auth-options.c

   1 /* $OpenBSD: auth-options.c,v 1.83 2018/06/19 02:59:41 djm Exp $ */
   2 /*
   3  * Copyright (c) 2018 Damien Miller <djm@mindrot.org>
   4  *
   5  * Permission to use, copy, modify, and distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 #include "includes.h"
  19
  20 #include <sys/types.h>
  21
  22 #include <netdb.h>
  23 #include <pwd.h>
  24 #include <string.h>
  25 #include <stdio.h>
  26 #include <stdarg.h>
  27 #include <ctype.h>
  28 #include <limits.h>
  29
  30 #include "openbsd-compat/sys-queue.h"
  31
  32 #include "xmalloc.h"
  33 #include "ssherr.h"
  34 #include "log.h"
  35 #include "sshbuf.h"
  36 #include "misc.h"
  37 #include "sshkey.h"
  38 #include "match.h"
  39 #include "ssh2.h"
  40 #include "auth-options.h"
  41
  42 /*
  43  * Match flag 'opt' in *optsp, and if allow_negate is set then also match
  44  * 'no-opt'. Returns -1 if option not matched, 1 if option matches or 0
  45  * if negated option matches.
  46  * If the option or negated option matches, then *optsp is updated to
  47  * point to the first character after the option.
  48  */
  49 static int
  50 opt_flag(const char *opt, int allow_negate, const char **optsp)
  51 {
  52         size_t opt_len = strlen(opt);
  53         const char *opts = *optsp;
  54         int negate = 0;
  55
  56         if (allow_negate && strncasecmp(opts, "no-", 3) == 0) {
  57                 opts += 3;
  58                 negate = 1;
  59         }
  60         if (strncasecmp(opts, opt, opt_len) == 0) {
  61                 *optsp = opts + opt_len;
  62                 return negate ? 0 : 1;
  63         }
  64         return -1;
  65 }
  66
  67 static char *
  68 opt_dequote(const char **sp, const char **errstrp)
  69 {
  70         const char *s = *sp;
  71         char *ret;
  72         size_t i;
  73
  74         *errstrp = NULL;
  75         if (*s != '"') {
  76                 *errstrp = "missing start quote";
  77                 return NULL;
  78         }
  79         s++;
  80         if ((ret = malloc(strlen((s)) + 1)) == NULL) {
  81                 *errstrp = "memory allocation failed";
  82                 return NULL;
  83         }
  84         for (i = 0; *s != '\0' && *s != '"';) {
  85                 if (s[0] == '\\' && s[1] == '"')
  86                         s++;
  87                 ret[i++] = *s++;
  88         }
  89         if (*s == '\0') {
  90                 *errstrp = "missing end quote";
  91                 free(ret);
  92                 return NULL;
  93         }
  94         ret[i] = '\0';
  95         s++;
  96         *sp = s;
  97         return ret;
  98 }
  99
 100 static int
 101 opt_match(const char **opts, const char *term)
 102 {
 103         if (strncasecmp((*opts), term, strlen(term)) == 0 &&
 104             (*opts)[strlen(term)] == '=') {
 105                 *opts += strlen(term) + 1;
 106                 return 1;
 107         }
 108         return 0;
 109 }
 110
 111 static int
 112 dup_strings(char ***dstp, size_t *ndstp, char **src, size_t nsrc)
 113 {
 114         char **dst;
 115         size_t i, j;
 116
 117         *dstp = NULL;
 118         *ndstp = 0;
 119         if (nsrc == 0)
 120                 return 0;
 121
 122         if ((dst = calloc(nsrc, sizeof(*src))) == NULL)
 123                 return -1;
 124         for (i = 0; i < nsrc; i++) {
 125                 if ((dst[i] = strdup(src[i])) == NULL) {
 126                         for (j = 0; j < i; j++)
 127                                 free(dst[j]);
 128                         free(dst);
 129                         return -1;
 130                 }
 131         }
 132         /* success */
 133         *dstp = dst;
 134         *ndstp = nsrc;
 135         return 0;
 136 }
 137
 138 #define OPTIONS_CRITICAL        1
 139 #define OPTIONS_EXTENSIONS      2
 140 static int
 141 cert_option_list(struct sshauthopt *opts, struct sshbuf *oblob,
 142     u_int which, int crit)
 143 {
 144         char *command, *allowed;
 145         char *name = NULL;
 146         struct sshbuf *c = NULL, *data = NULL;
 147         int r, ret = -1, found;
 148
 149         if ((c = sshbuf_fromb(oblob)) == NULL) {
 150                 error("%s: sshbuf_fromb failed", __func__);
 151                 goto out;
 152         }
 153
 154         while (sshbuf_len(c) > 0) {
 155                 sshbuf_free(data);
 156                 data = NULL;
 157                 if ((r = sshbuf_get_cstring(c, &name, NULL)) != 0 ||
 158                     (r = sshbuf_froms(c, &data)) != 0) {
 159                         error("Unable to parse certificate options: %s",
 160                             ssh_err(r));
 161                         goto out;
 162                 }
 163                 debug3("found certificate option \"%.100s\" len %zu",
 164                     name, sshbuf_len(data));
 165                 found = 0;
 166                 if ((which & OPTIONS_EXTENSIONS) != 0) {
 167                         if (strcmp(name, "permit-X11-forwarding") == 0) {
 168                                 opts->permit_x11_forwarding_flag = 1;
 169                                 found = 1;
 170                         } else if (strcmp(name,
 171                             "permit-agent-forwarding") == 0) {
 172                                 opts->permit_agent_forwarding_flag = 1;
 173                                 found = 1;
 174                         } else if (strcmp(name,
 175                             "permit-port-forwarding") == 0) {
 176                                 opts->permit_port_forwarding_flag = 1;
 177                                 found = 1;
 178                         } else if (strcmp(name, "permit-pty") == 0) {
 179                                 opts->permit_pty_flag = 1;
 180                                 found = 1;
 181                         } else if (strcmp(name, "permit-user-rc") == 0) {
 182                                 opts->permit_user_rc = 1;
 183                                 found = 1;
 184                         }
 185                 }
 186                 if (!found && (which & OPTIONS_CRITICAL) != 0) {
 187                         if (strcmp(name, "force-command") == 0) {
 188                                 if ((r = sshbuf_get_cstring(data, &command,
 189                                     NULL)) != 0) {
 190                                         error("Unable to parse \"%s\" "
 191                                             "section: %s", name, ssh_err(r));
 192                                         goto out;
 193                                 }
 194                                 if (opts->force_command != NULL) {
 195                                         error("Certificate has multiple "
 196                                             "force-command options");
 197                                         free(command);
 198                                         goto out;
 199                                 }
 200                                 opts->force_command = command;
 201                                 found = 1;
 202                         }
 203                         if (strcmp(name, "source-address") == 0) {
 204                                 if ((r = sshbuf_get_cstring(data, &allowed,
 205                                     NULL)) != 0) {
 206                                         error("Unable to parse \"%s\" "
 207                                             "section: %s", name, ssh_err(r));
 208                                         goto out;
 209                                 }
 210                                 if (opts->required_from_host_cert != NULL) {
 211                                         error("Certificate has multiple "
 212                                             "source-address options");
 213                                         free(allowed);
 214                                         goto out;
 215                                 }
 216                                 /* Check syntax */
 217                                 if (addr_match_cidr_list(NULL, allowed) == -1) {
 218                                         error("Certificate source-address "
 219                                             "contents invalid");
 220                                         goto out;
 221                                 }
 222                                 opts->required_from_host_cert = allowed;
 223                                 found = 1;
 224                         }
 225                 }
 226
 227                 if (!found) {
 228                         if (crit) {
 229                                 error("Certificate critical option \"%s\" "
 230                                     "is not supported", name);
 231                                 goto out;
 232                         } else {
 233                                 logit("Certificate extension \"%s\" "
 234                                     "is not supported", name);
 235                         }
 236                 } else if (sshbuf_len(data) != 0) {
 237                         error("Certificate option \"%s\" corrupt "
 238                             "(extra data)", name);
 239                         goto out;
 240                 }
 241                 free(name);
 242                 name = NULL;
 243         }
 244         /* successfully parsed all options */
 245         ret = 0;
 246
 247  out:
 248         free(name);
 249         sshbuf_free(data);
 250         sshbuf_free(c);
 251         return ret;
 252 }
 253
 254 struct sshauthopt *
 255 sshauthopt_new(void)
 256 {
 257         struct sshauthopt *ret;
 258
 259         if ((ret = calloc(1, sizeof(*ret))) == NULL)
 260                 return NULL;
 261         ret->force_tun_device = -1;
 262         return ret;
 263 }
 264
 265 void
 266 sshauthopt_free(struct sshauthopt *opts)
 267 {
 268         size_t i;
 269
 270         if (opts == NULL)
 271                 return;
 272
 273         free(opts->cert_principals);
 274         free(opts->force_command);
 275         free(opts->required_from_host_cert);
 276         free(opts->required_from_host_keys);
 277
 278         for (i = 0; i < opts->nenv; i++)
 279                 free(opts->env[i]);
 280         free(opts->env);
 281
 282         for (i = 0; i < opts->npermitopen; i++)
 283                 free(opts->permitopen[i]);
 284         free(opts->permitopen);
 285
 286         for (i = 0; i < opts->npermitlisten; i++)
 287                 free(opts->permitlisten[i]);
 288         free(opts->permitlisten);
 289
 290         explicit_bzero(opts, sizeof(*opts));
 291         free(opts);
 292 }
 293
 294 struct sshauthopt *
 295 sshauthopt_new_with_keys_defaults(void)
 296 {
 297         struct sshauthopt *ret = NULL;
 298
 299         if ((ret = sshauthopt_new()) == NULL)
 300                 return NULL;
 301
 302         /* Defaults for authorized_keys flags */
 303         ret->permit_port_forwarding_flag = 1;
 304         ret->permit_agent_forwarding_flag = 1;
 305         ret->permit_x11_forwarding_flag = 1;
 306         ret->permit_pty_flag = 1;
 307         ret->permit_user_rc = 1;
 308         return ret;
 309 }
 310
 311 /*
 312  * Parse and record a permitopen/permitlisten directive.
 313  * Return 0 on success. Return -1 on failure and sets *errstrp to error reason.
 314  */
 315 static int
 316 handle_permit(const char **optsp, int allow_bare_port,
 317     char ***permitsp, size_t *npermitsp, const char **errstrp)
 318 {
 319         char *opt, *tmp, *cp, *host, **permits = *permitsp;
 320         size_t npermits = *npermitsp;
 321         const char *errstr = "unknown error";
 322
 323         if (npermits > INT_MAX) {
 324                 *errstrp = "too many permission directives";
 325                 return -1;
 326         }
 327         if ((opt = opt_dequote(optsp, &errstr)) == NULL) {
 328                 return -1;
 329         }
 330         if (allow_bare_port && strchr(opt, ':') == NULL) {
 331                 /*
 332                  * Allow a bare port number in permitlisten to indicate a
 333                  * listen_host wildcard.
 334                  */
 335                 if (asprintf(&tmp, "*:%s", opt) < 0) {
 336                         *errstrp = "memory allocation failed";
 337                         return -1;
 338                 }
 339                 free(opt);
 340                 opt = tmp;
 341         }
 342         if ((tmp = strdup(opt)) == NULL) {
 343                 free(opt);
 344                 *errstrp = "memory allocation failed";
 345                 return -1;
 346         }
 347         cp = tmp;
 348         /* validate syntax before recording it. */
 349         host = hpdelim(&cp);
 350         if (host == NULL || strlen(host) >= NI_MAXHOST) {
 351                 free(tmp);
 352                 free(opt);
 353                 *errstrp = "invalid permission hostname";
 354                 return -1;
 355         }
 356         /*
 357          * don't want to use permitopen_port to avoid
 358          * dependency on channels.[ch] here.
 359          */
 360         if (cp == NULL ||
 361             (strcmp(cp, "*") != 0 && a2port(cp) <= 0)) {
 362                 free(tmp);
 363                 free(opt);
 364                 *errstrp = "invalid permission port";
 365                 return -1;
 366         }
 367         /* XXX - add streamlocal support */
 368         free(tmp);
 369         /* Record it */
 370         if ((permits = recallocarray(permits, npermits, npermits + 1,
 371             sizeof(*permits))) == NULL) {
 372                 free(opt);
 373                 /* NB. don't update *permitsp if alloc fails */
 374                 *errstrp = "memory allocation failed";
 375                 return -1;
 376         }
 377         permits[npermits++] = opt;
 378         *permitsp = permits;
 379         *npermitsp = npermits;
 380         return 0;
 381 }
 382
 383 struct sshauthopt *
 384 sshauthopt_parse(const char *opts, const char **errstrp)
 385 {
 386         char **oarray, *opt, *cp, *tmp;
 387         int r;
 388         struct sshauthopt *ret = NULL;
 389         const char *errstr = "unknown error";
 390         uint64_t valid_before;
 391
 392         if (errstrp != NULL)
 393                 *errstrp = NULL;
 394         if ((ret = sshauthopt_new_with_keys_defaults()) == NULL)
 395                 goto alloc_fail;
 396
 397         if (opts == NULL)
 398                 return ret;
 399
 400         while (*opts && *opts != ' ' && *opts != '\t') {
 401                 /* flag options */
 402                 if ((r = opt_flag("restrict", 0, &opts)) != -1) {
 403                         ret->restricted = 1;
 404                         ret->permit_port_forwarding_flag = 0;
 405                         ret->permit_agent_forwarding_flag = 0;
 406                         ret->permit_x11_forwarding_flag = 0;
 407                         ret->permit_pty_flag = 0;
 408                         ret->permit_user_rc = 0;
 409                 } else if ((r = opt_flag("cert-authority", 0, &opts)) != -1) {
 410                         ret->cert_authority = r;
 411                 } else if ((r = opt_flag("port-forwarding", 1, &opts)) != -1) {
 412                         ret->permit_port_forwarding_flag = r == 1;
 413                 } else if ((r = opt_flag("agent-forwarding", 1, &opts)) != -1) {
 414                         ret->permit_agent_forwarding_flag = r == 1;
 415                 } else if ((r = opt_flag("x11-forwarding", 1, &opts)) != -1) {
 416                         ret->permit_x11_forwarding_flag = r == 1;
 417                 } else if ((r = opt_flag("pty", 1, &opts)) != -1) {
 418                         ret->permit_pty_flag = r == 1;
 419                 } else if ((r = opt_flag("user-rc", 1, &opts)) != -1) {
 420                         ret->permit_user_rc = r == 1;
 421                 } else if (opt_match(&opts, "command")) {
 422                         if (ret->force_command != NULL) {
 423                                 errstr = "multiple \"command\" clauses";
 424                                 goto fail;
 425                         }
 426                         ret->force_command = opt_dequote(&opts, &errstr);
 427                         if (ret->force_command == NULL)
 428                                 goto fail;
 429                 } else if (opt_match(&opts, "principals")) {
 430                         if (ret->cert_principals != NULL) {
 431                                 errstr = "multiple \"principals\" clauses";
 432                                 goto fail;
 433                         }
 434                         ret->cert_principals = opt_dequote(&opts, &errstr);
 435                         if (ret->cert_principals == NULL)
 436                                 goto fail;
 437                 } else if (opt_match(&opts, "from")) {
 438                         if (ret->required_from_host_keys != NULL) {
 439                                 errstr = "multiple \"from\" clauses";
 440                                 goto fail;
 441                         }
 442                         ret->required_from_host_keys = opt_dequote(&opts,
 443                             &errstr);
 444                         if (ret->required_from_host_keys == NULL)
 445                                 goto fail;
 446                 } else if (opt_match(&opts, "expiry-time")) {
 447                         if ((opt = opt_dequote(&opts, &errstr)) == NULL)
 448                                 goto fail;
 449                         if (parse_absolute_time(opt, &valid_before) != 0 ||
 450                             valid_before == 0) {
 451                                 free(opt);
 452                                 errstr = "invalid expires time";
 453                                 goto fail;
 454                         }
 455                         free(opt);
 456                         if (ret->valid_before == 0 ||
 457                             valid_before < ret->valid_before)
 458                                 ret->valid_before = valid_before;
 459                 } else if (opt_match(&opts, "environment")) {
 460                         if (ret->nenv > INT_MAX) {
 461                                 errstr = "too many environment strings";
 462                                 goto fail;
 463                         }
 464                         if ((opt = opt_dequote(&opts, &errstr)) == NULL)
 465                                 goto fail;
 466                         /* env name must be alphanumeric and followed by '=' */
 467                         if ((tmp = strchr(opt, '=')) == NULL) {
 468                                 free(opt);
 469                                 errstr = "invalid environment string";
 470                                 goto fail;
 471                         }
 472                         for (cp = opt; cp < tmp; cp++) {
 473                                 if (!isalnum((u_char)*cp) && *cp != '_') {
 474                                         free(opt);
 475                                         errstr = "invalid environment string";
 476                                         goto fail;
 477                                 }
 478                         }
 479                         /* Append it. */
 480                         oarray = ret->env;
 481                         if ((ret->env = recallocarray(ret->env, ret->nenv,
 482                             ret->nenv + 1, sizeof(*ret->env))) == NULL) {
 483                                 free(opt);
 484                                 ret->env = oarray; /* put it back for cleanup */
 485                                 goto alloc_fail;
 486                         }
 487                         ret->env[ret->nenv++] = opt;
 488                 } else if (opt_match(&opts, "permitopen")) {
 489                         if (handle_permit(&opts, 0, &ret->permitopen,
 490                             &ret->npermitopen, &errstr) != 0)
 491                                 goto fail;
 492                 } else if (opt_match(&opts, "permitlisten")) {
 493                         if (handle_permit(&opts, 1, &ret->permitlisten,
 494                             &ret->npermitlisten, &errstr) != 0)
 495                                 goto fail;
 496                 } else if (opt_match(&opts, "tunnel")) {
 497                         if ((opt = opt_dequote(&opts, &errstr)) == NULL)
 498                                 goto fail;
 499                         ret->force_tun_device = a2tun(opt, NULL);
 500                         free(opt);
 501                         if (ret->force_tun_device == SSH_TUNID_ERR) {
 502                                 errstr = "invalid tun device";
 503                                 goto fail;
 504                         }
 505                 }
 506                 /*
 507                  * Skip the comma, and move to the next option
 508                  * (or break out if there are no more).
 509                  */
 510                 if (*opts == '\0' || *opts == ' ' || *opts == '\t')
 511                         break;          /* End of options. */
 512                 /* Anything other than a comma is an unknown option */
 513                 if (*opts != ',') {
 514                         errstr = "unknown key option";
 515                         goto fail;
 516                 }
 517                 opts++;
 518                 if (*opts == '\0') {
 519                         errstr = "unexpected end-of-options";
 520                         goto fail;
 521                 }
 522         }
 523
 524         /* success */
 525         if (errstrp != NULL)
 526                 *errstrp = NULL;
 527         return ret;
 528
 529 alloc_fail:
 530         errstr = "memory allocation failed";
 531 fail:
 532         sshauthopt_free(ret);
 533         if (errstrp != NULL)
 534                 *errstrp = errstr;
 535         return NULL;
 536 }
 537
 538 struct sshauthopt *
 539 sshauthopt_from_cert(struct sshkey *k)
 540 {
 541         struct sshauthopt *ret;
 542
 543         if (k == NULL || !sshkey_type_is_cert(k->type) || k->cert == NULL ||
 544             k->cert->type != SSH2_CERT_TYPE_USER)
 545                 return NULL;
 546
 547         if ((ret = sshauthopt_new()) == NULL)
 548                 return NULL;
 549
 550         /* Handle options and critical extensions separately */
 551         if (cert_option_list(ret, k->cert->critical,
 552             OPTIONS_CRITICAL, 1) == -1) {
 553                 sshauthopt_free(ret);
 554                 return NULL;
 555         }
 556         if (cert_option_list(ret, k->cert->extensions,
 557             OPTIONS_EXTENSIONS, 0) == -1) {
 558                 sshauthopt_free(ret);
 559                 return NULL;
 560         }
 561         /* success */
 562         return ret;
 563 }
 564
 565 /*
 566  * Merges "additional" options to "primary" and returns the result.
 567  * NB. Some options from primary have primacy.
 568  */
 569 struct sshauthopt *
 570 sshauthopt_merge(const struct sshauthopt *primary,
 571     const struct sshauthopt *additional, const char **errstrp)
 572 {
 573         struct sshauthopt *ret;
 574         const char *errstr = "internal error";
 575         const char *tmp;
 576
 577         if (errstrp != NULL)
 578                 *errstrp = NULL;
 579
 580         if ((ret = sshauthopt_new()) == NULL)
 581                 goto alloc_fail;
 582
 583         /* cert_authority and cert_principals are cleared in result */
 584
 585         /* Prefer access lists from primary. */
 586         /* XXX err is both set and mismatch? */
 587         tmp = primary->required_from_host_cert;
 588         if (tmp == NULL)
 589                 tmp = additional->required_from_host_cert;
 590         if (tmp != NULL && (ret->required_from_host_cert = strdup(tmp)) == NULL)
 591                 goto alloc_fail;
 592         tmp = primary->required_from_host_keys;
 593         if (tmp == NULL)
 594                 tmp = additional->required_from_host_keys;
 595         if (tmp != NULL && (ret->required_from_host_keys = strdup(tmp)) == NULL)
 596                 goto alloc_fail;
 597
 598         /*
 599          * force_tun_device, permitopen/permitlisten and environment all
 600          * prefer the primary.
 601          */
 602         ret->force_tun_device = primary->force_tun_device;
 603         if (ret->force_tun_device == -1)
 604                 ret->force_tun_device = additional->force_tun_device;
 605         if (primary->nenv > 0) {
 606                 if (dup_strings(&ret->env, &ret->nenv,
 607                     primary->env, primary->nenv) != 0)
 608                         goto alloc_fail;
 609         } else if (additional->nenv) {
 610                 if (dup_strings(&ret->env, &ret->nenv,
 611                     additional->env, additional->nenv) != 0)
 612                         goto alloc_fail;
 613         }
 614         if (primary->npermitopen > 0) {
 615                 if (dup_strings(&ret->permitopen, &ret->npermitopen,
 616                     primary->permitopen, primary->npermitopen) != 0)
 617                         goto alloc_fail;
 618         } else if (additional->npermitopen > 0) {
 619                 if (dup_strings(&ret->permitopen, &ret->npermitopen,
 620                     additional->permitopen, additional->npermitopen) != 0)
 621                         goto alloc_fail;
 622         }
 623
 624         if (primary->npermitlisten > 0) {
 625                 if (dup_strings(&ret->permitlisten, &ret->npermitlisten,
 626                     primary->permitlisten, primary->npermitlisten) != 0)
 627                         goto alloc_fail;
 628         } else if (additional->npermitlisten > 0) {
 629                 if (dup_strings(&ret->permitlisten, &ret->npermitlisten,
 630                     additional->permitlisten, additional->npermitlisten) != 0)
 631                         goto alloc_fail;
 632         }
 633
 634         /* Flags are logical-AND (i.e. must be set in both for permission) */
 635 #define OPTFLAG(x) ret->x = (primary->x == 1) && (additional->x == 1)
 636         OPTFLAG(permit_port_forwarding_flag);
 637         OPTFLAG(permit_agent_forwarding_flag);
 638         OPTFLAG(permit_x11_forwarding_flag);
 639         OPTFLAG(permit_pty_flag);
 640         OPTFLAG(permit_user_rc);
 641 #undef OPTFLAG
 642
 643         /* Earliest expiry time should win */
 644         if (primary->valid_before != 0)
 645                 ret->valid_before = primary->valid_before;
 646         if (additional->valid_before != 0 &&
 647             additional->valid_before < ret->valid_before)
 648                 ret->valid_before = additional->valid_before;
 649
 650         /*
 651          * When both multiple forced-command are specified, only
 652          * proceed if they are identical, otherwise fail.
 653          */
 654         if (primary->force_command != NULL &&
 655             additional->force_command != NULL) {
 656                 if (strcmp(primary->force_command,
 657                     additional->force_command) == 0) {
 658                         /* ok */
 659                         ret->force_command = strdup(primary->force_command);
 660                         if (ret->force_command == NULL)
 661                                 goto alloc_fail;
 662                 } else {
 663                         errstr = "forced command options do not match";
 664                         goto fail;
 665                 }
 666         } else if (primary->force_command != NULL) {
 667                 if ((ret->force_command = strdup(
 668                     primary->force_command)) == NULL)
 669                         goto alloc_fail;
 670         } else if (additional->force_command != NULL) {
 671                 if ((ret->force_command = strdup(
 672                     additional->force_command)) == NULL)
 673                         goto alloc_fail;
 674         }
 675         /* success */
 676         if (errstrp != NULL)
 677                 *errstrp = NULL;
 678         return ret;
 679
 680  alloc_fail:
 681         errstr = "memory allocation failed";
 682  fail:
 683         if (errstrp != NULL)
 684                 *errstrp = errstr;
 685         sshauthopt_free(ret);
 686         return NULL;
 687 }
 688
 689 /*
 690  * Copy options
 691  */
 692 struct sshauthopt *
 693 sshauthopt_copy(const struct sshauthopt *orig)
 694 {
 695         struct sshauthopt *ret;
 696
 697         if ((ret = sshauthopt_new()) == NULL)
 698                 return NULL;
 699
 700 #define OPTSCALAR(x) ret->x = orig->x
 701         OPTSCALAR(permit_port_forwarding_flag);
 702         OPTSCALAR(permit_agent_forwarding_flag);
 703         OPTSCALAR(permit_x11_forwarding_flag);
 704         OPTSCALAR(permit_pty_flag);
 705         OPTSCALAR(permit_user_rc);
 706         OPTSCALAR(restricted);
 707         OPTSCALAR(cert_authority);
 708         OPTSCALAR(force_tun_device);
 709         OPTSCALAR(valid_before);
 710 #undef OPTSCALAR
 711 #define OPTSTRING(x) \
 712         do { \
 713                 if (orig->x != NULL && (ret->x = strdup(orig->x)) == NULL) { \
 714                         sshauthopt_free(ret); \
 715                         return NULL; \
 716                 } \
 717         } while (0)
 718         OPTSTRING(cert_principals);
 719         OPTSTRING(force_command);
 720         OPTSTRING(required_from_host_cert);
 721         OPTSTRING(required_from_host_keys);
 722 #undef OPTSTRING
 723
 724         if (dup_strings(&ret->env, &ret->nenv, orig->env, orig->nenv) != 0 ||
 725             dup_strings(&ret->permitopen, &ret->npermitopen,
 726             orig->permitopen, orig->npermitopen) != 0 ||
 727             dup_strings(&ret->permitlisten, &ret->npermitlisten,
 728             orig->permitlisten, orig->npermitlisten) != 0) {
 729                 sshauthopt_free(ret);
 730                 return NULL;
 731         }
 732         return ret;
 733 }
 734
 735 static int
 736 serialise_array(struct sshbuf *m, char **a, size_t n)
 737 {
 738         struct sshbuf *b;
 739         size_t i;
 740         int r;
 741
 742         if (n > INT_MAX)
 743                 return SSH_ERR_INTERNAL_ERROR;
 744
 745         if ((b = sshbuf_new()) == NULL) {
 746                 return SSH_ERR_ALLOC_FAIL;
 747         }
 748         for (i = 0; i < n; i++) {
 749                 if ((r = sshbuf_put_cstring(b, a[i])) != 0) {
 750                         sshbuf_free(b);
 751                         return r;
 752                 }
 753         }
 754         if ((r = sshbuf_put_u32(m, n)) != 0 ||
 755             (r = sshbuf_put_stringb(m, b)) != 0) {
 756                 sshbuf_free(b);
 757                 return r;
 758         }
 759         /* success */
 760         return 0;
 761 }
 762
 763 static int
 764 deserialise_array(struct sshbuf *m, char ***ap, size_t *np)
 765 {
 766         char **a = NULL;
 767         size_t i, n = 0;
 768         struct sshbuf *b = NULL;
 769         u_int tmp;
 770         int r = SSH_ERR_INTERNAL_ERROR;
 771
 772         if ((r = sshbuf_get_u32(m, &tmp)) != 0 ||
 773             (r = sshbuf_froms(m, &b)) != 0)
 774                 goto out;
 775         if (tmp > INT_MAX) {
 776                 r = SSH_ERR_INVALID_FORMAT;
 777                 goto out;
 778         }
 779         n = tmp;
 780         if (n > 0 && (a = calloc(n, sizeof(*a))) == NULL) {
 781                 r = SSH_ERR_ALLOC_FAIL;
 782                 goto out;
 783         }
 784         for (i = 0; i < n; i++) {
 785                 if ((r = sshbuf_get_cstring(b, &a[i], NULL)) != 0)
 786                         goto out;
 787         }
 788         /* success */
 789         r = 0;
 790         *ap = a;
 791         a = NULL;
 792         *np = n;
 793         n = 0;
 794  out:
 795         for (i = 0; i < n; i++)
 796                 free(a[i]);
 797         free(a);
 798         sshbuf_free(b);
 799         return r;
 800 }
 801
 802 static int
 803 serialise_nullable_string(struct sshbuf *m, const char *s)
 804 {
 805         int r;
 806
 807         if ((r = sshbuf_put_u8(m, s == NULL)) != 0 ||
 808             (r = sshbuf_put_cstring(m, s)) != 0)
 809                 return r;
 810         return 0;
 811 }
 812
 813 static int
 814 deserialise_nullable_string(struct sshbuf *m, char **sp)
 815 {
 816         int r;
 817         u_char flag;
 818
 819         *sp = NULL;
 820         if ((r = sshbuf_get_u8(m, &flag)) != 0 ||
 821             (r = sshbuf_get_cstring(m, flag ? NULL : sp, NULL)) != 0)
 822                 return r;
 823         return 0;
 824 }
 825
 826 int
 827 sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m,
 828     int untrusted)
 829 {
 830         int r = SSH_ERR_INTERNAL_ERROR;
 831
 832         /* Flag and simple integer options */
 833         if ((r = sshbuf_put_u8(m, opts->permit_port_forwarding_flag)) != 0 ||
 834             (r = sshbuf_put_u8(m, opts->permit_agent_forwarding_flag)) != 0 ||
 835             (r = sshbuf_put_u8(m, opts->permit_x11_forwarding_flag)) != 0 ||
 836             (r = sshbuf_put_u8(m, opts->permit_pty_flag)) != 0 ||
 837             (r = sshbuf_put_u8(m, opts->permit_user_rc)) != 0 ||
 838             (r = sshbuf_put_u8(m, opts->restricted)) != 0 ||
 839             (r = sshbuf_put_u8(m, opts->cert_authority)) != 0 ||
 840             (r = sshbuf_put_u64(m, opts->valid_before)) != 0)
 841                 return r;
 842
 843         /* tunnel number can be negative to indicate "unset" */
 844         if ((r = sshbuf_put_u8(m, opts->force_tun_device == -1)) != 0 ||
 845             (r = sshbuf_put_u32(m, (opts->force_tun_device < 0) ?
 846             0 : (u_int)opts->force_tun_device)) != 0)
 847                 return r;
 848
 849         /* String options; these may be NULL */
 850         if ((r = serialise_nullable_string(m,
 851             untrusted ? "yes" : opts->cert_principals)) != 0 ||
 852             (r = serialise_nullable_string(m,
 853             untrusted ? "true" : opts->force_command)) != 0 ||
 854             (r = serialise_nullable_string(m,
 855             untrusted ? NULL : opts->required_from_host_cert)) != 0 ||
 856             (r = serialise_nullable_string(m,
 857              untrusted ? NULL : opts->required_from_host_keys)) != 0)
 858                 return r;
 859
 860         /* Array options */
 861         if ((r = serialise_array(m, opts->env,
 862             untrusted ? 0 : opts->nenv)) != 0 ||
 863             (r = serialise_array(m, opts->permitopen,
 864             untrusted ? 0 : opts->npermitopen)) != 0 ||
 865             (r = serialise_array(m, opts->permitlisten,
 866             untrusted ? 0 : opts->npermitlisten)) != 0)
 867                 return r;
 868
 869         /* success */
 870         return 0;
 871 }
 872
 873 int
 874 sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **optsp)
 875 {
 876         struct sshauthopt *opts = NULL;
 877         int r = SSH_ERR_INTERNAL_ERROR;
 878         u_char f;
 879         u_int tmp;
 880
 881         if ((opts = calloc(1, sizeof(*opts))) == NULL)
 882                 return SSH_ERR_ALLOC_FAIL;
 883
 884 #define OPT_FLAG(x) \
 885         do { \
 886                 if ((r = sshbuf_get_u8(m, &f)) != 0) \
 887                         goto out; \
 888                 opts->x = f; \
 889         } while (0)
 890         OPT_FLAG(permit_port_forwarding_flag);
 891         OPT_FLAG(permit_agent_forwarding_flag);
 892         OPT_FLAG(permit_x11_forwarding_flag);
 893         OPT_FLAG(permit_pty_flag);
 894         OPT_FLAG(permit_user_rc);
 895         OPT_FLAG(restricted);
 896         OPT_FLAG(cert_authority);
 897 #undef OPT_FLAG
 898
 899         if ((r = sshbuf_get_u64(m, &opts->valid_before)) != 0)
 900                 goto out;
 901
 902         /* tunnel number can be negative to indicate "unset" */
 903         if ((r = sshbuf_get_u8(m, &f)) != 0 ||
 904             (r = sshbuf_get_u32(m, &tmp)) != 0)
 905                 goto out;
 906         opts->force_tun_device = f ? -1 : (int)tmp;
 907
 908         /* String options may be NULL */
 909         if ((r = deserialise_nullable_string(m, &opts->cert_principals)) != 0 ||
 910             (r = deserialise_nullable_string(m, &opts->force_command)) != 0 ||
 911             (r = deserialise_nullable_string(m,
 912             &opts->required_from_host_cert)) != 0 ||
 913             (r = deserialise_nullable_string(m,
 914             &opts->required_from_host_keys)) != 0)
 915                 goto out;
 916
 917         /* Array options */
 918         if ((r = deserialise_array(m, &opts->env, &opts->nenv)) != 0 ||
 919             (r = deserialise_array(m,
 920             &opts->permitopen, &opts->npermitopen)) != 0 ||
 921             (r = deserialise_array(m,
 922             &opts->permitlisten, &opts->npermitlisten)) != 0)
 923                 goto out;
 924
 925         /* success */
 926         r = 0;
 927         *optsp = opts;
 928         opts = NULL;
 929  out:
 930         sshauthopt_free(opts);
 931         return r;
 932 }