File: | src/usr.bin/ssh/sshd/../auth-options.c |
Warning: | line 338, column 8 Although the value stored to 'r' is used in the enclosing expression, the value is never actually read from 'r' |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | /* $OpenBSD: auth-options.c,v 1.101 2023/07/14 07:44:21 dtucker Exp $ */ |
2 | /* |
3 | * Copyright (c) 2018 Damien Miller <djm@mindrot.org> |
4 | * |
5 | * Permission to use, copy, modify, and distribute this software for any |
6 | * purpose with or without fee is hereby granted, provided that the above |
7 | * copyright notice and this permission notice appear in all copies. |
8 | * |
9 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
10 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
11 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
12 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
13 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
14 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF |
15 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
16 | */ |
17 | |
18 | #include <sys/types.h> |
19 | #include <sys/queue.h> |
20 | |
21 | #include <stdlib.h> |
22 | #include <netdb.h> |
23 | #include <pwd.h> |
24 | #include <string.h> |
25 | #include <stdio.h> |
26 | #include <stdint.h> |
27 | #include <stdarg.h> |
28 | #include <ctype.h> |
29 | #include <limits.h> |
30 | |
31 | #include "xmalloc.h" |
32 | #include "ssherr.h" |
33 | #include "log.h" |
34 | #include "sshbuf.h" |
35 | #include "misc.h" |
36 | #include "sshkey.h" |
37 | #include "match.h" |
38 | #include "ssh2.h" |
39 | #include "auth-options.h" |
40 | |
41 | static int |
42 | dup_strings(char ***dstp, size_t *ndstp, char **src, size_t nsrc) |
43 | { |
44 | char **dst; |
45 | size_t i, j; |
46 | |
47 | *dstp = NULL((void *)0); |
48 | *ndstp = 0; |
49 | |
50 | if (nsrc == 0) |
51 | return 0; |
52 | if (nsrc >= SIZE_MAX0xffffffffffffffffUL / sizeof(*src) || |
53 | (dst = calloc(nsrc, sizeof(*src))) == NULL((void *)0)) |
54 | return -1; |
55 | for (i = 0; i < nsrc; i++) { |
56 | if ((dst[i] = strdup(src[i])) == NULL((void *)0)) { |
57 | for (j = 0; j < i; j++) |
58 | free(dst[j]); |
59 | free(dst); |
60 | return -1; |
61 | } |
62 | } |
63 | /* success */ |
64 | *dstp = dst; |
65 | *ndstp = nsrc; |
66 | return 0; |
67 | } |
68 | |
69 | #define OPTIONS_CRITICAL1 1 |
70 | #define OPTIONS_EXTENSIONS2 2 |
71 | static int |
72 | cert_option_list(struct sshauthopt *opts, struct sshbuf *oblob, |
73 | u_int which, int crit) |
74 | { |
75 | char *command, *allowed; |
76 | char *name = NULL((void *)0); |
77 | struct sshbuf *c = NULL((void *)0), *data = NULL((void *)0); |
78 | int r, ret = -1, found; |
79 | |
80 | if ((c = sshbuf_fromb(oblob)) == NULL((void *)0)) { |
81 | error_f("sshbuf_fromb failed")sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 81, 1, SYSLOG_LEVEL_ERROR, ((void *)0), "sshbuf_fromb failed" ); |
82 | goto out; |
83 | } |
84 | |
85 | while (sshbuf_len(c) > 0) { |
86 | sshbuf_free(data); |
87 | data = NULL((void *)0); |
88 | if ((r = sshbuf_get_cstring(c, &name, NULL((void *)0))) != 0 || |
89 | (r = sshbuf_froms(c, &data)) != 0) { |
90 | error_r(r, "Unable to parse certificate options")sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 90, 0, SYSLOG_LEVEL_ERROR, ssh_err(r), "Unable to parse certificate options" ); |
91 | goto out; |
92 | } |
93 | debug3("found certificate option \"%.100s\" len %zu",sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 94, 0, SYSLOG_LEVEL_DEBUG3, ((void *)0), "found certificate option \"%.100s\" len %zu" , name, sshbuf_len(data)) |
94 | name, sshbuf_len(data))sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 94, 0, SYSLOG_LEVEL_DEBUG3, ((void *)0), "found certificate option \"%.100s\" len %zu" , name, sshbuf_len(data)); |
95 | found = 0; |
96 | if ((which & OPTIONS_EXTENSIONS2) != 0) { |
97 | if (strcmp(name, "no-touch-required") == 0) { |
98 | opts->no_require_user_presence = 1; |
99 | found = 1; |
100 | } else if (strcmp(name, "permit-X11-forwarding") == 0) { |
101 | opts->permit_x11_forwarding_flag = 1; |
102 | found = 1; |
103 | } else if (strcmp(name, |
104 | "permit-agent-forwarding") == 0) { |
105 | opts->permit_agent_forwarding_flag = 1; |
106 | found = 1; |
107 | } else if (strcmp(name, |
108 | "permit-port-forwarding") == 0) { |
109 | opts->permit_port_forwarding_flag = 1; |
110 | found = 1; |
111 | } else if (strcmp(name, "permit-pty") == 0) { |
112 | opts->permit_pty_flag = 1; |
113 | found = 1; |
114 | } else if (strcmp(name, "permit-user-rc") == 0) { |
115 | opts->permit_user_rc = 1; |
116 | found = 1; |
117 | } |
118 | } |
119 | if (!found && (which & OPTIONS_CRITICAL1) != 0) { |
120 | if (strcmp(name, "verify-required") == 0) { |
121 | opts->require_verify = 1; |
122 | found = 1; |
123 | } else if (strcmp(name, "force-command") == 0) { |
124 | if ((r = sshbuf_get_cstring(data, &command, |
125 | NULL((void *)0))) != 0) { |
126 | error_r(r, "Unable to parse \"%s\" "sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 127, 0, SYSLOG_LEVEL_ERROR, ssh_err(r), "Unable to parse \"%s\" " "section", name) |
127 | "section", name)sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 127, 0, SYSLOG_LEVEL_ERROR, ssh_err(r), "Unable to parse \"%s\" " "section", name); |
128 | goto out; |
129 | } |
130 | if (opts->force_command != NULL((void *)0)) { |
131 | error("Certificate has multiple "sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 132, 0, SYSLOG_LEVEL_ERROR, ((void *)0), "Certificate has multiple " "force-command options") |
132 | "force-command options")sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 132, 0, SYSLOG_LEVEL_ERROR, ((void *)0), "Certificate has multiple " "force-command options"); |
133 | free(command); |
134 | goto out; |
135 | } |
136 | opts->force_command = command; |
137 | found = 1; |
138 | } else if (strcmp(name, "source-address") == 0) { |
139 | if ((r = sshbuf_get_cstring(data, &allowed, |
140 | NULL((void *)0))) != 0) { |
141 | error_r(r, "Unable to parse \"%s\" "sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 142, 0, SYSLOG_LEVEL_ERROR, ssh_err(r), "Unable to parse \"%s\" " "section", name) |
142 | "section", name)sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 142, 0, SYSLOG_LEVEL_ERROR, ssh_err(r), "Unable to parse \"%s\" " "section", name); |
143 | goto out; |
144 | } |
145 | if (opts->required_from_host_cert != NULL((void *)0)) { |
146 | error("Certificate has multiple "sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 147, 0, SYSLOG_LEVEL_ERROR, ((void *)0), "Certificate has multiple " "source-address options") |
147 | "source-address options")sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 147, 0, SYSLOG_LEVEL_ERROR, ((void *)0), "Certificate has multiple " "source-address options"); |
148 | free(allowed); |
149 | goto out; |
150 | } |
151 | /* Check syntax */ |
152 | if (addr_match_cidr_list(NULL((void *)0), allowed) == -1) { |
153 | error("Certificate source-address "sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 154, 0, SYSLOG_LEVEL_ERROR, ((void *)0), "Certificate source-address " "contents invalid") |
154 | "contents invalid")sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 154, 0, SYSLOG_LEVEL_ERROR, ((void *)0), "Certificate source-address " "contents invalid"); |
155 | goto out; |
156 | } |
157 | opts->required_from_host_cert = allowed; |
158 | found = 1; |
159 | } |
160 | } |
161 | |
162 | if (!found) { |
163 | if (crit) { |
164 | error("Certificate critical option \"%s\" "sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 165, 0, SYSLOG_LEVEL_ERROR, ((void *)0), "Certificate critical option \"%s\" " "is not supported", name) |
165 | "is not supported", name)sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 165, 0, SYSLOG_LEVEL_ERROR, ((void *)0), "Certificate critical option \"%s\" " "is not supported", name); |
166 | goto out; |
167 | } else { |
168 | logit("Certificate extension \"%s\" "sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 169, 0, SYSLOG_LEVEL_INFO, ((void *)0), "Certificate extension \"%s\" " "is not supported", name) |
169 | "is not supported", name)sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 169, 0, SYSLOG_LEVEL_INFO, ((void *)0), "Certificate extension \"%s\" " "is not supported", name); |
170 | } |
171 | } else if (sshbuf_len(data) != 0) { |
172 | error("Certificate option \"%s\" corrupt "sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 173, 0, SYSLOG_LEVEL_ERROR, ((void *)0), "Certificate option \"%s\" corrupt " "(extra data)", name) |
173 | "(extra data)", name)sshlog("/usr/src/usr.bin/ssh/sshd/../auth-options.c", __func__ , 173, 0, SYSLOG_LEVEL_ERROR, ((void *)0), "Certificate option \"%s\" corrupt " "(extra data)", name); |
174 | goto out; |
175 | } |
176 | free(name); |
177 | name = NULL((void *)0); |
178 | } |
179 | /* successfully parsed all options */ |
180 | ret = 0; |
181 | |
182 | out: |
183 | free(name); |
184 | sshbuf_free(data); |
185 | sshbuf_free(c); |
186 | return ret; |
187 | } |
188 | |
189 | struct sshauthopt * |
190 | sshauthopt_new(void) |
191 | { |
192 | struct sshauthopt *ret; |
193 | |
194 | if ((ret = calloc(1, sizeof(*ret))) == NULL((void *)0)) |
195 | return NULL((void *)0); |
196 | ret->force_tun_device = -1; |
197 | return ret; |
198 | } |
199 | |
200 | void |
201 | sshauthopt_free(struct sshauthopt *opts) |
202 | { |
203 | size_t i; |
204 | |
205 | if (opts == NULL((void *)0)) |
206 | return; |
207 | |
208 | free(opts->cert_principals); |
209 | free(opts->force_command); |
210 | free(opts->required_from_host_cert); |
211 | free(opts->required_from_host_keys); |
212 | |
213 | for (i = 0; i < opts->nenv; i++) |
214 | free(opts->env[i]); |
215 | free(opts->env); |
216 | |
217 | for (i = 0; i < opts->npermitopen; i++) |
218 | free(opts->permitopen[i]); |
219 | free(opts->permitopen); |
220 | |
221 | for (i = 0; i < opts->npermitlisten; i++) |
222 | free(opts->permitlisten[i]); |
223 | free(opts->permitlisten); |
224 | |
225 | freezero(opts, sizeof(*opts)); |
226 | } |
227 | |
228 | struct sshauthopt * |
229 | sshauthopt_new_with_keys_defaults(void) |
230 | { |
231 | struct sshauthopt *ret = NULL((void *)0); |
232 | |
233 | if ((ret = sshauthopt_new()) == NULL((void *)0)) |
234 | return NULL((void *)0); |
235 | |
236 | /* Defaults for authorized_keys flags */ |
237 | ret->permit_port_forwarding_flag = 1; |
238 | ret->permit_agent_forwarding_flag = 1; |
239 | ret->permit_x11_forwarding_flag = 1; |
240 | ret->permit_pty_flag = 1; |
241 | ret->permit_user_rc = 1; |
242 | return ret; |
243 | } |
244 | |
245 | /* |
246 | * Parse and record a permitopen/permitlisten directive. |
247 | * Return 0 on success. Return -1 on failure and sets *errstrp to error reason. |
248 | */ |
249 | static int |
250 | handle_permit(const char **optsp, int allow_bare_port, |
251 | char ***permitsp, size_t *npermitsp, const char **errstrp) |
252 | { |
253 | char *opt, *tmp, *cp, *host, **permits = *permitsp; |
254 | size_t npermits = *npermitsp; |
255 | const char *errstr = "unknown error"; |
256 | |
257 | if (npermits > SSH_AUTHOPT_PERMIT_MAX4096) { |
258 | *errstrp = "too many permission directives"; |
259 | return -1; |
260 | } |
261 | if ((opt = opt_dequote(optsp, &errstr)) == NULL((void *)0)) { |
262 | return -1; |
263 | } |
264 | if (allow_bare_port && strchr(opt, ':') == NULL((void *)0)) { |
265 | /* |
266 | * Allow a bare port number in permitlisten to indicate a |
267 | * listen_host wildcard. |
268 | */ |
269 | if (asprintf(&tmp, "*:%s", opt) == -1) { |
270 | free(opt); |
271 | *errstrp = "memory allocation failed"; |
272 | return -1; |
273 | } |
274 | free(opt); |
275 | opt = tmp; |
276 | } |
277 | if ((tmp = strdup(opt)) == NULL((void *)0)) { |
278 | free(opt); |
279 | *errstrp = "memory allocation failed"; |
280 | return -1; |
281 | } |
282 | cp = tmp; |
283 | /* validate syntax before recording it. */ |
284 | host = hpdelim2(&cp, NULL((void *)0)); |
285 | if (host == NULL((void *)0) || strlen(host) >= NI_MAXHOST256) { |
286 | free(tmp); |
287 | free(opt); |
288 | *errstrp = "invalid permission hostname"; |
289 | return -1; |
290 | } |
291 | /* |
292 | * don't want to use permitopen_port to avoid |
293 | * dependency on channels.[ch] here. |
294 | */ |
295 | if (cp == NULL((void *)0) || |
296 | (strcmp(cp, "*") != 0 && a2port(cp) <= 0)) { |
297 | free(tmp); |
298 | free(opt); |
299 | *errstrp = "invalid permission port"; |
300 | return -1; |
301 | } |
302 | /* XXX - add streamlocal support */ |
303 | free(tmp); |
304 | /* Record it */ |
305 | if ((permits = recallocarray(permits, npermits, npermits + 1, |
306 | sizeof(*permits))) == NULL((void *)0)) { |
307 | free(opt); |
308 | /* NB. don't update *permitsp if alloc fails */ |
309 | *errstrp = "memory allocation failed"; |
310 | return -1; |
311 | } |
312 | permits[npermits++] = opt; |
313 | *permitsp = permits; |
314 | *npermitsp = npermits; |
315 | return 0; |
316 | } |
317 | |
318 | struct sshauthopt * |
319 | sshauthopt_parse(const char *opts, const char **errstrp) |
320 | { |
321 | char **oarray, *opt, *cp, *tmp; |
322 | int r; |
323 | struct sshauthopt *ret = NULL((void *)0); |
324 | const char *errstr = "unknown error"; |
325 | uint64_t valid_before; |
326 | size_t i, l; |
327 | |
328 | if (errstrp != NULL((void *)0)) |
329 | *errstrp = NULL((void *)0); |
330 | if ((ret = sshauthopt_new_with_keys_defaults()) == NULL((void *)0)) |
331 | goto alloc_fail; |
332 | |
333 | if (opts == NULL((void *)0)) |
334 | return ret; |
335 | |
336 | while (*opts && *opts != ' ' && *opts != '\t') { |
337 | /* flag options */ |
338 | if ((r = opt_flag("restrict", 0, &opts)) != -1) { |
Although the value stored to 'r' is used in the enclosing expression, the value is never actually read from 'r' | |
339 | ret->restricted = 1; |
340 | ret->permit_port_forwarding_flag = 0; |
341 | ret->permit_agent_forwarding_flag = 0; |
342 | ret->permit_x11_forwarding_flag = 0; |
343 | ret->permit_pty_flag = 0; |
344 | ret->permit_user_rc = 0; |
345 | } else if ((r = opt_flag("cert-authority", 0, &opts)) != -1) { |
346 | ret->cert_authority = r; |
347 | } else if ((r = opt_flag("port-forwarding", 1, &opts)) != -1) { |
348 | ret->permit_port_forwarding_flag = r == 1; |
349 | } else if ((r = opt_flag("agent-forwarding", 1, &opts)) != -1) { |
350 | ret->permit_agent_forwarding_flag = r == 1; |
351 | } else if ((r = opt_flag("x11-forwarding", 1, &opts)) != -1) { |
352 | ret->permit_x11_forwarding_flag = r == 1; |
353 | } else if ((r = opt_flag("touch-required", 1, &opts)) != -1) { |
354 | ret->no_require_user_presence = r != 1; /* NB. flip */ |
355 | } else if ((r = opt_flag("verify-required", 1, &opts)) != -1) { |
356 | ret->require_verify = r == 1; |
357 | } else if ((r = opt_flag("pty", 1, &opts)) != -1) { |
358 | ret->permit_pty_flag = r == 1; |
359 | } else if ((r = opt_flag("user-rc", 1, &opts)) != -1) { |
360 | ret->permit_user_rc = r == 1; |
361 | } else if (opt_match(&opts, "command")) { |
362 | if (ret->force_command != NULL((void *)0)) { |
363 | errstr = "multiple \"command\" clauses"; |
364 | goto fail; |
365 | } |
366 | ret->force_command = opt_dequote(&opts, &errstr); |
367 | if (ret->force_command == NULL((void *)0)) |
368 | goto fail; |
369 | } else if (opt_match(&opts, "principals")) { |
370 | if (ret->cert_principals != NULL((void *)0)) { |
371 | errstr = "multiple \"principals\" clauses"; |
372 | goto fail; |
373 | } |
374 | ret->cert_principals = opt_dequote(&opts, &errstr); |
375 | if (ret->cert_principals == NULL((void *)0)) |
376 | goto fail; |
377 | } else if (opt_match(&opts, "from")) { |
378 | if (ret->required_from_host_keys != NULL((void *)0)) { |
379 | errstr = "multiple \"from\" clauses"; |
380 | goto fail; |
381 | } |
382 | ret->required_from_host_keys = opt_dequote(&opts, |
383 | &errstr); |
384 | if (ret->required_from_host_keys == NULL((void *)0)) |
385 | goto fail; |
386 | } else if (opt_match(&opts, "expiry-time")) { |
387 | if ((opt = opt_dequote(&opts, &errstr)) == NULL((void *)0)) |
388 | goto fail; |
389 | if (parse_absolute_time(opt, &valid_before) != 0 || |
390 | valid_before == 0) { |
391 | free(opt); |
392 | errstr = "invalid expires time"; |
393 | goto fail; |
394 | } |
395 | free(opt); |
396 | if (ret->valid_before == 0 || |
397 | valid_before < ret->valid_before) |
398 | ret->valid_before = valid_before; |
399 | } else if (opt_match(&opts, "environment")) { |
400 | if (ret->nenv > SSH_AUTHOPT_ENV_MAX1024) { |
401 | errstr = "too many environment strings"; |
402 | goto fail; |
403 | } |
404 | if ((opt = opt_dequote(&opts, &errstr)) == NULL((void *)0)) |
405 | goto fail; |
406 | /* env name must be alphanumeric and followed by '=' */ |
407 | if ((tmp = strchr(opt, '=')) == NULL((void *)0)) { |
408 | free(opt); |
409 | errstr = "invalid environment string"; |
410 | goto fail; |
411 | } |
412 | if ((cp = strdup(opt)) == NULL((void *)0)) { |
413 | free(opt); |
414 | goto alloc_fail; |
415 | } |
416 | l = (size_t)(tmp - opt); |
417 | cp[l] = '\0'; /* truncate at '=' */ |
418 | if (!valid_env_name(cp)) { |
419 | free(cp); |
420 | free(opt); |
421 | errstr = "invalid environment string"; |
422 | goto fail; |
423 | } |
424 | /* Check for duplicates; XXX O(n*log(n)) */ |
425 | for (i = 0; i < ret->nenv; i++) { |
426 | if (strncmp(ret->env[i], cp, l) == 0 && |
427 | ret->env[i][l] == '=') |
428 | break; |
429 | } |
430 | free(cp); |
431 | /* First match wins */ |
432 | if (i >= ret->nenv) { |
433 | /* Append it. */ |
434 | oarray = ret->env; |
435 | if ((ret->env = recallocarray(ret->env, |
436 | ret->nenv, ret->nenv + 1, |
437 | sizeof(*ret->env))) == NULL((void *)0)) { |
438 | free(opt); |
439 | /* put it back for cleanup */ |
440 | ret->env = oarray; |
441 | goto alloc_fail; |
442 | } |
443 | ret->env[ret->nenv++] = opt; |
444 | opt = NULL((void *)0); /* transferred */ |
445 | } |
446 | free(opt); |
447 | } else if (opt_match(&opts, "permitopen")) { |
448 | if (handle_permit(&opts, 0, &ret->permitopen, |
449 | &ret->npermitopen, &errstr) != 0) |
450 | goto fail; |
451 | } else if (opt_match(&opts, "permitlisten")) { |
452 | if (handle_permit(&opts, 1, &ret->permitlisten, |
453 | &ret->npermitlisten, &errstr) != 0) |
454 | goto fail; |
455 | } else if (opt_match(&opts, "tunnel")) { |
456 | if ((opt = opt_dequote(&opts, &errstr)) == NULL((void *)0)) |
457 | goto fail; |
458 | ret->force_tun_device = a2tun(opt, NULL((void *)0)); |
459 | free(opt); |
460 | if (ret->force_tun_device == SSH_TUNID_ERR(0x7fffffff - 1)) { |
461 | errstr = "invalid tun device"; |
462 | goto fail; |
463 | } |
464 | } |
465 | /* |
466 | * Skip the comma, and move to the next option |
467 | * (or break out if there are no more). |
468 | */ |
469 | if (*opts == '\0' || *opts == ' ' || *opts == '\t') |
470 | break; /* End of options. */ |
471 | /* Anything other than a comma is an unknown option */ |
472 | if (*opts != ',') { |
473 | errstr = "unknown key option"; |
474 | goto fail; |
475 | } |
476 | opts++; |
477 | if (*opts == '\0') { |
478 | errstr = "unexpected end-of-options"; |
479 | goto fail; |
480 | } |
481 | } |
482 | |
483 | /* success */ |
484 | if (errstrp != NULL((void *)0)) |
485 | *errstrp = NULL((void *)0); |
486 | return ret; |
487 | |
488 | alloc_fail: |
489 | errstr = "memory allocation failed"; |
490 | fail: |
491 | sshauthopt_free(ret); |
492 | if (errstrp != NULL((void *)0)) |
493 | *errstrp = errstr; |
494 | return NULL((void *)0); |
495 | } |
496 | |
497 | struct sshauthopt * |
498 | sshauthopt_from_cert(struct sshkey *k) |
499 | { |
500 | struct sshauthopt *ret; |
501 | |
502 | if (k == NULL((void *)0) || !sshkey_type_is_cert(k->type) || k->cert == NULL((void *)0) || |
503 | k->cert->type != SSH2_CERT_TYPE_USER1) |
504 | return NULL((void *)0); |
505 | |
506 | if ((ret = sshauthopt_new()) == NULL((void *)0)) |
507 | return NULL((void *)0); |
508 | |
509 | /* Handle options and critical extensions separately */ |
510 | if (cert_option_list(ret, k->cert->critical, |
511 | OPTIONS_CRITICAL1, 1) == -1) { |
512 | sshauthopt_free(ret); |
513 | return NULL((void *)0); |
514 | } |
515 | if (cert_option_list(ret, k->cert->extensions, |
516 | OPTIONS_EXTENSIONS2, 0) == -1) { |
517 | sshauthopt_free(ret); |
518 | return NULL((void *)0); |
519 | } |
520 | /* success */ |
521 | return ret; |
522 | } |
523 | |
524 | /* |
525 | * Merges "additional" options to "primary" and returns the result. |
526 | * NB. Some options from primary have primacy. |
527 | */ |
528 | struct sshauthopt * |
529 | sshauthopt_merge(const struct sshauthopt *primary, |
530 | const struct sshauthopt *additional, const char **errstrp) |
531 | { |
532 | struct sshauthopt *ret; |
533 | const char *errstr = "internal error"; |
534 | const char *tmp; |
535 | |
536 | if (errstrp != NULL((void *)0)) |
537 | *errstrp = NULL((void *)0); |
538 | |
539 | if ((ret = sshauthopt_new()) == NULL((void *)0)) |
540 | goto alloc_fail; |
541 | |
542 | /* cert_authority and cert_principals are cleared in result */ |
543 | |
544 | /* Prefer access lists from primary. */ |
545 | /* XXX err is both set and mismatch? */ |
546 | tmp = primary->required_from_host_cert; |
547 | if (tmp == NULL((void *)0)) |
548 | tmp = additional->required_from_host_cert; |
549 | if (tmp != NULL((void *)0) && (ret->required_from_host_cert = strdup(tmp)) == NULL((void *)0)) |
550 | goto alloc_fail; |
551 | tmp = primary->required_from_host_keys; |
552 | if (tmp == NULL((void *)0)) |
553 | tmp = additional->required_from_host_keys; |
554 | if (tmp != NULL((void *)0) && (ret->required_from_host_keys = strdup(tmp)) == NULL((void *)0)) |
555 | goto alloc_fail; |
556 | |
557 | /* |
558 | * force_tun_device, permitopen/permitlisten and environment all |
559 | * prefer the primary. |
560 | */ |
561 | ret->force_tun_device = primary->force_tun_device; |
562 | if (ret->force_tun_device == -1) |
563 | ret->force_tun_device = additional->force_tun_device; |
564 | if (primary->nenv > 0) { |
565 | if (dup_strings(&ret->env, &ret->nenv, |
566 | primary->env, primary->nenv) != 0) |
567 | goto alloc_fail; |
568 | } else if (additional->nenv) { |
569 | if (dup_strings(&ret->env, &ret->nenv, |
570 | additional->env, additional->nenv) != 0) |
571 | goto alloc_fail; |
572 | } |
573 | if (primary->npermitopen > 0) { |
574 | if (dup_strings(&ret->permitopen, &ret->npermitopen, |
575 | primary->permitopen, primary->npermitopen) != 0) |
576 | goto alloc_fail; |
577 | } else if (additional->npermitopen > 0) { |
578 | if (dup_strings(&ret->permitopen, &ret->npermitopen, |
579 | additional->permitopen, additional->npermitopen) != 0) |
580 | goto alloc_fail; |
581 | } |
582 | |
583 | if (primary->npermitlisten > 0) { |
584 | if (dup_strings(&ret->permitlisten, &ret->npermitlisten, |
585 | primary->permitlisten, primary->npermitlisten) != 0) |
586 | goto alloc_fail; |
587 | } else if (additional->npermitlisten > 0) { |
588 | if (dup_strings(&ret->permitlisten, &ret->npermitlisten, |
589 | additional->permitlisten, additional->npermitlisten) != 0) |
590 | goto alloc_fail; |
591 | } |
592 | |
593 | #define OPTFLAG_AND(x) ret->x = (primary->x == 1) && (additional->x == 1) |
594 | #define OPTFLAG_OR(x)ret->x = (primary->x == 1) || (additional->x == 1) ret->x = (primary->x == 1) || (additional->x == 1) |
595 | /* Permissive flags are logical-AND (i.e. must be set in both) */ |
596 | OPTFLAG_AND(permit_port_forwarding_flag); |
597 | OPTFLAG_AND(permit_agent_forwarding_flag); |
598 | OPTFLAG_AND(permit_x11_forwarding_flag); |
599 | OPTFLAG_AND(permit_pty_flag); |
600 | OPTFLAG_AND(permit_user_rc); |
601 | OPTFLAG_AND(no_require_user_presence); |
602 | /* Restrictive flags are logical-OR (i.e. must be set in either) */ |
603 | OPTFLAG_OR(require_verify)ret->require_verify = (primary->require_verify == 1) || (additional->require_verify == 1); |
604 | #undef OPTFLAG_AND |
605 | |
606 | /* Earliest expiry time should win */ |
607 | if (primary->valid_before != 0) |
608 | ret->valid_before = primary->valid_before; |
609 | if (additional->valid_before != 0 && |
610 | additional->valid_before < ret->valid_before) |
611 | ret->valid_before = additional->valid_before; |
612 | |
613 | /* |
614 | * When both multiple forced-command are specified, only |
615 | * proceed if they are identical, otherwise fail. |
616 | */ |
617 | if (primary->force_command != NULL((void *)0) && |
618 | additional->force_command != NULL((void *)0)) { |
619 | if (strcmp(primary->force_command, |
620 | additional->force_command) == 0) { |
621 | /* ok */ |
622 | ret->force_command = strdup(primary->force_command); |
623 | if (ret->force_command == NULL((void *)0)) |
624 | goto alloc_fail; |
625 | } else { |
626 | errstr = "forced command options do not match"; |
627 | goto fail; |
628 | } |
629 | } else if (primary->force_command != NULL((void *)0)) { |
630 | if ((ret->force_command = strdup( |
631 | primary->force_command)) == NULL((void *)0)) |
632 | goto alloc_fail; |
633 | } else if (additional->force_command != NULL((void *)0)) { |
634 | if ((ret->force_command = strdup( |
635 | additional->force_command)) == NULL((void *)0)) |
636 | goto alloc_fail; |
637 | } |
638 | /* success */ |
639 | if (errstrp != NULL((void *)0)) |
640 | *errstrp = NULL((void *)0); |
641 | return ret; |
642 | |
643 | alloc_fail: |
644 | errstr = "memory allocation failed"; |
645 | fail: |
646 | if (errstrp != NULL((void *)0)) |
647 | *errstrp = errstr; |
648 | sshauthopt_free(ret); |
649 | return NULL((void *)0); |
650 | } |
651 | |
652 | /* |
653 | * Copy options |
654 | */ |
655 | struct sshauthopt * |
656 | sshauthopt_copy(const struct sshauthopt *orig) |
657 | { |
658 | struct sshauthopt *ret; |
659 | |
660 | if ((ret = sshauthopt_new()) == NULL((void *)0)) |
661 | return NULL((void *)0); |
662 | |
663 | #define OPTSCALAR(x) ret->x = orig->x |
664 | OPTSCALAR(permit_port_forwarding_flag); |
665 | OPTSCALAR(permit_agent_forwarding_flag); |
666 | OPTSCALAR(permit_x11_forwarding_flag); |
667 | OPTSCALAR(permit_pty_flag); |
668 | OPTSCALAR(permit_user_rc); |
669 | OPTSCALAR(restricted); |
670 | OPTSCALAR(cert_authority); |
671 | OPTSCALAR(force_tun_device); |
672 | OPTSCALAR(valid_before); |
673 | OPTSCALAR(no_require_user_presence); |
674 | OPTSCALAR(require_verify); |
675 | #undef OPTSCALAR |
676 | #define OPTSTRING(x) \ |
677 | do { \ |
678 | if (orig->x != NULL((void *)0) && (ret->x = strdup(orig->x)) == NULL((void *)0)) { \ |
679 | sshauthopt_free(ret); \ |
680 | return NULL((void *)0); \ |
681 | } \ |
682 | } while (0) |
683 | OPTSTRING(cert_principals); |
684 | OPTSTRING(force_command); |
685 | OPTSTRING(required_from_host_cert); |
686 | OPTSTRING(required_from_host_keys); |
687 | #undef OPTSTRING |
688 | |
689 | if (dup_strings(&ret->env, &ret->nenv, orig->env, orig->nenv) != 0 || |
690 | dup_strings(&ret->permitopen, &ret->npermitopen, |
691 | orig->permitopen, orig->npermitopen) != 0 || |
692 | dup_strings(&ret->permitlisten, &ret->npermitlisten, |
693 | orig->permitlisten, orig->npermitlisten) != 0) { |
694 | sshauthopt_free(ret); |
695 | return NULL((void *)0); |
696 | } |
697 | return ret; |
698 | } |
699 | |
700 | static int |
701 | serialise_array(struct sshbuf *m, char **a, size_t n) |
702 | { |
703 | struct sshbuf *b; |
704 | size_t i; |
705 | int r = SSH_ERR_INTERNAL_ERROR-1; |
706 | |
707 | if (n > INT_MAX0x7fffffff) |
708 | return SSH_ERR_INTERNAL_ERROR-1; |
709 | |
710 | if ((b = sshbuf_new()) == NULL((void *)0)) { |
711 | return SSH_ERR_ALLOC_FAIL-2; |
712 | } |
713 | for (i = 0; i < n; i++) { |
714 | if ((r = sshbuf_put_cstring(b, a[i])) != 0) |
715 | goto out; |
716 | } |
717 | if ((r = sshbuf_put_u32(m, n)) != 0 || |
718 | (r = sshbuf_put_stringb(m, b)) != 0) |
719 | goto out; |
720 | /* success */ |
721 | r = 0; |
722 | out: |
723 | sshbuf_free(b); |
724 | return r; |
725 | } |
726 | |
727 | static int |
728 | deserialise_array(struct sshbuf *m, char ***ap, size_t *np) |
729 | { |
730 | char **a = NULL((void *)0); |
731 | size_t i, n = 0; |
732 | struct sshbuf *b = NULL((void *)0); |
733 | u_int tmp; |
734 | int r = SSH_ERR_INTERNAL_ERROR-1; |
735 | |
736 | if ((r = sshbuf_get_u32(m, &tmp)) != 0 || |
737 | (r = sshbuf_froms(m, &b)) != 0) |
738 | goto out; |
739 | if (tmp > INT_MAX0x7fffffff) { |
740 | r = SSH_ERR_INVALID_FORMAT-4; |
741 | goto out; |
742 | } |
743 | n = tmp; |
744 | if (n > 0 && (a = calloc(n, sizeof(*a))) == NULL((void *)0)) { |
745 | r = SSH_ERR_ALLOC_FAIL-2; |
746 | goto out; |
747 | } |
748 | for (i = 0; i < n; i++) { |
749 | if ((r = sshbuf_get_cstring(b, &a[i], NULL((void *)0))) != 0) |
750 | goto out; |
751 | } |
752 | /* success */ |
753 | r = 0; |
754 | *ap = a; |
755 | a = NULL((void *)0); |
756 | *np = n; |
757 | n = 0; |
758 | out: |
759 | if (a != NULL((void *)0)) { |
760 | for (i = 0; i < n; i++) |
761 | free(a[i]); |
762 | free(a); |
763 | } |
764 | sshbuf_free(b); |
765 | return r; |
766 | } |
767 | |
768 | static int |
769 | serialise_nullable_string(struct sshbuf *m, const char *s) |
770 | { |
771 | int r; |
772 | |
773 | if ((r = sshbuf_put_u8(m, s == NULL((void *)0))) != 0 || |
774 | (r = sshbuf_put_cstring(m, s)) != 0) |
775 | return r; |
776 | return 0; |
777 | } |
778 | |
779 | static int |
780 | deserialise_nullable_string(struct sshbuf *m, char **sp) |
781 | { |
782 | int r; |
783 | u_char flag; |
784 | |
785 | *sp = NULL((void *)0); |
786 | if ((r = sshbuf_get_u8(m, &flag)) != 0 || |
787 | (r = sshbuf_get_cstring(m, flag ? NULL((void *)0) : sp, NULL((void *)0))) != 0) |
788 | return r; |
789 | return 0; |
790 | } |
791 | |
792 | int |
793 | sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m, |
794 | int untrusted) |
795 | { |
796 | int r = SSH_ERR_INTERNAL_ERROR-1; |
797 | |
798 | /* Flag options */ |
799 | if ((r = sshbuf_put_u8(m, opts->permit_port_forwarding_flag)) != 0 || |
800 | (r = sshbuf_put_u8(m, opts->permit_agent_forwarding_flag)) != 0 || |
801 | (r = sshbuf_put_u8(m, opts->permit_x11_forwarding_flag)) != 0 || |
802 | (r = sshbuf_put_u8(m, opts->permit_pty_flag)) != 0 || |
803 | (r = sshbuf_put_u8(m, opts->permit_user_rc)) != 0 || |
804 | (r = sshbuf_put_u8(m, opts->restricted)) != 0 || |
805 | (r = sshbuf_put_u8(m, opts->cert_authority)) != 0 || |
806 | (r = sshbuf_put_u8(m, opts->no_require_user_presence)) != 0 || |
807 | (r = sshbuf_put_u8(m, opts->require_verify)) != 0) |
808 | return r; |
809 | |
810 | /* Simple integer options */ |
811 | if ((r = sshbuf_put_u64(m, opts->valid_before)) != 0) |
812 | return r; |
813 | |
814 | /* tunnel number can be negative to indicate "unset" */ |
815 | if ((r = sshbuf_put_u8(m, opts->force_tun_device == -1)) != 0 || |
816 | (r = sshbuf_put_u32(m, (opts->force_tun_device < 0) ? |
817 | 0 : (u_int)opts->force_tun_device)) != 0) |
818 | return r; |
819 | |
820 | /* String options; these may be NULL */ |
821 | if ((r = serialise_nullable_string(m, |
822 | untrusted ? "yes" : opts->cert_principals)) != 0 || |
823 | (r = serialise_nullable_string(m, |
824 | untrusted ? "true" : opts->force_command)) != 0 || |
825 | (r = serialise_nullable_string(m, |
826 | untrusted ? NULL((void *)0) : opts->required_from_host_cert)) != 0 || |
827 | (r = serialise_nullable_string(m, |
828 | untrusted ? NULL((void *)0) : opts->required_from_host_keys)) != 0) |
829 | return r; |
830 | |
831 | /* Array options */ |
832 | if ((r = serialise_array(m, opts->env, |
833 | untrusted ? 0 : opts->nenv)) != 0 || |
834 | (r = serialise_array(m, opts->permitopen, |
835 | untrusted ? 0 : opts->npermitopen)) != 0 || |
836 | (r = serialise_array(m, opts->permitlisten, |
837 | untrusted ? 0 : opts->npermitlisten)) != 0) |
838 | return r; |
839 | |
840 | /* success */ |
841 | return 0; |
842 | } |
843 | |
844 | int |
845 | sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **optsp) |
846 | { |
847 | struct sshauthopt *opts = NULL((void *)0); |
848 | int r = SSH_ERR_INTERNAL_ERROR-1; |
849 | u_char f; |
850 | u_int tmp; |
851 | |
852 | if ((opts = calloc(1, sizeof(*opts))) == NULL((void *)0)) |
853 | return SSH_ERR_ALLOC_FAIL-2; |
854 | |
855 | /* Flag options */ |
856 | #define OPT_FLAG(x) \ |
857 | do { \ |
858 | if ((r = sshbuf_get_u8(m, &f)) != 0) \ |
859 | goto out; \ |
860 | opts->x = f; \ |
861 | } while (0) |
862 | OPT_FLAG(permit_port_forwarding_flag); |
863 | OPT_FLAG(permit_agent_forwarding_flag); |
864 | OPT_FLAG(permit_x11_forwarding_flag); |
865 | OPT_FLAG(permit_pty_flag); |
866 | OPT_FLAG(permit_user_rc); |
867 | OPT_FLAG(restricted); |
868 | OPT_FLAG(cert_authority); |
869 | OPT_FLAG(no_require_user_presence); |
870 | OPT_FLAG(require_verify); |
871 | #undef OPT_FLAG |
872 | |
873 | /* Simple integer options */ |
874 | if ((r = sshbuf_get_u64(m, &opts->valid_before)) != 0) |
875 | goto out; |
876 | |
877 | /* tunnel number can be negative to indicate "unset" */ |
878 | if ((r = sshbuf_get_u8(m, &f)) != 0 || |
879 | (r = sshbuf_get_u32(m, &tmp)) != 0) |
880 | goto out; |
881 | opts->force_tun_device = f ? -1 : (int)tmp; |
882 | |
883 | /* String options may be NULL */ |
884 | if ((r = deserialise_nullable_string(m, &opts->cert_principals)) != 0 || |
885 | (r = deserialise_nullable_string(m, &opts->force_command)) != 0 || |
886 | (r = deserialise_nullable_string(m, |
887 | &opts->required_from_host_cert)) != 0 || |
888 | (r = deserialise_nullable_string(m, |
889 | &opts->required_from_host_keys)) != 0) |
890 | goto out; |
891 | |
892 | /* Array options */ |
893 | if ((r = deserialise_array(m, &opts->env, &opts->nenv)) != 0 || |
894 | (r = deserialise_array(m, |
895 | &opts->permitopen, &opts->npermitopen)) != 0 || |
896 | (r = deserialise_array(m, |
897 | &opts->permitlisten, &opts->npermitlisten)) != 0) |
898 | goto out; |
899 | |
900 | /* success */ |
901 | r = 0; |
902 | *optsp = opts; |
903 | opts = NULL((void *)0); |
904 | out: |
905 | sshauthopt_free(opts); |
906 | return r; |
907 | } |