1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
|
/*
* Dropbear - a SSH2 server
*
* Copyright (c) 2008 Frederic Moulins
* All rights reserved.
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*
* This file incorporates work covered by the following copyright and
* permission notice:
*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
* All rights reserved
* As far as I am concerned, the code I have written for this software
* can be used freely for any purpose. Any derived versions of this
* software must be clearly marked as such, and if the derived work is
* incompatible with the protocol description in the RFC file, it must be
* called by a name other than "ssh" or "Secure Shell".
*
* This copyright and permission notice applies to the code parsing public keys
* options string which can also be found in OpenSSH auth-options.c file
* (auth_parse_options).
*
*/
/* Process pubkey options during a pubkey auth request */
#include "includes.h"
#include "session.h"
#include "dbutil.h"
#include "signkey.h"
#include "auth.h"
#ifdef ENABLE_SVR_PUBKEY_OPTIONS
/* Returns 1 if pubkey allows agent forwarding,
* 0 otherwise */
int svr_pubkey_allows_agentfwd() {
if (ses.authstate.pubkey_options
&& ses.authstate.pubkey_options->no_agent_forwarding_flag) {
return 0;
}
return 1;
}
/* Returns 1 if pubkey allows tcp forwarding,
* 0 otherwise */
int svr_pubkey_allows_tcpfwd() {
if (ses.authstate.pubkey_options
&& ses.authstate.pubkey_options->no_port_forwarding_flag) {
return 0;
}
return 1;
}
/* Returns 1 if pubkey allows x11 forwarding,
* 0 otherwise */
int svr_pubkey_allows_x11fwd() {
if (ses.authstate.pubkey_options
&& ses.authstate.pubkey_options->no_x11_forwarding_flag) {
return 0;
}
return 1;
}
/* Returns 1 if pubkey allows pty, 0 otherwise */
int svr_pubkey_allows_pty() {
if (ses.authstate.pubkey_options
&& ses.authstate.pubkey_options->no_pty_flag) {
return 0;
}
return 1;
}
/* Set chansession command to the one forced by 'command' public key option */
void svr_pubkey_set_forced_command(struct ChanSess *chansess) {
if (ses.authstate.pubkey_options)
chansess->cmd = ses.authstate.pubkey_options->forced_command;
}
/* Free potential public key options */
void svr_pubkey_options_cleanup() {
if (ses.authstate.pubkey_options) {
m_free(ses.authstate.pubkey_options);
ses.authstate.pubkey_options = NULL;
}
}
/* Parse pubkey options and set ses.authstate.pubkey_options accordingly.
* Returns DROPBEAR_SUCCESS if key is ok for auth, DROPBEAR_FAILURE otherwise */
int svr_add_pubkey_options(const char* opts) {
const char *cp;
int i;
int ret = DROPBEAR_FAILURE;
TRACE(("enter addpubkeyoptions"))
if (!opts || *opts == ' ') {
/* no option, success */
ret = DROPBEAR_SUCCESS;
goto end;
}
ses.authstate.pubkey_options = (struct PubKeyOptions*)m_malloc(sizeof( struct PubKeyOptions ));
while (*opts && *opts != ' ' && *opts != '\t') {
cp = "no-port-forwarding";
if (strncasecmp(opts, cp, strlen(cp)) == 0) {
dropbear_log(LOG_WARNING, "Port forwarding disabled.");
ses.authstate.pubkey_options->no_port_forwarding_flag = 1;
opts += strlen(cp);
goto next_option;
}
#ifdef ENABLE_AGENTFWD
cp = "no-agent-forwarding";
if (strncasecmp(opts, cp, strlen(cp)) == 0) {
dropbear_log(LOG_WARNING, "Agent forwarding disabled.");
ses.authstate.pubkey_options->no_agent_forwarding_flag = 1;
opts += strlen(cp);
goto next_option;
}
#endif
#ifdef ENABLE_X11FWD
cp = "no-X11-forwarding";
if (strncasecmp(opts, cp, strlen(cp)) == 0) {
dropbear_log(LOG_WARNING, "X11 forwarding disabled.");
ses.authstate.pubkey_options->no_x11_forwarding_flag = 1;
opts += strlen(cp);
goto next_option;
}
#endif
cp = "no-pty";
if (strncasecmp(opts, cp, strlen(cp)) == 0) {
dropbear_log(LOG_WARNING, "Pty allocation disabled.");
ses.authstate.pubkey_options->no_pty_flag = 1;
opts += strlen(cp);
goto next_option;
}
cp = "command=\"";
if (strncasecmp(opts, cp, strlen(cp)) == 0) {
opts += strlen(cp);
ses.authstate.pubkey_options->forced_command = (char*)m_malloc(strlen(opts) + 1);
i = 0;
while (*opts) {
if (*opts == '"')
break;
if (*opts == '\\' && opts[1] == '"') {
opts += 2;
ses.authstate.pubkey_options->forced_command[i++] = '"';
continue;
}
ses.authstate.pubkey_options->forced_command[i++] = *opts++;
}
if (!*opts) {
dropbear_log(LOG_WARNING,
"Missing end quote in public key command option");
m_free(ses.authstate.pubkey_options->forced_command);
ses.authstate.pubkey_options->forced_command = NULL;
goto bad_option;
}
ses.authstate.pubkey_options->forced_command[i] = '\0';
if (strlen(ses.authstate.pubkey_options->forced_command) > MAX_CMD_LEN) {
dropbear_log(LOG_WARNING,
"Public key option command too long (>MAX_CMD_LEN).");
m_free(ses.authstate.pubkey_options->forced_command);
ses.authstate.pubkey_options->forced_command = NULL;
goto bad_option;
}
dropbear_log(LOG_WARNING, "Forced command '%s'",
ses.authstate.pubkey_options->forced_command);
opts++;
goto next_option;
}
next_option:
/*
* Skip the comma, and move to the next option
* (or break out if there are no more).
*/
if (!*opts) {
TRACE(("Bugs in svr-chansession.c pubkey option processing."))
}
if (*opts == ' ' || *opts == '\t') {
break; /* End of options. */
}
if (*opts != ',') {
goto bad_option;
}
opts++;
/* Process the next option. */
}
/* parsed all options with no problem */
ret = DROPBEAR_SUCCESS;
goto end;
bad_option:
ret = DROPBEAR_FAILURE;
m_free(ses.authstate.pubkey_options);
ses.authstate.pubkey_options = NULL;
dropbear_log(LOG_WARNING, "Bad public key options : '%.50s'", opts);
end:
TRACE(("leave addpubkeyoptions"))
return ret;
}
#endif
|
