blob: 16871d7543c031b14f7dca90ed72e6d7bf19c5e6 [file] [log] [blame]
djm@openbsd.org7c856852018-03-03 03:15:51 +00001/* $OpenBSD: auth-options.h,v 1.25 2018/03/03 03:15:51 djm Exp $ */
Ben Lindstrom05764b92002-03-05 01:53:02 +00002
Damien Millere4340be2000-09-16 13:29:08 +11003/*
djm@openbsd.org7c856852018-03-03 03:15:51 +00004 * Copyright (c) 2018 Damien Miller <djm@mindrot.org>
Damien Millere4340be2000-09-16 13:29:08 +11005 *
djm@openbsd.org7c856852018-03-03 03:15:51 +00006 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
Damien Millere4340be2000-09-16 13:29:08 +110017 */
Damien Miller389edc42000-11-06 12:39:34 +110018
Damien Millerf6d9e222000-06-18 14:50:44 +100019#ifndef AUTH_OPTIONS_H
20#define AUTH_OPTIONS_H
Ben Lindstrom226cfa02001-01-22 05:34:40 +000021
djm@openbsd.org90c4bec2018-03-03 03:06:02 +000022struct passwd;
23struct sshkey;
24
djm@openbsd.org90c4bec2018-03-03 03:06:02 +000025/*
26 * sshauthopt represents key options parsed from authorized_keys or
27 * from certificate extensions/options.
28 */
29struct sshauthopt {
30 /* Feature flags */
31 int permit_port_forwarding_flag;
32 int permit_agent_forwarding_flag;
33 int permit_x11_forwarding_flag;
34 int permit_pty_flag;
35 int permit_user_rc;
36
37 /* "restrict" keyword was invoked */
38 int restricted;
39
40 /* Certificate-related options */
41 int cert_authority;
42 char *cert_principals;
43
44 int force_tun_device;
45 char *force_command;
46
47 /* Custom environment */
48 size_t nenv;
49 char **env;
50
51 /* Permitted port forwardings */
52 size_t npermitopen;
53 char **permitopen;
54
55 /*
56 * Permitted host/addresses (comma-separated)
57 * Caller must check source address matches both lists (if present).
58 */
59 char *required_from_host_cert;
60 char *required_from_host_keys;
61};
62
63struct sshauthopt *sshauthopt_new(void);
64struct sshauthopt *sshauthopt_new_with_keys_defaults(void);
65void sshauthopt_free(struct sshauthopt *opts);
66struct sshauthopt *sshauthopt_copy(const struct sshauthopt *orig);
67int sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m, int);
68int sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **opts);
69
70/*
71 * Parse authorized_keys options. Returns an options structure on success
72 * or NULL on failure. Will set errstr on failure.
73 */
74struct sshauthopt *sshauthopt_parse(const char *s, const char **errstr);
75
76/*
77 * Parse certification options to a struct sshauthopt.
78 * Returns options on success or NULL on failure.
79 */
80struct sshauthopt *sshauthopt_from_cert(struct sshkey *k);
81
82/*
83 * Merge key options.
84 */
85struct sshauthopt *sshauthopt_merge(const struct sshauthopt *primary,
86 const struct sshauthopt *additional, const char **errstrp);
87
Damien Millerf6d9e222000-06-18 14:50:44 +100088#endif