xref: /dragonfly/crypto/openssh/auth-options.h (revision 50a69bb5)
1 /* $OpenBSD: auth-options.h,v 1.31 2021/07/23 03:57:20 djm Exp $ */
2 
3 /*
4  * Copyright (c) 2018 Damien Miller <djm@mindrot.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #ifndef AUTH_OPTIONS_H
20 #define AUTH_OPTIONS_H
21 
22 struct passwd;
23 struct sshkey;
24 
25 /* Maximum number of permitopen/permitlisten directives to accept */
26 #define SSH_AUTHOPT_PERMIT_MAX	4096
27 
28 /* Maximum number of environment directives to accept */
29 #define SSH_AUTHOPT_ENV_MAX	1024
30 
31 /*
32  * sshauthopt represents key options parsed from authorized_keys or
33  * from certificate extensions/options.
34  */
35 struct sshauthopt {
36 	/* Feature flags */
37 	int permit_port_forwarding_flag;
38 	int permit_agent_forwarding_flag;
39 	int permit_x11_forwarding_flag;
40 	int permit_pty_flag;
41 	int permit_user_rc;
42 
43 	/* "restrict" keyword was invoked */
44 	int restricted;
45 
46 	/* key/principal expiry date */
47 	uint64_t valid_before;
48 
49 	/* Certificate-related options */
50 	int cert_authority;
51 	char *cert_principals;
52 
53 	int force_tun_device;
54 	char *force_command;
55 
56 	/* Custom environment */
57 	size_t nenv;
58 	char **env;
59 
60 	/* Permitted port forwardings */
61 	size_t npermitopen;
62 	char **permitopen;
63 
64 	/* Permitted listens (remote forwarding) */
65 	size_t npermitlisten;
66 	char **permitlisten;
67 
68 	/*
69 	 * Permitted host/addresses (comma-separated)
70 	 * Caller must check source address matches both lists (if present).
71 	 */
72 	char *required_from_host_cert;
73 	char *required_from_host_keys;
74 
75 	/* Key requires user presence asserted */
76 	int no_require_user_presence;
77 	/* Key requires user verification (e.g. PIN) */
78 	int require_verify;
79 };
80 
81 struct sshauthopt *sshauthopt_new(void);
82 struct sshauthopt *sshauthopt_new_with_keys_defaults(void);
83 void sshauthopt_free(struct sshauthopt *opts);
84 struct sshauthopt *sshauthopt_copy(const struct sshauthopt *orig);
85 int sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m, int);
86 int sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **opts);
87 
88 /*
89  * Parse authorized_keys options. Returns an options structure on success
90  * or NULL on failure. Will set errstr on failure.
91  */
92 struct sshauthopt *sshauthopt_parse(const char *s, const char **errstr);
93 
94 /*
95  * Parse certification options to a struct sshauthopt.
96  * Returns options on success or NULL on failure.
97  */
98 struct sshauthopt *sshauthopt_from_cert(struct sshkey *k);
99 
100 /*
101  * Merge key options.
102  */
103 struct sshauthopt *sshauthopt_merge(const struct sshauthopt *primary,
104     const struct sshauthopt *additional, const char **errstrp);
105 
106 #endif
107