auth-options.c

   1 /*
   2  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   3  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   4  *                    All rights reserved
   5  * As far as I am concerned, the code I have written for this software
   6  * can be used freely for any purpose.  Any derived versions of this
   7  * software must be clearly marked as such, and if the derived work is
   8  * incompatible with the protocol description in the RFC file, it must be
   9  * called by a name other than "ssh" or "Secure Shell".
  10  */
  11
  12 #include "includes.h"
  13 RCSID("$OpenBSD: auth-options.c,v 1.25 2002/07/21 18:32:20 stevesk Exp $");
  14
  15 #include "xmalloc.h"
  16 #include "match.h"
  17 #include "log.h"
  18 #include "canohost.h"
  19 #include "channels.h"
  20 #include "auth-options.h"
  21 #include "servconf.h"
  22 #include "misc.h"
  23 #include "monitor_wrap.h"
  24 #include "auth.h"
  25
  26 /* Flags set authorized_keys flags */
  27 int no_port_forwarding_flag = 0;
  28 int no_agent_forwarding_flag = 0;
  29 int no_x11_forwarding_flag = 0;
  30 int no_pty_flag = 0;
  31
  32 /* "command=" option. */
  33 char *forced_command = NULL;
  34
  35 /* "environment=" options. */
  36 struct envstring *custom_environment = NULL;
  37
  38 extern ServerOptions options;
  39
  40 void
  41 auth_clear_options(void)
  42 {
  43         no_agent_forwarding_flag = 0;
  44         no_port_forwarding_flag = 0;
  45         no_pty_flag = 0;
  46         no_x11_forwarding_flag = 0;
  47         while (custom_environment) {
  48                 struct envstring *ce = custom_environment;
  49                 custom_environment = ce->next;
  50                 xfree(ce->s);
  51                 xfree(ce);
  52         }
  53         if (forced_command) {
  54                 xfree(forced_command);
  55                 forced_command = NULL;
  56         }
  57         channel_clear_permitted_opens();
  58         auth_debug_reset();
  59 }
  60
  61 /*
  62  * return 1 if access is granted, 0 if not.
  63  * side effect: sets key option flags
  64  */
  65 int
  66 auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
  67 {
  68         const char *cp;
  69         int i;
  70
  71         /* reset options */
  72         auth_clear_options();
  73
  74         if (!opts)
  75                 return 1;
  76
  77         while (*opts && *opts != ' ' && *opts != '\t') {
  78                 cp = "no-port-forwarding";
  79                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
  80                         auth_debug_add("Port forwarding disabled.");
  81                         no_port_forwarding_flag = 1;
  82                         opts += strlen(cp);
  83                         goto next_option;
  84                 }
  85                 cp = "no-agent-forwarding";
  86                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
  87                         auth_debug_add("Agent forwarding disabled.");
  88                         no_agent_forwarding_flag = 1;
  89                         opts += strlen(cp);
  90                         goto next_option;
  91                 }
  92                 cp = "no-X11-forwarding";
  93                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
  94                         auth_debug_add("X11 forwarding disabled.");
  95                         no_x11_forwarding_flag = 1;
  96                         opts += strlen(cp);
  97                         goto next_option;
  98                 }
  99                 cp = "no-pty";
 100                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 101                         auth_debug_add("Pty allocation disabled.");
 102                         no_pty_flag = 1;
 103                         opts += strlen(cp);
 104                         goto next_option;
 105                 }
 106                 cp = "command=\"";
 107                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 108                         opts += strlen(cp);
 109                         forced_command = xmalloc(strlen(opts) + 1);
 110                         i = 0;
 111                         while (*opts) {
 112                                 if (*opts == '"')
 113                                         break;
 114                                 if (*opts == '\\' && opts[1] == '"') {
 115                                         opts += 2;
 116                                         forced_command[i++] = '"';
 117                                         continue;
 118                                 }
 119                                 forced_command[i++] = *opts++;
 120                         }
 121                         if (!*opts) {
 122                                 debug("%.100s, line %lu: missing end quote",
 123                                     file, linenum);
 124                                 auth_debug_add("%.100s, line %lu: missing end quote",
 125                                     file, linenum);
 126                                 xfree(forced_command);
 127                                 forced_command = NULL;
 128                                 goto bad_option;
 129                         }
 130                         forced_command[i] = 0;
 131                         auth_debug_add("Forced command: %.900s", forced_command);
 132                         opts++;
 133                         goto next_option;
 134                 }
 135                 cp = "environment=\"";
 136                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 137                         char *s;
 138                         struct envstring *new_envstring;
 139
 140                         opts += strlen(cp);
 141                         s = xmalloc(strlen(opts) + 1);
 142                         i = 0;
 143                         while (*opts) {
 144                                 if (*opts == '"')
 145                                         break;
 146                                 if (*opts == '\\' && opts[1] == '"') {
 147                                         opts += 2;
 148                                         s[i++] = '"';
 149                                         continue;
 150                                 }
 151                                 s[i++] = *opts++;
 152                         }
 153                         if (!*opts) {
 154                                 debug("%.100s, line %lu: missing end quote",
 155                                     file, linenum);
 156                                 auth_debug_add("%.100s, line %lu: missing end quote",
 157                                     file, linenum);
 158                                 xfree(s);
 159                                 goto bad_option;
 160                         }
 161                         s[i] = 0;
 162                         auth_debug_add("Adding to environment: %.900s", s);
 163                         debug("Adding to environment: %.900s", s);
 164                         opts++;
 165                         new_envstring = xmalloc(sizeof(struct envstring));
 166                         new_envstring->s = s;
 167                         new_envstring->next = custom_environment;
 168                         custom_environment = new_envstring;
 169                         goto next_option;
 170                 }
 171                 cp = "from=\"";
 172                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 173                         const char *remote_ip = get_remote_ipaddr();
 174                         const char *remote_host = get_canonical_hostname(
 175                             options.verify_reverse_mapping);
 176                         char *patterns = xmalloc(strlen(opts) + 1);
 177
 178                         opts += strlen(cp);
 179                         i = 0;
 180                         while (*opts) {
 181                                 if (*opts == '"')
 182                                         break;
 183                                 if (*opts == '\\' && opts[1] == '"') {
 184                                         opts += 2;
 185                                         patterns[i++] = '"';
 186                                         continue;
 187                                 }
 188                                 patterns[i++] = *opts++;
 189                         }
 190                         if (!*opts) {
 191                                 debug("%.100s, line %lu: missing end quote",
 192                                     file, linenum);
 193                                 auth_debug_add("%.100s, line %lu: missing end quote",
 194                                     file, linenum);
 195                                 xfree(patterns);
 196                                 goto bad_option;
 197                         }
 198                         patterns[i] = 0;
 199                         opts++;
 200                         if (match_host_and_ip(remote_host, remote_ip,
 201                             patterns) != 1) {
 202                                 xfree(patterns);
 203                                 log("Authentication tried for %.100s with "
 204                                     "correct key but not from a permitted "
 205                                     "host (host=%.200s, ip=%.200s).",
 206                                     pw->pw_name, remote_host, remote_ip);
 207                                 auth_debug_add("Your host '%.200s' is not "
 208                                     "permitted to use this key for login.",
 209                                     remote_host);
 210                                 /* deny access */
 211                                 return 0;
 212                         }
 213                         xfree(patterns);
 214                         /* Host name matches. */
 215                         goto next_option;
 216                 }
 217                 cp = "permitopen=\"";
 218                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 219                         char host[256], sport[6];
 220                         u_short port;
 221                         char *patterns = xmalloc(strlen(opts) + 1);
 222
 223                         opts += strlen(cp);
 224                         i = 0;
 225                         while (*opts) {
 226                                 if (*opts == '"')
 227                                         break;
 228                                 if (*opts == '\\' && opts[1] == '"') {
 229                                         opts += 2;
 230                                         patterns[i++] = '"';
 231                                         continue;
 232                                 }
 233                                 patterns[i++] = *opts++;
 234                         }
 235                         if (!*opts) {
 236                                 debug("%.100s, line %lu: missing end quote",
 237                                     file, linenum);
 238                                 auth_debug_add("%.100s, line %lu: missing end quote",
 239                                     file, linenum);
 240                                 xfree(patterns);
 241                                 goto bad_option;
 242                         }
 243                         patterns[i] = 0;
 244                         opts++;
 245                         if (sscanf(patterns, "%255[^:]:%5[0-9]", host, sport) != 2 &&
 246                             sscanf(patterns, "%255[^/]/%5[0-9]", host, sport) != 2) {
 247                                 debug("%.100s, line %lu: Bad permitopen specification "
 248                                     "<%.100s>", file, linenum, patterns);
 249                                 auth_debug_add("%.100s, line %lu: "
 250                                     "Bad permitopen specification", file, linenum);
 251                                 xfree(patterns);
 252                                 goto bad_option;
 253                         }
 254                         if ((port = a2port(sport)) == 0) {
 255                                 debug("%.100s, line %lu: Bad permitopen port <%.100s>",
 256                                     file, linenum, sport);
 257                                 auth_debug_add("%.100s, line %lu: "
 258                                     "Bad permitopen port", file, linenum);
 259                                 xfree(patterns);
 260                                 goto bad_option;
 261                         }
 262                         if (options.allow_tcp_forwarding)
 263                                 channel_add_permitted_opens(host, port);
 264                         xfree(patterns);
 265                         goto next_option;
 266                 }
 267 next_option:
 268                 /*
 269                  * Skip the comma, and move to the next option
 270                  * (or break out if there are no more).
 271                  */
 272                 if (!*opts)
 273                         fatal("Bugs in auth-options.c option processing.");
 274                 if (*opts == ' ' || *opts == '\t')
 275                         break;          /* End of options. */
 276                 if (*opts != ',')
 277                         goto bad_option;
 278                 opts++;
 279                 /* Process the next option. */
 280         }
 281
 282         if (!use_privsep)
 283                 auth_debug_send();
 284
 285         /* grant access */
 286         return 1;
 287
 288 bad_option:
 289         log("Bad options in %.100s file, line %lu: %.50s",
 290             file, linenum, opts);
 291         auth_debug_add("Bad options in %.100s file, line %lu: %.50s",
 292             file, linenum, opts);
 293
 294         if (!use_privsep)
 295                 auth_debug_send();
 296
 297         /* deny access */
 298         return 0;
 299 }