                         opts += strlen(cp);
  95                         goto next_option;
  96                 }
  97                 cp = "no-agent-forwarding";
  98                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
  99                         auth_debug_add("Agent forwarding disabled.");
 100                         no_agent_forwarding_flag = 1;
 101                         opts += strlen(cp);
 102                         goto next_option;
 103                 }
 104                 cp = "no-X11-forwarding";
 105                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 106                         auth_debug_add("X11 forwarding disabled.");
 107                         no_x11_forwarding_flag = 1;
 108                         opts += strlen(cp);
 109                         goto next_option;
 110                 }
 111                 cp = "no-pty";
 112                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 113                         auth_debug_add("Pty allocation disabled.");
 114                         no_pty_flag = 1;
 115                         opts += strlen(cp);
 116                         goto next_option;
 117                 }
 118                 cp = "command=\"";
 119                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 120                         opts += strlen(cp);
 121                         forced_command = xmalloc(strlen(opts) + 1);
 122                         i = 0;
 123                         while (*opts) {
 124                                 if (*opts == '"')
 125                                         break;
 126                                 if (*opts == '\\' && opts[1] == '"') {
 127                                         opts += 2;
 128                                         forced_command[i++] = '"';
 129                                         continue;
 130                                 }
 131                                 forced_command[i++] = *opts++;
 132                         }
 133                         if (!*opts) {
 134                                 debug("%.100s, line %lu: missing end quote",
 135                                     file, linenum);
 136                                 auth_debug_add("%.100s, line %lu: missing end quote",
 137                                     file, linenum);
 138                                 xfree(forced_command);
 139                                 forced_command = NULL;
 140                                 goto bad_option;
 141                         }
 142                         forced_command[i] = '\0';
 143                         auth_debug_add("Forced command: %.900s", forced_command);
 144                         opts++;
 145                         goto next_option;
 146                 }
 147                 cp = "environment=\"";
 148                 if (options.permit_user_env &&
 149                     strncasecmp(opts, cp, strlen(cp)) == 0) {
 150                         char *s;
 151                         struct envstring *new_envstring;
 152
 153                         opts += strlen(cp);
 154                         s = xmalloc(strlen(opts) + 1);
 155                         i = 0;
 156                         while (*opts) {
 157                                 if (*opts == '"')
 158                                         break;
 159                                 if (*opts == '\\' && opts[1] == '"') {
 160                                         opts += 2;
 161                                         s[i++] = '"';
 162                                         continue;
 163                                 }
 164                                 s[i++] = *opts++;
 165                         }
 166                         if (!*opts) {
 167                                 debug("%.100s, line %lu: missing end quote",
 168                                     file, linenum);
 169                                 auth_debug_add("%.100s, line %lu: missing end quote",
 170                                     file, linenum);
 171                                 xfree(s);
 172                                 goto bad_option;
 173                         }
 174                         s[i] = '\0';
 175                         auth_debug_add("Adding to environment: %.900s", s);
 176                         debug("Adding to environment: %.900s", s);
 177                         opts++;
 178                         new_envstring = xmalloc(sizeof(struct envstring));
 179                         new_envstring->s = s;
 180                         new_envstring->next = custom_environment;
 181                         custom_environment = new_envstring;
 182                         goto next_option;
 183                 }
 184                 cp = "from=\"";
 185                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 186                         const char *remote_ip = get_remote_ipaddr();
 187                         const char *remote_host = get_canonical_hostname(
 188                             options.use_dns);
 189                         char *patterns = xmalloc(strlen(opts) + 1);
 190
 191                         opts += strlen(cp);
 192                         i = 0;
 193                         while (*opts) {
 194                                 if (*opts == '"')
 195                                         break;
 196                                 if (*opts == '\\' && opts[1] == '"') {
 197                                         opts += 2;
 198                                         patterns[i++] = '"';
 199                                         continue;
 200                                 }
 201                                 patterns[i++] = *opts++;
 202                         }
 203                         if (!*opts) {
 204                                 debug("%.100s, line %lu: missing end quote",
 205                                     file, linenum);
 206                                 auth_debug_add("%.100s, line %lu: missing end quote",
 207                                     file, linenum);
 208                                 xfree(patterns);
 209                                 goto bad_option;
 210                         }
 211                         patterns[i] = '\0';
 212                         opts++;
 213                         if (match_host_and_ip(remote_host, remote_ip,
 214                             patterns) != 1) {
 215                                 xfree(patterns);
 216                                 logit("Authentication tried for %.100s with "
 217                                     "correct key but not from a permitted "
 218                                     "host (host=%.200s, ip=%.200s).",
 219                                     pw->pw_name, remote_host, remote_ip);
 220                                 auth_debug_add("Your host '%.200s' is not "
 221                                     "permitted to use this key for login.",
 222                                     remote_host);
 223                                 /* deny access */
 224                                 return 0;
 225                         }
 226                         xfree(patterns);
 227                         /* Host name matches. */
 228                         goto next_option;
 229                 }
 230                 cp = "permitopen=\"";
 231                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 232                         char *host, *p;
 233                         u_short port;
 234                         char *patterns = xmalloc(strlen(opts) + 1);
 235
 236                         opts += strlen(cp);
 237                         i = 0;
 238                         while (*opts) {
 239                                 if (*opts == '"')
 240                                         break;
 241                                 if (*opts == '\\' && opts[1] == '"') {
 242                                         opts += 2;
 243                                         patterns[i++] = '"';
 244                                         continue;
 245                                 }
 246                                 patterns[i++] = *opts++;
 247                         }
 248                         if (!*opts) {
 249                                 debug("%.100s, line %lu: missing end quote",
 250                                     file, linenum);
 251                                 auth_debug_add("%.100s, line %lu: missing "
 252                                     "end quote", file, linenum);
 253                                 xfree(patterns);
 254                                 goto bad_option;
 255                         }
 256                         patterns[i] = '\0';
 257                         opts++;
 258                         p = patterns;
 259                         host = hpdelim(&p);
 260                         if (host == NULL || strlen(host) >= NI_MAXHOST) {
 261                                 debug("%.100s, line %lu: Bad permitopen "
 262                                     "specification <%.100s>", file, linenum,
 263                                     patterns);
 264                                 auth_debug_add("%.100s, line %lu: "
 265                                     "Bad permitopen specification", file,
 266                                     linenum);
 267                                 xfree(patterns);
 268                                 goto bad_option;
 269                         }
 270                         host = cleanhostname(host);
 271                         if (p == NULL || (port = a2port(p)) == 0) {
 272                                 debug("%.100s, line %lu: Bad permitopen port "
 273                                     "<%.100s>", file, linenum, p ? p : "");
 274                                 auth_debug_add("%.100s, line %lu: "
 275                                     "Bad permitopen port", file, linenum);
 276                                 xfree(patterns);
 277                                 goto bad_option;
 278                         }
 279                         if (options.allow_tcp_forwarding)
 280                                 channel_add_permitted_opens(host, port);
 281                         xfree(patterns);
 282                         goto next_option;
 283                 }
 284                 cp = "tunnel=\"";
 285                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 286                         char *tun = NULL;
 287                         opts += strlen(cp);
 288                         tun = xmalloc(strlen(opts) + 1);
 289                         i = 0;
 290                         while (*opts) {
 291                                 if (*opts == '"')
 292                                         break;
 293                                 tun[i++] = *opts++;
 294                         }
 295                         if (!*opts) {
 296                                 debug("%.100s, line %lu: missing end quote",
 297                                     file, linenum);
 298                                 auth_debug_add("%.100s, line %lu: missing end quote",
 299                                     file, linenum);
 300                                 xfree(tun);
 301                                 forced_tun_device = -1;
 302                                 goto bad_option;
 303                         }
 304                         tun[i] = '\0';
 305                         forced_tun_device = a2tun(tun, NULL);
 306                         xfree(tun);
 307                         if (forced_tun_device == SSH_TUNID_ERR) {
 308                                 debug("%.100s, line %lu: invalid tun device",
 309                                     file, linenum);
 310                                 auth_debug_add("%.100s, line %lu: invalid tun device",
 311                                     file, linenum);
 312                                 forced_tun_device = -1;
 313                                 goto bad_option;
 314                         }
 315                         auth_debug_add("Forced tun device: %d", forced_tun_device);
 316                         opts++;
 317                         goto next_option;
 318                 }
 319 next_option:
 320                 /*
 321                  * Skip the comma, and move to the next option
 322                  * (or break out if there are no more).
 323                  */
 324                 if (!*opts)
 325                         fatal("Bugs in auth-options.c option processing.");
 326                 if (*opts == ' ' || *opts == '\t')
 327                         break;          /* End of options. */
 328                 if (*opts != ',')
 329                         goto bad_option;
 330                 opts++;
 331                 /* Process the next option. */
 332         }
 333
 334         if (!use_privsep)
 335                 auth_debug_send();
 336
 337         /* grant access */
 338         return 1;
 339
 340 bad_option:
 341         logit("Bad options in %.100s file, line %lu: %.50s",
 342             file, linenum, opts);
 343         auth_debug_add("Bad options in %.100s file, line %lu: %.50s",
 344             file, linenum, opts);
 345
 346         if (!use_privsep)
 347                 auth_debug_send();
 348
 349         /* deny access */
 350         return 0;
 351 }