1*50a69bb5SSascha Wildner /* $OpenBSD: auth-options.h,v 1.31 2021/07/23 03:57:20 djm Exp $ */ 218de8d7fSPeter Avalos 318de8d7fSPeter Avalos /* 4664f4763Szrj * Copyright (c) 2018 Damien Miller <djm@mindrot.org> 518de8d7fSPeter Avalos * 6664f4763Szrj * Permission to use, copy, modify, and distribute this software for any 7664f4763Szrj * purpose with or without fee is hereby granted, provided that the above 8664f4763Szrj * copyright notice and this permission notice appear in all copies. 9664f4763Szrj * 10664f4763Szrj * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11664f4763Szrj * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12664f4763Szrj * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13664f4763Szrj * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14664f4763Szrj * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15664f4763Szrj * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16664f4763Szrj * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 1718de8d7fSPeter Avalos */ 1818de8d7fSPeter Avalos 1918de8d7fSPeter Avalos #ifndef AUTH_OPTIONS_H 2018de8d7fSPeter Avalos #define AUTH_OPTIONS_H 2118de8d7fSPeter Avalos 22664f4763Szrj struct passwd; 23664f4763Szrj struct sshkey; 24664f4763Szrj 250cbfa66cSDaniel Fojt /* Maximum number of permitopen/permitlisten directives to accept */ 260cbfa66cSDaniel Fojt #define SSH_AUTHOPT_PERMIT_MAX 4096 270cbfa66cSDaniel Fojt 28*50a69bb5SSascha Wildner /* Maximum number of environment directives to accept */ 29*50a69bb5SSascha Wildner #define SSH_AUTHOPT_ENV_MAX 1024 30*50a69bb5SSascha Wildner 31664f4763Szrj /* 32664f4763Szrj * sshauthopt represents key options parsed from authorized_keys or 33664f4763Szrj * from certificate extensions/options. 34664f4763Szrj */ 35664f4763Szrj struct sshauthopt { 36664f4763Szrj /* Feature flags */ 37664f4763Szrj int permit_port_forwarding_flag; 38664f4763Szrj int permit_agent_forwarding_flag; 39664f4763Szrj int permit_x11_forwarding_flag; 40664f4763Szrj int permit_pty_flag; 41664f4763Szrj int permit_user_rc; 42664f4763Szrj 43664f4763Szrj /* "restrict" keyword was invoked */ 44664f4763Szrj int restricted; 45664f4763Szrj 46664f4763Szrj /* key/principal expiry date */ 47664f4763Szrj uint64_t valid_before; 48664f4763Szrj 49664f4763Szrj /* Certificate-related options */ 50664f4763Szrj int cert_authority; 51664f4763Szrj char *cert_principals; 52664f4763Szrj 53664f4763Szrj int force_tun_device; 54664f4763Szrj char *force_command; 55664f4763Szrj 56664f4763Szrj /* Custom environment */ 57664f4763Szrj size_t nenv; 58664f4763Szrj char **env; 59664f4763Szrj 60664f4763Szrj /* Permitted port forwardings */ 61664f4763Szrj size_t npermitopen; 62664f4763Szrj char **permitopen; 63664f4763Szrj 64664f4763Szrj /* Permitted listens (remote forwarding) */ 65664f4763Szrj size_t npermitlisten; 66664f4763Szrj char **permitlisten; 67664f4763Szrj 68664f4763Szrj /* 69664f4763Szrj * Permitted host/addresses (comma-separated) 70664f4763Szrj * Caller must check source address matches both lists (if present). 71664f4763Szrj */ 72664f4763Szrj char *required_from_host_cert; 73664f4763Szrj char *required_from_host_keys; 740cbfa66cSDaniel Fojt 750cbfa66cSDaniel Fojt /* Key requires user presence asserted */ 760cbfa66cSDaniel Fojt int no_require_user_presence; 77*50a69bb5SSascha Wildner /* Key requires user verification (e.g. PIN) */ 78*50a69bb5SSascha Wildner int require_verify; 7918de8d7fSPeter Avalos }; 8018de8d7fSPeter Avalos 81664f4763Szrj struct sshauthopt *sshauthopt_new(void); 82664f4763Szrj struct sshauthopt *sshauthopt_new_with_keys_defaults(void); 83664f4763Szrj void sshauthopt_free(struct sshauthopt *opts); 84664f4763Szrj struct sshauthopt *sshauthopt_copy(const struct sshauthopt *orig); 85664f4763Szrj int sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m, int); 86664f4763Szrj int sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **opts); 8718de8d7fSPeter Avalos 88664f4763Szrj /* 89664f4763Szrj * Parse authorized_keys options. Returns an options structure on success 90664f4763Szrj * or NULL on failure. Will set errstr on failure. 91664f4763Szrj */ 92664f4763Szrj struct sshauthopt *sshauthopt_parse(const char *s, const char **errstr); 93664f4763Szrj 94664f4763Szrj /* 95664f4763Szrj * Parse certification options to a struct sshauthopt. 96664f4763Szrj * Returns options on success or NULL on failure. 97664f4763Szrj */ 98664f4763Szrj struct sshauthopt *sshauthopt_from_cert(struct sshkey *k); 99664f4763Szrj 100664f4763Szrj /* 101664f4763Szrj * Merge key options. 102664f4763Szrj */ 103664f4763Szrj struct sshauthopt *sshauthopt_merge(const struct sshauthopt *primary, 104664f4763Szrj const struct sshauthopt *additional, const char **errstrp); 10518de8d7fSPeter Avalos 10618de8d7fSPeter Avalos #endif 107