Attachment #3013 for bug #1800

Lines 120-125 initialize_server_options(ServerOptions *options) Link Here

(-)a/servconf.c (-3 / +32 lines)
120	options->challenge_response_authentication = -1;	120	options->challenge_response_authentication = -1;
121	options->permit_empty_passwd = -1;	121	options->permit_empty_passwd = -1;
122	options->permit_user_env = -1;	122	options->permit_user_env = -1;
		123	options->permit_user_env_whitelist = NULL;
123	options->compression = -1;	124	options->compression = -1;
124	options->rekey_limit = -1;	125	options->rekey_limit = -1;
125	options->rekey_interval = -1;	126	options->rekey_interval = -1;
Lines 280-287 fill_default_server_options(ServerOptions *options) Link Here
280	options->challenge_response_authentication = 1;	281	options->challenge_response_authentication = 1;
281	if (options->permit_empty_passwd == -1)	282	if (options->permit_empty_passwd == -1)
282	options->permit_empty_passwd = 0;	283	options->permit_empty_passwd = 0;
283	if (options->permit_user_env == -1)	284	if (options->permit_user_env == -1) {
284	options->permit_user_env = 0;	285	options->permit_user_env = 0;
		286	options->permit_user_env_whitelist = NULL;
		287	}
285	if (options->compression == -1)	288	if (options->compression == -1)
286	options->compression = COMP_DELAYED;	289	options->compression = COMP_DELAYED;
287	if (options->rekey_limit == -1)	290	if (options->rekey_limit == -1)
Lines 1289-1295 process_server_config_line(ServerOptions options, char line, Link Here
1289		1292
1290	case sPermitUserEnvironment:	1293	case sPermitUserEnvironment:
1291	intptr = &options->permit_user_env;	1294	intptr = &options->permit_user_env;
1292	goto parse_flag;	1295	charptr = &options->permit_user_env_whitelist;
		1296	arg = strdelim(&cp);
		1297	if (!arg \|\| *arg == '\0')
		1298	fatal("%s line %d: missing argument.",
		1299	filename, linenum);
		1300	value = 0;
		1301	p = NULL;
		1302	if (strcmp(arg, "yes") == 0)
		1303	value = 1;
		1304	else if (strcmp(arg, "no") == 0)
		1305	value = 0;
		1306	else {
		1307	/* Pattern-list specified */
		1308	value = 1;
		1309	p = xstrdup(arg);
		1310	}
		1311	if (activep && intptr == -1) {
		1312	*intptr = value;
		1313	*charptr = p;
		1314	}
		1315	break;
1293		1316
1294	case sCompression:	1317	case sCompression:
1295	intptr = &options->compression;	1318	intptr = &options->compression;
Lines 2272-2278 dump_config(ServerOptions *o) Link Here
2272	dump_cfg_fmtint(sStrictModes, o->strict_modes);	2295	dump_cfg_fmtint(sStrictModes, o->strict_modes);
2273	dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);	2296	dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
2274	dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);	2297	dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
2275	dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
2276	dump_cfg_fmtint(sCompression, o->compression);	2298	dump_cfg_fmtint(sCompression, o->compression);
2277	dump_cfg_fmtint(sGatewayPorts, o->fwd_opts.gateway_ports);	2299	dump_cfg_fmtint(sGatewayPorts, o->fwd_opts.gateway_ports);
2278	dump_cfg_fmtint(sUseDNS, o->use_dns);	2300	dump_cfg_fmtint(sUseDNS, o->use_dns);
Lines 2352-2356 dump_config(ServerOptions *o) Link Here
2352	printf("rekeylimit %llu %d\n", (unsigned long long)o->rekey_limit,	2374	printf("rekeylimit %llu %d\n", (unsigned long long)o->rekey_limit,
2353	o->rekey_interval);	2375	o->rekey_interval);
2354		2376
		2377	if (o->permit_user_env_whitelist == NULL)
		2378	dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
		2379	else {
		2380	printf("permituserenvironment %s\n",
		2381	o->permit_user_env_whitelist);
		2382	}
		2383
2355	channel_print_adm_permitted_opens();	2384	channel_print_adm_permitted_opens();
2356	}	2385	}

Lines 121-126 typedef struct { Link Here

(-)a/servconf.h (+1 lines)
121	int permit_empty_passwd; /* If false, do not permit empty	121	int permit_empty_passwd; /* If false, do not permit empty
122	* passwords. */	122	* passwords. */
123	int permit_user_env; /* If true, read ~/.ssh/environment */	123	int permit_user_env; /* If true, read ~/.ssh/environment */
		124	char permit_user_env_whitelist; / pattern-list whitelist */
124	int compression; /* If true, compression is allowed */	125	int compression; /* If true, compression is allowed */
125	int allow_tcp_forwarding; /* One of FORWARD_* */	126	int allow_tcp_forwarding; /* One of FORWARD_* */
126	int allow_streamlocal_forwarding; /* One of FORWARD_* */	127	int allow_streamlocal_forwarding; /* One of FORWARD_* */

Lines 888-897 child_set_env(char **envp, u_int envsizep, const char *name, Link Here

(-)a/session.c (-5 / +15 lines)
888	* into the environment. If the file does not exist, this does nothing.	888	* into the environment. If the file does not exist, this does nothing.
889	* Otherwise, it must consist of empty lines, comments (line starts with '#')	889	* Otherwise, it must consist of empty lines, comments (line starts with '#')
890	* and assignments of the form name=value. No other forms are allowed.	890	* and assignments of the form name=value. No other forms are allowed.
		891	* If whitelist is not NULL, then it is interpreted as a pattern list and
		892	* only variable names that match it will be accepted.
891	*/	893	*/
892	static void	894	static void
893	read_environment_file(char **env, u_int envsize,	895	read_environment_file(char **env, u_int envsize,
894	const char *filename)	896	const char filename, const char whitelist)
895	{	897	{
896	FILE *f;	898	FILE *f;
897	char buf[4096];	899	char buf[4096];
Lines 924-929 read_environment_file(char **env, u_int envsize, Link Here
924	*/	926	*/
925	*value = '\0';	927	*value = '\0';
926	value++;	928	value++;
		929	if (whitelist != NULL &&
		930	match_pattern_list(cp, whitelist, 0) != 1)
		931	continue;
927	child_set_env(env, envsize, cp, value);	932	child_set_env(env, envsize, cp, value);
928	}	933	}
929	fclose(f);	934	fclose(f);
Lines 962-968 read_etc_default_login(char **env, u_int envsize, uid_t uid) Link Here
962	* so we use a temporary environment and copy the variables we're	967	* so we use a temporary environment and copy the variables we're
963	* interested in.	968	* interested in.
964	*/	969	*/
965	read_environment_file(&tmpenv, &tmpenvsize, "/etc/default/login");	970	read_environment_file(&tmpenv, &tmpenvsize, "/etc/default/login", NULL);
966		971
967	if (tmpenv == NULL)	972	if (tmpenv == NULL)
968	return;	973	return;
Lines 1098-1104 do_setup_env(Session s, const char shell) Link Here
1098	;	1103	;
1099	if (str[i] == '=') {	1104	if (str[i] == '=') {
1100	str[i] = 0;	1105	str[i] = 0;
1101	child_set_env(&env, &envsize, str, str + i + 1);	1106	/* Apply PermitUserEnvironment whitelist if specified */
		1107	if (options.permit_user_env_whitelist == NULL \|\|
		1108	match_pattern_list(str,
		1109	options.permit_user_env_whitelist, 0) == 1)
		1110	child_set_env(&env, &envsize, str, str + i + 1);
1102	}	1111	}
1103	custom_environment = ce->next;	1112	custom_environment = ce->next;
1104	free(ce->s);	1113	free(ce->s);
Lines 1153-1159 do_setup_env(Session s, const char shell) Link Here
1153		1162
1154	if ((cp = getenv("AUTHSTATE")) != NULL)	1163	if ((cp = getenv("AUTHSTATE")) != NULL)
1155	child_set_env(&env, &envsize, "AUTHSTATE", cp);	1164	child_set_env(&env, &envsize, "AUTHSTATE", cp);
1156	read_environment_file(&env, &envsize, "/etc/environment");	1165	read_environment_file(&env, &envsize, "/etc/environment", NULL);
1157	}	1166	}
1158	#endif	1167	#endif
1159	#ifdef KRB5	1168	#ifdef KRB5
Lines 1187-1193 do_setup_env(Session s, const char shell) Link Here
1187	if (options.permit_user_env) {	1196	if (options.permit_user_env) {
1188	snprintf(buf, sizeof buf, "%.200s/.ssh/environment",	1197	snprintf(buf, sizeof buf, "%.200s/.ssh/environment",
1189	strcmp(pw->pw_dir, "/") ? pw->pw_dir : "");	1198	strcmp(pw->pw_dir, "/") ? pw->pw_dir : "");
1190	read_environment_file(&env, &envsize, buf);	1199	read_environment_file(&env, &envsize, buf,
		1200	options.permit_user_env_whitelist);
1191	}	1201	}
1192	if (debug_flag) {	1202	if (debug_flag) {
1193	/* dump the environment */	1203	/* dump the environment */

Lines 1238-1243 options in Link Here

(-)a/sshd_config.5 (+6 lines)
1238	.Pa ~/.ssh/authorized_keys	1238	.Pa ~/.ssh/authorized_keys
1239	are processed by	1239	are processed by
1240	.Xr sshd 8 .	1240	.Xr sshd 8 .
		1241	Valid options are
		1242	.Cm yes ,
		1243	.Cm no
		1244	or a pattern-list specifying which environment variable names to accept
		1245	(for example
		1246	.Qq LANG,LC_* ) .
1241	The default is	1247	The default is
1242	.Cm no .	1248	.Cm no .
1243	Enabling environment processing may enable users to bypass access	1249	Enabling environment processing may enable users to bypass access

Return to bug 1800