-/* $OpenBSD: auth-options.c,v 1.40 2006/08/03 03:34:41 deraadt Exp $ */
+/* $OpenBSD: auth-options.c,v 1.44 2009/01/22 10:09:16 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
#include <stdio.h>
#include <stdarg.h>
+#include "openbsd-compat/sys-queue.h"
#include "xmalloc.h"
#include "match.h"
#include "log.h"
int no_agent_forwarding_flag = 0;
int no_x11_forwarding_flag = 0;
int no_pty_flag = 0;
+int no_user_rc = 0;
/* "command=" option. */
char *forced_command = NULL;
no_port_forwarding_flag = 0;
no_pty_flag = 0;
no_x11_forwarding_flag = 0;
+ no_user_rc = 0;
while (custom_environment) {
struct envstring *ce = custom_environment;
custom_environment = ce->next;
opts += strlen(cp);
goto next_option;
}
+ cp = "no-user-rc";
+ if (strncasecmp(opts, cp, strlen(cp)) == 0) {
+ auth_debug_add("User rc file execution disabled.");
+ no_user_rc = 1;
+ opts += strlen(cp);
+ goto next_option;
+ }
cp = "command=\"";
if (strncasecmp(opts, cp, strlen(cp)) == 0) {
opts += strlen(cp);
}
patterns[i] = '\0';
opts++;
- if (match_host_and_ip(remote_host, remote_ip,
- patterns) != 1) {
+ switch (match_host_and_ip(remote_host, remote_ip,
+ patterns)) {
+ case 1:
+ xfree(patterns);
+ /* Host name matches. */
+ goto next_option;
+ case -1:
+ debug("%.100s, line %lu: invalid criteria",
+ file, linenum);
+ auth_debug_add("%.100s, line %lu: "
+ "invalid criteria", file, linenum);
+ /* FALLTHROUGH */
+ case 0:
xfree(patterns);
logit("Authentication tried for %.100s with "
"correct key but not from a permitted "
auth_debug_add("Your host '%.200s' is not "
"permitted to use this key for login.",
remote_host);
- /* deny access */
- return 0;
+ break;
}
- xfree(patterns);
- /* Host name matches. */
- goto next_option;
+ /* deny access */
+ return 0;
}
cp = "permitopen=\"";
if (strncasecmp(opts, cp, strlen(cp)) == 0) {
char *host, *p;
- u_short port;
+ int port;
char *patterns = xmalloc(strlen(opts) + 1);
opts += strlen(cp);
goto bad_option;
}
host = cleanhostname(host);
- if (p == NULL || (port = a2port(p)) == 0) {
+ if (p == NULL || (port = a2port(p)) <= 0) {
debug("%.100s, line %lu: Bad permitopen port "
"<%.100s>", file, linenum, p ? p : "");
auth_debug_add("%.100s, line %lu: "