upstream: permitlisten option for authorized_keys; ok markus@

OpenBSD-Commit-ID: 8650883018d7aa893173d703379e4456a222c672

1 files changed, 34 insertions, 18 deletions

diff --git a/session.c b/session.c
index 3a3fd841a..e72fcb0a8 100644
--- a/session.c
+++ b/session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.296 2018/06/06 18:22:41 djm Exp $ */
+/* $OpenBSD: session.c,v 1.297 2018/06/06 18:23:32 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -290,27 +290,43 @@ prepare_auth_info_file(struct passwd *pw, struct sshbuf *info)
 }
 
 static void
-set_permitopen_from_authopts(struct ssh *ssh, const struct sshauthopt *opts)
+set_fwdpermit_from_authopts(struct ssh *ssh, const struct sshauthopt *opts)
 {
         char *tmp, *cp, *host;
         int port;
         size_t i;
 
-        if ((options.allow_tcp_forwarding & FORWARD_LOCAL) == 0)
-                return;
-        channel_clear_permission(ssh, FORWARD_USER, FORWARD_LOCAL);
-        for (i = 0; i < auth_opts->npermitopen; i++) {
-                tmp = cp = xstrdup(auth_opts->permitopen[i]);
-                /* This shouldn't fail as it has already been checked */
-                if ((host = hpdelim(&cp)) == NULL)
-                        fatal("%s: internal error: hpdelim", __func__);
-                host = cleanhostname(host);
-                if (cp == NULL || (port = permitopen_port(cp)) < 0)
-                        fatal("%s: internal error: permitopen port",
-                            __func__);
-                channel_add_permission(ssh, FORWARD_USER, FORWARD_LOCAL,
-                    host, port);
-                free(tmp);
+        if ((options.allow_tcp_forwarding & FORWARD_LOCAL) != 0) {
+                channel_clear_permission(ssh, FORWARD_USER, FORWARD_LOCAL);
+                for (i = 0; i < auth_opts->npermitopen; i++) {
+                        tmp = cp = xstrdup(auth_opts->permitopen[i]);
+                        /* This shouldn't fail as it has already been checked */
+                        if ((host = hpdelim(&cp)) == NULL)
+                                fatal("%s: internal error: hpdelim", __func__);
+                        host = cleanhostname(host);
+                        if (cp == NULL || (port = permitopen_port(cp)) < 0)
+                                fatal("%s: internal error: permitopen port",
+                                    __func__);
+                        channel_add_permission(ssh,
+                            FORWARD_USER, FORWARD_LOCAL, host, port);
+                        free(tmp);
+                }
+        }
+        if ((options.allow_tcp_forwarding & FORWARD_REMOTE) != 0) {
+                channel_clear_permission(ssh, FORWARD_USER, FORWARD_REMOTE);
+                for (i = 0; i < auth_opts->npermitlisten; i++) {
+                        tmp = cp = xstrdup(auth_opts->permitlisten[i]);
+                        /* This shouldn't fail as it has already been checked */
+                        if ((host = hpdelim(&cp)) == NULL)
+                                fatal("%s: internal error: hpdelim", __func__);
+                        host = cleanhostname(host);
+                        if (cp == NULL || (port = permitopen_port(cp)) < 0)
+                                fatal("%s: internal error: permitlisten port",
+                                    __func__);
+                        channel_add_permission(ssh,
+                            FORWARD_USER, FORWARD_REMOTE, host, port);
+                        free(tmp);
+                }
         }
 }
 
@@ -323,7 +339,7 @@ do_authenticated(struct ssh *ssh, Authctxt *authctxt)
 
         /* setup the channel layer */
         /* XXX - streamlocal? */
-        set_permitopen_from_authopts(ssh, auth_opts);
+        set_fwdpermit_from_authopts(ssh, auth_opts);
 
         if (!auth_opts->permit_port_forwarding_flag ||
             options.disable_forwarding) {