Grid Community Toolkit  6.2.1629922860 (tag: v6.2.20210826)
 All Data Structures Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
auth-options.h
1 /* $OpenBSD: auth-options.h,v 1.30 2020/08/27 01:07:09 djm Exp $ */
2 
3 /*
4  * Copyright (c) 2018 Damien Miller <djm@mindrot.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #ifndef AUTH_OPTIONS_H
20 #define AUTH_OPTIONS_H
21 
22 struct passwd;
23 struct sshkey;
24 
25 /* Maximum number of permitopen/permitlisten directives to accept */
26 #define SSH_AUTHOPT_PERMIT_MAX 4096
27 
28 /*
29  * sshauthopt represents key options parsed from authorized_keys or
30  * from certificate extensions/options.
31  */
32 struct sshauthopt {
33  /* Feature flags */
34  int permit_port_forwarding_flag;
35  int permit_agent_forwarding_flag;
36  int permit_x11_forwarding_flag;
37  int permit_pty_flag;
38  int permit_user_rc;
39 
40  /* "restrict" keyword was invoked */
41  int restricted;
42 
43  /* key/principal expiry date */
44  uint64_t valid_before;
45 
46  /* Certificate-related options */
47  int cert_authority;
48  char *cert_principals;
49 
50  int force_tun_device;
51  char *force_command;
52 
53  /* Custom environment */
54  size_t nenv;
55  char **env;
56 
57  /* Permitted port forwardings */
58  size_t npermitopen;
59  char **permitopen;
60 
61  /* Permitted listens (remote forwarding) */
62  size_t npermitlisten;
63  char **permitlisten;
64 
65  /*
66  * Permitted host/addresses (comma-separated)
67  * Caller must check source address matches both lists (if present).
68  */
69  char *required_from_host_cert;
70  char *required_from_host_keys;
71 
72  /* Key requires user presence asserted */
73  int no_require_user_presence;
74  /* Key requires user verification (e.g. PIN) */
75  int require_verify;
76 };
77 
78 struct sshauthopt *sshauthopt_new(void);
79 struct sshauthopt *sshauthopt_new_with_keys_defaults(void);
80 void sshauthopt_free(struct sshauthopt *opts);
81 struct sshauthopt *sshauthopt_copy(const struct sshauthopt *orig);
82 int sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m, int);
83 int sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **opts);
84 
85 /*
86  * Parse authorized_keys options. Returns an options structure on success
87  * or NULL on failure. Will set errstr on failure.
88  */
89 struct sshauthopt *sshauthopt_parse(const char *s, const char **errstr);
90 
91 /*
92  * Parse certification options to a struct sshauthopt.
93  * Returns options on success or NULL on failure.
94  */
95 struct sshauthopt *sshauthopt_from_cert(struct sshkey *k);
96 
97 /*
98  * Merge key options.
99  */
100 struct sshauthopt *sshauthopt_merge(const struct sshauthopt *primary,
101  const struct sshauthopt *additional, const char **errstrp);
102 
103 #endif
Generated by   doxygen 1.8.5