- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] Include user name in password reset emails
by Lukas Fleischer 22 May '15

22 May '15

Fixes FS#44320. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/passreset.php | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/web/html/passreset.php b/web/html/passreset.php index fca3d10..29f2c64 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -41,15 +41,17 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir } } elseif (isset($_POST['email'])) { $email = $_POST['email']; + $username = username_from_id(uid_from_email($email)); if (empty($email)) { $error = __('Missing a required field.'); } else { $subject = 'AUR Password Reset'; - $body = __('A password reset request was submitted for the account '. - 'associated with your e-mail address. If you wish to reset '. - 'your password follow the link below, otherwise ignore '. - 'this message and nothing will happen.'); + $body = __('A password reset request was submitted for the ' . + 'account %s associated with your e-mail address. ' . + 'If you wish to reset your password follow the ' . + 'link below, otherwise ignore this message and ' . + 'nothing will happen.', $username); send_resetkey($email, $subject, $body); header('Location: ' . get_uri('/passreset/') . '?step=confirm'); -- 2.4.1

1 0

[aur-dev] [PATCH 1/3] Fix the permission check in pkgbase_adopt()
by Lukas Fleischer 22 May '15

22 May '15

Filter the affected package bases before closing any package requests. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgbasefuncs.inc.php | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/web/lib/pkgbasefuncs.inc.php b/web/lib/pkgbasefuncs.inc.php index 50cb47e..d10b5ad 100644 --- a/web/lib/pkgbasefuncs.inc.php +++ b/web/lib/pkgbasefuncs.inc.php @@ -579,7 +579,25 @@ function pkgbase_adopt ($base_ids, $action=true, $via) { } } + /* Verify package ownership. */ $base_ids = sanitize_ids($base_ids); + + $q = "SELECT ID FROM PackageBases "; + $q.= "WHERE ID IN (" . implode(",", $base_ids) . ") "; + + if ($action && !has_credential(CRED_PKGBASE_ADOPT)) { + /* Regular users may only adopt orphan packages. */ + $q.= "AND MaintainerUID IS NULL"; + } + if (!$action && !has_credential(CRED_PKGBASE_DISOWN)) { + /* Regular users may only disown their own packages. */ + $q.= "AND MaintainerUID = " . $uid; + } + + $result = $dbh->query($q); + $base_ids = $result->fetchAll(PDO::FETCH_COLUMN, 0); + + /* Error out if the list of remaining packages is empty. */ if (empty($base_ids)) { if ($action) { return array(false, __("You did not select any packages to adopt.")); @@ -618,16 +636,6 @@ function pkgbase_adopt ($base_ids, $action=true, $via) { $q.= "SET MaintainerUID = NULL "; } $q.= "WHERE ID IN (" . implode(",", $base_ids) . ") "; - - if ($action && !has_credential(CRED_PKGBASE_ADOPT)) { - /* Regular users may only adopt orphan packages. */ - $q.= "AND MaintainerUID IS NULL"; - } - if (!$action && !has_credential(CRED_PKGBASE_DISOWN)) { - /* Regular users may only disown their own packages. */ - $q.= "AND MaintainerUID = " . $uid; - } - $dbh->exec($q); if ($action) { -- 2.4.1

1 4

[aur-dev] [PATCH 1/2] Fix processing of pkgbase_get_comaintainers()
by Lukas Fleischer 22 May '15

22 May '15

pkgbase_get_comaintainers() returns an array of user names, not an array of user IDs. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/pkgdisown.php | 6 +++--- web/lib/pkgbasefuncs.inc.php | 15 +++++++++------ 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/web/html/pkgdisown.php b/web/html/pkgdisown.php index 071a76c..fa182dc 100644 --- a/web/html/pkgdisown.php +++ b/web/html/pkgdisown.php @@ -11,7 +11,7 @@ check_sid(); html_header(__("Disown Package")); $maintainer_uids = array(pkgbase_maintainer_uid($base_id)); -$comaintainer_uids = pkgbase_get_comaintainers($base_id); +$comaintainers = pkgbase_get_comaintainers($base_id); if (has_credential(CRED_PKGBASE_DISOWN, $maintainer_uids)): ?> <div class="box"> @@ -26,9 +26,9 @@ if (has_credential(CRED_PKGBASE_DISOWN, $maintainer_uids)): ?> <?php endforeach; ?> </ul> - <?php if (count($comaintainer_uids) > 0): ?> + <?php if (count($comaintainers) > 0): ?> <?= __('By selecting the checkbox, you confirm that you want to disown the package and transfer ownership to %s%s%s.', - '', $comaintainer_uids[0], ''); ?> + '', $comaintainers[0], ''); ?> <?php else: ?> <?= __('By selecting the checkbox, you confirm that you want to disown the package.') ?> <?php endif; ?> diff --git a/web/lib/pkgbasefuncs.inc.php b/web/lib/pkgbasefuncs.inc.php index b8da23c..5b8b52f 100644 --- a/web/lib/pkgbasefuncs.inc.php +++ b/web/lib/pkgbasefuncs.inc.php @@ -646,12 +646,15 @@ function pkgbase_adopt ($base_ids, $action=true, $via) { } } else { foreach ($base_ids as $base_id) { - $uids = pkgbase_get_comaintainers($base_id); - - $q = "UPDATE PackageBases "; - $q.= "SET MaintainerUID = " . $uids[0] . " "; - $q.= "WHERE ID = " . $base_id; - $dbh->exec($q); + $comaintainers = pkgbase_get_comaintainers($base_id); + + if (count($comaintainers) > 0) { + $uid = uid_from_username($comaintainers[0]); + $q = "UPDATE PackageBases "; + $q.= "SET MaintainerUID = " . $uid . " "; + $q.= "WHERE ID = " . $base_id; + $dbh->exec($q); + } } } } -- 2.4.1

1 1

[aur-dev] [PATCH] Store co-maintainer priorities
by Lukas Fleischer 22 May '15

22 May '15

In addition to saving the list of package co-maintainers, also save their order. This makes it possible to define a "primary" co-maintainer. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- schema/aur-schema.sql | 1 + upgrading/4.0.0.txt | 1 + web/lib/pkgbasefuncs.inc.php | 7 +++++-- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/schema/aur-schema.sql b/schema/aur-schema.sql index 9c647d8..5641d0d 100644 --- a/schema/aur-schema.sql +++ b/schema/aur-schema.sql @@ -281,6 +281,7 @@ CREATE TABLE PackageComments ( CREATE TABLE PackageComaintainers ( UsersID INTEGER UNSIGNED NOT NULL, PackageBaseID INTEGER UNSIGNED NOT NULL, + Priority INTEGER UNSIGNED NOT NULL, INDEX (UsersID), INDEX (PackageBaseID), FOREIGN KEY (UsersID) REFERENCES Users(ID) ON DELETE CASCADE, diff --git a/upgrading/4.0.0.txt b/upgrading/4.0.0.txt index 023dec0..9a4a807 100644 --- a/upgrading/4.0.0.txt +++ b/upgrading/4.0.0.txt @@ -26,6 +26,7 @@ UPDATE PackageBases SET PackagerUID = NULL; CREATE TABLE PackageComaintainers ( UsersID INTEGER UNSIGNED NOT NULL, PackageBaseID INTEGER UNSIGNED NOT NULL, + Priority INTEGER UNSIGNED NOT NULL, INDEX (UsersID), INDEX (PackageBaseID), FOREIGN KEY (UsersID) REFERENCES Users(ID) ON DELETE CASCADE, diff --git a/web/lib/pkgbasefuncs.inc.php b/web/lib/pkgbasefuncs.inc.php index 3e4b572..50cb47e 100644 --- a/web/lib/pkgbasefuncs.inc.php +++ b/web/lib/pkgbasefuncs.inc.php @@ -967,7 +967,8 @@ function pkgbase_get_comaintainers($base_id) { $dbh = DB::connect(); $q = "SELECT UserName FROM PackageComaintainers "; $q .= "INNER JOIN Users ON Users.ID = PackageComaintainers.UsersID "; - $q .= "WHERE PackageComaintainers.PackageBaseID = " . intval($base_id); + $q .= "WHERE PackageComaintainers.PackageBaseID = " . intval($base_id) . " "; + $q .= "ORDER BY Priority ASC"; $result = $dbh->query($q); if ($result) { @@ -1012,9 +1013,11 @@ function pkgbase_set_comaintainers($base_id, $users) { $q = sprintf("DELETE FROM PackageComaintainers WHERE PackageBaseID = %d", $base_id); $dbh->exec($q); + $i = 1; foreach ($uids as $uid) { - $q = sprintf("INSERT INTO PackageComaintainers (PackageBaseID, UsersID) VALUES (%d, %d)", $base_id, $uid); + $q = sprintf("INSERT INTO PackageComaintainers (PackageBaseID, UsersID, Priority) VALUES (%d, %d, %d)", $base_id, $uid, $i); $dbh->exec($q); + $i++; } return array(true, __("The package base co-maintainers have been updated.")); -- 2.4.1

1 0

[aur-dev] [PATCH] Update upgrade instructions for 4.0.0
by Lukas Fleischer 22 May '15

22 May '15

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- upgrading/4.0.0.txt | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/upgrading/4.0.0.txt b/upgrading/4.0.0.txt index b1582f2..023dec0 100644 --- a/upgrading/4.0.0.txt +++ b/upgrading/4.0.0.txt @@ -1,14 +1,18 @@ +WARNING! Following these upgrade instructions will reset all packages! If you +want to keep the package contents, please create a backup before starting the +upgrade process and import the source tarballs into the Git repositories +afterwards. + 1. Add a field for the SSH public key to the Users table: ---- ALTER TABLE Users ADD COLUMN SSHPubKey VARCHAR(4096) NULL DEFAULT NULL; ---- -2. Create a new user and set up a patched version of the sshd as -described in INSTALL. +2. Create a new user and configure the sshd as described in INSTALL. -3. Create a directory for the package base Git repositories and run -init-repos.py to initialize them. +3. Run gen-templates.py to initialize the Git repository template. Create a +directory for the Git repositories and run init-repos.py to initialize them. 4. Reset the packager field of all package bases: -- 2.4.1

1 0

[aur-dev] [PATCH] Make the type parameter of pkgreq_by_pkgbase() optional
by Lukas Fleischer 21 May '15

21 May '15

This simplifies the code a bit, improves maintainability and reduces the number of SQL queries when deleting a package. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgbasefuncs.inc.php | 5 +---- web/lib/pkgreqfuncs.inc.php | 9 ++++++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/web/lib/pkgbasefuncs.inc.php b/web/lib/pkgbasefuncs.inc.php index 3f02bc7..3e4b572 100644 --- a/web/lib/pkgbasefuncs.inc.php +++ b/web/lib/pkgbasefuncs.inc.php @@ -513,10 +513,7 @@ function pkgbase_delete ($base_ids, $merge_base_id, $via, $grant=false) { if (!$action) { $username = username_from_sid($_COOKIE['AURSID']); foreach ($base_ids as $base_id) { - $pkgreq_ids = array_merge( - pkgreq_by_pkgbase($base_id, 'deletion'), - pkgreq_by_pkgbase($base_id, 'merge'), - pkgreq_by_pkgbase($base_id, 'orphan')); + $pkgreq_ids = array_merge(pkgreq_by_pkgbase($base_id)); foreach ($pkgreq_ids as $pkgreq_id) { pkgreq_close(intval($pkgreq_id), 'accepted', 'The user ' . $username . diff --git a/web/lib/pkgreqfuncs.inc.php b/web/lib/pkgreqfuncs.inc.php index e4c63b5..c056d68 100644 --- a/web/lib/pkgreqfuncs.inc.php +++ b/web/lib/pkgreqfuncs.inc.php @@ -49,15 +49,18 @@ function pkgreq_list($offset, $limit) { * * @return array List of package request IDs */ -function pkgreq_by_pkgbase($baseid, $type) { +function pkgreq_by_pkgbase($baseid, $type=false) { $dbh = DB::connect(); $q = "SELECT PackageRequests.ID "; $q.= "FROM PackageRequests INNER JOIN RequestTypes ON "; $q.= "RequestTypes.ID = PackageRequests.ReqTypeID "; $q.= "WHERE PackageRequests.Status = 0 "; - $q.= "AND PackageRequests.PackageBaseID = " . intval($baseid) . " "; - $q.= "AND RequestTypes.Name = " . $dbh->quote($type); + $q.= "AND PackageRequests.PackageBaseID = " . intval($baseid); + + if ($type) { + $q .= " AND RequestTypes.Name = " . $dbh->quote($type); + } return $dbh->query($q)->fetchAll(PDO::FETCH_COLUMN, 0); } -- 2.4.1

1 0

[aur-dev] aur-dev no longer uses port 2222 for SSH
by Lukas Fleischer 21 May '15

21 May '15

Hi, If you are using the AUR 4.0.0 testing environment on aur-dev.archlinux.org, please note that we now use the default SSH port 22 instead of 2222. This means that you can drop the ":2222" part from your Git remote URIs or remove the "Port 2222" line from your local SSH configuration. We are currently preparing the migration to AUR 4.0.0 and we are going to inform all AUR users about the transition in a couple of days. Regards, Lukas

2 1

[aur-dev] [PATCH] Change default configuration to use SSH port 22
by Lukas Fleischer 21 May '15

21 May '15

We no longer run a separate SSH daemon on port 2222. Change the default configuration accordingly. Also remove some configuration files that are no longer needed. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- conf/aur-sshd.socket | 6 ------ conf/aur-sshd@.service | 8 -------- conf/cgitrc.proto | 2 +- conf/config.proto | 2 +- scripts/git-integration/sshd_config | 6 ------ 5 files changed, 2 insertions(+), 22 deletions(-) delete mode 100644 conf/aur-sshd.socket delete mode 100644 conf/aur-sshd@.service delete mode 100644 scripts/git-integration/sshd_config diff --git a/conf/aur-sshd.socket b/conf/aur-sshd.socket deleted file mode 100644 index 5b0c3df..0000000 --- a/conf/aur-sshd.socket +++ /dev/null @@ -1,6 +0,0 @@ -[Socket] -ListenStream=2222 -Accept=yes - -[Install] -WantedBy=sockets.target diff --git a/conf/aur-sshd@.service b/conf/aur-sshd@.service deleted file mode 100644 index 5ec410a..0000000 --- a/conf/aur-sshd@.service +++ /dev/null @@ -1,8 +0,0 @@ -[Unit] -Description=AUR OpenSSH Per-Connection Daemon - -[Service] -ExecStart=-/srv/http/aurweb/openssh/sshd -i -f /srv/http/aurweb/.ssh/sshd_config -User=aur -StandardInput=socket -StandardError=syslog diff --git a/conf/cgitrc.proto b/conf/cgitrc.proto index 86b410b..d9bde83 100644 --- a/conf/cgitrc.proto +++ b/conf/cgitrc.proto @@ -1,5 +1,5 @@ virtual-root=/cgit/ -clone-prefix=git+ssh://aur@aur.archlinux.org:2222 +clone-prefix=git+ssh://aur@aur.archlinux.org noheader=0 logo= css=/css/cgit.css diff --git a/conf/config.proto b/conf/config.proto index 99ab602..623d044 100644 --- a/conf/config.proto +++ b/conf/config.proto @@ -20,7 +20,7 @@ disable_http_login = 1 aur_location = https://aur.archlinux.org cgit_uri = https://aur.archlinux.org/cgit/ git_clone_uri_anon = https://aur.archlinux.org/cgit/%s.git/ -git_clone_uri_priv = ssh+git://aur@aur.archlinux.org:2222/%s.git/ +git_clone_uri_priv = ssh+git://aur@aur.archlinux.org/%s.git/ max_rpc_results = 5000 aur_request_ml = aur-requests(a)archlinux.org request_idle_time = 1209600 diff --git a/scripts/git-integration/sshd_config b/scripts/git-integration/sshd_config deleted file mode 100644 index d3d2f5a..0000000 --- a/scripts/git-integration/sshd_config +++ /dev/null @@ -1,6 +0,0 @@ -Port 2222 -HostKey ~/.ssh/ssh_host_rsa_key -PasswordAuthentication no -UsePrivilegeSeparation no -AuthorizedKeysCommand /srv/http/aurweb/scripts/git-integration/git-auth.py "%t" "%k" -AuthorizedKeysCommandUser aur -- 2.4.1

1 0

[aur-dev] [PATCH] Remove the OpenSSH patch
by Lukas Fleischer 21 May '15

21 May '15

Extended AuthorizedKeysCommand parameters are now officially supported by OpenSSH. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- INSTALL | 41 +- .../0001-Patch-sshd-for-the-AUR.patch | 1094 -------------------- 2 files changed, 15 insertions(+), 1120 deletions(-) delete mode 100644 scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch diff --git a/INSTALL b/INSTALL index 34e1a00..2a67f9b 100644 --- a/INSTALL +++ b/INSTALL @@ -17,39 +17,28 @@ Setup on Arch Linux 4) Create a new MySQL database and a user and import the AUR SQL schema: - $ mysql -uaur -p AUR </srv/http/aurweb/schema/aur-schema.sql + $ mysql -uaur -p AUR </srv/http/aurweb/schema/aur-schema.sql 5) Generate templates for new Git repositories: - $ /srv/http/aurweb/scripts/git-integration/gen-templates.py + $ /srv/http/aurweb/scripts/git-integration/gen-templates.py -6) Clone the OpenSSH project, apply the aurweb sshd patch and run `make`: +6) Create a new user: - $ cd /srv/http/aurweb/ - $ git clone git://anongit.mindrot.org/openssh.git - $ cd openssh - $ git checkout V_6_8_P1 - $ git am ../scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch - $ autoreconf - $ ./configure - $ make + # useradd -U -d /srv/http/aurweb -c 'AUR user' aur -7) Create and edit the sshd configuration: +7) Install the git-auth wrapper script: - $ cd /srv/http/aurweb/ - $ umask 077 - $ mkdir .ssh/ - $ ssh-keygen -f .ssh/ssh_host_rsa_key -N '' -t rsa - $ cp scripts/git-integration/sshd_config .ssh/ + # cd /srv/http/aurweb/scripts/git-integration/ + # cp git-auth.sh /usr/local/bin/aur-git-auth + # chmod 755 /usr/local/bin/aur-git-auth -8) Create a new user and change ownership of the .ssh directory: +8) Configure sshd(8) for the AUR. Add the following lines at the end of your + sshd_config(5) and restart the sshd. Note that OpenSSH 6.9 or newer is + needed! - # useradd -U -d /srv/http/aurweb -c 'AUR user' aur - # chown aur:aur /srv/http/aurweb/.ssh/ + Match User aur + PasswordAuthentication no + AuthorizedKeysCommand /usr/local/bin/aur-git-auth "%t" "%k" + AuthorizedKeysCommandUser aur -9) Add, enable and start systemd unit files for the new sshd: - - # cp /srv/http/aurweb/conf/aur-sshd.socket /etc/systemd/system/ - # cp /srv/http/aurweb/conf/aur-sshd@.service /etc/systemd/system/ - # systemctl enable aur-sshd.socket - # systemctl start aur-sshd.socket diff --git a/scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch b/scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch deleted file mode 100644 index 688b115..0000000 --- a/scripts/git-integration/0001-Patch-sshd-for-the-AUR.patch +++ /dev/null @@ -1,1094 +0,0 @@ -From 6423ae83d38535687d52097b7854b3c81151fe34 Mon Sep 17 00:00:00 2001 -From: Lukas Fleischer <lfleischer(a)archlinux.org> -Date: Sat, 11 Apr 2015 12:57:46 +0200 -Subject: [PATCH] Patch sshd for the AUR - -* Apply the latest version of Damien Miller's patch to extend the - parameters to the AuthorizedKeysCommand. - -* Remove the secure path check for the AuthorizedKeysCommand. We are - running the sshd under a non-privileged user who has as little - permissions as possible. In particular, he does not own the directory - that contains the scripts for the Git backend. - -* Prevent from running the sshd as root. - -Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> ---- - auth2-pubkey.c | 530 +++++++++++++++++++++++++++++++++++++++++++-------------- - servconf.c | 35 ++++ - servconf.h | 8 +- - ssh.c | 5 + - sshd.c | 5 + - sshd_config.5 | 54 +++++- - sshkey.c | 172 +++++++++++-------- - sshkey.h | 1 + - 8 files changed, 606 insertions(+), 204 deletions(-) - -diff --git a/auth2-pubkey.c b/auth2-pubkey.c -index d943efa..2ce0a4b 100644 ---- a/auth2-pubkey.c -+++ b/auth2-pubkey.c -@@ -65,6 +65,9 @@ - #include "monitor_wrap.h" - #include "authfile.h" - #include "match.h" -+#include "ssherr.h" -+#include "channels.h" /* XXX for session.h */ -+#include "session.h" /* XXX for child_set_env(); refactor? */ - - /* import */ - extern ServerOptions options; -@@ -248,6 +251,227 @@ pubkey_auth_info(Authctxt *authctxt, const Key *key, const char *fmt, ...) - free(extra); - } - -+/* -+ * Splits 's' into an argument vector. Handles quoted string and basic -+ * escape characters (\\, \", \'). Caller must free the argument vector -+ * and its members. -+ */ -+static int -+split_argv(const char *s, int *argcp, char ***argvp) -+{ -+ int r = SSH_ERR_INTERNAL_ERROR; -+ int argc = 0, quote, i, j; -+ char *arg, **argv = xcalloc(1, sizeof(*argv)); -+ -+ *argvp = NULL; -+ *argcp = 0; -+ -+ for (i = 0; s[i] != '\0'; i++) { -+ /* Skip leading whitespace */ -+ if (s[i] == ' ' || s[i] == '\t') -+ continue; -+ -+ /* Start of a token */ -+ quote = 0; -+ if (s[i] == '\\' && -+ (s[i + 1] == '\'' || s[i + 1] == '\"' || s[i + 1] == '\\')) -+ i++; -+ else if (s[i] == '\'' || s[i] == '"') -+ quote = s[i++]; -+ -+ argv = xrealloc(argv, (argc + 2), sizeof(*argv)); -+ arg = argv[argc++] = xcalloc(1, strlen(s + i) + 1); -+ argv[argc] = NULL; -+ -+ /* Copy the token in, removing escapes */ -+ for (j = 0; s[i] != '\0'; i++) { -+ if (s[i] == '\\') { -+ if (s[i + 1] == '\'' || -+ s[i + 1] == '\"' || -+ s[i + 1] == '\\') { -+ i++; /* Skip '\' */ -+ arg[j++] = s[i]; -+ } else { -+ /* Unrecognised escape */ -+ arg[j++] = s[i]; -+ } -+ } else if (quote == 0 && (s[i] == ' ' || s[i] == '\t')) -+ break; /* done */ -+ else if (quote != 0 && s[i] == quote) -+ break; /* done */ -+ else -+ arg[j++] = s[i]; -+ } -+ if (s[i] == '\0') { -+ if (quote != 0) { -+ /* Ran out of string looking for close quote */ -+ r = SSH_ERR_INVALID_FORMAT; -+ goto out; -+ } -+ break; -+ } -+ } -+ /* Success */ -+ *argcp = argc; -+ *argvp = argv; -+ argc = 0; -+ argv = NULL; -+ r = 0; -+ out: -+ if (argc != 0 && argv != NULL) { -+ for (i = 0; i < argc; i++) -+ free(argv[i]); -+ free(argv); -+ } -+ return r; -+} -+ -+/* -+ * Runs command in a subprocess. Returns pid on success and a FILE* to the -+ * subprocess' stdout or 0 on failure. -+ * NB. "command" is only used for logging. -+ */ -+static pid_t -+subprocess(const char *tag, struct passwd *pw, const char *command, -+ int ac, char **av, FILE **child) -+{ -+ FILE *f; -+ struct stat st; -+ int devnull, p[2], i; -+ pid_t pid; -+ char *cp, errmsg[512]; -+ u_int envsize; -+ char **child_env; -+ -+ *child = NULL; -+ -+ debug3("%s: %s command \"%s\" running as %s", __func__, -+ tag, command, pw->pw_name); -+ -+ /* Verify the path exists and is safe-ish to execute */ -+ if (*av[0] != '/') { -+ error("%s path is not absolute", tag); -+ return 0; -+ } -+ temporarily_use_uid(pw); -+ if (stat(av[0], &st) < 0) { -+ error("Could not stat %s \"%s\": %s", tag, -+ av[0], strerror(errno)); -+ restore_uid(); -+ return 0; -+ } -+ -+ /* -+ * Run the command; stderr is left in place, stdout is the -+ * authorized_keys output. -+ */ -+ if (pipe(p) != 0) { -+ error("%s: pipe: %s", tag, strerror(errno)); -+ restore_uid(); -+ return 0; -+ } -+ -+ /* -+ * Don't want to call this in the child, where it can fatal() and -+ * run cleanup_exit() code. -+ */ -+ restore_uid(); -+ -+ switch ((pid = fork())) { -+ case -1: /* error */ -+ error("%s: fork: %s", tag, strerror(errno)); -+ close(p[0]); -+ close(p[1]); -+ return 0; -+ case 0: /* child */ -+ /* Prepare a minimal environment for the child. */ -+ envsize = 5; -+ child_env = xcalloc(sizeof(*child_env), envsize); -+ child_set_env(&child_env, &envsize, "PATH", _PATH_STDPATH); -+ child_set_env(&child_env, &envsize, "USER", pw->pw_name); -+ child_set_env(&child_env, &envsize, "LOGNAME", pw->pw_name); -+ child_set_env(&child_env, &envsize, "HOME", pw->pw_dir); -+ if ((cp = getenv("LANG")) != NULL) -+ child_set_env(&child_env, &envsize, "LANG", cp); -+ -+ for (i = 0; i < NSIG; i++) -+ signal(i, SIG_DFL); -+ -+ if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) { -+ error("%s: open %s: %s", tag, _PATH_DEVNULL, -+ strerror(errno)); -+ _exit(1); -+ } -+ /* Keep stderr around a while longer to catch errors */ -+ if (dup2(devnull, STDIN_FILENO) == -1 || -+ dup2(p[1], STDOUT_FILENO) == -1) { -+ error("%s: dup2: %s", tag, strerror(errno)); -+ _exit(1); -+ } -+ closefrom(STDERR_FILENO + 1); -+ -+ /* Don't use permanently_set_uid() here to avoid fatal() */ -+ if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) { -+ error("%s: setresgid %u: %s", tag, (u_int)pw->pw_gid, -+ strerror(errno)); -+ _exit(1); -+ } -+ if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0) { -+ error("%s: setresuid %u: %s", tag, (u_int)pw->pw_uid, -+ strerror(errno)); -+ _exit(1); -+ } -+ /* stdin is pointed to /dev/null at this point */ -+ if (dup2(STDIN_FILENO, STDERR_FILENO) == -1) { -+ error("%s: dup2: %s", tag, strerror(errno)); -+ _exit(1); -+ } -+ -+ execve(av[0], av, child_env); -+ error("%s exec \"%s\": %s", tag, command, strerror(errno)); -+ _exit(127); -+ default: /* parent */ -+ break; -+ } -+ -+ close(p[1]); -+ if ((f = fdopen(p[0], "r")) == NULL) { -+ error("%s: fdopen: %s", tag, strerror(errno)); -+ close(p[0]); -+ /* Don't leave zombie child */ -+ kill(pid, SIGTERM); -+ while (waitpid(pid, NULL, 0) == -1 && errno == EINTR) -+ ; -+ return 0; -+ } -+ /* Success */ -+ debug3("%s: %s pid %ld", __func__, tag, (long)pid); -+ *child = f; -+ return pid; -+} -+ -+/* Returns 0 if pid exited cleanly, non-zero otherwise */ -+static int -+exited_cleanly(pid_t pid, const char *tag, const char *cmd) -+{ -+ int status; -+ -+ while (waitpid(pid, &status, 0) == -1) { -+ if (errno != EINTR) { -+ error("%s: waitpid: %s", tag, strerror(errno)); -+ return -1; -+ } -+ } -+ if (WIFSIGNALED(status)) { -+ error("%s %s exited on signal %d", tag, cmd, WTERMSIG(status)); -+ return -1; -+ } else if (WEXITSTATUS(status) != 0) { -+ error("%s %s failed, status %d", tag, cmd, WEXITSTATUS(status)); -+ return -1; -+ } -+ return 0; -+} -+ - static int - match_principals_option(const char *principal_list, struct sshkey_cert *cert) - { -@@ -269,19 +493,13 @@ match_principals_option(const char *principal_list, struct sshkey_cert *cert) - } - - static int --match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert) -+process_principals(FILE *f, char *file, struct passwd *pw, -+ struct sshkey_cert *cert) - { -- FILE *f; - char line[SSH_MAX_PUBKEY_BYTES], *cp, *ep, *line_opts; - u_long linenum = 0; - u_int i; - -- temporarily_use_uid(pw); -- debug("trying authorized principals file %s", file); -- if ((f = auth_openprincipals(file, pw, options.strict_modes)) == NULL) { -- restore_uid(); -- return 0; -- } - while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { - /* Skip leading whitespace. */ - for (cp = line; *cp == ' ' || *cp == '\t'; cp++) -@@ -309,24 +527,119 @@ match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert) - } - for (i = 0; i < cert->nprincipals; i++) { - if (strcmp(cp, cert->principals[i]) == 0) { -- debug3("matched principal \"%.100s\" " -- "from file \"%s\" on line %lu", -- cert->principals[i], file, linenum); -+ debug3("%s:%lu: matched principal \"%.100s\"", -+ file == NULL ? "(command)" : file, -+ linenum, cert->principals[i]); - if (auth_parse_options(pw, line_opts, - file, linenum) != 1) - continue; -- fclose(f); -- restore_uid(); - return 1; - } - } - } -+ return 0; -+} -+ -+static int -+match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert) -+{ -+ FILE *f; -+ int success; -+ -+ temporarily_use_uid(pw); -+ debug("trying authorized principals file %s", file); -+ if ((f = auth_openprincipals(file, pw, options.strict_modes)) == NULL) { -+ restore_uid(); -+ return 0; -+ } -+ success = process_principals(f, file, pw, cert); - fclose(f); - restore_uid(); -- return 0; -+ return success; - } - - /* -+ * Checks whether principal is allowed in output of command. -+ * returns 1 if the principal is allowed or 0 otherwise. -+ */ -+static int -+match_principals_command(struct passwd *user_pw, struct sshkey *key) -+{ -+ FILE *f = NULL; -+ int ok, found_principal = 0; -+ struct passwd *pw; -+ int i, ac = 0, uid_swapped = 0; -+ pid_t pid; -+ char *username = NULL, *command = NULL, **av = NULL; -+ void (*osigchld)(int); -+ -+ if (options.authorized_principals_command == NULL) -+ return 0; -+ if (options.authorized_principals_command_user == NULL) { -+ error("No user for AuthorizedPrincipalsCommand specified, " -+ "skipping"); -+ return 0; -+ } -+ -+ /* -+ * NB. all returns later this function should go via "out" to -+ * ensure the original SIGCHLD handler is restored properly. -+ */ -+ osigchld = signal(SIGCHLD, SIG_DFL); -+ -+ /* Prepare and verify the user for the command */ -+ username = percent_expand(options.authorized_principals_command_user, -+ "u", user_pw->pw_name, (char *)NULL); -+ pw = getpwnam(username); -+ if (pw == NULL) { -+ error("AuthorizedPrincipalsCommandUser \"%s\" not found: %s", -+ username, strerror(errno)); -+ goto out; -+ } -+ -+ command = percent_expand(options.authorized_principals_command, -+ "u", user_pw->pw_name, "h", user_pw->pw_dir, (char *)NULL); -+ -+ /* Turn the command into an argument vector */ -+ if (split_argv(command, &ac, &av) != 0) { -+ error("AuthorizedPrincipalsCommand \"%s\" contains " -+ "invalid quotes", command); -+ goto out; -+ } -+ if (ac == 0) { -+ error("AuthorizedPrincipalsCommand \"%s\" yielded no arguments", -+ command); -+ goto out; -+ } -+ -+ if ((pid = subprocess("AuthorizedPrincipalsCommand", pw, command, -+ ac, av, &f)) == 0) -+ goto out; -+ -+ uid_swapped = 1; -+ temporarily_use_uid(pw); -+ -+ ok = process_principals(f, NULL, pw, key->cert); -+ -+ if (exited_cleanly(pid, "AuthorizedPrincipalsCommand", command)) -+ goto out; -+ -+ /* Read completed successfully */ -+ found_principal = ok; -+ out: -+ if (f != NULL) -+ fclose(f); -+ signal(SIGCHLD, osigchld); -+ for (i = 0; i < ac; i++) -+ free(av[i]); -+ free(av); -+ if (uid_swapped) -+ restore_uid(); -+ free(command); -+ free(username); -+ return found_principal; -+} -+/* - * Checks whether key is allowed in authorized_keys-format file, - * returns 1 if the key is allowed or 0 otherwise. - */ -@@ -448,7 +761,7 @@ user_cert_trusted_ca(struct passwd *pw, Key *key) - { - char *ca_fp, *principals_file = NULL; - const char *reason; -- int ret = 0; -+ int ret = 0, found_principal = 0; - - if (!key_is_cert(key) || options.trusted_user_ca_keys == NULL) - return 0; -@@ -470,14 +783,20 @@ user_cert_trusted_ca(struct passwd *pw, Key *key) - * against the username. - */ - if ((principals_file = authorized_principals_file(pw)) != NULL) { -- if (!match_principals_file(principals_file, pw, key->cert)) { -- reason = "Certificate does not contain an " -- "authorized principal"; -+ if (match_principals_file(principals_file, pw, key->cert)) -+ found_principal = 1; -+ } -+ /* Try querying command if specified */ -+ if (!found_principal && match_principals_command(pw, key)) -+ found_principal = 1; -+ /* If principals file or command specify, then require a match here */ -+ if (!found_principal && (principals_file != NULL || -+ options.authorized_principals_command != NULL)) { -+ reason = "Certificate does not contain an authorized principal"; - fail_reason: -- error("%s", reason); -- auth_debug_add("%s", reason); -- goto out; -- } -+ error("%s", reason); -+ auth_debug_add("%s", reason); -+ goto out; - } - if (key_cert_check_authority(key, 0, 1, - principals_file == NULL ? pw->pw_name : NULL, &reason) != 0) -@@ -526,144 +845,105 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file) - static int - user_key_command_allowed2(struct passwd *user_pw, Key *key) - { -- FILE *f; -- int ok, found_key = 0; -+ FILE *f = NULL; -+ int r, ok, found_key = 0; - struct passwd *pw; -- struct stat st; -- int status, devnull, p[2], i; -+ int i, uid_swapped = 0, ac = 0; - pid_t pid; -- char *username, errmsg[512]; -+ char *username = NULL, *key_fp = NULL, *keytext = NULL; -+ char *command = NULL, **av = NULL; -+ void (*osigchld)(int); - -- if (options.authorized_keys_command == NULL || -- options.authorized_keys_command[0] != '/') -+ if (options.authorized_keys_command == NULL) - return 0; -- - if (options.authorized_keys_command_user == NULL) { - error("No user for AuthorizedKeysCommand specified, skipping"); - return 0; - } - -+ /* -+ * NB. all returns later this function should go via "out" to -+ * ensure the original SIGCHLD handler is restored properly. -+ */ -+ osigchld = signal(SIGCHLD, SIG_DFL); -+ -+ /* Prepare and verify the user for the command */ - username = percent_expand(options.authorized_keys_command_user, - "u", user_pw->pw_name, (char *)NULL); - pw = getpwnam(username); - if (pw == NULL) { - error("AuthorizedKeysCommandUser \"%s\" not found: %s", - username, strerror(errno)); -- free(username); -- return 0; -+ goto out; - } -- free(username); -- -- temporarily_use_uid(pw); - -- if (stat(options.authorized_keys_command, &st) < 0) { -- error("Could not stat AuthorizedKeysCommand \"%s\": %s", -- options.authorized_keys_command, strerror(errno)); -+ /* Prepare AuthorizedKeysCommand */ -+ if ((key_fp = sshkey_fingerprint(key, options.fingerprint_hash, -+ SSH_FP_DEFAULT)) == NULL) { -+ error("%s: sshkey_fingerprint failed", __func__); - goto out; - } -- if (auth_secure_path(options.authorized_keys_command, &st, NULL, 0, -- errmsg, sizeof(errmsg)) != 0) { -- error("Unsafe AuthorizedKeysCommand: %s", errmsg); -+ if ((r = sshkey_to_base64(key, &keytext)) != 0) { -+ error("%s: sshkey_to_base64 failed: %s", __func__, ssh_err(r)); - goto out; - } -- -- if (pipe(p) != 0) { -- error("%s: pipe: %s", __func__, strerror(errno)); -+ command = percent_expand(options.authorized_keys_command, -+ "u", user_pw->pw_name, "h", user_pw->pw_dir, -+ "t", sshkey_ssh_name(key), "f", key_fp, "k", keytext, (char *)NULL); -+ -+ /* Turn the command into an argument vector */ -+ if (split_argv(command, &ac, &av) != 0) { -+ error("AuthorizedKeysCommand \"%s\" contains invalid quotes", -+ command); -+ goto out; -+ } -+ if (ac == 0) { -+ error("AuthorizedKeysCommand \"%s\" yielded no arguments", -+ command); - goto out; - } -- -- debug3("Running AuthorizedKeysCommand: \"%s %s\" as \"%s\"", -- options.authorized_keys_command, user_pw->pw_name, pw->pw_name); - - /* -- * Don't want to call this in the child, where it can fatal() and -- * run cleanup_exit() code. -+ * If AuthorizedKeysCommand was run without arguments -+ * then fall back to the old behaviour of passing the -+ * target username as a single argument. - */ -- restore_uid(); -- -- switch ((pid = fork())) { -- case -1: /* error */ -- error("%s: fork: %s", __func__, strerror(errno)); -- close(p[0]); -- close(p[1]); -- return 0; -- case 0: /* child */ -- for (i = 0; i < NSIG; i++) -- signal(i, SIG_DFL); -- -- if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) { -- error("%s: open %s: %s", __func__, _PATH_DEVNULL, -- strerror(errno)); -- _exit(1); -- } -- /* Keep stderr around a while longer to catch errors */ -- if (dup2(devnull, STDIN_FILENO) == -1 || -- dup2(p[1], STDOUT_FILENO) == -1) { -- error("%s: dup2: %s", __func__, strerror(errno)); -- _exit(1); -- } -- closefrom(STDERR_FILENO + 1); -- -- /* Don't use permanently_set_uid() here to avoid fatal() */ -- if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) { -- error("setresgid %u: %s", (u_int)pw->pw_gid, -- strerror(errno)); -- _exit(1); -- } -- if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0) { -- error("setresuid %u: %s", (u_int)pw->pw_uid, -- strerror(errno)); -- _exit(1); -- } -- /* stdin is pointed to /dev/null at this point */ -- if (dup2(STDIN_FILENO, STDERR_FILENO) == -1) { -- error("%s: dup2: %s", __func__, strerror(errno)); -- _exit(1); -- } -- -- execl(options.authorized_keys_command, -- options.authorized_keys_command, user_pw->pw_name, NULL); -- -- error("AuthorizedKeysCommand %s exec failed: %s", -- options.authorized_keys_command, strerror(errno)); -- _exit(127); -- default: /* parent */ -- break; -+ if (ac == 1) { -+ av = xrealloc(av, ac + 2, sizeof(*av)); -+ av[1] = xstrdup(user_pw->pw_name); -+ av[2] = NULL; -+ /* Fix up command too, since it is used in log messages */ -+ free(command); -+ xasprintf(&command, "%s %s", av[0], av[1]); - } - -+ if ((pid = subprocess("AuthorizedKeysCommand", pw, command, -+ ac, av, &f)) == 0) -+ goto out; -+ -+ uid_swapped = 1; - temporarily_use_uid(pw); - -- close(p[1]); -- if ((f = fdopen(p[0], "r")) == NULL) { -- error("%s: fdopen: %s", __func__, strerror(errno)); -- close(p[0]); -- /* Don't leave zombie child */ -- kill(pid, SIGTERM); -- while (waitpid(pid, NULL, 0) == -1 && errno == EINTR) -- ; -- goto out; -- } - ok = check_authkeys_file(f, options.authorized_keys_command, key, pw); -- fclose(f); - -- while (waitpid(pid, &status, 0) == -1) { -- if (errno != EINTR) { -- error("%s: waitpid: %s", __func__, strerror(errno)); -- goto out; -- } -- } -- if (WIFSIGNALED(status)) { -- error("AuthorizedKeysCommand %s exited on signal %d", -- options.authorized_keys_command, WTERMSIG(status)); -+ if (exited_cleanly(pid, "AuthorizedKeysCommand", command)) - goto out; -- } else if (WEXITSTATUS(status) != 0) { -- error("AuthorizedKeysCommand %s returned status %d", -- options.authorized_keys_command, WEXITSTATUS(status)); -- goto out; -- } -+ -+ /* Read completed successfully */ - found_key = ok; - out: -- restore_uid(); -+ if (f != NULL) -+ fclose(f); -+ signal(SIGCHLD, osigchld); -+ for (i = 0; i < ac; i++) -+ free(av[i]); -+ free(av); -+ if (uid_swapped) -+ restore_uid(); -+ free(command); -+ free(username); -+ free(key_fp); -+ free(keytext); - return found_key; - } - -diff --git a/servconf.c b/servconf.c -index 3185462..510cdde 100644 ---- a/servconf.c -+++ b/servconf.c -@@ -159,6 +159,8 @@ initialize_server_options(ServerOptions *options) - options->revoked_keys_file = NULL; - options->trusted_user_ca_keys = NULL; - options->authorized_principals_file = NULL; -+ options->authorized_principals_command = NULL; -+ options->authorized_principals_command_user = NULL; - options->ip_qos_interactive = -1; - options->ip_qos_bulk = -1; - options->version_addendum = NULL; -@@ -396,6 +398,7 @@ typedef enum { - sUsePrivilegeSeparation, sAllowAgentForwarding, - sHostCertificate, - sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile, -+ sAuthorizedPrincipalsCommand, sAuthorizedPrincipalsCommandUser, - sKexAlgorithms, sIPQoS, sVersionAddendum, - sAuthorizedKeysCommand, sAuthorizedKeysCommandUser, - sAuthenticationMethods, sHostKeyAgent, sPermitUserRC, -@@ -528,6 +531,8 @@ static struct { - { "ipqos", sIPQoS, SSHCFG_ALL }, - { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL }, - { "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL }, -+ { "authorizedprincipalscommand", sAuthorizedPrincipalsCommand, SSHCFG_ALL }, -+ { "authorizedprincipalscommanduser", sAuthorizedPrincipalsCommandUser, SSHCFG_ALL }, - { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL }, - { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL }, - { "streamlocalbindmask", sStreamLocalBindMask, SSHCFG_ALL }, -@@ -1697,6 +1702,34 @@ process_server_config_line(ServerOptions *options, char *line, - *charptr = xstrdup(arg); - break; - -+ case sAuthorizedPrincipalsCommand: -+ if (cp == NULL) -+ fatal("%.200s line %d: Missing argument.", filename, -+ linenum); -+ len = strspn(cp, WHITESPACE); -+ if (*activep && -+ options->authorized_principals_command == NULL) { -+ if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0) -+ fatal("%.200s line %d: " -+ "AuthorizedPrincipalsCommand must be " -+ "an absolute path", filename, linenum); -+ options->authorized_principals_command = -+ xstrdup(cp + len); -+ } -+ return 0; -+ -+ case sAuthorizedPrincipalsCommandUser: -+ charptr = &options->authorized_principals_command_user; -+ -+ arg = strdelim(&cp); -+ if (!arg || *arg == '\0') -+ fatal("%s line %d: missing " -+ "AuthorizedPrincipalsCommandUser argument.", -+ filename, linenum); -+ if (*activep && *charptr == NULL) -+ *charptr = xstrdup(arg); -+ break; -+ - case sAuthenticationMethods: - if (*activep && options->num_auth_methods == 0) { - while ((arg = strdelim(&cp)) && *arg != '\0') { -@@ -2166,6 +2199,8 @@ dump_config(ServerOptions *o) - dump_cfg_string(sVersionAddendum, o->version_addendum); - dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command); - dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user); -+ dump_cfg_string(sAuthorizedPrincipalsCommand, o->authorized_principals_command); -+ dump_cfg_string(sAuthorizedPrincipalsCommandUser, o->authorized_principals_command_user); - dump_cfg_string(sHostKeyAgent, o->host_key_agent); - dump_cfg_string(sKexAlgorithms, - o->kex_algorithms ? o->kex_algorithms : KEX_SERVER_KEX); -diff --git a/servconf.h b/servconf.h -index 9922f0c..35d6673 100644 ---- a/servconf.h -+++ b/servconf.h -@@ -176,9 +176,11 @@ typedef struct { - char *chroot_directory; - char *revoked_keys_file; - char *trusted_user_ca_keys; -- char *authorized_principals_file; - char *authorized_keys_command; - char *authorized_keys_command_user; -+ char *authorized_principals_file; -+ char *authorized_principals_command; -+ char *authorized_principals_command_user; - - int64_t rekey_limit; - int rekey_interval; -@@ -214,9 +216,11 @@ struct connection_info { - M_CP_STROPT(banner); \ - M_CP_STROPT(trusted_user_ca_keys); \ - M_CP_STROPT(revoked_keys_file); \ -- M_CP_STROPT(authorized_principals_file); \ - M_CP_STROPT(authorized_keys_command); \ - M_CP_STROPT(authorized_keys_command_user); \ -+ M_CP_STROPT(authorized_principals_file); \ -+ M_CP_STROPT(authorized_principals_command); \ -+ M_CP_STROPT(authorized_principals_command_user); \ - M_CP_STROPT(hostbased_key_types); \ - M_CP_STROPT(pubkey_key_types); \ - M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \ -diff --git a/ssh.c b/ssh.c -index 0ad82f0..abf4e54 100644 ---- a/ssh.c -+++ b/ssh.c -@@ -548,6 +548,11 @@ main(int ac, char **av) - original_real_uid = getuid(); - original_effective_uid = geteuid(); - -+ if (original_effective_uid == 0) { -+ fprintf(stderr, "this is a patched version of the sshd that must not be run as root.\n"); -+ exit(1); -+ } -+ - /* - * Use uid-swapping to give up root privileges for the duration of - * option processing. We will re-instantiate the rights when we are -diff --git a/sshd.c b/sshd.c -index 6aa17fa..672c486 100644 ---- a/sshd.c -+++ b/sshd.c -@@ -1694,6 +1694,11 @@ main(int ac, char **av) - strcasecmp(options.authorized_keys_command, "none") != 0)) - fatal("AuthorizedKeysCommand set without " - "AuthorizedKeysCommandUser"); -+ if (options.authorized_principals_command_user == NULL && -+ (options.authorized_principals_command != NULL && -+ strcasecmp(options.authorized_principals_command, "none") != 0)) -+ fatal("AuthorizedPrincipalsCommand set without " -+ "AuthorizedPrincipalsCommandUser"); - - /* - * Check whether there is any path through configured auth methods. -diff --git a/sshd_config.5 b/sshd_config.5 -index 6dce0c7..a267af9 100644 ---- a/sshd_config.5 -+++ b/sshd_config.5 -@@ -230,9 +230,21 @@ The default is not to require multiple authentication; successful completion - of a single authentication method is sufficient. - .It Cm AuthorizedKeysCommand - Specifies a program to be used to look up the user's public keys. --The program must be owned by root and not writable by group or others. --It will be invoked with a single argument of the username --being authenticated, and should produce on standard output zero or -+The program must be owned by root, not writable by group or others and -+specified by an absolute path. -+.Pp -+Arguments to -+.Cm AuthorizedKeysCommand -+may be provided using the following tokens, which will be expanded -+at runtime: %% is replaced by a literal '%', %u is replaced by the -+username being authenticated, %h is replaced by the home directory -+of the user being authenticated, %t is replaced with the key type -+offered for authentication, %f is replaced with the fingerprint of -+the key, and %k is replaced with the key being offered for authentication. -+If no arguments are specified then the username of the target user -+will be supplied. -+.Pp -+The program should produce on standard output zero or - more lines of authorized_keys output (see AUTHORIZED_KEYS in - .Xr sshd 8 ) . - If a key supplied by AuthorizedKeysCommand does not successfully authenticate -@@ -271,6 +283,42 @@ directory. - Multiple files may be listed, separated by whitespace. - The default is - .Dq .ssh/authorized_keys .ssh/authorized_keys2 . -+.It Cm AuthorizedPrincipalsCommand -+Specifies a program to be used to generate the list of allowed -+certificate principals as per -+.Cm AuthorizedPrincipalsFile . -+The program must be owned by root, not writable by group or others and -+specified by an absolute path. -+.Pp -+Arguments to -+.Cm AuthorizedPrincipalsCommand -+may be provided using the following tokens, which will be expanded -+at runtime: %% is replaced by a literal '%', %u is replaced by the -+username being authenticated and %h is replaced by the home directory -+of the user being authenticated. -+.Pp -+The program should produce on standard output zero or -+more lines of -+.Cm AuthorizedPrincipalsFile -+output. -+If either -+.Cm AuthorizedPrincipalsCommand -+or -+.Cm AuthorizedPrincipalsFile -+is specified, then certificates offered by the client for authentication -+must contain a principal that is listed. -+By default, no AuthorizedPrincipalsCommand is run. -+.It Cm AuthorizedPrincipalsCommandUser -+Specifies the user under whose account the AuthorizedPrincipalsCommand is run. -+It is recommended to use a dedicated user that has no other role on the host -+than running authorized principals commands. -+If -+.Cm AuthorizedPrincipalsCommand -+is specified but -+.Cm AuthorizedPrincipalsCommandUser -+is not, then -+.Xr sshd 8 -+will refuse to start. - .It Cm AuthorizedPrincipalsFile - Specifies a file that lists principal names that are accepted for - certificate authentication. -diff --git a/sshkey.c b/sshkey.c -index 3cc3f44..ecb61fd 100644 ---- a/sshkey.c -+++ b/sshkey.c -@@ -761,6 +761,12 @@ to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain) - if (key == NULL) - return SSH_ERR_INVALID_ARGUMENT; - -+ if (sshkey_is_cert(key)) { -+ if (key->cert == NULL) -+ return SSH_ERR_EXPECTED_CERT; -+ if (sshbuf_len(key->cert->certblob) == 0) -+ return SSH_ERR_KEY_LACKS_CERTBLOB; -+ } - type = force_plain ? sshkey_type_plain(key->type) : key->type; - typename = sshkey_ssh_name_from_type_nid(type, key->ecdsa_nid); - -@@ -1409,98 +1415,116 @@ sshkey_read(struct sshkey *ret, char **cpp) - } - - int --sshkey_write(const struct sshkey *key, FILE *f) -+sshkey_to_base64(const struct sshkey *key, char **b64p) - { -- int ret = SSH_ERR_INTERNAL_ERROR; -- struct sshbuf *b = NULL, *bb = NULL; -+ int r = SSH_ERR_INTERNAL_ERROR; -+ struct sshbuf *b = NULL; - char *uu = NULL; -+ -+ if (b64p != NULL) -+ *b64p = NULL; -+ if ((b = sshbuf_new()) == NULL) -+ return SSH_ERR_ALLOC_FAIL; -+ if ((r = sshkey_putb(key, b)) != 0) -+ goto out; -+ if ((uu = sshbuf_dtob64(b)) == NULL) { -+ r = SSH_ERR_ALLOC_FAIL; -+ goto out; -+ } -+ /* Success */ -+ if (b64p != NULL) { -+ *b64p = uu; -+ uu = NULL; -+ } -+ r = 0; -+ out: -+ sshbuf_free(b); -+ free(uu); -+ return r; -+} -+ -+static int -+sshkey_format_rsa1(const struct sshkey *key, struct sshbuf *b) -+{ -+ int r = SSH_ERR_INTERNAL_ERROR; - #ifdef WITH_SSH1 - u_int bits = 0; - char *dec_e = NULL, *dec_n = NULL; --#endif /* WITH_SSH1 */ - -- if (sshkey_is_cert(key)) { -- if (key->cert == NULL) -- return SSH_ERR_EXPECTED_CERT; -- if (sshbuf_len(key->cert->certblob) == 0) -- return SSH_ERR_KEY_LACKS_CERTBLOB; -+ if (key->rsa == NULL || key->rsa->e == NULL || -+ key->rsa->n == NULL) { -+ r = SSH_ERR_INVALID_ARGUMENT; -+ goto out; - } -- if ((b = sshbuf_new()) == NULL) -- return SSH_ERR_ALLOC_FAIL; -- switch (key->type) { --#ifdef WITH_SSH1 -- case KEY_RSA1: -- if (key->rsa == NULL || key->rsa->e == NULL || -- key->rsa->n == NULL) { -- ret = SSH_ERR_INVALID_ARGUMENT; -- goto out; -- } -- if ((dec_e = BN_bn2dec(key->rsa->e)) == NULL || -- (dec_n = BN_bn2dec(key->rsa->n)) == NULL) { -- ret = SSH_ERR_ALLOC_FAIL; -- goto out; -- } -- /* size of modulus 'n' */ -- if ((bits = BN_num_bits(key->rsa->n)) <= 0) { -- ret = SSH_ERR_INVALID_ARGUMENT; -- goto out; -- } -- if ((ret = sshbuf_putf(b, "%u %s %s", bits, dec_e, dec_n)) != 0) -- goto out; -+ if ((dec_e = BN_bn2dec(key->rsa->e)) == NULL || -+ (dec_n = BN_bn2dec(key->rsa->n)) == NULL) { -+ r = SSH_ERR_ALLOC_FAIL; -+ goto out; -+ } -+ /* size of modulus 'n' */ -+ if ((bits = BN_num_bits(key->rsa->n)) <= 0) { -+ r = SSH_ERR_INVALID_ARGUMENT; -+ goto out; -+ } -+ if ((r = sshbuf_putf(b, "%u %s %s", bits, dec_e, dec_n)) != 0) -+ goto out; -+ -+ /* Success */ -+ r = 0; -+ out: -+ if (dec_e != NULL) -+ OPENSSL_free(dec_e); -+ if (dec_n != NULL) -+ OPENSSL_free(dec_n); - #endif /* WITH_SSH1 */ -- break; --#ifdef WITH_OPENSSL -- case KEY_DSA: -- case KEY_DSA_CERT_V00: -- case KEY_DSA_CERT: -- case KEY_ECDSA: -- case KEY_ECDSA_CERT: -- case KEY_RSA: -- case KEY_RSA_CERT_V00: -- case KEY_RSA_CERT: --#endif /* WITH_OPENSSL */ -- case KEY_ED25519: -- case KEY_ED25519_CERT: -- if ((bb = sshbuf_new()) == NULL) { -- ret = SSH_ERR_ALLOC_FAIL; -- goto out; -- } -- if ((ret = sshkey_putb(key, bb)) != 0) -- goto out; -- if ((uu = sshbuf_dtob64(bb)) == NULL) { -- ret = SSH_ERR_ALLOC_FAIL; -+ -+ return r; -+} -+ -+static int -+sshkey_format_text(const struct sshkey *key, struct sshbuf *b) -+{ -+ int r = SSH_ERR_INTERNAL_ERROR; -+ char *uu = NULL; -+ -+ if (key->type == KEY_RSA1) { -+ if ((r = sshkey_format_rsa1(key, b)) != 0) - goto out; -- } -- if ((ret = sshbuf_putf(b, "%s ", sshkey_ssh_name(key))) != 0) -+ } else { -+ /* Unsupported key types handled in sshkey_to_base64() */ -+ if ((r = sshkey_to_base64(key, &uu)) != 0) - goto out; -- if ((ret = sshbuf_put(b, uu, strlen(uu))) != 0) -+ if ((r = sshbuf_putf(b, "%s %s", -+ sshkey_ssh_name(key), uu)) != 0) - goto out; -- break; -- default: -- ret = SSH_ERR_KEY_TYPE_UNKNOWN; -- goto out; - } -+ r = 0; -+ out: -+ free(uu); -+ return r; -+} -+ -+int -+sshkey_write(const struct sshkey *key, FILE *f) -+{ -+ struct sshbuf *b = NULL; -+ int r = SSH_ERR_INTERNAL_ERROR; -+ -+ if ((b = sshbuf_new()) == NULL) -+ return SSH_ERR_ALLOC_FAIL; -+ if ((r = sshkey_format_text(key, b)) != 0) -+ goto out; - if (fwrite(sshbuf_ptr(b), sshbuf_len(b), 1, f) != 1) { - if (feof(f)) - errno = EPIPE; -- ret = SSH_ERR_SYSTEM_ERROR; -+ r = SSH_ERR_SYSTEM_ERROR; - goto out; - } -- ret = 0; -+ /* Success */ -+ r = 0; - out: -- if (b != NULL) -- sshbuf_free(b); -- if (bb != NULL) -- sshbuf_free(bb); -- if (uu != NULL) -- free(uu); --#ifdef WITH_SSH1 -- if (dec_e != NULL) -- OPENSSL_free(dec_e); -- if (dec_n != NULL) -- OPENSSL_free(dec_n); --#endif /* WITH_SSH1 */ -- return ret; -+ sshbuf_free(b); -+ return r; - } - - const char * -diff --git a/sshkey.h b/sshkey.h -index 62c1c3e..98f1ca9 100644 ---- a/sshkey.h -+++ b/sshkey.h -@@ -163,6 +163,7 @@ int sshkey_from_blob(const u_char *, size_t, struct sshkey **); - int sshkey_fromb(struct sshbuf *, struct sshkey **); - int sshkey_froms(struct sshbuf *, struct sshkey **); - int sshkey_to_blob(const struct sshkey *, u_char **, size_t *); -+int sshkey_to_base64(const struct sshkey *, char **); - int sshkey_putb(const struct sshkey *, struct sshbuf *); - int sshkey_puts(const struct sshkey *, struct sshbuf *); - int sshkey_plain_to_blob(const struct sshkey *, u_char **, size_t *); --- -2.3.5 - -- 2.4.1

1 1

[aur-dev] [PATCH] Fix email body of password reset emails
by Lukas Fleischer 17 May '15

17 May '15

When the password reset function was factored out in 5d31bb2 (Move reset key submission to a separate function, 2013-03-19), a semicolon was accidentally replaced by a concatenation operator. As a result of this, all password reset emails sent since mid-2013 only contained a password reset link without any description. Fix this by terminating the assignment with a semicolon again. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/passreset.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/html/passreset.php b/web/html/passreset.php index fecefe4..d1b57a4 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -49,7 +49,7 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir $body = __('A password reset request was submitted for the account '. 'associated with your e-mail address. If you wish to reset '. 'your password follow the link below, otherwise ignore '. - 'this message and nothing will happen.'). + 'this message and nothing will happen.'); send_resetkey($email, $subject, $body); header('Location: ' . get_uri('/passreset/') . '?step=confirm'); -- 2.4.1

1 0