version 1.23, 2002/03/19 10:35:39 |
version 1.23.2.3, 2002/06/26 15:30:37 |
|
|
#include "bufaux.h" |
#include "bufaux.h" |
#include "misc.h" |
#include "misc.h" |
#include "monitor_wrap.h" |
#include "monitor_wrap.h" |
|
#include "auth.h" |
|
|
/* Debugging messages */ |
|
Buffer auth_debug; |
|
int auth_debug_init; |
|
|
|
/* Flags set authorized_keys flags */ |
/* Flags set authorized_keys flags */ |
int no_port_forwarding_flag = 0; |
int no_port_forwarding_flag = 0; |
int no_agent_forwarding_flag = 0; |
int no_agent_forwarding_flag = 0; |
|
|
|
|
extern ServerOptions options; |
extern ServerOptions options; |
|
|
static void |
|
auth_send_debug(Buffer *m) |
|
{ |
|
char *msg; |
|
|
|
while (buffer_len(m)) { |
|
msg = buffer_get_string(m, NULL); |
|
packet_send_debug("%s", msg); |
|
xfree(msg); |
|
} |
|
} |
|
|
|
void |
void |
auth_clear_options(void) |
auth_clear_options(void) |
{ |
{ |
if (auth_debug_init) |
|
buffer_clear(&auth_debug); |
|
else { |
|
buffer_init(&auth_debug); |
|
auth_debug_init = 1; |
|
} |
|
|
|
no_agent_forwarding_flag = 0; |
no_agent_forwarding_flag = 0; |
no_port_forwarding_flag = 0; |
no_port_forwarding_flag = 0; |
no_pty_flag = 0; |
no_pty_flag = 0; |
|
|
forced_command = NULL; |
forced_command = NULL; |
} |
} |
channel_clear_permitted_opens(); |
channel_clear_permitted_opens(); |
|
auth_debug_reset(); |
} |
} |
|
|
/* |
/* |
|
|
int |
int |
auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum) |
auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum) |
{ |
{ |
char tmp[1024]; |
|
const char *cp; |
const char *cp; |
int i; |
int i; |
|
|
|
|
while (*opts && *opts != ' ' && *opts != '\t') { |
while (*opts && *opts != ' ' && *opts != '\t') { |
cp = "no-port-forwarding"; |
cp = "no-port-forwarding"; |
if (strncasecmp(opts, cp, strlen(cp)) == 0) { |
if (strncasecmp(opts, cp, strlen(cp)) == 0) { |
snprintf(tmp, sizeof(tmp), "Port forwarding disabled."); |
auth_debug_add("Port forwarding disabled."); |
buffer_put_cstring(&auth_debug, tmp); |
|
no_port_forwarding_flag = 1; |
no_port_forwarding_flag = 1; |
opts += strlen(cp); |
opts += strlen(cp); |
goto next_option; |
goto next_option; |
} |
} |
cp = "no-agent-forwarding"; |
cp = "no-agent-forwarding"; |
if (strncasecmp(opts, cp, strlen(cp)) == 0) { |
if (strncasecmp(opts, cp, strlen(cp)) == 0) { |
snprintf(tmp, sizeof(tmp), "Agent forwarding disabled."); |
auth_debug_add("Agent forwarding disabled."); |
buffer_put_cstring(&auth_debug, tmp); |
|
no_agent_forwarding_flag = 1; |
no_agent_forwarding_flag = 1; |
opts += strlen(cp); |
opts += strlen(cp); |
goto next_option; |
goto next_option; |
} |
} |
cp = "no-X11-forwarding"; |
cp = "no-X11-forwarding"; |
if (strncasecmp(opts, cp, strlen(cp)) == 0) { |
if (strncasecmp(opts, cp, strlen(cp)) == 0) { |
snprintf(tmp, sizeof(tmp), "X11 forwarding disabled."); |
auth_debug_add("X11 forwarding disabled."); |
buffer_put_cstring(&auth_debug, tmp); |
|
no_x11_forwarding_flag = 1; |
no_x11_forwarding_flag = 1; |
opts += strlen(cp); |
opts += strlen(cp); |
goto next_option; |
goto next_option; |
} |
} |
cp = "no-pty"; |
cp = "no-pty"; |
if (strncasecmp(opts, cp, strlen(cp)) == 0) { |
if (strncasecmp(opts, cp, strlen(cp)) == 0) { |
snprintf(tmp, sizeof(tmp), "Pty allocation disabled."); |
auth_debug_add("Pty allocation disabled."); |
buffer_put_cstring(&auth_debug, tmp); |
|
no_pty_flag = 1; |
no_pty_flag = 1; |
opts += strlen(cp); |
opts += strlen(cp); |
goto next_option; |
goto next_option; |
|
|
if (!*opts) { |
if (!*opts) { |
debug("%.100s, line %lu: missing end quote", |
debug("%.100s, line %lu: missing end quote", |
file, linenum); |
file, linenum); |
snprintf(tmp, sizeof(tmp), "%.100s, line %lu: missing end quote", |
auth_debug_add("%.100s, line %lu: missing end quote", |
file, linenum); |
file, linenum); |
buffer_put_cstring(&auth_debug, tmp); |
|
xfree(forced_command); |
xfree(forced_command); |
forced_command = NULL; |
forced_command = NULL; |
goto bad_option; |
goto bad_option; |
} |
} |
forced_command[i] = 0; |
forced_command[i] = 0; |
snprintf(tmp, sizeof(tmp), "Forced command: %.900s", forced_command); |
auth_debug_add("Forced command: %.900s", forced_command); |
buffer_put_cstring(&auth_debug, tmp); |
|
opts++; |
opts++; |
goto next_option; |
goto next_option; |
} |
} |
|
|
if (!*opts) { |
if (!*opts) { |
debug("%.100s, line %lu: missing end quote", |
debug("%.100s, line %lu: missing end quote", |
file, linenum); |
file, linenum); |
snprintf(tmp, sizeof(tmp), "%.100s, line %lu: missing end quote", |
auth_debug_add("%.100s, line %lu: missing end quote", |
file, linenum); |
file, linenum); |
buffer_put_cstring(&auth_debug, tmp); |
|
xfree(s); |
xfree(s); |
goto bad_option; |
goto bad_option; |
} |
} |
s[i] = 0; |
s[i] = 0; |
snprintf(tmp, sizeof(tmp), "Adding to environment: %.900s", s); |
auth_debug_add("Adding to environment: %.900s", s); |
buffer_put_cstring(&auth_debug, tmp); |
|
debug("Adding to environment: %.900s", s); |
debug("Adding to environment: %.900s", s); |
opts++; |
opts++; |
new_envstring = xmalloc(sizeof(struct envstring)); |
new_envstring = xmalloc(sizeof(struct envstring)); |
|
|
if (!*opts) { |
if (!*opts) { |
debug("%.100s, line %lu: missing end quote", |
debug("%.100s, line %lu: missing end quote", |
file, linenum); |
file, linenum); |
snprintf(tmp, sizeof(tmp), "%.100s, line %lu: missing end quote", |
auth_debug_add("%.100s, line %lu: missing end quote", |
file, linenum); |
file, linenum); |
buffer_put_cstring(&auth_debug, tmp); |
|
xfree(patterns); |
xfree(patterns); |
goto bad_option; |
goto bad_option; |
} |
} |
|
|
"correct key but not from a permitted " |
"correct key but not from a permitted " |
"host (host=%.200s, ip=%.200s).", |
"host (host=%.200s, ip=%.200s).", |
pw->pw_name, remote_host, remote_ip); |
pw->pw_name, remote_host, remote_ip); |
snprintf(tmp, sizeof(tmp), |
auth_debug_add("Your host '%.200s' is not " |
"Your host '%.200s' is not " |
|
"permitted to use this key for login.", |
"permitted to use this key for login.", |
remote_host); |
remote_host); |
buffer_put_cstring(&auth_debug, tmp); |
|
/* deny access */ |
/* deny access */ |
return 0; |
return 0; |
} |
} |
|
|
if (!*opts) { |
if (!*opts) { |
debug("%.100s, line %lu: missing end quote", |
debug("%.100s, line %lu: missing end quote", |
file, linenum); |
file, linenum); |
snprintf(tmp, sizeof(tmp), "%.100s, line %lu: missing end quote", |
auth_debug_add("%.100s, line %lu: missing end quote", |
file, linenum); |
file, linenum); |
buffer_put_cstring(&auth_debug, tmp); |
|
xfree(patterns); |
xfree(patterns); |
goto bad_option; |
goto bad_option; |
} |
} |
|
|
sscanf(patterns, "%255[^/]/%5[0-9]", host, sport) != 2) { |
sscanf(patterns, "%255[^/]/%5[0-9]", host, sport) != 2) { |
debug("%.100s, line %lu: Bad permitopen specification " |
debug("%.100s, line %lu: Bad permitopen specification " |
"<%.100s>", file, linenum, patterns); |
"<%.100s>", file, linenum, patterns); |
snprintf(tmp, sizeof(tmp), "%.100s, line %lu: " |
auth_debug_add("%.100s, line %lu: " |
"Bad permitopen specification", file, linenum); |
"Bad permitopen specification", file, linenum); |
buffer_put_cstring(&auth_debug, tmp); |
|
xfree(patterns); |
xfree(patterns); |
goto bad_option; |
goto bad_option; |
} |
} |
if ((port = a2port(sport)) == 0) { |
if ((port = a2port(sport)) == 0) { |
debug("%.100s, line %lu: Bad permitopen port <%.100s>", |
debug("%.100s, line %lu: Bad permitopen port <%.100s>", |
file, linenum, sport); |
file, linenum, sport); |
snprintf(tmp, sizeof(tmp), "%.100s, line %lu: " |
auth_debug_add("%.100s, line %lu: " |
"Bad permitopen port", file, linenum); |
"Bad permitopen port", file, linenum); |
buffer_put_cstring(&auth_debug, tmp); |
|
xfree(patterns); |
xfree(patterns); |
goto bad_option; |
goto bad_option; |
} |
} |
|
|
} |
} |
|
|
if (!use_privsep) |
if (!use_privsep) |
auth_send_debug(&auth_debug); |
auth_debug_send(); |
|
|
/* grant access */ |
/* grant access */ |
return 1; |
return 1; |
|
|
bad_option: |
bad_option: |
log("Bad options in %.100s file, line %lu: %.50s", |
log("Bad options in %.100s file, line %lu: %.50s", |
file, linenum, opts); |
file, linenum, opts); |
snprintf(tmp, sizeof(tmp), |
auth_debug_add("Bad options in %.100s file, line %lu: %.50s", |
"Bad options in %.100s file, line %lu: %.50s", |
|
file, linenum, opts); |
file, linenum, opts); |
buffer_put_cstring(&auth_debug, tmp); |
|
|
|
if (!use_privsep) |
if (!use_privsep) |
auth_send_debug(&auth_debug); |
auth_debug_send(); |
|
|
/* deny access */ |
/* deny access */ |
return 0; |
return 0; |