tyler.durden/openssh-portable
1
0
Fork 0
mirror of https://github.com/PowerShell/openssh-portable.git synced 2025-07-28 16:24:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

upstream commit

Browse Source 
KNF and add a little more debug()
This commit is contained in:
djm@openbsd.org 2014-12-23 22:42:48 +00:00 committed by Damien Miller
parent 8abd80315d
commit 5191df927d
2 changed files with 55 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
auth-rhosts.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: auth-rhosts.c,v 1.45 2014/07/15 15:54:14 millert Exp $ */ /* $OpenBSD: auth-rhosts.c,v 1.46 2014/12/23 22:42:48 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -57,7 +57,8 @@ check_rhosts_file(const char *filename, const char *hostname,
const char *server_user) const char *server_user)
{ {
FILE *f; FILE *f;
char buf[1024]; /* Must not be larger than host, user, dummy below. */ #define RBUFLN 1024
char buf[RBUFLN];/* Must not be larger than host, user, dummy below. */
int fd; int fd;
struct stat st; struct stat st;
@ -80,8 +81,9 @@ check_rhosts_file(const char *filename, const char *hostname,
return 0; return 0;
} }
while (fgets(buf, sizeof(buf), f)) { while (fgets(buf, sizeof(buf), f)) {
/* All three must be at least as big as buf to avoid overflows. */ /* All three must have length >= buf to avoid overflows. */
char hostbuf[1024], userbuf[1024], dummy[1024], *host, *user, *cp; char hostbuf[RBUFLN], userbuf[RBUFLN], dummy[RBUFLN];
char *host, *user, *cp;
int negated; int negated;
for (cp = buf; *cp == ' ' || *cp == '\t'; cp++) for (cp = buf; *cp == ' ' || *cp == '\t'; cp++)
@ -140,8 +142,8 @@ check_rhosts_file(const char *filename, const char *hostname,
/* Check for empty host/user names (particularly '+'). */ /* Check for empty host/user names (particularly '+'). */
if (!host[0] || !user[0]) { if (!host[0] || !user[0]) {
/* We come here if either was '+' or '-'. */ /* We come here if either was '+' or '-'. */
auth_debug_add("Ignoring wild host/user names in %.100s.", auth_debug_add("Ignoring wild host/user names "
filename); "in %.100s.", filename);
continue; continue;
} }
/* Verify that host name matches. */ /* Verify that host name matches. */
@ -149,7 +151,8 @@ check_rhosts_file(const char *filename, const char *hostname,
if (!innetgr(host + 1, hostname, NULL, NULL) && if (!innetgr(host + 1, hostname, NULL, NULL) &&
!innetgr(host + 1, ipaddr, NULL, NULL)) !innetgr(host + 1, ipaddr, NULL, NULL))
continue; continue;
} else if (strcasecmp(host, hostname) && strcmp(host, ipaddr) != 0) } else if (strcasecmp(host, hostname) &&
strcmp(host, ipaddr) != 0)
continue; /* Different hostname. */ continue; /* Different hostname. */
/* Verify that user name matches. */ /* Verify that user name matches. */
@ -208,7 +211,8 @@ auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostnam
/* Switch to the user's uid. */ /* Switch to the user's uid. */
temporarily_use_uid(pw); temporarily_use_uid(pw);
/* /*
* Quick check: if the user has no .shosts or .rhosts files, return * Quick check: if the user has no .shosts or .rhosts files and
* no system hosts.equiv/shosts.equiv files exist then return
* failure immediately without doing costly lookups from name * failure immediately without doing costly lookups from name
* servers. * servers.
*/ */
@ -223,27 +227,38 @@ auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostnam
/* Switch back to privileged uid. */ /* Switch back to privileged uid. */
restore_uid(); restore_uid();
/* Deny if The user has no .shosts or .rhosts file and there are no system-wide files. */ /*
* Deny if The user has no .shosts or .rhosts file and there
* are no system-wide files.
*/
if (!rhosts_files[rhosts_file_index] && if (!rhosts_files[rhosts_file_index] &&
stat(_PATH_RHOSTS_EQUIV, &st) < 0 && stat(_PATH_RHOSTS_EQUIV, &st) < 0 &&
stat(_PATH_SSH_HOSTS_EQUIV, &st) < 0) stat(_PATH_SSH_HOSTS_EQUIV, &st) < 0) {
debug3("%s: no hosts access files exist", __func__);
return 0; return 0;
}
/* If not logging in as superuser, try /etc/hosts.equiv and shosts.equiv. */ /*
if (pw->pw_uid != 0) { * If not logging in as superuser, try /etc/hosts.equiv and
* shosts.equiv.
*/
if (pw->pw_uid == 0)
debug3("%s: root user, ignoring system hosts files", __func__);
else {
if (check_rhosts_file(_PATH_RHOSTS_EQUIV, hostname, ipaddr, if (check_rhosts_file(_PATH_RHOSTS_EQUIV, hostname, ipaddr,
client_user, pw->pw_name)) { client_user, pw->pw_name)) {
auth_debug_add("Accepted for %.100s [%.100s] by /etc/hosts.equiv.", auth_debug_add("Accepted for %.100s [%.100s] by "
hostname, ipaddr); "/etc/hosts.equiv.", hostname, ipaddr);
return 1; return 1;
} }
if (check_rhosts_file(_PATH_SSH_HOSTS_EQUIV, hostname, ipaddr, if (check_rhosts_file(_PATH_SSH_HOSTS_EQUIV, hostname, ipaddr,
client_user, pw->pw_name)) { client_user, pw->pw_name)) {
auth_debug_add("Accepted for %.100s [%.100s] by %.100s.", auth_debug_add("Accepted for %.100s [%.100s] by "
hostname, ipaddr, _PATH_SSH_HOSTS_EQUIV); "%.100s.", hostname, ipaddr, _PATH_SSH_HOSTS_EQUIV);
return 1; return 1;
} }
} }
/* /*
* Check that the home directory is owned by root or the user, and is * Check that the home directory is owned by root or the user, and is
* not group or world writable. * not group or world writable.
@ -290,20 +305,25 @@ auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostnam
auth_debug_add("Bad file modes for %.200s", buf); auth_debug_add("Bad file modes for %.200s", buf);
continue; continue;
} }
/* Check if we have been configured to ignore .rhosts and .shosts files. */ /*
* Check if we have been configured to ignore .rhosts
* and .shosts files.
*/
if (options.ignore_rhosts) { if (options.ignore_rhosts) {
auth_debug_add("Server has been configured to ignore %.100s.", auth_debug_add("Server has been configured to "
rhosts_files[rhosts_file_index]); "ignore %.100s.", rhosts_files[rhosts_file_index]);
continue; continue;
} }
/* Check if authentication is permitted by the file. */ /* Check if authentication is permitted by the file. */
if (check_rhosts_file(buf, hostname, ipaddr, client_user, pw->pw_name)) { if (check_rhosts_file(buf, hostname, ipaddr,
client_user, pw->pw_name)) {
auth_debug_add("Accepted by %.100s.", auth_debug_add("Accepted by %.100s.",
rhosts_files[rhosts_file_index]); rhosts_files[rhosts_file_index]);
/* Restore the privileged uid. */ /* Restore the privileged uid. */
restore_uid(); restore_uid();
auth_debug_add("Accepted host %s ip %s client_user %s server_user %s", auth_debug_add("Accepted host %s ip %s client_user "
hostname, ipaddr, client_user, pw->pw_name); "%s server_user %s", hostname, ipaddr,
client_user, pw->pw_name);
return 1; return 1;
} }
} }

18
auth2-hostbased.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: auth2-hostbased.c,v 1.19 2014/12/21 22:27:56 djm Exp $ */ /* $OpenBSD: auth2-hostbased.c,v 1.20 2014/12/23 22:42:48 djm Exp $ */
/* /*
* Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2000 Markus Friedl. All rights reserved.
* *
@ -163,7 +163,7 @@ hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
resolvedname = get_canonical_hostname(options.use_dns); resolvedname = get_canonical_hostname(options.use_dns);
ipaddr = get_remote_ipaddr(); ipaddr = get_remote_ipaddr();
debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s", debug2("%s: chost %s resolvedname %s ipaddr %s", __func__,
chost, resolvedname, ipaddr); chost, resolvedname, ipaddr);
if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') { if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') {
@ -172,19 +172,27 @@ hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
} }
if (options.hostbased_uses_name_from_packet_only) { if (options.hostbased_uses_name_from_packet_only) {
if (auth_rhosts2(pw, cuser, chost, chost) == 0) if (auth_rhosts2(pw, cuser, chost, chost) == 0) {
debug2("%s: auth_rhosts2 refused "
"user \"%.100s\" host \"%.100s\" (from packet)",
__func__, cuser, chost);
return 0; return 0;
}
lookup = chost; lookup = chost;
} else { } else {
if (strcasecmp(resolvedname, chost) != 0) if (strcasecmp(resolvedname, chost) != 0)
logit("userauth_hostbased mismatch: " logit("userauth_hostbased mismatch: "
"client sends %s, but we resolve %s to %s", "client sends %s, but we resolve %s to %s",
chost, ipaddr, resolvedname); chost, ipaddr, resolvedname);
if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0) if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0) {
debug2("%s: auth_rhosts2 refused "
"user \"%.100s\" host \"%.100s\" addr \"%.100s\"",
__func__, cuser, resolvedname, ipaddr);
return 0; return 0;
}
lookup = resolvedname; lookup = resolvedname;
} }
debug2("userauth_hostbased: access allowed by auth_rhosts2"); debug2("%s: access allowed by auth_rhosts2", __func__);
if (key_is_cert(key) && if (key_is_cert(key) &&
key_cert_check_authority(key, 1, 0, lookup, &reason)) { key_cert_check_authority(key, 1, 0, lookup, &reason)) {