summaryrefslogtreecommitdiff
path: root/servconf.c
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2017-10-04 11:23:58 +0100
committerColin Watson <cjwatson@debian.org>2017-10-05 23:58:12 +0100
commit0556ea972b15607b7e13ff31bc05840881c91dd3 (patch)
treed6b8d48062d0278b5ae0eeff42d0e9afa9f26860 /servconf.c
parentdb2122d97eb1ecdd8d99b7bf79b0dd2b5addfd92 (diff)
parent801a62eedaaf47b20dbf4b426dc3e084bf0c8d49 (diff)
New upstream release (7.6p1)
Diffstat (limited to 'servconf.c')
-rw-r--r--servconf.c117
1 files changed, 88 insertions, 29 deletions
diff --git a/servconf.c b/servconf.c
index 1a7a5f182..5e996cf8f 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1,5 +1,5 @@
1 1
2/* $OpenBSD: servconf.c,v 1.306 2017/03/14 07:19:07 djm Exp $ */ 2/* $OpenBSD: servconf.c,v 1.312 2017/10/02 19:33:20 djm Exp $ */
3/* 3/*
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved 5 * All rights reserved
@@ -151,7 +151,7 @@ initialize_server_options(ServerOptions *options)
151 options->num_authkeys_files = 0; 151 options->num_authkeys_files = 0;
152 options->num_accept_env = 0; 152 options->num_accept_env = 0;
153 options->permit_tun = -1; 153 options->permit_tun = -1;
154 options->num_permitted_opens = -1; 154 options->permitted_opens = NULL;
155 options->adm_forced_command = NULL; 155 options->adm_forced_command = NULL;
156 options->chroot_directory = NULL; 156 options->chroot_directory = NULL;
157 options->authorized_keys_command = NULL; 157 options->authorized_keys_command = NULL;
@@ -166,6 +166,7 @@ initialize_server_options(ServerOptions *options)
166 options->version_addendum = NULL; 166 options->version_addendum = NULL;
167 options->fingerprint_hash = -1; 167 options->fingerprint_hash = -1;
168 options->disable_forwarding = -1; 168 options->disable_forwarding = -1;
169 options->expose_userauth_info = -1;
169 options->debian_banner = -1; 170 options->debian_banner = -1;
170} 171}
171 172
@@ -338,6 +339,8 @@ fill_default_server_options(ServerOptions *options)
338 options->fingerprint_hash = SSH_FP_HASH_DEFAULT; 339 options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
339 if (options->disable_forwarding == -1) 340 if (options->disable_forwarding == -1)
340 options->disable_forwarding = 0; 341 options->disable_forwarding = 0;
342 if (options->expose_userauth_info == -1)
343 options->expose_userauth_info = 0;
341 if (options->debian_banner == -1) 344 if (options->debian_banner == -1)
342 options->debian_banner = 1; 345 options->debian_banner = 1;
343 346
@@ -426,6 +429,7 @@ typedef enum {
426 sAuthenticationMethods, sHostKeyAgent, sPermitUserRC, 429 sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
427 sStreamLocalBindMask, sStreamLocalBindUnlink, 430 sStreamLocalBindMask, sStreamLocalBindUnlink,
428 sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding, 431 sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding,
432 sExposeAuthInfo,
429 sDebianBanner, 433 sDebianBanner,
430 sDeprecated, sIgnore, sUnsupported 434 sDeprecated, sIgnore, sUnsupported
431} ServerOpCodes; 435} ServerOpCodes;
@@ -458,7 +462,7 @@ static struct {
458 { "keyregenerationinterval", sDeprecated, SSHCFG_GLOBAL }, 462 { "keyregenerationinterval", sDeprecated, SSHCFG_GLOBAL },
459 { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL }, 463 { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
460 { "syslogfacility", sLogFacility, SSHCFG_GLOBAL }, 464 { "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
461 { "loglevel", sLogLevel, SSHCFG_GLOBAL }, 465 { "loglevel", sLogLevel, SSHCFG_ALL },
462 { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL }, 466 { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
463 { "rhostsrsaauthentication", sDeprecated, SSHCFG_ALL }, 467 { "rhostsrsaauthentication", sDeprecated, SSHCFG_ALL },
464 { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL }, 468 { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
@@ -579,6 +583,7 @@ static struct {
579 { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL }, 583 { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL },
580 { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL }, 584 { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },
581 { "disableforwarding", sDisableForwarding, SSHCFG_ALL }, 585 { "disableforwarding", sDisableForwarding, SSHCFG_ALL },
586 { "exposeauthinfo", sExposeAuthInfo, SSHCFG_ALL },
582 { "debianbanner", sDebianBanner, SSHCFG_GLOBAL }, 587 { "debianbanner", sDebianBanner, SSHCFG_GLOBAL },
583 { NULL, sBadOption, 0 } 588 { NULL, sBadOption, 0 }
584}; 589};
@@ -711,6 +716,44 @@ process_queued_listen_addrs(ServerOptions *options)
711 options->num_queued_listens = 0; 716 options->num_queued_listens = 0;
712} 717}
713 718
719/*
720 * Inform channels layer of permitopen options from configuration.
721 */
722void
723process_permitopen(struct ssh *ssh, ServerOptions *options)
724{
725 u_int i;
726 int port;
727 char *host, *arg, *oarg;
728
729 channel_clear_adm_permitted_opens(ssh);
730 if (options->num_permitted_opens == 0)
731 return; /* permit any */
732
733 /* handle keywords: "any" / "none" */
734 if (options->num_permitted_opens == 1 &&
735 strcmp(options->permitted_opens[0], "any") == 0)
736 return;
737 if (options->num_permitted_opens == 1 &&
738 strcmp(options->permitted_opens[0], "none") == 0) {
739 channel_disable_adm_local_opens(ssh);
740 return;
741 }
742 /* Otherwise treat it as a list of permitted host:port */
743 for (i = 0; i < options->num_permitted_opens; i++) {
744 oarg = arg = xstrdup(options->permitted_opens[i]);
745 host = hpdelim(&arg);
746 if (host == NULL)
747 fatal("%s: missing host in PermitOpen", __func__);
748 host = cleanhostname(host);
749 if (arg == NULL || ((port = permitopen_port(arg)) < 0))
750 fatal("%s: bad port number in PermitOpen", __func__);
751 /* Send it to channels layer */
752 channel_add_adm_permitted_opens(ssh, host, port);
753 free(oarg);
754 }
755}
756
714struct connection_info * 757struct connection_info *
715get_connection_info(int populate, int use_dns) 758get_connection_info(int populate, int use_dns)
716{ 759{
@@ -954,13 +997,6 @@ static const struct multistate multistate_gatewayports[] = {
954 { "no", 0 }, 997 { "no", 0 },
955 { NULL, -1 } 998 { NULL, -1 }
956}; 999};
957static const struct multistate multistate_privsep[] = {
958 { "yes", PRIVSEP_NOSANDBOX },
959 { "sandbox", PRIVSEP_ON },
960 { "nosandbox", PRIVSEP_NOSANDBOX },
961 { "no", PRIVSEP_OFF },
962 { NULL, -1 }
963};
964static const struct multistate multistate_tcpfwd[] = { 1000static const struct multistate multistate_tcpfwd[] = {
965 { "yes", FORWARD_ALLOW }, 1001 { "yes", FORWARD_ALLOW },
966 { "all", FORWARD_ALLOW }, 1002 { "all", FORWARD_ALLOW },
@@ -975,7 +1011,7 @@ process_server_config_line(ServerOptions *options, char *line,
975 const char *filename, int linenum, int *activep, 1011 const char *filename, int linenum, int *activep,
976 struct connection_info *connectinfo) 1012 struct connection_info *connectinfo)
977{ 1013{
978 char *cp, **charptr, *arg, *p; 1014 char *cp, **charptr, *arg, *arg2, *p;
979 int cmdline = 0, *intptr, value, value2, n, port; 1015 int cmdline = 0, *intptr, value, value2, n, port;
980 SyslogFacility *log_facility_ptr; 1016 SyslogFacility *log_facility_ptr;
981 LogLevel *log_level_ptr; 1017 LogLevel *log_level_ptr;
@@ -1379,7 +1415,7 @@ process_server_config_line(ServerOptions *options, char *line,
1379 if (value == SYSLOG_LEVEL_NOT_SET) 1415 if (value == SYSLOG_LEVEL_NOT_SET)
1380 fatal("%.200s line %d: unsupported log level '%s'", 1416 fatal("%.200s line %d: unsupported log level '%s'",
1381 filename, linenum, arg ? arg : "<NONE>"); 1417 filename, linenum, arg ? arg : "<NONE>");
1382 if (*log_level_ptr == -1) 1418 if (*activep && *log_level_ptr == -1)
1383 *log_level_ptr = (LogLevel) value; 1419 *log_level_ptr = (LogLevel) value;
1384 break; 1420 break;
1385 1421
@@ -1654,24 +1690,18 @@ process_server_config_line(ServerOptions *options, char *line,
1654 if (!arg || *arg == '\0') 1690 if (!arg || *arg == '\0')
1655 fatal("%s line %d: missing PermitOpen specification", 1691 fatal("%s line %d: missing PermitOpen specification",
1656 filename, linenum); 1692 filename, linenum);
1657 n = options->num_permitted_opens; /* modified later */ 1693 i = options->num_permitted_opens; /* modified later */
1658 if (strcmp(arg, "any") == 0) { 1694 if (strcmp(arg, "any") == 0 || strcmp(arg, "none") == 0) {
1659 if (*activep && n == -1) { 1695 if (*activep && i == 0) {
1660 channel_clear_adm_permitted_opens();
1661 options->num_permitted_opens = 0;
1662 }
1663 break;
1664 }
1665 if (strcmp(arg, "none") == 0) {
1666 if (*activep && n == -1) {
1667 options->num_permitted_opens = 1; 1696 options->num_permitted_opens = 1;
1668 channel_disable_adm_local_opens(); 1697 options->permitted_opens = xcalloc(1,
1698 sizeof(*options->permitted_opens));
1699 options->permitted_opens[0] = xstrdup(arg);
1669 } 1700 }
1670 break; 1701 break;
1671 } 1702 }
1672 if (*activep && n == -1)
1673 channel_clear_adm_permitted_opens();
1674 for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) { 1703 for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1704 arg2 = xstrdup(arg);
1675 p = hpdelim(&arg); 1705 p = hpdelim(&arg);
1676 if (p == NULL) 1706 if (p == NULL)
1677 fatal("%s line %d: missing host in PermitOpen", 1707 fatal("%s line %d: missing host in PermitOpen",
@@ -1680,9 +1710,16 @@ process_server_config_line(ServerOptions *options, char *line,
1680 if (arg == NULL || ((port = permitopen_port(arg)) < 0)) 1710 if (arg == NULL || ((port = permitopen_port(arg)) < 0))
1681 fatal("%s line %d: bad port number in " 1711 fatal("%s line %d: bad port number in "
1682 "PermitOpen", filename, linenum); 1712 "PermitOpen", filename, linenum);
1683 if (*activep && n == -1) 1713 if (*activep && i == 0) {
1684 options->num_permitted_opens = 1714 options->permitted_opens = xrecallocarray(
1685 channel_add_adm_permitted_opens(p, port); 1715 options->permitted_opens,
1716 options->num_permitted_opens,
1717 options->num_permitted_opens + 1,
1718 sizeof(*options->permitted_opens));
1719 i = options->num_permitted_opens++;
1720 options->permitted_opens[i] = arg2;
1721 } else
1722 free(arg2);
1686 } 1723 }
1687 break; 1724 break;
1688 1725
@@ -1869,6 +1906,10 @@ process_server_config_line(ServerOptions *options, char *line,
1869 options->fingerprint_hash = value; 1906 options->fingerprint_hash = value;
1870 break; 1907 break;
1871 1908
1909 case sExposeAuthInfo:
1910 intptr = &options->expose_userauth_info;
1911 goto parse_flag;
1912
1872 case sDebianBanner: 1913 case sDebianBanner:
1873 intptr = &options->debian_banner; 1914 intptr = &options->debian_banner;
1874 goto parse_int; 1915 goto parse_int;
@@ -2011,6 +2052,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
2011 M_CP_INTOPT(allow_streamlocal_forwarding); 2052 M_CP_INTOPT(allow_streamlocal_forwarding);
2012 M_CP_INTOPT(allow_agent_forwarding); 2053 M_CP_INTOPT(allow_agent_forwarding);
2013 M_CP_INTOPT(disable_forwarding); 2054 M_CP_INTOPT(disable_forwarding);
2055 M_CP_INTOPT(expose_userauth_info);
2014 M_CP_INTOPT(permit_tun); 2056 M_CP_INTOPT(permit_tun);
2015 M_CP_INTOPT(fwd_opts.gateway_ports); 2057 M_CP_INTOPT(fwd_opts.gateway_ports);
2016 M_CP_INTOPT(fwd_opts.streamlocal_bind_unlink); 2058 M_CP_INTOPT(fwd_opts.streamlocal_bind_unlink);
@@ -2027,6 +2069,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
2027 M_CP_INTOPT(ip_qos_bulk); 2069 M_CP_INTOPT(ip_qos_bulk);
2028 M_CP_INTOPT(rekey_limit); 2070 M_CP_INTOPT(rekey_limit);
2029 M_CP_INTOPT(rekey_interval); 2071 M_CP_INTOPT(rekey_interval);
2072 M_CP_INTOPT(log_level);
2030 2073
2031 /* 2074 /*
2032 * The bind_mask is a mode_t that may be unsigned, so we can't use 2075 * The bind_mask is a mode_t that may be unsigned, so we can't use
@@ -2051,6 +2094,13 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
2051 dst->n[dst->num_n] = xstrdup(src->n[dst->num_n]); \ 2094 dst->n[dst->num_n] = xstrdup(src->n[dst->num_n]); \
2052 } \ 2095 } \
2053} while(0) 2096} while(0)
2097#define M_CP_STRARRAYOPT_ALLOC(n, num_n) do { \
2098 if (src->num_n != 0) { \
2099 dst->n = xcalloc(src->num_n, sizeof(*dst->n)); \
2100 M_CP_STRARRAYOPT(n, num_n); \
2101 dst->num_n = src->num_n; \
2102 } \
2103} while(0)
2054 2104
2055 /* See comment in servconf.h */ 2105 /* See comment in servconf.h */
2056 COPY_MATCH_STRING_OPTS(); 2106 COPY_MATCH_STRING_OPTS();
@@ -2081,6 +2131,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
2081#undef M_CP_INTOPT 2131#undef M_CP_INTOPT
2082#undef M_CP_STROPT 2132#undef M_CP_STROPT
2083#undef M_CP_STRARRAYOPT 2133#undef M_CP_STRARRAYOPT
2134#undef M_CP_STRARRAYOPT_ALLOC
2084 2135
2085void 2136void
2086parse_server_config(ServerOptions *options, const char *filename, Buffer *conf, 2137parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
@@ -2312,6 +2363,7 @@ dump_config(ServerOptions *o)
2312 dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding); 2363 dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding);
2313 dump_cfg_fmtint(sStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink); 2364 dump_cfg_fmtint(sStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink);
2314 dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash); 2365 dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);
2366 dump_cfg_fmtint(sExposeAuthInfo, o->expose_userauth_info);
2315 2367
2316 /* string arguments */ 2368 /* string arguments */
2317 dump_cfg_string(sPidFile, o->pid_file); 2369 dump_cfg_string(sPidFile, o->pid_file);
@@ -2381,5 +2433,12 @@ dump_config(ServerOptions *o)
2381 printf("rekeylimit %llu %d\n", (unsigned long long)o->rekey_limit, 2433 printf("rekeylimit %llu %d\n", (unsigned long long)o->rekey_limit,
2382 o->rekey_interval); 2434 o->rekey_interval);
2383 2435
2384 channel_print_adm_permitted_opens(); 2436 printf("permitopen");
2437 if (o->num_permitted_opens == 0)
2438 printf(" any");
2439 else {
2440 for (i = 0; i < o->num_permitted_opens; i++)
2441 printf(" %s", o->permitted_opens[i]);
2442 }
2443 printf("\n");
2385} 2444}