Return to auth-options.h CVS log

Up to [local] / src / usr.bin / ssh

Annotation of src/usr.bin/ssh/auth-options.h, Revision 1.31

1.31    ! djm         1: /* $OpenBSD: auth-options.h,v 1.30 2020/08/27 01:07:09 djm Exp $ */
1.11      stevesk     2:
1.2       deraadt     3: /*
1.25      djm         4:  * Copyright (c) 2018 Damien Miller <djm@mindrot.org>
1.2       deraadt     5:  *
1.25      djm         6:  * Permission to use, copy, modify, and distribute this software for any
                      7:  * purpose with or without fee is hereby granted, provided that the above
                      8:  * copyright notice and this permission notice appear in all copies.
                      9:  *
                     10:  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
                     11:  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
                     12:  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
                     13:  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
                     14:  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
                     15:  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
                     16:  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1.2       deraadt    17:  */
1.5       djm        18:
1.1       markus     19: #ifndef AUTH_OPTIONS_H
                     20: #define AUTH_OPTIONS_H
1.8       markus     21:
1.24      djm        22: struct passwd;
                     23: struct sshkey;
1.28      djm        24:
                     25: /* Maximum number of permitopen/permitlisten directives to accept */
1.31    ! djm        26: #define SSH_AUTHOPT_PERMIT_MAX 4096
        !            27:
        !            28: /* Maximum number of environment directives to accept */
        !            29: #define SSH_AUTHOPT_ENV_MAX    1024
1.24      djm        30:
                     31: /*
                     32:  * sshauthopt represents key options parsed from authorized_keys or
                     33:  * from certificate extensions/options.
                     34:  */
                     35: struct sshauthopt {
                     36:        /* Feature flags */
                     37:        int permit_port_forwarding_flag;
                     38:        int permit_agent_forwarding_flag;
                     39:        int permit_x11_forwarding_flag;
                     40:        int permit_pty_flag;
                     41:        int permit_user_rc;
                     42:
                     43:        /* "restrict" keyword was invoked */
                     44:        int restricted;
1.26      djm        45:
                     46:        /* key/principal expiry date */
                     47:        uint64_t valid_before;
1.24      djm        48:
                     49:        /* Certificate-related options */
                     50:        int cert_authority;
                     51:        char *cert_principals;
                     52:
                     53:        int force_tun_device;
                     54:        char *force_command;
                     55:
                     56:        /* Custom environment */
                     57:        size_t nenv;
                     58:        char **env;
                     59:
                     60:        /* Permitted port forwardings */
                     61:        size_t npermitopen;
                     62:        char **permitopen;
1.27      djm        63:
                     64:        /* Permitted listens (remote forwarding) */
                     65:        size_t npermitlisten;
                     66:        char **permitlisten;
1.24      djm        67:
                     68:        /*
                     69:         * Permitted host/addresses (comma-separated)
                     70:         * Caller must check source address matches both lists (if present).
                     71:         */
                     72:        char *required_from_host_cert;
                     73:        char *required_from_host_keys;
1.29      djm        74:
                     75:        /* Key requires user presence asserted */
                     76:        int no_require_user_presence;
1.30      djm        77:        /* Key requires user verification (e.g. PIN) */
                     78:        int require_verify;
1.24      djm        79: };
                     80:
                     81: struct sshauthopt *sshauthopt_new(void);
                     82: struct sshauthopt *sshauthopt_new_with_keys_defaults(void);
                     83: void sshauthopt_free(struct sshauthopt *opts);
                     84: struct sshauthopt *sshauthopt_copy(const struct sshauthopt *orig);
                     85: int sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m, int);
                     86: int sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **opts);
                     87:
                     88: /*
                     89:  * Parse authorized_keys options. Returns an options structure on success
                     90:  * or NULL on failure. Will set errstr on failure.
                     91:  */
                     92: struct sshauthopt *sshauthopt_parse(const char *s, const char **errstr);
                     93:
                     94: /*
                     95:  * Parse certification options to a struct sshauthopt.
                     96:  * Returns options on success or NULL on failure.
                     97:  */
                     98: struct sshauthopt *sshauthopt_from_cert(struct sshkey *k);
                     99:
                    100: /*
                    101:  * Merge key options.
                    102:  */
                    103: struct sshauthopt *sshauthopt_merge(const struct sshauthopt *primary,
                    104:     const struct sshauthopt *additional, const char **errstrp);
1.4       markus    105:
1.1       markus    106: #endif