1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
// Copyright 2025 Lablup Inc. and Jeongkyu Shin
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//! SSH authentication options parsing
//!
//! Handles authentication-related configuration options including
//! identity files, authentication methods, and algorithm preferences.
use crate::ssh::ssh_config::parser::helpers::parse_yes_no;
use crate::ssh::ssh_config::security::secure_validate_path;
use crate::ssh::ssh_config::types::SshHostConfig;
use anyhow::{Context, Result};
/// Parse authentication-related SSH configuration options
pub(super) fn parse_authentication_option(
host: &mut SshHostConfig,
keyword: &str,
args: &[String],
line_number: usize,
) -> Result<()> {
match keyword {
"identityfile" => {
if args.is_empty() {
anyhow::bail!("IdentityFile requires a value at line {line_number}");
}
let path = secure_validate_path(&args[0], "identity", line_number)
.with_context(|| format!("Invalid IdentityFile path at line {line_number}"))?;
host.identity_files.push(path);
}
"identitiesonly" => {
if args.is_empty() {
anyhow::bail!("IdentitiesOnly requires a value at line {line_number}");
}
host.identities_only = Some(parse_yes_no(&args[0], line_number)?);
}
"addkeystoagent" => {
if args.is_empty() {
anyhow::bail!("AddKeysToAgent requires a value at line {line_number}");
}
let value = args[0].to_lowercase();
if !["yes", "no", "ask", "confirm"].contains(&value.as_str()) {
anyhow::bail!(
"Invalid AddKeysToAgent value '{}' at line {} (must be yes/no/ask/confirm)",
args[0],
line_number
);
}
host.add_keys_to_agent = Some(value);
}
"identityagent" => {
if args.is_empty() {
anyhow::bail!("IdentityAgent requires a value at line {line_number}");
}
// IdentityAgent can be a socket path or special value "none" or "SSH_AUTH_SOCK"
let value = &args[0];
// Security: Validate special values first
if value.to_lowercase() == "none" || value == "SSH_AUTH_SOCK" {
host.identity_agent = Some(value.to_string());
} else {
// Security: Check for path traversal attempts without expanding the path
if value.contains("../") || value.contains("..\\") {
anyhow::bail!(
"Security violation: IdentityAgent path contains directory traversal sequence '..' at line {line_number}. \
Path traversal attacks are not allowed."
);
}
// Check for null bytes and other dangerous characters
if value.contains('\0') {
anyhow::bail!(
"Security violation: IdentityAgent path contains null byte at line {line_number}. \
This could be used for path truncation attacks."
);
}
// Validate it looks like a path (contains / or starts with ~)
if !value.contains('/') && !value.starts_with('~') {
tracing::warn!(
"IdentityAgent '{}' at line {} does not look like a valid socket path",
value,
line_number
);
}
// Store the original path format (validation happens at usage time)
host.identity_agent = Some(value.to_string());
}
}
"pubkeyacceptedalgorithms" => {
if args.is_empty() {
anyhow::bail!("PubkeyAcceptedAlgorithms requires a value at line {line_number}");
}
// Security: Limit the number of algorithms to prevent memory exhaustion
const MAX_ALGORITHMS: usize = 50;
const MAX_ALGORITHM_NAME_LENGTH: usize = 256;
let mut algorithms = Vec::with_capacity(MAX_ALGORITHMS.min(args.len() * 2));
let mut total_count = 0;
let mut truncated = false;
// Efficiently parse algorithms without creating unnecessary intermediate strings
for arg in args {
// Split each arg by comma and process
for algorithm in arg.split(',') {
total_count += 1;
// Stop processing if we've hit the limit
if algorithms.len() >= MAX_ALGORITHMS {
truncated = true;
break;
}
let trimmed = algorithm.trim();
// Skip empty strings from malformed input
if trimmed.is_empty() {
continue;
}
// Security: Limit individual algorithm name length
if trimmed.len() > MAX_ALGORITHM_NAME_LENGTH {
tracing::warn!(
"Algorithm name at line {} exceeds maximum length of {} characters, skipping",
line_number, MAX_ALGORITHM_NAME_LENGTH
);
continue;
}
// Security: Validate algorithm name contains only safe characters
// Allow alphanumeric, hyphens, dots, underscores, @ and +
if !trimmed.chars().all(|c| {
c.is_ascii_alphanumeric()
|| c == '-'
|| c == '.'
|| c == '_'
|| c == '@'
|| c == '+'
}) {
anyhow::bail!(
"PubkeyAcceptedAlgorithms at line {line_number} contains invalid characters in algorithm name '{trimmed}'. \
Only alphanumeric characters, hyphens, dots, underscores, @ and + are allowed"
);
}
algorithms.push(trimmed.to_string());
}
if truncated {
break;
}
}
if truncated {
tracing::warn!(
"PubkeyAcceptedAlgorithms at line {} contains {} algorithms, truncated to first {}",
line_number, total_count, MAX_ALGORITHMS
);
}
// Ensure we have at least one algorithm
if algorithms.is_empty() {
anyhow::bail!(
"PubkeyAcceptedAlgorithms at line {line_number} must contain at least one valid algorithm"
);
}
host.pubkey_accepted_algorithms = algorithms;
}
"certificatefile" => {
if args.is_empty() {
anyhow::bail!("CertificateFile requires a value at line {line_number}");
}
let path = secure_validate_path(&args[0], "certificate", line_number)
.with_context(|| format!("Invalid CertificateFile path at line {line_number}"))?;
host.certificate_files.push(path);
}
"pubkeyauthentication" => {
if args.is_empty() {
anyhow::bail!("PubkeyAuthentication requires a value at line {line_number}");
}
host.pubkey_authentication = Some(parse_yes_no(&args[0], line_number)?);
}
"passwordauthentication" => {
if args.is_empty() {
anyhow::bail!("PasswordAuthentication requires a value at line {line_number}");
}
host.password_authentication = Some(parse_yes_no(&args[0], line_number)?);
}
"kbdinteractiveauthentication" => {
if args.is_empty() {
anyhow::bail!(
"KbdInteractiveAuthentication requires a value at line {line_number}"
);
}
host.keyboard_interactive_authentication = Some(parse_yes_no(&args[0], line_number)?);
}
"gssapiauthentication" => {
if args.is_empty() {
anyhow::bail!("GSSAPIAuthentication requires a value at line {line_number}");
}
host.gssapi_authentication = Some(parse_yes_no(&args[0], line_number)?);
}
"preferredauthentications" => {
if args.is_empty() {
anyhow::bail!("PreferredAuthentications requires a value at line {line_number}");
}
host.preferred_authentications = args
.join(",")
.split(',')
.map(|s| s.trim().to_string())
.collect();
}
"hostbasedauthentication" => {
if args.is_empty() {
anyhow::bail!("HostbasedAuthentication requires a value at line {line_number}");
}
host.hostbased_authentication = Some(parse_yes_no(&args[0], line_number)?);
}
"hostbasedacceptedalgorithms" => {
if args.is_empty() {
anyhow::bail!("HostbasedAcceptedAlgorithms requires a value at line {line_number}");
}
// Security: Limit the number of algorithms to prevent memory exhaustion
const MAX_ALGORITHMS: usize = 50;
const MAX_ALGORITHM_NAME_LENGTH: usize = 256;
let mut algorithms = Vec::with_capacity(MAX_ALGORITHMS.min(args.len() * 2));
let mut total_count = 0;
let mut truncated = false;
// Efficiently parse algorithms without creating unnecessary intermediate strings
for arg in args {
// Split each arg by comma and process
for algorithm in arg.split(',') {
total_count += 1;
// Stop processing if we've hit the limit
if algorithms.len() >= MAX_ALGORITHMS {
truncated = true;
break;
}
let trimmed = algorithm.trim();
// Skip empty strings from malformed input
if trimmed.is_empty() {
continue;
}
// Security: Limit individual algorithm name length
if trimmed.len() > MAX_ALGORITHM_NAME_LENGTH {
tracing::warn!(
"Algorithm name at line {} exceeds maximum length of {} characters, skipping",
line_number, MAX_ALGORITHM_NAME_LENGTH
);
continue;
}
// Security: Validate algorithm name contains only safe characters
// Allow alphanumeric, hyphens, dots, underscores, @ and +
if !trimmed.chars().all(|c| {
c.is_ascii_alphanumeric()
|| c == '-'
|| c == '.'
|| c == '_'
|| c == '@'
|| c == '+'
}) {
anyhow::bail!(
"HostbasedAcceptedAlgorithms at line {line_number} contains invalid characters in algorithm name '{trimmed}'. \
Only alphanumeric characters, hyphens, dots, underscores, @ and + are allowed"
);
}
algorithms.push(trimmed.to_string());
}
if truncated {
break;
}
}
if truncated {
tracing::warn!(
"HostbasedAcceptedAlgorithms at line {} contains {} algorithms, truncated to first {}",
line_number, total_count, MAX_ALGORITHMS
);
}
// Ensure we have at least one algorithm
if algorithms.is_empty() {
anyhow::bail!(
"HostbasedAcceptedAlgorithms at line {line_number} must contain at least one valid algorithm"
);
}
host.hostbased_accepted_algorithms = algorithms;
}
"numberofpasswordprompts" => {
if args.is_empty() {
anyhow::bail!("NumberOfPasswordPrompts requires a value at line {line_number}");
}
let num: u32 = args[0].parse().with_context(|| {
format!(
"Invalid NumberOfPasswordPrompts value '{}' at line {}",
args[0], line_number
)
})?;
// Security: Enforce reasonable limits to prevent DoS attacks
// OpenSSH default is 3, typical max is 10
const MAX_PASSWORD_PROMPTS: u32 = 100;
if num == 0 {
anyhow::bail!("NumberOfPasswordPrompts at line {line_number} must be at least 1");
}
if num > MAX_PASSWORD_PROMPTS {
anyhow::bail!(
"NumberOfPasswordPrompts {num} at line {line_number} exceeds maximum allowed value of {MAX_PASSWORD_PROMPTS}"
);
}
// Warn if outside typical range but still within limits
if !(1..=10).contains(&num) {
tracing::warn!(
"NumberOfPasswordPrompts {} at line {} is outside typical range 1-10. \
This may cause security issues or poor user experience",
num,
line_number
);
}
host.number_of_password_prompts = Some(num);
}
"enablesshkeysign" => {
if args.is_empty() {
anyhow::bail!("EnableSSHKeysign requires a value at line {line_number}");
}
let value = parse_yes_no(&args[0], line_number)?;
if value {
tracing::debug!(
"EnableSSHKeysign enabled at line {} (security-sensitive: allows ssh-keysign for HostbasedAuthentication)",
line_number
);
}
host.enable_ssh_keysign = Some(value);
}
"usekeychain" => {
if args.is_empty() {
anyhow::bail!("UseKeychain requires a value at line {line_number}");
}
// Security: Warn on non-macOS systems
#[cfg(not(target_os = "macos"))]
{
tracing::warn!(
"UseKeychain at line {} is a macOS-only option and will be ignored on this platform. \
Consider using IgnoreUnknown UseKeychain in your SSH config for cross-platform compatibility.",
line_number
);
}
let value = parse_yes_no(&args[0], line_number)?;
// Only store on macOS platforms
#[cfg(target_os = "macos")]
{
if value {
tracing::debug!(
"UseKeychain enabled at line {} (Note: Currently supports parsing only. \
Keychain integration will be implemented in a future release)",
line_number
);
}
host.use_keychain = Some(value);
}
// Prevent unused variable warning on non-macOS
#[cfg(not(target_os = "macos"))]
let _ = value;
}
_ => unreachable!(
"Unexpected keyword in parse_authentication_option: {}",
keyword
),
}
Ok(())
}