auth-options.c

   1 /* $OpenBSD: auth-options.c,v 1.38 2006/07/17 12:02:24 dtucker Exp $ */
   2 /*
   3  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   5  *                    All rights reserved
   6  * As far as I am concerned, the code I have written for this software
   7  * can be used freely for any purpose.  Any derived versions of this
   8  * software must be clearly marked as such, and if the derived work is
   9  * incompatible with the protocol description in the RFC file, it must be
  10  * called by a name other than "ssh" or "Secure Shell".
  11  */
  12
  13 #include "includes.h"
  14
  15 #include <sys/types.h>
  16
  17 #if defined(HAVE_NETDB_H)
  18 # include <netdb.h>
  19 #endif
  20 #include <pwd.h>
  21
  22 #include "xmalloc.h"
  23 #include "match.h"
  24 #include "log.h"
  25 #include "canohost.h"
  26 #include "channels.h"
  27 #include "auth-options.h"
  28 #include "servconf.h"
  29 #include "misc.h"
  30 #include "monitor_wrap.h"
  31 #include "auth.h"
  32
  33 /* Flags set authorized_keys flags */
  34 int no_port_forwarding_flag = 0;
  35 int no_agent_forwarding_flag = 0;
  36 int no_x11_forwarding_flag = 0;
  37 int no_pty_flag = 0;
  38
  39 /* "command=" option. */
  40 char *forced_command = NULL;
  41
  42 /* "environment=" options. */
  43 struct envstring *custom_environment = NULL;
  44
  45 /* "tunnel=" option. */
  46 int forced_tun_device = -1;
  47
  48 extern ServerOptions options;
  49
  50 void
  51 auth_clear_options(void)
  52 {
  53         no_agent_forwarding_flag = 0;
  54         no_port_forwarding_flag = 0;
  55         no_pty_flag = 0;
  56         no_x11_forwarding_flag = 0;
  57         while (custom_environment) {
  58                 struct envstring *ce = custom_environment;
  59                 custom_environment = ce->next;
  60                 xfree(ce->s);
  61                 xfree(ce);
  62         }
  63         if (forced_command) {
  64                 xfree(forced_command);
  65                 forced_command = NULL;
  66         }
  67         forced_tun_device = -1;
  68         channel_clear_permitted_opens();
  69         auth_debug_reset();
  70 }
  71
  72 /*
  73  * return 1 if access is granted, 0 if not.
  74  * side effect: sets key option flags
  75  */
  76 int
  77 auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
  78 {
  79         const char *cp;
  80         int i;
  81
  82         /* reset options */
  83         auth_clear_options();
  84
  85         if (!opts)
  86                 return 1;
  87
  88         while (*opts && *opts != ' ' && *opts != '\t') {
  89                 cp = "no-port-forwarding";
  90                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
  91                         auth_debug_add("Port forwarding disabled.");
  92                         no_port_forwarding_flag = 1;
  93                         opts += strlen(cp);
  94                         goto next_option;
  95                 }
  96                 cp = "no-agent-forwarding";
  97                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
  98                         auth_debug_add("Agent forwarding disabled.");
  99                         no_agent_forwarding_flag = 1;
 100                         opts += strlen(cp);
 101                         goto next_option;
 102                 }
 103                 cp = "no-X11-forwarding";
 104                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 105                         auth_debug_add("X11 forwarding disabled.");
 106                         no_x11_forwarding_flag = 1;
 107                         opts += strlen(cp);
 108                         goto next_option;
 109                 }
 110                 cp = "no-pty";
 111                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 112                         auth_debug_add("Pty allocation disabled.");
 113                         no_pty_flag = 1;
 114                         opts += strlen(cp);
 115                         goto next_option;
 116                 }
 117                 cp = "command=\"";
 118                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 119                         opts += strlen(cp);
 120                         forced_command = xmalloc(strlen(opts) + 1);
 121                         i = 0;
 122                         while (*opts) {
 123                                 if (*opts == '"')
 124                                         break;
 125                                 if (*opts == '\\' && opts[1] == '"') {
 126                                         opts += 2;
 127                                         forced_command[i++] = '"';
 128                                         continue;
 129                                 }
 130                                 forced_command[i++] = *opts++;
 131                         }
 132                         if (!*opts) {
 133                                 debug("%.100s, line %lu: missing end quote",
 134                                     file, linenum);
 135                                 auth_debug_add("%.100s, line %lu: missing end quote",
 136                                     file, linenum);
 137                                 xfree(forced_command);
 138                                 forced_command = NULL;
 139                                 goto bad_option;
 140                         }
 141                         forced_command[i] = '\0';
 142                         auth_debug_add("Forced command: %.900s", forced_command);
 143                         opts++;
 144                         goto next_option;
 145                 }
 146                 cp = "environment=\"";
 147                 if (options.permit_user_env &&
 148                     strncasecmp(opts, cp, strlen(cp)) == 0) {
 149                         char *s;
 150                         struct envstring *new_envstring;
 151
 152                         opts += strlen(cp);
 153                         s = xmalloc(strlen(opts) + 1);
 154                         i = 0;
 155                         while (*opts) {
 156                                 if (*opts == '"')
 157                                         break;
 158                                 if (*opts == '\\' && opts[1] == '"') {
 159                                         opts += 2;
 160                                         s[i++] = '"';
 161                                         continue;
 162                                 }
 163                                 s[i++] = *opts++;
 164                         }
 165                         if (!*opts) {
 166                                 debug("%.100s, line %lu: missing end quote",
 167                                     file, linenum);
 168                                 auth_debug_add("%.100s, line %lu: missing end quote",
 169                                     file, linenum);
 170                                 xfree(s);
 171                                 goto bad_option;
 172                         }
 173                         s[i] = '\0';
 174                         auth_debug_add("Adding to environment: %.900s", s);
 175                         debug("Adding to environment: %.900s", s);
 176                         opts++;
 177                         new_envstring = xmalloc(sizeof(struct envstring));
 178                         new_envstring->s = s;
 179                         new_envstring->next = custom_environment;
 180                         custom_environment = new_envstring;
 181                         goto next_option;
 182                 }
 183                 cp = "from=\"";
 184                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 185                         const char *remote_ip = get_remote_ipaddr();
 186                         const char *remote_host = get_canonical_hostname(
 187                             options.use_dns);
 188                         char *patterns = xmalloc(strlen(opts) + 1);
 189
 190                         opts += strlen(cp);
 191                         i = 0;
 192                         while (*opts) {
 193                                 if (*opts == '"')
 194                                         break;
 195                                 if (*opts == '\\' && opts[1] == '"') {
 196                                         opts += 2;
 197                                         patterns[i++] = '"';
 198                                         continue;
 199                                 }
 200                                 patterns[i++] = *opts++;
 201                         }
 202                         if (!*opts) {
 203                                 debug("%.100s, line %lu: missing end quote",
 204                                     file, linenum);
 205                                 auth_debug_add("%.100s, line %lu: missing end quote",
 206                                     file, linenum);
 207                                 xfree(patterns);
 208                                 goto bad_option;
 209                         }
 210                         patterns[i] = '\0';
 211                         opts++;
 212                         if (match_host_and_ip(remote_host, remote_ip,
 213                             patterns) != 1) {
 214                                 xfree(patterns);
 215                                 logit("Authentication tried for %.100s with "
 216                                     "correct key but not from a permitted "
 217                                     "host (host=%.200s, ip=%.200s).",
 218                                     pw->pw_name, remote_host, remote_ip);
 219                                 auth_debug_add("Your host '%.200s' is not "
 220                                     "permitted to use this key for login.",
 221                                     remote_host);
 222                                 /* deny access */
 223                                 return 0;
 224                         }
 225                         xfree(patterns);
 226                         /* Host name matches. */
 227                         goto next_option;
 228                 }
 229                 cp = "permitopen=\"";
 230                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 231                         char *host, *p;
 232                         u_short port;
 233                         char *patterns = xmalloc(strlen(opts) + 1);
 234
 235                         opts += strlen(cp);
 236                         i = 0;
 237                         while (*opts) {
 238                                 if (*opts == '"')
 239                                         break;
 240                                 if (*opts == '\\' && opts[1] == '"') {
 241                                         opts += 2;
 242                                         patterns[i++] = '"';
 243                                         continue;
 244                                 }
 245                                 patterns[i++] = *opts++;
 246                         }
 247                         if (!*opts) {
 248                                 debug("%.100s, line %lu: missing end quote",
 249                                     file, linenum);
 250                                 auth_debug_add("%.100s, line %lu: missing "
 251                                     "end quote", file, linenum);
 252                                 xfree(patterns);
 253                                 goto bad_option;
 254                         }
 255                         patterns[i] = '\0';
 256                         opts++;
 257                         p = patterns;
 258                         host = hpdelim(&p);
 259                         if (host == NULL || strlen(host) >= NI_MAXHOST) {
 260                                 debug("%.100s, line %lu: Bad permitopen "
 261                                     "specification <%.100s>", file, linenum,
 262                                     patterns);
 263                                 auth_debug_add("%.100s, line %lu: "
 264                                     "Bad permitopen specification", file,
 265                                     linenum);
 266                                 xfree(patterns);
 267                                 goto bad_option;
 268                         }
 269                         host = cleanhostname(host);
 270                         if (p == NULL || (port = a2port(p)) == 0) {
 271                                 debug("%.100s, line %lu: Bad permitopen port "
 272                                     "<%.100s>", file, linenum, p ? p : "");
 273                                 auth_debug_add("%.100s, line %lu: "
 274                                     "Bad permitopen port", file, linenum);
 275                                 xfree(patterns);
 276                                 goto bad_option;
 277                         }
 278                         if (options.allow_tcp_forwarding)
 279                                 channel_add_permitted_opens(host, port);
 280                         xfree(patterns);
 281                         goto next_option;
 282                 }
 283                 cp = "tunnel=\"";
 284                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 285                         char *tun = NULL;
 286                         opts += strlen(cp);
 287                         tun = xmalloc(strlen(opts) + 1);
 288                         i = 0;
 289                         while (*opts) {
 290                                 if (*opts == '"')
 291                                         break;
 292                                 tun[i++] = *opts++;
 293                         }
 294                         if (!*opts) {
 295                                 debug("%.100s, line %lu: missing end quote",
 296                                     file, linenum);
 297                                 auth_debug_add("%.100s, line %lu: missing end quote",
 298                                     file, linenum);
 299                                 xfree(tun);
 300                                 forced_tun_device = -1;
 301                                 goto bad_option;
 302                         }
 303                         tun[i] = '\0';
 304                         forced_tun_device = a2tun(tun, NULL);
 305                         xfree(tun);
 306                         if (forced_tun_device == SSH_TUNID_ERR) {
 307                                 debug("%.100s, line %lu: invalid tun device",
 308                                     file, linenum);
 309                                 auth_debug_add("%.100s, line %lu: invalid tun device",
 310                                     file, linenum);
 311                                 forced_tun_device = -1;
 312                                 goto bad_option;
 313                         }
 314                         auth_debug_add("Forced tun device: %d", forced_tun_device);
 315                         opts++;
 316                         goto next_option;
 317                 }
 318 next_option:
 319                 /*
 320                  * Skip the comma, and move to the next option
 321                  * (or break out if there are no more).
 322                  */
 323                 if (!*opts)
 324                         fatal("Bugs in auth-options.c option processing.");
 325                 if (*opts == ' ' || *opts == '\t')
 326                         break;          /* End of options. */
 327                 if (*opts != ',')
 328                         goto bad_option;
 329                 opts++;
 330                 /* Process the next option. */
 331         }
 332
 333         if (!use_privsep)
 334                 auth_debug_send();
 335
 336         /* grant access */
 337         return 1;
 338
 339 bad_option:
 340         logit("Bad options in %.100s file, line %lu: %.50s",
 341             file, linenum, opts);
 342         auth_debug_add("Bad options in %.100s file, line %lu: %.50s",
 343             file, linenum, opts);
 344
 345         if (!use_privsep)
 346                 auth_debug_send();
 347
 348         /* deny access */
 349         return 0;
 350 }