View | Details | Raw Unified | Return to bug 2582 | Differences between
and this patch

Collapse All | Expand All

(-)a/channels.c (-1 / +5 lines)
Lines 138-143 static int num_adm_permitted_opens = 0; Link Here
138
/* special-case port number meaning allow any port */
138
/* special-case port number meaning allow any port */
139
#define FWD_PERMIT_ANY_PORT	0
139
#define FWD_PERMIT_ANY_PORT	0
140
140
141
/* special-case port number meaning allow any host */
142
#define FWD_PERMIT_ANY_HOST	"*"
143
141
/*
144
/*
142
 * If this is true, all opens are permitted.  This is the case on the server
145
 * If this is true, all opens are permitted.  This is the case on the server
143
 * on which we have to trust the client anyway, and the user could do
146
 * on which we have to trust the client anyway, and the user could do
Lines 3298-3304 open_match(ForwardPermission *allowed_open, const char *requestedhost, Link Here
3298
	if (allowed_open->port_to_connect != FWD_PERMIT_ANY_PORT &&
3301
	if (allowed_open->port_to_connect != FWD_PERMIT_ANY_PORT &&
3299
	    allowed_open->port_to_connect != requestedport)
3302
	    allowed_open->port_to_connect != requestedport)
3300
		return 0;
3303
		return 0;
3301
	if (strcmp(allowed_open->host_to_connect, requestedhost) != 0)
3304
	if (strcmp(allowed_open->host_to_connect, FWD_PERMIT_ANY_HOST) != 0 &&
3305
	    strcmp(allowed_open->host_to_connect, requestedhost) != 0)
3302
		return 0;
3306
		return 0;
3303
	return 1;
3307
	return 1;
3304
}
3308
}
(-)a/sshd_config.5 (+3 lines)
Lines 1210-1215 can be used to remove all restrictions and permit any forwarding requests. Link Here
1210
An argument of
1210
An argument of
1211
.Dq none
1211
.Dq none
1212
can be used to prohibit all forwarding requests.
1212
can be used to prohibit all forwarding requests.
1213
Wildcard
1214
.Dq *
1215
can be used for host, address or port to set up fine-grained access control.
1213
By default all port forwarding requests are permitted.
1216
By default all port forwarding requests are permitted.
1214
.It Cm PermitRootLogin
1217
.It Cm PermitRootLogin
1215
Specifies whether root can log in using
1218
Specifies whether root can log in using

Return to bug 2582