1124981e1SDag-Erling Smørgrav /* $OpenBSD: auth-options.h,v 1.31 2021/07/23 03:57:20 djm Exp $ */ 2ae1f160dSDag-Erling Smørgrav 3b66f2d16SKris Kennaway /* 4b66f2d16SKris Kennaway * Copyright (c) 2018 Damien Miller <djm@mindrot.org> 5b66f2d16SKris Kennaway * 6b66f2d16SKris Kennaway * Permission to use, copy, modify, and distribute this software for any 7b66f2d16SKris Kennaway * purpose with or without fee is hereby granted, provided that the above 8b66f2d16SKris Kennaway * copyright notice and this permission notice appear in all copies. 9b66f2d16SKris Kennaway * 10b66f2d16SKris Kennaway * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11b66f2d16SKris Kennaway * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12b66f2d16SKris Kennaway * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13b66f2d16SKris Kennaway * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 145b9b2fafSBrian Feldman * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15b66f2d16SKris Kennaway * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16b66f2d16SKris Kennaway * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 171e8db6e2SBrian Feldman */ 181e8db6e2SBrian Feldman 191e8db6e2SBrian Feldman #ifndef AUTH_OPTIONS_H 201e8db6e2SBrian Feldman #define AUTH_OPTIONS_H 211e8db6e2SBrian Feldman 221e8db6e2SBrian Feldman struct passwd; 231e8db6e2SBrian Feldman struct sshkey; 24b66f2d16SKris Kennaway 25b66f2d16SKris Kennaway /* Maximum number of permitopen/permitlisten directives to accept */ 26b66f2d16SKris Kennaway #define SSH_AUTHOPT_PERMIT_MAX 4096 27b66f2d16SKris Kennaway 28b66f2d16SKris Kennaway /* Maximum number of environment directives to accept */ 29d4af9e69SDag-Erling Smørgrav #define SSH_AUTHOPT_ENV_MAX 1024 30b66f2d16SKris Kennaway 31b66f2d16SKris Kennaway /* 32021d409fSDag-Erling Smørgrav * sshauthopt represents key options parsed from authorized_keys or 33124981e1SDag-Erling Smørgrav * from certificate extensions/options. 34b66f2d16SKris Kennaway */ 35ae1f160dSDag-Erling Smørgrav struct sshauthopt { 365b9b2fafSBrian Feldman /* Feature flags */ 37124981e1SDag-Erling Smørgrav int permit_port_forwarding_flag; 385b9b2fafSBrian Feldman int permit_agent_forwarding_flag; 39b66f2d16SKris Kennaway int permit_x11_forwarding_flag; 40 int permit_pty_flag; 41 int permit_user_rc; 42 43 /* "restrict" keyword was invoked */ 44 int restricted; 45 46 /* key/principal expiry date */ 47 uint64_t valid_before; 48 49 /* Certificate-related options */ 50 int cert_authority; 51 char *cert_principals; 52 53 int force_tun_device; 54 char *force_command; 55 56 /* Custom environment */ 57 size_t nenv; 58 char **env; 59 60 /* Permitted port forwardings */ 61 size_t npermitopen; 62 char **permitopen; 63 64 /* Permitted listens (remote forwarding) */ 65 size_t npermitlisten; 66 char **permitlisten; 67 68 /* 69 * Permitted host/addresses (comma-separated) 70 * Caller must check source address matches both lists (if present). 71 */ 72 char *required_from_host_cert; 73 char *required_from_host_keys; 74 75 /* Key requires user presence asserted */ 76 int no_require_user_presence; 77 /* Key requires user verification (e.g. PIN) */ 78 int require_verify; 79 }; 80 81 struct sshauthopt *sshauthopt_new(void); 82 struct sshauthopt *sshauthopt_new_with_keys_defaults(void); 83 void sshauthopt_free(struct sshauthopt *opts); 84 struct sshauthopt *sshauthopt_copy(const struct sshauthopt *orig); 85 int sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m, int); 86 int sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **opts); 87 88 /* 89 * Parse authorized_keys options. Returns an options structure on success 90 * or NULL on failure. Will set errstr on failure. 91 */ 92 struct sshauthopt *sshauthopt_parse(const char *s, const char **errstr); 93 94 /* 95 * Parse certification options to a struct sshauthopt. 96 * Returns options on success or NULL on failure. 97 */ 98 struct sshauthopt *sshauthopt_from_cert(struct sshkey *k); 99 100 /* 101 * Merge key options. 102 */ 103 struct sshauthopt *sshauthopt_merge(const struct sshauthopt *primary, 104 const struct sshauthopt *additional, const char **errstrp); 105 106 #endif 107