Attachment #3411 for bug #2755




#ifdef HAVE_PATHS_H
# include <paths.h>
#endif
#include <dirent.h>
#include <pwd.h>
#include <signal.h>
#include <stdio.h>

	return ret;
}

/*
 * Opens file at path and checks whether key is allowed in it.
 * This returns 1 if the key is allowed or 0 otherwise.
 */
static int
open_check_authkeys_file(struct ssh *ssh, struct passwd *pw,
	struct sshkey *key, char *filepath, struct sshauthopt **authoptsp)
{
	int found_key = 0;
	FILE *f;

	debug("trying public key file %s", filepath);
	f = auth_openkeyfile(filepath, pw, options.strict_modes);
	if (f != NULL) {
		found_key = check_authkeys_file(ssh, pw, f, filepath,
			key, authoptsp);
		fclose(f);
	}
	return found_key;
}

/*
 * Filters dotfiles from directory scan results.
 */
static int
user_key_dotfiles_filter(const struct dirent *entry) {
	if (entry->d_ino == 0)
		return 0;

	if (strlen(entry->d_name) == 0 || entry->d_name[0] == '.')
		return 0;

	return 1;
}

/*
 * Checks whether key is allowed in file.
 * returns 1 if the key is allowed or 0 otherwise.
 */
static int
user_key_allowed2(struct ssh *ssh, struct passwd *pw, struct sshkey *key,
    char *path, struct sshauthopt **authoptsp)
{
	char inner_filepath[PATH_MAX];
	int dir_entries, dir_index = 0, found_key = 0, r;
	struct dirent **namelist;

	if (authoptsp != NULL)
		*authoptsp = NULL;

	/* Temporarily use the user's uid. */
	temporarily_use_uid(pw);

	dir_entries = scandir(path, &namelist, user_key_dotfiles_filter, alphasort);
	if (dir_entries >= 0) {
		debug("checking directory %s for public key files", path);

		for(dir_index = 0; found_key == 0 && dir_index < dir_entries; dir_index++) {
			r = snprintf(inner_filepath, sizeof(inner_filepath), "%s/%s",
				path, namelist[dir_index]->d_name);
			if (r <= 0 || (size_t)r >= sizeof(inner_filepath))
				continue;
			found_key = open_check_authkeys_file(ssh, pw, key,
				inner_filepath, authoptsp);
			if (found_key == 1)
				break;
		}

		for(dir_index = 0; dir_index < dir_entries; dir_index++) {
			free(namelist[dir_index]);
		}
		free(namelist);
	} else {
		found_key = open_check_authkeys_file(ssh, pw, key, path, authoptsp);
	}

	restore_uid();

    int auth_attempt, struct sshauthopt **authoptsp)
{
	u_int success = 0, i;
	char *path;
	struct sshauthopt *opts = NULL;

	if (authoptsp != NULL)

	for (i = 0; !success && i < options.num_authkeys_files; i++) {
		if (strcasecmp(options.authorized_keys_files[i], "none") == 0)
			continue;
		path = expand_authorized_keys(
		    options.authorized_keys_files[i], pw);
		success = user_key_allowed2(ssh, pw, key, path, &opts);
		free(path);
		if (!success) {
			sshauthopt_free(opts);
			opts = NULL;

Lines 281-286 After expansion, Link Here

(-)a/sshd_config.5 (-1 / +2 lines)
281	is taken to be an absolute path or one relative to the user's home	281	is taken to be an absolute path or one relative to the user's home
282	directory.	282	directory.
283	Multiple files may be listed, separated by whitespace.	283	Multiple files may be listed, separated by whitespace.
		284	If a directory is specified, all files beneath it are included (non-recursively
		285	and ignoring dotfiles).
284	Alternately this option may be set to	286	Alternately this option may be set to
285	.Cm none	287	.Cm none
286	to skip checking for user keys in files.	288	to skip checking for user keys in files.
287	-

Return to bug 2755

Lines 34-39 Link Here

(-)a/auth2-pubkey.c (-12 / +65 lines)
34	#ifdef HAVE_PATHS_H	34	#ifdef HAVE_PATHS_H
35	# include <paths.h>	35	# include <paths.h>
36	#endif	36	#endif
		37	#include <dirent.h>
37	#include <pwd.h>	38	#include <pwd.h>
38	#include <signal.h>	39	#include <signal.h>
39	#include <stdio.h>	40	#include <stdio.h>
Lines 841-856 user_cert_trusted_ca(struct ssh ssh, struct passwd pw, struct sshkey *key, Link Here
841	return ret;	842	return ret;
842	}	843	}
843		844
		845	/*
		846	* Opens file at path and checks whether key is allowed in it.
		847	* This returns 1 if the key is allowed or 0 otherwise.
		848	*/
		849	static int
		850	open_check_authkeys_file(struct ssh ssh, struct passwd pw,
		851	struct sshkey key, char filepath, struct sshauthopt **authoptsp)
		852	{
		853	int found_key = 0;
		854	FILE *f;
		855
		856	debug("trying public key file %s", filepath);
		857	f = auth_openkeyfile(filepath, pw, options.strict_modes);
		858	if (f != NULL) {
		859	found_key = check_authkeys_file(ssh, pw, f, filepath,
		860	key, authoptsp);
		861	fclose(f);
		862	}
		863	return found_key;
		864	}
		865
		866	/*
		867	* Filters dotfiles from directory scan results.
		868	*/
		869	static int
		870	user_key_dotfiles_filter(const struct dirent *entry) {
		871	if (entry->d_ino == 0)
		872	return 0;
		873
		874	if (strlen(entry->d_name) == 0 \|\| entry->d_name[0] == '.')
		875	return 0;
		876
		877	return 1;
		878	}
		879
844	/*	880	/*
845	* Checks whether key is allowed in file.	881	* Checks whether key is allowed in file.
846	* returns 1 if the key is allowed or 0 otherwise.	882	* returns 1 if the key is allowed or 0 otherwise.
847	*/	883	*/
848	static int	884	static int
849	user_key_allowed2(struct ssh ssh, struct passwd pw, struct sshkey *key,	885	user_key_allowed2(struct ssh ssh, struct passwd pw, struct sshkey *key,
850	char file, struct sshauthopt *authoptsp)	886	char path, struct sshauthopt *authoptsp)
851	{	887	{
852	FILE *f;	888	char inner_filepath[PATH_MAX];
853	int found_key = 0;	889	int dir_entries, dir_index = 0, found_key = 0, r;
		890	struct dirent **namelist;
854		891
855	if (authoptsp != NULL)	892	if (authoptsp != NULL)
856	*authoptsp = NULL;	893	*authoptsp = NULL;
Lines 858-868 user_key_allowed2(struct ssh ssh, struct passwd pw, struct sshkey *key, Link Here
858	/* Temporarily use the user's uid. */	895	/* Temporarily use the user's uid. */
859	temporarily_use_uid(pw);	896	temporarily_use_uid(pw);
860		897
861	debug("trying public key file %s", file);	898	dir_entries = scandir(path, &namelist, user_key_dotfiles_filter, alphasort);
862	if ((f = auth_openkeyfile(file, pw, options.strict_modes)) != NULL) {	899	if (dir_entries >= 0) {
863	found_key = check_authkeys_file(ssh, pw, f, file,	900	debug("checking directory %s for public key files", path);
864	key, authoptsp);	901
865	fclose(f);	902	for(dir_index = 0; found_key == 0 && dir_index < dir_entries; dir_index++) {
		903	r = snprintf(inner_filepath, sizeof(inner_filepath), "%s/%s",
		904	path, namelist[dir_index]->d_name);
		905	if (r <= 0 \|\| (size_t)r >= sizeof(inner_filepath))
		906	continue;
		907	found_key = open_check_authkeys_file(ssh, pw, key,
		908	inner_filepath, authoptsp);
		909	if (found_key == 1)
		910	break;
		911	}
		912
		913	for(dir_index = 0; dir_index < dir_entries; dir_index++) {
		914	free(namelist[dir_index]);
		915	}
		916	free(namelist);
		917	} else {
		918	found_key = open_check_authkeys_file(ssh, pw, key, path, authoptsp);
866	}	919	}
867		920
868	restore_uid();	921	restore_uid();
Lines 1009-1015 user_key_allowed(struct ssh ssh, struct passwd pw, struct sshkey *key, Link Here
1009	int auth_attempt, struct sshauthopt **authoptsp)	1062	int auth_attempt, struct sshauthopt **authoptsp)
1010	{	1063	{
1011	u_int success = 0, i;	1064	u_int success = 0, i;
1012	char *file;	1065	char *path;
1013	struct sshauthopt *opts = NULL;	1066	struct sshauthopt *opts = NULL;
1014		1067
1015	if (authoptsp != NULL)	1068	if (authoptsp != NULL)
Lines 1024-1033 user_key_allowed(struct ssh ssh, struct passwd pw, struct sshkey *key, Link Here
1024	for (i = 0; !success && i < options.num_authkeys_files; i++) {	1077	for (i = 0; !success && i < options.num_authkeys_files; i++) {
1025	if (strcasecmp(options.authorized_keys_files[i], "none") == 0)	1078	if (strcasecmp(options.authorized_keys_files[i], "none") == 0)
1026	continue;	1079	continue;
1027	file = expand_authorized_keys(	1080	path = expand_authorized_keys(
1028	options.authorized_keys_files[i], pw);	1081	options.authorized_keys_files[i], pw);
1029	success = user_key_allowed2(ssh, pw, key, file, &opts);	1082	success = user_key_allowed2(ssh, pw, key, path, &opts);
1030	free(file);	1083	free(path);
1031	if (!success) {	1084	if (!success) {
1032	sshauthopt_free(opts);	1085	sshauthopt_free(opts);
1033	opts = NULL;	1086	opts = NULL;