Return to auth-options.h CVS log

Up to [local] / src / usr.bin / ssh

Annotation of src/usr.bin/ssh/auth-options.h, Revision 1.28

1.28    ! djm         1: /* $OpenBSD: auth-options.h,v 1.27 2018/06/06 18:23:32 djm Exp $ */
1.11      stevesk     2:
1.2       deraadt     3: /*
1.25      djm         4:  * Copyright (c) 2018 Damien Miller <djm@mindrot.org>
1.2       deraadt     5:  *
1.25      djm         6:  * Permission to use, copy, modify, and distribute this software for any
                      7:  * purpose with or without fee is hereby granted, provided that the above
                      8:  * copyright notice and this permission notice appear in all copies.
                      9:  *
                     10:  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
                     11:  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
                     12:  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
                     13:  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
                     14:  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
                     15:  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
                     16:  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1.2       deraadt    17:  */
1.5       djm        18:
1.1       markus     19: #ifndef AUTH_OPTIONS_H
                     20: #define AUTH_OPTIONS_H
1.8       markus     21:
1.24      djm        22: struct passwd;
                     23: struct sshkey;
1.28    ! djm        24:
        !            25: /* Maximum number of permitopen/permitlisten directives to accept */
        !            26: #define SSH_AUTHOPT_PERMIT_MAX 4096
1.24      djm        27:
                     28: /*
                     29:  * sshauthopt represents key options parsed from authorized_keys or
                     30:  * from certificate extensions/options.
                     31:  */
                     32: struct sshauthopt {
                     33:        /* Feature flags */
                     34:        int permit_port_forwarding_flag;
                     35:        int permit_agent_forwarding_flag;
                     36:        int permit_x11_forwarding_flag;
                     37:        int permit_pty_flag;
                     38:        int permit_user_rc;
                     39:
                     40:        /* "restrict" keyword was invoked */
                     41:        int restricted;
1.26      djm        42:
                     43:        /* key/principal expiry date */
                     44:        uint64_t valid_before;
1.24      djm        45:
                     46:        /* Certificate-related options */
                     47:        int cert_authority;
                     48:        char *cert_principals;
                     49:
                     50:        int force_tun_device;
                     51:        char *force_command;
                     52:
                     53:        /* Custom environment */
                     54:        size_t nenv;
                     55:        char **env;
                     56:
                     57:        /* Permitted port forwardings */
                     58:        size_t npermitopen;
                     59:        char **permitopen;
1.27      djm        60:
                     61:        /* Permitted listens (remote forwarding) */
                     62:        size_t npermitlisten;
                     63:        char **permitlisten;
1.24      djm        64:
                     65:        /*
                     66:         * Permitted host/addresses (comma-separated)
                     67:         * Caller must check source address matches both lists (if present).
                     68:         */
                     69:        char *required_from_host_cert;
                     70:        char *required_from_host_keys;
                     71: };
                     72:
                     73: struct sshauthopt *sshauthopt_new(void);
                     74: struct sshauthopt *sshauthopt_new_with_keys_defaults(void);
                     75: void sshauthopt_free(struct sshauthopt *opts);
                     76: struct sshauthopt *sshauthopt_copy(const struct sshauthopt *orig);
                     77: int sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m, int);
                     78: int sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **opts);
                     79:
                     80: /*
                     81:  * Parse authorized_keys options. Returns an options structure on success
                     82:  * or NULL on failure. Will set errstr on failure.
                     83:  */
                     84: struct sshauthopt *sshauthopt_parse(const char *s, const char **errstr);
                     85:
                     86: /*
                     87:  * Parse certification options to a struct sshauthopt.
                     88:  * Returns options on success or NULL on failure.
                     89:  */
                     90: struct sshauthopt *sshauthopt_from_cert(struct sshkey *k);
                     91:
                     92: /*
                     93:  * Merge key options.
                     94:  */
                     95: struct sshauthopt *sshauthopt_merge(const struct sshauthopt *primary,
                     96:     const struct sshauthopt *additional, const char **errstrp);
1.4       markus     97:
1.1       markus     98: #endif