1 /* $OpenBSD: auth-options.c,v 1.102 2025/09/15 04:38:00 djm Exp $ */
2 /*
3 * Copyright (c) 2018 Damien Miller <djm@mindrot.org>
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18 #include "includes.h"
19
20 #include <sys/types.h>
21 #include <sys/queue.h>
22
23 #include <stdlib.h>
24 #include <netdb.h>
25 #include <pwd.h>
26 #include <string.h>
27 #include <stdio.h>
28 #include <stdint.h>
29 #include <stdarg.h>
30 #include <ctype.h>
31 #include <limits.h>
32
33 #include "xmalloc.h"
34 #include "ssherr.h"
35 #include "log.h"
36 #include "sshbuf.h"
37 #include "misc.h"
38 #include "sshkey.h"
39 #include "match.h"
40 #include "ssh2.h"
41 #include "auth-options.h"
42
43 static int
dup_strings(char *** dstp,size_t * ndstp,char ** src,size_t nsrc)44 dup_strings(char ***dstp, size_t *ndstp, char **src, size_t nsrc)
45 {
46 char **dst;
47 size_t i, j;
48
49 *dstp = NULL;
50 *ndstp = 0;
51
52 if (nsrc == 0)
53 return 0;
54 if (nsrc >= SIZE_MAX / sizeof(*src) ||
55 (dst = calloc(nsrc, sizeof(*src))) == NULL)
56 return -1;
57 for (i = 0; i < nsrc; i++) {
58 if ((dst[i] = strdup(src[i])) == NULL) {
59 for (j = 0; j < i; j++)
60 free(dst[j]);
61 free(dst);
62 return -1;
63 }
64 }
65 /* success */
66 *dstp = dst;
67 *ndstp = nsrc;
68 return 0;
69 }
70
71 #define OPTIONS_CRITICAL 1
72 #define OPTIONS_EXTENSIONS 2
73 static int
cert_option_list(struct sshauthopt * opts,struct sshbuf * oblob,u_int which,int crit)74 cert_option_list(struct sshauthopt *opts, struct sshbuf *oblob,
75 u_int which, int crit)
76 {
77 char *command, *allowed;
78 char *name = NULL;
79 struct sshbuf *c = NULL, *data = NULL;
80 int r, ret = -1, found;
81
82 if ((c = sshbuf_fromb(oblob)) == NULL) {
83 error_f("sshbuf_fromb failed");
84 goto out;
85 }
86
87 while (sshbuf_len(c) > 0) {
88 sshbuf_free(data);
89 data = NULL;
90 if ((r = sshbuf_get_cstring(c, &name, NULL)) != 0 ||
91 (r = sshbuf_froms(c, &data)) != 0) {
92 error_r(r, "Unable to parse certificate options");
93 goto out;
94 }
95 debug3("found certificate option \"%.100s\" len %zu",
96 name, sshbuf_len(data));
97 found = 0;
98 if ((which & OPTIONS_EXTENSIONS) != 0) {
99 if (strcmp(name, "no-touch-required") == 0) {
100 opts->no_require_user_presence = 1;
101 found = 1;
102 } else if (strcmp(name, "permit-X11-forwarding") == 0) {
103 opts->permit_x11_forwarding_flag = 1;
104 found = 1;
105 } else if (strcmp(name,
106 "permit-agent-forwarding") == 0) {
107 opts->permit_agent_forwarding_flag = 1;
108 found = 1;
109 } else if (strcmp(name,
110 "permit-port-forwarding") == 0) {
111 opts->permit_port_forwarding_flag = 1;
112 found = 1;
113 } else if (strcmp(name, "permit-pty") == 0) {
114 opts->permit_pty_flag = 1;
115 found = 1;
116 } else if (strcmp(name, "permit-user-rc") == 0) {
117 opts->permit_user_rc = 1;
118 found = 1;
119 }
120 }
121 if (!found && (which & OPTIONS_CRITICAL) != 0) {
122 if (strcmp(name, "verify-required") == 0) {
123 opts->require_verify = 1;
124 found = 1;
125 } else if (strcmp(name, "force-command") == 0) {
126 if ((r = sshbuf_get_cstring(data, &command,
127 NULL)) != 0) {
128 error_r(r, "Unable to parse \"%s\" "
129 "section", name);
130 goto out;
131 }
132 if (opts->force_command != NULL) {
133 error("Certificate has multiple "
134 "force-command options");
135 free(command);
136 goto out;
137 }
138 opts->force_command = command;
139 found = 1;
140 } else if (strcmp(name, "source-address") == 0) {
141 if ((r = sshbuf_get_cstring(data, &allowed,
142 NULL)) != 0) {
143 error_r(r, "Unable to parse \"%s\" "
144 "section", name);
145 goto out;
146 }
147 if (opts->required_from_host_cert != NULL) {
148 error("Certificate has multiple "
149 "source-address options");
150 free(allowed);
151 goto out;
152 }
153 /* Check syntax */
154 if (addr_match_cidr_list(NULL, allowed) == -1) {
155 error("Certificate source-address "
156 "contents invalid");
157 free(allowed);
158 goto out;
159 }
160 opts->required_from_host_cert = allowed;
161 found = 1;
162 }
163 }
164
165 if (!found) {
166 if (crit) {
167 error("Certificate critical option \"%s\" "
168 "is not supported", name);
169 goto out;
170 } else {
171 logit("Certificate extension \"%s\" "
172 "is not supported", name);
173 }
174 } else if (sshbuf_len(data) != 0) {
175 error("Certificate option \"%s\" corrupt "
176 "(extra data)", name);
177 goto out;
178 }
179 free(name);
180 name = NULL;
181 }
182 /* successfully parsed all options */
183 ret = 0;
184
185 out:
186 free(name);
187 sshbuf_free(data);
188 sshbuf_free(c);
189 return ret;
190 }
191
192 struct sshauthopt *
sshauthopt_new(void)193 sshauthopt_new(void)
194 {
195 struct sshauthopt *ret;
196
197 if ((ret = calloc(1, sizeof(*ret))) == NULL)
198 return NULL;
199 ret->force_tun_device = -1;
200 return ret;
201 }
202
203 void
sshauthopt_free(struct sshauthopt * opts)204 sshauthopt_free(struct sshauthopt *opts)
205 {
206 size_t i;
207
208 if (opts == NULL)
209 return;
210
211 free(opts->cert_principals);
212 free(opts->force_command);
213 free(opts->required_from_host_cert);
214 free(opts->required_from_host_keys);
215
216 for (i = 0; i < opts->nenv; i++)
217 free(opts->env[i]);
218 free(opts->env);
219
220 for (i = 0; i < opts->npermitopen; i++)
221 free(opts->permitopen[i]);
222 free(opts->permitopen);
223
224 for (i = 0; i < opts->npermitlisten; i++)
225 free(opts->permitlisten[i]);
226 free(opts->permitlisten);
227
228 freezero(opts, sizeof(*opts));
229 }
230
231 struct sshauthopt *
sshauthopt_new_with_keys_defaults(void)232 sshauthopt_new_with_keys_defaults(void)
233 {
234 struct sshauthopt *ret = NULL;
235
236 if ((ret = sshauthopt_new()) == NULL)
237 return NULL;
238
239 /* Defaults for authorized_keys flags */
240 ret->permit_port_forwarding_flag = 1;
241 ret->permit_agent_forwarding_flag = 1;
242 ret->permit_x11_forwarding_flag = 1;
243 ret->permit_pty_flag = 1;
244 ret->permit_user_rc = 1;
245 return ret;
246 }
247
248 /*
249 * Parse and record a permitopen/permitlisten directive.
250 * Return 0 on success. Return -1 on failure and sets *errstrp to error reason.
251 */
252 static int
handle_permit(const char ** optsp,int allow_bare_port,char *** permitsp,size_t * npermitsp,const char ** errstrp)253 handle_permit(const char **optsp, int allow_bare_port,
254 char ***permitsp, size_t *npermitsp, const char **errstrp)
255 {
256 char *opt, *tmp, *cp, *host, **permits = *permitsp;
257 size_t npermits = *npermitsp;
258 const char *errstr = "unknown error";
259
260 if (npermits > SSH_AUTHOPT_PERMIT_MAX) {
261 *errstrp = "too many permission directives";
262 return -1;
263 }
264 if ((opt = opt_dequote(optsp, &errstr)) == NULL) {
265 return -1;
266 }
267 if (allow_bare_port && strchr(opt, ':') == NULL) {
268 /*
269 * Allow a bare port number in permitlisten to indicate a
270 * listen_host wildcard.
271 */
272 if (asprintf(&tmp, "*:%s", opt) == -1) {
273 free(opt);
274 *errstrp = "memory allocation failed";
275 return -1;
276 }
277 free(opt);
278 opt = tmp;
279 }
280 if ((tmp = strdup(opt)) == NULL) {
281 free(opt);
282 *errstrp = "memory allocation failed";
283 return -1;
284 }
285 cp = tmp;
286 /* validate syntax before recording it. */
287 host = hpdelim2(&cp, NULL);
288 if (host == NULL || strlen(host) >= NI_MAXHOST) {
289 free(tmp);
290 free(opt);
291 *errstrp = "invalid permission hostname";
292 return -1;
293 }
294 /*
295 * don't want to use permitopen_port to avoid
296 * dependency on channels.[ch] here.
297 */
298 if (cp == NULL ||
299 (strcmp(cp, "*") != 0 && a2port(cp) <= 0)) {
300 free(tmp);
301 free(opt);
302 *errstrp = "invalid permission port";
303 return -1;
304 }
305 /* XXX - add streamlocal support */
306 free(tmp);
307 /* Record it */
308 if ((permits = recallocarray(permits, npermits, npermits + 1,
309 sizeof(*permits))) == NULL) {
310 free(opt);
311 /* NB. don't update *permitsp if alloc fails */
312 *errstrp = "memory allocation failed";
313 return -1;
314 }
315 permits[npermits++] = opt;
316 *permitsp = permits;
317 *npermitsp = npermits;
318 return 0;
319 }
320
321 struct sshauthopt *
sshauthopt_parse(const char * opts,const char ** errstrp)322 sshauthopt_parse(const char *opts, const char **errstrp)
323 {
324 char **oarray, *opt, *cp, *tmp;
325 int r;
326 struct sshauthopt *ret = NULL;
327 const char *errstr = "unknown error";
328 uint64_t valid_before;
329 size_t i, l;
330
331 if (errstrp != NULL)
332 *errstrp = NULL;
333 if ((ret = sshauthopt_new_with_keys_defaults()) == NULL)
334 goto alloc_fail;
335
336 if (opts == NULL)
337 return ret;
338
339 while (*opts && *opts != ' ' && *opts != '\t') {
340 /* flag options */
341 if ((r = opt_flag("restrict", 0, &opts)) != -1) {
342 ret->restricted = 1;
343 ret->permit_port_forwarding_flag = 0;
344 ret->permit_agent_forwarding_flag = 0;
345 ret->permit_x11_forwarding_flag = 0;
346 ret->permit_pty_flag = 0;
347 ret->permit_user_rc = 0;
348 } else if ((r = opt_flag("cert-authority", 0, &opts)) != -1) {
349 ret->cert_authority = r;
350 } else if ((r = opt_flag("port-forwarding", 1, &opts)) != -1) {
351 ret->permit_port_forwarding_flag = r == 1;
352 } else if ((r = opt_flag("agent-forwarding", 1, &opts)) != -1) {
353 ret->permit_agent_forwarding_flag = r == 1;
354 } else if ((r = opt_flag("x11-forwarding", 1, &opts)) != -1) {
355 ret->permit_x11_forwarding_flag = r == 1;
356 } else if ((r = opt_flag("touch-required", 1, &opts)) != -1) {
357 ret->no_require_user_presence = r != 1; /* NB. flip */
358 } else if ((r = opt_flag("verify-required", 1, &opts)) != -1) {
359 ret->require_verify = r == 1;
360 } else if ((r = opt_flag("pty", 1, &opts)) != -1) {
361 ret->permit_pty_flag = r == 1;
362 } else if ((r = opt_flag("user-rc", 1, &opts)) != -1) {
363 ret->permit_user_rc = r == 1;
364 } else if (opt_match(&opts, "command")) {
365 if (ret->force_command != NULL) {
366 errstr = "multiple \"command\" clauses";
367 goto fail;
368 }
369 ret->force_command = opt_dequote(&opts, &errstr);
370 if (ret->force_command == NULL)
371 goto fail;
372 } else if (opt_match(&opts, "principals")) {
373 if (ret->cert_principals != NULL) {
374 errstr = "multiple \"principals\" clauses";
375 goto fail;
376 }
377 ret->cert_principals = opt_dequote(&opts, &errstr);
378 if (ret->cert_principals == NULL)
379 goto fail;
380 } else if (opt_match(&opts, "from")) {
381 if (ret->required_from_host_keys != NULL) {
382 errstr = "multiple \"from\" clauses";
383 goto fail;
384 }
385 ret->required_from_host_keys = opt_dequote(&opts,
386 &errstr);
387 if (ret->required_from_host_keys == NULL)
388 goto fail;
389 } else if (opt_match(&opts, "expiry-time")) {
390 if ((opt = opt_dequote(&opts, &errstr)) == NULL)
391 goto fail;
392 if (parse_absolute_time(opt, &valid_before) != 0 ||
393 valid_before == 0) {
394 free(opt);
395 errstr = "invalid expires time";
396 goto fail;
397 }
398 free(opt);
399 if (ret->valid_before == 0 ||
400 valid_before < ret->valid_before)
401 ret->valid_before = valid_before;
402 } else if (opt_match(&opts, "environment")) {
403 if (ret->nenv > SSH_AUTHOPT_ENV_MAX) {
404 errstr = "too many environment strings";
405 goto fail;
406 }
407 if ((opt = opt_dequote(&opts, &errstr)) == NULL)
408 goto fail;
409 /* env name must be alphanumeric and followed by '=' */
410 if ((tmp = strchr(opt, '=')) == NULL) {
411 free(opt);
412 errstr = "invalid environment string";
413 goto fail;
414 }
415 if ((cp = strdup(opt)) == NULL) {
416 free(opt);
417 goto alloc_fail;
418 }
419 l = (size_t)(tmp - opt);
420 cp[l] = '\0'; /* truncate at '=' */
421 if (!valid_env_name(cp)) {
422 free(cp);
423 free(opt);
424 errstr = "invalid environment string";
425 goto fail;
426 }
427 /* Check for duplicates; XXX O(n*log(n)) */
428 for (i = 0; i < ret->nenv; i++) {
429 if (strncmp(ret->env[i], cp, l) == 0 &&
430 ret->env[i][l] == '=')
431 break;
432 }
433 free(cp);
434 /* First match wins */
435 if (i >= ret->nenv) {
436 /* Append it. */
437 oarray = ret->env;
438 if ((ret->env = recallocarray(ret->env,
439 ret->nenv, ret->nenv + 1,
440 sizeof(*ret->env))) == NULL) {
441 free(opt);
442 /* put it back for cleanup */
443 ret->env = oarray;
444 goto alloc_fail;
445 }
446 ret->env[ret->nenv++] = opt;
447 opt = NULL; /* transferred */
448 }
449 free(opt);
450 } else if (opt_match(&opts, "permitopen")) {
451 if (handle_permit(&opts, 0, &ret->permitopen,
452 &ret->npermitopen, &errstr) != 0)
453 goto fail;
454 } else if (opt_match(&opts, "permitlisten")) {
455 if (handle_permit(&opts, 1, &ret->permitlisten,
456 &ret->npermitlisten, &errstr) != 0)
457 goto fail;
458 } else if (opt_match(&opts, "tunnel")) {
459 if ((opt = opt_dequote(&opts, &errstr)) == NULL)
460 goto fail;
461 ret->force_tun_device = a2tun(opt, NULL);
462 free(opt);
463 if (ret->force_tun_device == SSH_TUNID_ERR) {
464 errstr = "invalid tun device";
465 goto fail;
466 }
467 }
468 /*
469 * Skip the comma, and move to the next option
470 * (or break out if there are no more).
471 */
472 if (*opts == '\0' || *opts == ' ' || *opts == '\t')
473 break; /* End of options. */
474 /* Anything other than a comma is an unknown option */
475 if (*opts != ',') {
476 errstr = "unknown key option";
477 goto fail;
478 }
479 opts++;
480 if (*opts == '\0') {
481 errstr = "unexpected end-of-options";
482 goto fail;
483 }
484 }
485
486 /* success */
487 if (errstrp != NULL)
488 *errstrp = NULL;
489 return ret;
490
491 alloc_fail:
492 errstr = "memory allocation failed";
493 fail:
494 sshauthopt_free(ret);
495 if (errstrp != NULL)
496 *errstrp = errstr;
497 return NULL;
498 }
499
500 struct sshauthopt *
sshauthopt_from_cert(struct sshkey * k)501 sshauthopt_from_cert(struct sshkey *k)
502 {
503 struct sshauthopt *ret;
504
505 if (k == NULL || !sshkey_type_is_cert(k->type) || k->cert == NULL ||
506 k->cert->type != SSH2_CERT_TYPE_USER)
507 return NULL;
508
509 if ((ret = sshauthopt_new()) == NULL)
510 return NULL;
511
512 /* Handle options and critical extensions separately */
513 if (cert_option_list(ret, k->cert->critical,
514 OPTIONS_CRITICAL, 1) == -1) {
515 sshauthopt_free(ret);
516 return NULL;
517 }
518 if (cert_option_list(ret, k->cert->extensions,
519 OPTIONS_EXTENSIONS, 0) == -1) {
520 sshauthopt_free(ret);
521 return NULL;
522 }
523 /* success */
524 return ret;
525 }
526
527 /*
528 * Merges "additional" options to "primary" and returns the result.
529 * NB. Some options from primary have primacy.
530 */
531 struct sshauthopt *
sshauthopt_merge(const struct sshauthopt * primary,const struct sshauthopt * additional,const char ** errstrp)532 sshauthopt_merge(const struct sshauthopt *primary,
533 const struct sshauthopt *additional, const char **errstrp)
534 {
535 struct sshauthopt *ret;
536 const char *errstr = "internal error";
537 const char *tmp;
538
539 if (errstrp != NULL)
540 *errstrp = NULL;
541
542 if ((ret = sshauthopt_new()) == NULL)
543 goto alloc_fail;
544
545 /* cert_authority and cert_principals are cleared in result */
546
547 /* Prefer access lists from primary. */
548 /* XXX err is both set and mismatch? */
549 tmp = primary->required_from_host_cert;
550 if (tmp == NULL)
551 tmp = additional->required_from_host_cert;
552 if (tmp != NULL && (ret->required_from_host_cert = strdup(tmp)) == NULL)
553 goto alloc_fail;
554 tmp = primary->required_from_host_keys;
555 if (tmp == NULL)
556 tmp = additional->required_from_host_keys;
557 if (tmp != NULL && (ret->required_from_host_keys = strdup(tmp)) == NULL)
558 goto alloc_fail;
559
560 /*
561 * force_tun_device, permitopen/permitlisten and environment all
562 * prefer the primary.
563 */
564 ret->force_tun_device = primary->force_tun_device;
565 if (ret->force_tun_device == -1)
566 ret->force_tun_device = additional->force_tun_device;
567 if (primary->nenv > 0) {
568 if (dup_strings(&ret->env, &ret->nenv,
569 primary->env, primary->nenv) != 0)
570 goto alloc_fail;
571 } else if (additional->nenv) {
572 if (dup_strings(&ret->env, &ret->nenv,
573 additional->env, additional->nenv) != 0)
574 goto alloc_fail;
575 }
576 if (primary->npermitopen > 0) {
577 if (dup_strings(&ret->permitopen, &ret->npermitopen,
578 primary->permitopen, primary->npermitopen) != 0)
579 goto alloc_fail;
580 } else if (additional->npermitopen > 0) {
581 if (dup_strings(&ret->permitopen, &ret->npermitopen,
582 additional->permitopen, additional->npermitopen) != 0)
583 goto alloc_fail;
584 }
585
586 if (primary->npermitlisten > 0) {
587 if (dup_strings(&ret->permitlisten, &ret->npermitlisten,
588 primary->permitlisten, primary->npermitlisten) != 0)
589 goto alloc_fail;
590 } else if (additional->npermitlisten > 0) {
591 if (dup_strings(&ret->permitlisten, &ret->npermitlisten,
592 additional->permitlisten, additional->npermitlisten) != 0)
593 goto alloc_fail;
594 }
595
596 #define OPTFLAG_AND(x) ret->x = (primary->x == 1) && (additional->x == 1)
597 #define OPTFLAG_OR(x) ret->x = (primary->x == 1) || (additional->x == 1)
598 /* Permissive flags are logical-AND (i.e. must be set in both) */
599 OPTFLAG_AND(permit_port_forwarding_flag);
600 OPTFLAG_AND(permit_agent_forwarding_flag);
601 OPTFLAG_AND(permit_x11_forwarding_flag);
602 OPTFLAG_AND(permit_pty_flag);
603 OPTFLAG_AND(permit_user_rc);
604 OPTFLAG_AND(no_require_user_presence);
605 /* Restrictive flags are logical-OR (i.e. must be set in either) */
606 OPTFLAG_OR(require_verify);
607 #undef OPTFLAG_AND
608
609 /* Earliest expiry time should win */
610 if (primary->valid_before != 0)
611 ret->valid_before = primary->valid_before;
612 if (additional->valid_before != 0 &&
613 additional->valid_before < ret->valid_before)
614 ret->valid_before = additional->valid_before;
615
616 /*
617 * When both multiple forced-command are specified, only
618 * proceed if they are identical, otherwise fail.
619 */
620 if (primary->force_command != NULL &&
621 additional->force_command != NULL) {
622 if (strcmp(primary->force_command,
623 additional->force_command) == 0) {
624 /* ok */
625 ret->force_command = strdup(primary->force_command);
626 if (ret->force_command == NULL)
627 goto alloc_fail;
628 } else {
629 errstr = "forced command options do not match";
630 goto fail;
631 }
632 } else if (primary->force_command != NULL) {
633 if ((ret->force_command = strdup(
634 primary->force_command)) == NULL)
635 goto alloc_fail;
636 } else if (additional->force_command != NULL) {
637 if ((ret->force_command = strdup(
638 additional->force_command)) == NULL)
639 goto alloc_fail;
640 }
641 /* success */
642 if (errstrp != NULL)
643 *errstrp = NULL;
644 return ret;
645
646 alloc_fail:
647 errstr = "memory allocation failed";
648 fail:
649 if (errstrp != NULL)
650 *errstrp = errstr;
651 sshauthopt_free(ret);
652 return NULL;
653 }
654
655 /*
656 * Copy options
657 */
658 struct sshauthopt *
sshauthopt_copy(const struct sshauthopt * orig)659 sshauthopt_copy(const struct sshauthopt *orig)
660 {
661 struct sshauthopt *ret;
662
663 if ((ret = sshauthopt_new()) == NULL)
664 return NULL;
665
666 #define OPTSCALAR(x) ret->x = orig->x
667 OPTSCALAR(permit_port_forwarding_flag);
668 OPTSCALAR(permit_agent_forwarding_flag);
669 OPTSCALAR(permit_x11_forwarding_flag);
670 OPTSCALAR(permit_pty_flag);
671 OPTSCALAR(permit_user_rc);
672 OPTSCALAR(restricted);
673 OPTSCALAR(cert_authority);
674 OPTSCALAR(force_tun_device);
675 OPTSCALAR(valid_before);
676 OPTSCALAR(no_require_user_presence);
677 OPTSCALAR(require_verify);
678 #undef OPTSCALAR
679 #define OPTSTRING(x) \
680 do { \
681 if (orig->x != NULL && (ret->x = strdup(orig->x)) == NULL) { \
682 sshauthopt_free(ret); \
683 return NULL; \
684 } \
685 } while (0)
686 OPTSTRING(cert_principals);
687 OPTSTRING(force_command);
688 OPTSTRING(required_from_host_cert);
689 OPTSTRING(required_from_host_keys);
690 #undef OPTSTRING
691
692 if (dup_strings(&ret->env, &ret->nenv, orig->env, orig->nenv) != 0 ||
693 dup_strings(&ret->permitopen, &ret->npermitopen,
694 orig->permitopen, orig->npermitopen) != 0 ||
695 dup_strings(&ret->permitlisten, &ret->npermitlisten,
696 orig->permitlisten, orig->npermitlisten) != 0) {
697 sshauthopt_free(ret);
698 return NULL;
699 }
700 return ret;
701 }
702
703 static int
serialise_array(struct sshbuf * m,char ** a,size_t n)704 serialise_array(struct sshbuf *m, char **a, size_t n)
705 {
706 struct sshbuf *b;
707 size_t i;
708 int r = SSH_ERR_INTERNAL_ERROR;
709
710 if (n > INT_MAX)
711 return SSH_ERR_INTERNAL_ERROR;
712
713 if ((b = sshbuf_new()) == NULL) {
714 return SSH_ERR_ALLOC_FAIL;
715 }
716 for (i = 0; i < n; i++) {
717 if ((r = sshbuf_put_cstring(b, a[i])) != 0)
718 goto out;
719 }
720 if ((r = sshbuf_put_u32(m, n)) != 0 ||
721 (r = sshbuf_put_stringb(m, b)) != 0)
722 goto out;
723 /* success */
724 r = 0;
725 out:
726 sshbuf_free(b);
727 return r;
728 }
729
730 static int
deserialise_array(struct sshbuf * m,char *** ap,size_t * np)731 deserialise_array(struct sshbuf *m, char ***ap, size_t *np)
732 {
733 char **a = NULL;
734 size_t i, n = 0;
735 struct sshbuf *b = NULL;
736 u_int tmp;
737 int r = SSH_ERR_INTERNAL_ERROR;
738
739 if ((r = sshbuf_get_u32(m, &tmp)) != 0 ||
740 (r = sshbuf_froms(m, &b)) != 0)
741 goto out;
742 if (tmp > INT_MAX) {
743 r = SSH_ERR_INVALID_FORMAT;
744 goto out;
745 }
746 n = tmp;
747 if (n > 0 && (a = calloc(n, sizeof(*a))) == NULL) {
748 r = SSH_ERR_ALLOC_FAIL;
749 goto out;
750 }
751 for (i = 0; i < n; i++) {
752 if ((r = sshbuf_get_cstring(b, &a[i], NULL)) != 0)
753 goto out;
754 }
755 /* success */
756 r = 0;
757 *ap = a;
758 a = NULL;
759 *np = n;
760 n = 0;
761 out:
762 if (a != NULL) {
763 for (i = 0; i < n; i++)
764 free(a[i]);
765 free(a);
766 }
767 sshbuf_free(b);
768 return r;
769 }
770
771 static int
serialise_nullable_string(struct sshbuf * m,const char * s)772 serialise_nullable_string(struct sshbuf *m, const char *s)
773 {
774 int r;
775
776 if ((r = sshbuf_put_u8(m, s == NULL)) != 0 ||
777 (r = sshbuf_put_cstring(m, s)) != 0)
778 return r;
779 return 0;
780 }
781
782 static int
deserialise_nullable_string(struct sshbuf * m,char ** sp)783 deserialise_nullable_string(struct sshbuf *m, char **sp)
784 {
785 int r;
786 u_char flag;
787
788 *sp = NULL;
789 if ((r = sshbuf_get_u8(m, &flag)) != 0 ||
790 (r = sshbuf_get_cstring(m, flag ? NULL : sp, NULL)) != 0)
791 return r;
792 return 0;
793 }
794
795 int
sshauthopt_serialise(const struct sshauthopt * opts,struct sshbuf * m,int untrusted)796 sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m,
797 int untrusted)
798 {
799 int r = SSH_ERR_INTERNAL_ERROR;
800
801 /* Flag options */
802 if ((r = sshbuf_put_u8(m, opts->permit_port_forwarding_flag)) != 0 ||
803 (r = sshbuf_put_u8(m, opts->permit_agent_forwarding_flag)) != 0 ||
804 (r = sshbuf_put_u8(m, opts->permit_x11_forwarding_flag)) != 0 ||
805 (r = sshbuf_put_u8(m, opts->permit_pty_flag)) != 0 ||
806 (r = sshbuf_put_u8(m, opts->permit_user_rc)) != 0 ||
807 (r = sshbuf_put_u8(m, opts->restricted)) != 0 ||
808 (r = sshbuf_put_u8(m, opts->cert_authority)) != 0 ||
809 (r = sshbuf_put_u8(m, opts->no_require_user_presence)) != 0 ||
810 (r = sshbuf_put_u8(m, opts->require_verify)) != 0)
811 return r;
812
813 /* Simple integer options */
814 if ((r = sshbuf_put_u64(m, opts->valid_before)) != 0)
815 return r;
816
817 /* tunnel number can be negative to indicate "unset" */
818 if ((r = sshbuf_put_u8(m, opts->force_tun_device == -1)) != 0 ||
819 (r = sshbuf_put_u32(m, (opts->force_tun_device < 0) ?
820 0 : (u_int)opts->force_tun_device)) != 0)
821 return r;
822
823 /* String options; these may be NULL */
824 if ((r = serialise_nullable_string(m,
825 untrusted ? "yes" : opts->cert_principals)) != 0 ||
826 (r = serialise_nullable_string(m,
827 untrusted ? "true" : opts->force_command)) != 0 ||
828 (r = serialise_nullable_string(m,
829 untrusted ? NULL : opts->required_from_host_cert)) != 0 ||
830 (r = serialise_nullable_string(m,
831 untrusted ? NULL : opts->required_from_host_keys)) != 0)
832 return r;
833
834 /* Array options */
835 if ((r = serialise_array(m, opts->env,
836 untrusted ? 0 : opts->nenv)) != 0 ||
837 (r = serialise_array(m, opts->permitopen,
838 untrusted ? 0 : opts->npermitopen)) != 0 ||
839 (r = serialise_array(m, opts->permitlisten,
840 untrusted ? 0 : opts->npermitlisten)) != 0)
841 return r;
842
843 /* success */
844 return 0;
845 }
846
847 int
sshauthopt_deserialise(struct sshbuf * m,struct sshauthopt ** optsp)848 sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **optsp)
849 {
850 struct sshauthopt *opts = NULL;
851 int r = SSH_ERR_INTERNAL_ERROR;
852 u_char f;
853 u_int tmp;
854
855 if ((opts = calloc(1, sizeof(*opts))) == NULL)
856 return SSH_ERR_ALLOC_FAIL;
857
858 /* Flag options */
859 #define OPT_FLAG(x) \
860 do { \
861 if ((r = sshbuf_get_u8(m, &f)) != 0) \
862 goto out; \
863 opts->x = f; \
864 } while (0)
865 OPT_FLAG(permit_port_forwarding_flag);
866 OPT_FLAG(permit_agent_forwarding_flag);
867 OPT_FLAG(permit_x11_forwarding_flag);
868 OPT_FLAG(permit_pty_flag);
869 OPT_FLAG(permit_user_rc);
870 OPT_FLAG(restricted);
871 OPT_FLAG(cert_authority);
872 OPT_FLAG(no_require_user_presence);
873 OPT_FLAG(require_verify);
874 #undef OPT_FLAG
875
876 /* Simple integer options */
877 if ((r = sshbuf_get_u64(m, &opts->valid_before)) != 0)
878 goto out;
879
880 /* tunnel number can be negative to indicate "unset" */
881 if ((r = sshbuf_get_u8(m, &f)) != 0 ||
882 (r = sshbuf_get_u32(m, &tmp)) != 0)
883 goto out;
884 opts->force_tun_device = f ? -1 : (int)tmp;
885
886 /* String options may be NULL */
887 if ((r = deserialise_nullable_string(m, &opts->cert_principals)) != 0 ||
888 (r = deserialise_nullable_string(m, &opts->force_command)) != 0 ||
889 (r = deserialise_nullable_string(m,
890 &opts->required_from_host_cert)) != 0 ||
891 (r = deserialise_nullable_string(m,
892 &opts->required_from_host_keys)) != 0)
893 goto out;
894
895 /* Array options */
896 if ((r = deserialise_array(m, &opts->env, &opts->nenv)) != 0 ||
897 (r = deserialise_array(m,
898 &opts->permitopen, &opts->npermitopen)) != 0 ||
899 (r = deserialise_array(m,
900 &opts->permitlisten, &opts->npermitlisten)) != 0)
901 goto out;
902
903 /* success */
904 r = 0;
905 *optsp = opts;
906 opts = NULL;
907 out:
908 sshauthopt_free(opts);
909 return r;
910 }
911