diff options
| author | Ed Maste <emaste@FreeBSD.org> | 2021-02-14 21:09:58 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2021-02-14 21:09:58 +0000 |
| commit | 3bbd8dc96b4466d8e4f850fc0adf7d02e1df2dc7 (patch) | |
| tree | 755d79f61bc5fe47efc42cd39ac819b2a5cd9390 /auth-options.c | |
| parent | db903103f46785ea0bba0f228691e1f8fb3a643d (diff) | |
| download | src-3bbd8dc96b4466d8e4f850fc0adf7d02e1df2dc7.tar.gz src-3bbd8dc96b4466d8e4f850fc0adf7d02e1df2dc7.zip | |
Vendor import of OpenSSH 8.4p1vendor/openssh/8.4p1
Diffstat (limited to 'auth-options.c')
| -rw-r--r-- | auth-options.c | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/auth-options.c b/auth-options.c index 696ba6ac6162..98afdf5fe701 100644 --- a/auth-options.c +++ b/auth-options.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth-options.c,v 1.92 2020/03/06 18:15:38 markus Exp $ */ +/* $OpenBSD: auth-options.c,v 1.93 2020/08/27 01:07:09 djm Exp $ */ /* * Copyright (c) 2018 Damien Miller <djm@mindrot.org> * @@ -119,7 +119,10 @@ cert_option_list(struct sshauthopt *opts, struct sshbuf *oblob, } } if (!found && (which & OPTIONS_CRITICAL) != 0) { - if (strcmp(name, "force-command") == 0) { + if (strcmp(name, "verify-required") == 0) { + opts->require_verify = 1; + found = 1; + } else if (strcmp(name, "force-command") == 0) { if ((r = sshbuf_get_cstring(data, &command, NULL)) != 0) { error("Unable to parse \"%s\" " @@ -134,8 +137,7 @@ cert_option_list(struct sshauthopt *opts, struct sshbuf *oblob, } opts->force_command = command; found = 1; - } - if (strcmp(name, "source-address") == 0) { + } else if (strcmp(name, "source-address") == 0) { if ((r = sshbuf_get_cstring(data, &allowed, NULL)) != 0) { error("Unable to parse \"%s\" " @@ -351,6 +353,8 @@ sshauthopt_parse(const char *opts, const char **errstrp) ret->permit_x11_forwarding_flag = r == 1; } else if ((r = opt_flag("touch-required", 1, &opts)) != -1) { ret->no_require_user_presence = r != 1; /* NB. flip */ + } else if ((r = opt_flag("verify-required", 1, &opts)) != -1) { + ret->require_verify = r == 1; } else if ((r = opt_flag("pty", 1, &opts)) != -1) { ret->permit_pty_flag = r == 1; } else if ((r = opt_flag("user-rc", 1, &opts)) != -1) { @@ -572,6 +576,7 @@ sshauthopt_merge(const struct sshauthopt *primary, } #define OPTFLAG_AND(x) ret->x = (primary->x == 1) && (additional->x == 1) +#define OPTFLAG_OR(x) ret->x = (primary->x == 1) || (additional->x == 1) /* Permissive flags are logical-AND (i.e. must be set in both) */ OPTFLAG_AND(permit_port_forwarding_flag); OPTFLAG_AND(permit_agent_forwarding_flag); @@ -579,6 +584,8 @@ sshauthopt_merge(const struct sshauthopt *primary, OPTFLAG_AND(permit_pty_flag); OPTFLAG_AND(permit_user_rc); OPTFLAG_AND(no_require_user_presence); + /* Restrictive flags are logical-OR (i.e. must be set in either) */ + OPTFLAG_OR(require_verify); #undef OPTFLAG_AND /* Earliest expiry time should win */ @@ -649,6 +656,7 @@ sshauthopt_copy(const struct sshauthopt *orig) OPTSCALAR(force_tun_device); OPTSCALAR(valid_before); OPTSCALAR(no_require_user_presence); + OPTSCALAR(require_verify); #undef OPTSCALAR #define OPTSTRING(x) \ do { \ @@ -781,7 +789,8 @@ sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m, (r = sshbuf_put_u8(m, opts->permit_user_rc)) != 0 || (r = sshbuf_put_u8(m, opts->restricted)) != 0 || (r = sshbuf_put_u8(m, opts->cert_authority)) != 0 || - (r = sshbuf_put_u8(m, opts->no_require_user_presence)) != 0) + (r = sshbuf_put_u8(m, opts->no_require_user_presence)) != 0 || + (r = sshbuf_put_u8(m, opts->require_verify)) != 0) return r; /* Simple integer options */ @@ -844,6 +853,7 @@ sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **optsp) OPT_FLAG(restricted); OPT_FLAG(cert_authority); OPT_FLAG(no_require_user_presence); + OPT_FLAG(require_verify); #undef OPT_FLAG /* Simple integer options */ |