[openssh-commits] [openssh] 09/12: upstream: make authorized_keys "restrict" keyword apply correctly

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit d322f2ccf7da095ce94d1d99cb563246f61487b0
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Tue Jul 14 01:05:05 2026 +0000

    upstream: make authorized_keys "restrict" keyword apply correctly
    
    to tunnel forwarding (which is administratively disabled by default).
    
    Reported by Erichen, Institute of Computing Technology,
    Chinese Academy of Sciences
    
    OpenBSD-Commit-ID: 5b3cc987a64749c94b20e12755db32a83f8f01e6
---
 serverloop.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/serverloop.c b/serverloop.c
index 8a6e3db80..9d8a3429e 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: serverloop.c,v 1.247 2026/05/31 04:47:29 djm Exp $ */
+/* $OpenBSD: serverloop.c,v 1.248 2026/07/14 01:05:05 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -523,7 +523,8 @@ server_request_tun(struct ssh *ssh)
 		ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
 		return NULL;
 	}
-	if ((options.permit_tun & mode) == 0 || options.disable_forwarding) {
+	if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
+	    auth_opts->restricted) {
 		ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
 		    "forwarding");
 		return NULL;

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.