dropbear: svr-authpubkeyoptions.c annotate

annotate svr-authpubkeyoptions.c @ 1306:34e6127ef02e

merge fixes from PuTTY import.c toint() from misc.c (revids are from hggit conversion) changeset: 4620:60a336a6c85c user: Simon Tatham <[email protected]> date: Thu Feb 25 20:26:33 2016 +0000 files: import.c description: Fix potential segfaults in reading OpenSSH's ASN.1 key format. The length coming back from ber_read_id_len might have overflowed, so treat it as potentially negative. Also, while I'm here, accumulate it inside ber_read_id_len as an unsigned, so as to avoid undefined behaviour on integer overflow, and toint() it before return. Thanks to Hanno Böck for spotting this, with the aid of AFL. (cherry picked from commit 5b7833cd474a24ec098654dcba8cb9509f3bf2c1) Conflicts: import.c (cherry-picker's note: resolving the conflict involved removing an entire section of the original commit which fixed ECDSA code not present on this branch) changeset: 4619:9c6c638d98d8 user: Simon Tatham <[email protected]> date: Sun Jul 14 10:45:54 2013 +0000 files: import.c ssh.c sshdss.c sshpubk.c sshrsa.c description: Tighten up a lot of casts from unsigned to int which are read by one of the GET_32BIT macros and then used as length fields. Missing bounds checks against zero have been added, and also I've introduced a helper function toint() which casts from unsigned to int in such a way as to avoid C undefined behaviour, since I'm not sure I trust compilers any more to do the obviously sensible thing. [originally from svn r9918] changeset: 4618:3957829f24d3 user: Simon Tatham <[email protected]> date: Mon Jul 08 22:36:04 2013 +0000 files: import.c sshdss.c sshrsa.c description: Add an assortment of extra safety checks. [originally from svn r9896] changeset: 4617:2cddee0bce12 user: Jacob Nevins <[email protected]> date: Wed Dec 07 00:24:45 2005 +0000 files: import.c description: Institutional failure to memset() things pointed at rather than pointers. Things should now be zeroed and memory not leaked. Spotted by Brant Thomsen. [originally from svn r6476] changeset: 4616:24ac78a9c71d user: Simon Tatham <[email protected]> date: Wed Feb 11 13:58:27 2004 +0000 files: import.c description: Jacob's last-minute testing found a couple of trivial bugs in import.c, and my attempts to reproduce them in cmdgen found another one there :-) [originally from svn r3847] changeset: 4615:088d39a73db0 user: Simon Tatham <[email protected]> date: Thu Jan 22 18:52:49 2004 +0000 files: import.c description: Placate some gcc warnings. [originally from svn r3761] changeset: 4614:e4288bad4d93 parent: 1758:108b8924593d user: Simon Tatham <[email protected]> date: Fri Oct 03 21:21:23 2003 +0000 files: import.c description: My ASN.1 decoder returned wrong IDs for anything above 0x1E! Good job it's never had to yet. Ahem. [originally from svn r3479]

author	Matt Johnston <matt@ucc.asn.au>
date	Tue, 12 Jul 2016 23:00:01 +0800
parents	5709b15a1b57
children	750ec4ec4cbe ab06e093d1e1

rev	line source
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	1 /*
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	2 * Dropbear - a SSH2 server
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	3 *
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	4 * Copyright (c) 2008 Frederic Moulins
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	5 * All rights reserved.
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	6 *
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	7 * Permission is hereby granted, free of charge, to any person obtaining a copy
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	8 * of this software and associated documentation files (the "Software"), to deal
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	9 * in the Software without restriction, including without limitation the rights
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	11 * copies of the Software, and to permit persons to whom the Software is
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	12 * furnished to do so, subject to the following conditions:
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	13 *
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	14 * The above copyright notice and this permission notice shall be included in
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	15 * all copies or substantial portions of the Software.
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	16 *
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	23 * SOFTWARE.
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	24 *
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	25 * This file incorporates work covered by the following copyright and
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	26 * permission notice:
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	27 *
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	28 * Author: Tatu Ylonen <[email protected]>
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	29 * Copyright (c) 1995 Tatu Ylonen <[email protected]>, Espoo, Finland
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	30 * All rights reserved
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	31 * As far as I am concerned, the code I have written for this software
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	32 * can be used freely for any purpose. Any derived versions of this
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	33 * software must be clearly marked as such, and if the derived work is
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	34 * incompatible with the protocol description in the RFC file, it must be
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	35 * called by a name other than "ssh" or "Secure Shell".
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	36 *
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	37 * This copyright and permission notice applies to the code parsing public keys
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	38 * options string which can also be found in OpenSSH auth-options.c file
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	39 * (auth_parse_options).
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	40 *
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	41 */
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	42
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	43 /* Process pubkey options during a pubkey auth request */
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	44 #include "includes.h"
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	45 #include "session.h"
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	46 #include "dbutil.h"
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	47 #include "signkey.h"
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	48 #include "auth.h"
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	49
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	50 #ifdef ENABLE_SVR_PUBKEY_OPTIONS
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	51
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	52 /* Returns 1 if pubkey allows agent forwarding,
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	53 * 0 otherwise */
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	54 int svr_pubkey_allows_agentfwd() {
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	55 if (ses.authstate.pubkey_options
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	56 && ses.authstate.pubkey_options->no_agent_forwarding_flag) {
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	57 return 0;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	58 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	59 return 1;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	60 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	61
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	62 /* Returns 1 if pubkey allows tcp forwarding,
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	63 * 0 otherwise */
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	64 int svr_pubkey_allows_tcpfwd() {
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	65 if (ses.authstate.pubkey_options
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	66 && ses.authstate.pubkey_options->no_port_forwarding_flag) {
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	67 return 0;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	68 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	69 return 1;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	70 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	71
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	72 /* Returns 1 if pubkey allows x11 forwarding,
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	73 * 0 otherwise */
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	74 int svr_pubkey_allows_x11fwd() {
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	75 if (ses.authstate.pubkey_options
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	76 && ses.authstate.pubkey_options->no_x11_forwarding_flag) {
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	77 return 0;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	78 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	79 return 1;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	80 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	81
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	82 /* Returns 1 if pubkey allows pty, 0 otherwise */
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	83 int svr_pubkey_allows_pty() {
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	84 if (ses.authstate.pubkey_options
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	85 && ses.authstate.pubkey_options->no_pty_flag) {
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	86 return 0;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	87 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	88 return 1;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	89 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	90
566 b321aeb57c64 - set $SSH_ORIGINAL_COMMAND if a command is forced, and log it Matt Johnston <matt@ucc.asn.au> parents: 502 diff changeset	91 /* Set chansession command to the one forced
b321aeb57c64 - set $SSH_ORIGINAL_COMMAND if a command is forced, and log it Matt Johnston <matt@ucc.asn.au> parents: 502 diff changeset	92 * by any 'command' public key option. */
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	93 void svr_pubkey_set_forced_command(struct ChanSess *chansess) {
1145 5709b15a1b57 Fix segfault with restricted authorized_key files without forced command Guilhem Moulin <guilhem@fripost.org> parents: 1094 diff changeset	94 if (ses.authstate.pubkey_options && ses.authstate.pubkey_options->forced_command) {
654 818108bf7749 - Fix use-after-free if multiple command requests were sent. Move Matt Johnston <matt@ucc.asn.au> parents: 594 diff changeset	95 if (chansess->cmd) {
818108bf7749 - Fix use-after-free if multiple command requests were sent. Move Matt Johnston <matt@ucc.asn.au> parents: 594 diff changeset	96 /* original_command takes ownership */
818108bf7749 - Fix use-after-free if multiple command requests were sent. Move Matt Johnston <matt@ucc.asn.au> parents: 594 diff changeset	97 chansess->original_command = chansess->cmd;
818108bf7749 - Fix use-after-free if multiple command requests were sent. Move Matt Johnston <matt@ucc.asn.au> parents: 594 diff changeset	98 } else {
818108bf7749 - Fix use-after-free if multiple command requests were sent. Move Matt Johnston <matt@ucc.asn.au> parents: 594 diff changeset	99 chansess->original_command = m_strdup("");
566 b321aeb57c64 - set $SSH_ORIGINAL_COMMAND if a command is forced, and log it Matt Johnston <matt@ucc.asn.au> parents: 502 diff changeset	100 }
654 818108bf7749 - Fix use-after-free if multiple command requests were sent. Move Matt Johnston <matt@ucc.asn.au> parents: 594 diff changeset	101 chansess->cmd = m_strdup(ses.authstate.pubkey_options->forced_command);
566 b321aeb57c64 - set $SSH_ORIGINAL_COMMAND if a command is forced, and log it Matt Johnston <matt@ucc.asn.au> parents: 502 diff changeset	102 #ifdef LOG_COMMANDS
654 818108bf7749 - Fix use-after-free if multiple command requests were sent. Move Matt Johnston <matt@ucc.asn.au> parents: 594 diff changeset	103 dropbear_log(LOG_INFO, "Command forced to '%s'", chansess->original_command);
566 b321aeb57c64 - set $SSH_ORIGINAL_COMMAND if a command is forced, and log it Matt Johnston <matt@ucc.asn.au> parents: 502 diff changeset	104 #endif
b321aeb57c64 - set $SSH_ORIGINAL_COMMAND if a command is forced, and log it Matt Johnston <matt@ucc.asn.au> parents: 502 diff changeset	105 }
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	106 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	107
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	108 /* Free potential public key options */
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	109 void svr_pubkey_options_cleanup() {
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	110 if (ses.authstate.pubkey_options) {
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	111 m_free(ses.authstate.pubkey_options);
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	112 ses.authstate.pubkey_options = NULL;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	113 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	114 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	115
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	116 /* helper for svr_add_pubkey_options. returns DROPBEAR_SUCCESS if the option is matched,
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	117 and increments the options_buf */
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	118 static int match_option(buffer options_buf, const char opt_name) {
502 43bbe17d6ba0 - Add Counter Mode support Matt Johnston <matt@ucc.asn.au> parents: 476 diff changeset	119 const unsigned int len = strlen(opt_name);
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	120 if (options_buf->len - options_buf->pos < len) {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	121 return DROPBEAR_FAILURE;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	122 }
1094 c45d65392c1a Fix pointer differ in signess warnings [-Werror=pointer-sign] Gaël PORTAY <gael.portay@gmail.com> parents: 668 diff changeset	123 if (strncasecmp((const char *) buf_getptr(options_buf, len), opt_name, len) == 0) {
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	124 buf_incrpos(options_buf, len);
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	125 return DROPBEAR_SUCCESS;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	126 }
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	127 return DROPBEAR_FAILURE;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	128 }
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	129
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	130 /* Parse pubkey options and set ses.authstate.pubkey_options accordingly.
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	131 * Returns DROPBEAR_SUCCESS if key is ok for auth, DROPBEAR_FAILURE otherwise */
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	132 int svr_add_pubkey_options(buffer options_buf, int line_num, const char filename) {
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	133 int ret = DROPBEAR_FAILURE;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	134
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	135 TRACE(("enter addpubkeyoptions"))
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	136
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	137 ses.authstate.pubkey_options = (struct PubKeyOptions*)m_malloc(sizeof( struct PubKeyOptions ));
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	138
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	139 buf_setpos(options_buf, 0);
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	140 while (options_buf->pos < options_buf->len) {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	141 if (match_option(options_buf, "no-port-forwarding") == DROPBEAR_SUCCESS) {
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	142 dropbear_log(LOG_WARNING, "Port forwarding disabled.");
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	143 ses.authstate.pubkey_options->no_port_forwarding_flag = 1;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	144 goto next_option;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	145 }
668 405418f7dc5e Fixed compilation with unset ENABLE_{SVR,CLI}_AGENTFWD. Andrey Mazo <ahippo@yandex.ru> parents: 654 diff changeset	146 #ifdef ENABLE_SVR_AGENTFWD
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	147 if (match_option(options_buf, "no-agent-forwarding") == DROPBEAR_SUCCESS) {
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	148 dropbear_log(LOG_WARNING, "Agent forwarding disabled.");
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	149 ses.authstate.pubkey_options->no_agent_forwarding_flag = 1;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	150 goto next_option;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	151 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	152 #endif
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	153 #ifdef ENABLE_X11FWD
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	154 if (match_option(options_buf, "no-X11-forwarding") == DROPBEAR_SUCCESS) {
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	155 dropbear_log(LOG_WARNING, "X11 forwarding disabled.");
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	156 ses.authstate.pubkey_options->no_x11_forwarding_flag = 1;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	157 goto next_option;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	158 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	159 #endif
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	160 if (match_option(options_buf, "no-pty") == DROPBEAR_SUCCESS) {
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	161 dropbear_log(LOG_WARNING, "Pty allocation disabled.");
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	162 ses.authstate.pubkey_options->no_pty_flag = 1;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	163 goto next_option;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	164 }
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	165 if (match_option(options_buf, "command=\"") == DROPBEAR_SUCCESS) {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	166 int escaped = 0;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	167 const unsigned char* command_start = buf_getptr(options_buf, 0);
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	168 while (options_buf->pos < options_buf->len) {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	169 const char c = buf_getbyte(options_buf);
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	170 if (!escaped && c == '"') {
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	171 const int command_len = buf_getptr(options_buf, 0) - command_start;
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	172 ses.authstate.pubkey_options->forced_command = m_malloc(command_len);
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	173 memcpy(ses.authstate.pubkey_options->forced_command,
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	174 command_start, command_len-1);
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	175 ses.authstate.pubkey_options->forced_command[command_len-1] = '\0';
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	176 dropbear_log(LOG_WARNING, "Forced command '%s'",
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	177 ses.authstate.pubkey_options->forced_command);
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	178 goto next_option;
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	179 }
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	180 escaped = (!escaped && c == '\\');
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	181 }
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	182 dropbear_log(LOG_WARNING, "Badly formatted command= authorized_keys option");
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	183 goto bad_option;
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	184 }
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	185
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	186 next_option:
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	187 /*
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	188 * Skip the comma, and move to the next option
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	189 * (or break out if there are no more).
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	190 */
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	191 if (options_buf->pos < options_buf->len
df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	192 && buf_getbyte(options_buf) != ',') {
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	193 goto bad_option;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	194 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	195 /* Process the next option. */
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	196 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	197 /* parsed all options with no problem */
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	198 ret = DROPBEAR_SUCCESS;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	199 goto end;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	200
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	201 bad_option:
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	202 ret = DROPBEAR_FAILURE;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	203 m_free(ses.authstate.pubkey_options);
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	204 ses.authstate.pubkey_options = NULL;
476 df7f7da7f6e4 - Rework pubkey options to be more careful about buffer lengths. Needs review. Matt Johnston <matt@ucc.asn.au> parents: 475 diff changeset	205 dropbear_log(LOG_WARNING, "Bad public key options at %s:%d", filename, line_num);
475 52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	206
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	207 end:
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	208 TRACE(("leave addpubkeyoptions"))
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	209 return ret;
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	210 }
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	211
52a644e7b8e1 * Patch from Frédéric Moulins adding options to authorized_keys. Matt Johnston <matt@ucc.asn.au> parents: diff changeset	212 #endif

Mercurial > dropbear

annotate svr-authpubkeyoptions.c @ 1306:34e6127ef02e