=================================================================== RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/auth-options.c,v retrieving revision 1.2.2.4 retrieving revision 1.3 diff -u -r1.2.2.4 -r1.3 --- src/usr.bin/ssh/auth-options.c 2001/03/21 18:52:32 1.2.2.4 +++ src/usr.bin/ssh/auth-options.c 2000/09/07 20:27:49 1.3 @@ -2,24 +2,47 @@ * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved + * RSA-based authentication. This code determines whether to admit a login + * based on RSA authentication. This file also contains functions to check + * validity of the host key. + * * As far as I am concerned, the code I have written for this software * can be used freely for any purpose. Any derived versions of this * software must be clearly marked as such, and if the derived work is * incompatible with the protocol description in the RFC file, it must be * called by a name other than "ssh" or "Secure Shell". + * + * + * Copyright (c) 2000 Markus Friedl. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include "includes.h" -RCSID("$OpenBSD: auth-options.c,v 1.2.2.4 2001/03/21 18:52:32 jason Exp $"); +RCSID("$OpenBSD: auth-options.c,v 1.3 2000/09/07 20:27:49 deraadt Exp $"); +#include "ssh.h" #include "packet.h" #include "xmalloc.h" #include "match.h" -#include "log.h" -#include "canohost.h" -#include "channels.h" -#include "auth-options.h" -#include "servconf.h" /* Flags set authorized_keys flags */ int no_port_forwarding_flag = 0; @@ -33,132 +56,99 @@ /* "environment=" options. */ struct envstring *custom_environment = NULL; -extern ServerOptions options; - -void -auth_clear_options(void) -{ - no_agent_forwarding_flag = 0; - no_port_forwarding_flag = 0; - no_pty_flag = 0; - no_x11_forwarding_flag = 0; - while (custom_environment) { - struct envstring *ce = custom_environment; - custom_environment = ce->next; - xfree(ce->s); - xfree(ce); - } - if (forced_command) { - xfree(forced_command); - forced_command = NULL; - } - channel_clear_permitted_opens(); -} - -/* - * return 1 if access is granted, 0 if not. - * side effect: sets key option flags - */ +/* return 1 if access is granted, 0 if not. side effect: sets key option flags */ int -auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum) +auth_parse_options(struct passwd *pw, char *options, unsigned long linenum) { const char *cp; - int i; - - /* reset options */ - auth_clear_options(); - - if (!opts) + if (!options) return 1; - - while (*opts && *opts != ' ' && *opts != '\t') { + while (*options && *options != ' ' && *options != '\t') { cp = "no-port-forwarding"; - if (strncasecmp(opts, cp, strlen(cp)) == 0) { + if (strncmp(options, cp, strlen(cp)) == 0) { packet_send_debug("Port forwarding disabled."); no_port_forwarding_flag = 1; - opts += strlen(cp); + options += strlen(cp); goto next_option; } cp = "no-agent-forwarding"; - if (strncasecmp(opts, cp, strlen(cp)) == 0) { + if (strncmp(options, cp, strlen(cp)) == 0) { packet_send_debug("Agent forwarding disabled."); no_agent_forwarding_flag = 1; - opts += strlen(cp); + options += strlen(cp); goto next_option; } cp = "no-X11-forwarding"; - if (strncasecmp(opts, cp, strlen(cp)) == 0) { + if (strncmp(options, cp, strlen(cp)) == 0) { packet_send_debug("X11 forwarding disabled."); no_x11_forwarding_flag = 1; - opts += strlen(cp); + options += strlen(cp); goto next_option; } cp = "no-pty"; - if (strncasecmp(opts, cp, strlen(cp)) == 0) { + if (strncmp(options, cp, strlen(cp)) == 0) { packet_send_debug("Pty allocation disabled."); no_pty_flag = 1; - opts += strlen(cp); + options += strlen(cp); goto next_option; } cp = "command=\""; - if (strncasecmp(opts, cp, strlen(cp)) == 0) { - opts += strlen(cp); - forced_command = xmalloc(strlen(opts) + 1); + if (strncmp(options, cp, strlen(cp)) == 0) { + int i; + options += strlen(cp); + forced_command = xmalloc(strlen(options) + 1); i = 0; - while (*opts) { - if (*opts == '"') + while (*options) { + if (*options == '"') break; - if (*opts == '\\' && opts[1] == '"') { - opts += 2; + if (*options == '\\' && options[1] == '"') { + options += 2; forced_command[i++] = '"'; continue; } - forced_command[i++] = *opts++; + forced_command[i++] = *options++; } - if (!*opts) { + if (!*options) { debug("%.100s, line %lu: missing end quote", - file, linenum); + SSH_USER_PERMITTED_KEYS, linenum); packet_send_debug("%.100s, line %lu: missing end quote", - file, linenum); - xfree(forced_command); - forced_command = NULL; - goto bad_option; + SSH_USER_PERMITTED_KEYS, linenum); + continue; } forced_command[i] = 0; packet_send_debug("Forced command: %.900s", forced_command); - opts++; + options++; goto next_option; } cp = "environment=\""; - if (strncasecmp(opts, cp, strlen(cp)) == 0) { + if (strncmp(options, cp, strlen(cp)) == 0) { + int i; char *s; struct envstring *new_envstring; - - opts += strlen(cp); - s = xmalloc(strlen(opts) + 1); + options += strlen(cp); + s = xmalloc(strlen(options) + 1); i = 0; - while (*opts) { - if (*opts == '"') + while (*options) { + if (*options == '"') break; - if (*opts == '\\' && opts[1] == '"') { - opts += 2; + if (*options == '\\' && options[1] == '"') { + options += 2; s[i++] = '"'; continue; } - s[i++] = *opts++; + s[i++] = *options++; } - if (!*opts) { + if (!*options) { debug("%.100s, line %lu: missing end quote", - file, linenum); + SSH_USER_PERMITTED_KEYS, linenum); packet_send_debug("%.100s, line %lu: missing end quote", - file, linenum); - xfree(s); - goto bad_option; + SSH_USER_PERMITTED_KEYS, linenum); + continue; } s[i] = 0; packet_send_debug("Adding to environment: %.900s", s); debug("Adding to environment: %.900s", s); - opts++; + options++; new_envstring = xmalloc(sizeof(struct envstring)); new_envstring->s = s; new_envstring->next = custom_environment; @@ -166,125 +156,81 @@ goto next_option; } cp = "from=\""; - if (strncasecmp(opts, cp, strlen(cp)) == 0) { + if (strncmp(options, cp, strlen(cp)) == 0) { int mname, mip; - const char *remote_ip = get_remote_ipaddr(); - const char *remote_host = get_canonical_hostname( - options.reverse_mapping_check); - char *patterns = xmalloc(strlen(opts) + 1); - - opts += strlen(cp); + char *patterns = xmalloc(strlen(options) + 1); + int i; + options += strlen(cp); i = 0; - while (*opts) { - if (*opts == '"') + while (*options) { + if (*options == '"') break; - if (*opts == '\\' && opts[1] == '"') { - opts += 2; + if (*options == '\\' && options[1] == '"') { + options += 2; patterns[i++] = '"'; continue; } - patterns[i++] = *opts++; + patterns[i++] = *options++; } - if (!*opts) { + if (!*options) { debug("%.100s, line %lu: missing end quote", - file, linenum); + SSH_USER_PERMITTED_KEYS, linenum); packet_send_debug("%.100s, line %lu: missing end quote", - file, linenum); - xfree(patterns); - goto bad_option; + SSH_USER_PERMITTED_KEYS, linenum); + continue; } patterns[i] = 0; - opts++; + options++; /* * Deny access if we get a negative * match for the hostname or the ip * or if we get not match at all */ - mname = match_hostname(remote_host, patterns, - strlen(patterns)); - mip = match_hostname(remote_ip, patterns, - strlen(patterns)); + mname = match_hostname(get_canonical_hostname(), + patterns, strlen(patterns)); + mip = match_hostname(get_remote_ipaddr(), + patterns, strlen(patterns)); xfree(patterns); if (mname == -1 || mip == -1 || (mname != 1 && mip != 1)) { - log("Authentication tried for %.100s with " - "correct key but not from a permitted " - "host (host=%.200s, ip=%.200s).", - pw->pw_name, remote_host, remote_ip); - packet_send_debug("Your host '%.200s' is not " - "permitted to use this key for login.", - remote_host); + log("Authentication tried for %.100s with correct key but not from a permitted host (host=%.200s, ip=%.200s).", + pw->pw_name, get_canonical_hostname(), + get_remote_ipaddr()); + packet_send_debug("Your host '%.200s' is not permitted to use this key for login.", + get_canonical_hostname()); + /* key invalid for this host, reset flags */ + no_agent_forwarding_flag = 0; + no_port_forwarding_flag = 0; + no_pty_flag = 0; + no_x11_forwarding_flag = 0; + while (custom_environment) { + struct envstring *ce = custom_environment; + custom_environment = ce->next; + xfree(ce->s); + xfree(ce); + } + if (forced_command) { + xfree(forced_command); + forced_command = NULL; + } /* deny access */ return 0; } /* Host name matches. */ goto next_option; } - cp = "permitopen=\""; - if (strncasecmp(opts, cp, strlen(cp)) == 0) { - u_short port; - char *c, *ep; - char *patterns = xmalloc(strlen(opts) + 1); - - opts += strlen(cp); - i = 0; - while (*opts) { - if (*opts == '"') - break; - if (*opts == '\\' && opts[1] == '"') { - opts += 2; - patterns[i++] = '"'; - continue; - } - patterns[i++] = *opts++; - } - if (!*opts) { - debug("%.100s, line %lu: missing end quote", - file, linenum); - packet_send_debug("%.100s, line %lu: missing end quote", - file, linenum); - xfree(patterns); - goto bad_option; - } - patterns[i] = 0; - opts++; - c = strchr(patterns, ':'); - if (c == NULL) { - debug("%.100s, line %lu: permitopen: missing colon <%.100s>", - file, linenum, patterns); - packet_send_debug("%.100s, line %lu: missing colon", - file, linenum); - xfree(patterns); - goto bad_option; - } - *c = 0; - c++; - port = strtol(c, &ep, 0); - if (c == ep) { - debug("%.100s, line %lu: permitopen: missing port <%.100s>", - file, linenum, patterns); - packet_send_debug("%.100s, line %lu: missing port", - file, linenum); - xfree(patterns); - goto bad_option; - } - if (options.allow_tcp_forwarding) - channel_add_permitted_opens(patterns, port); - xfree(patterns); - goto next_option; - } next_option: /* * Skip the comma, and move to the next option * (or break out if there are no more). */ - if (!*opts) + if (!*options) fatal("Bugs in auth-options.c option processing."); - if (*opts == ' ' || *opts == '\t') + if (*options == ' ' || *options == '\t') break; /* End of options. */ - if (*opts != ',') + if (*options != ',') goto bad_option; - opts++; + options++; /* Process the next option. */ } /* grant access */ @@ -292,9 +238,9 @@ bad_option: log("Bad options in %.100s file, line %lu: %.50s", - file, linenum, opts); + SSH_USER_PERMITTED_KEYS, linenum, options); packet_send_debug("Bad options in %.100s file, line %lu: %.50s", - file, linenum, opts); + SSH_USER_PERMITTED_KEYS, linenum, options); /* deny access */ return 0; }