# HG changeset patch
# User Matt Johnston <matt@ucc.asn.au>
# Date 1619873235 -28800
# Node ID 587c76726b5fdaf372e08956c479ab43a5b5c89f
# Parent  209711833f1540dc1d42ea81a7cd65a73b0c445e
Add "restrict" authorized_keys option

diff -r 209711833f15 -r 587c76726b5f dropbear.8
--- a/dropbear.8	Wed Mar 31 23:31:26 2021 +0800
+++ b/dropbear.8	Sat May 01 20:47:15 2021 +0800
@@ -135,6 +135,10 @@
 same functionality with other means even if no-pty is set.
 
 .TP
+.B restrict
+Applies all the no- restrictions listed above.
+
+.TP
 .B command=\fR"\fIforced_command\fR"
 Disregard the command provided by the user and always run \fIforced_command\fR.
 The -c command line option overrides this.
diff -r 209711833f15 -r 587c76726b5f svr-authpubkeyoptions.c
--- a/svr-authpubkeyoptions.c	Wed Mar 31 23:31:26 2021 +0800
+++ b/svr-authpubkeyoptions.c	Sat May 01 20:47:15 2021 +0800
@@ -166,6 +166,18 @@
 			ses.authstate.pubkey_options->no_pty_flag = 1;
 			goto next_option;
 		}
+		if (match_option(options_buf, "restrict") == DROPBEAR_SUCCESS) {
+			dropbear_log(LOG_WARNING, "Restrict option set");
+			ses.authstate.pubkey_options->no_port_forwarding_flag = 1;
+#if DROPBEAR_SVR_AGENTFWD
+			ses.authstate.pubkey_options->no_agent_forwarding_flag = 1;
+#endif
+#if DROPBEAR_X11FWD
+			ses.authstate.pubkey_options->no_x11_forwarding_flag = 1;
+#endif
+			ses.authstate.pubkey_options->no_pty_flag = 1;
+			goto next_option;
+		}
 		if (match_option(options_buf, "command=\"") == DROPBEAR_SUCCESS) {
 			int escaped = 0;
 			const unsigned char* command_start = buf_getptr(options_buf, 0);