- stevesk@cvs.openbsd.org 2002/02/28 19:36:28

     [auth.c match.c match.h]
     delay hostname lookup until we see a ``@'' in DenyUsers and AllowUsers
     for sshd -u0; ok markus@

diff --git a/ChangeLog b/ChangeLog
index 68112ac2d8ab43bbe39b3e44d509dd4be2edba14..d1a69532fcd26597570ab905daaff8037adc1190 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -20,6 +20,10 @@
    - markus@cvs.openbsd.org 2002/02/28 15:46:33
      [authfile.c kex.c kexdh.c kexgex.c key.c ssh-dss.c]
      add some const EVP_MD for openssl-0.9.7
+   - stevesk@cvs.openbsd.org 2002/02/28 19:36:28
+     [auth.c match.c match.h]
+     delay hostname lookup until we see a ``@'' in DenyUsers and AllowUsers
+     for sshd -u0; ok markus@
 
 20020226
  - (tim) Bug 12 [configure.ac] add sys/bitypes.h to int64_t tests

diff --git a/auth.c b/auth.c
index efa7ee28bbdae5b7e2d3c2d4114426be3bbcd891..eae6a7bdf2dfb4cbeeb717d7114de03baf33265b 100644 (file)
--- a/auth.c
+++ b/auth.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth.c,v 1.32 2002/01/29 14:32:03 markus Exp $");
+RCSID("$OpenBSD: auth.c,v 1.33 2002/02/28 19:36:28 stevesk Exp $");
 
 #ifdef HAVE_LOGIN_H
 #include <login.h>
@@ -65,7 +65,6 @@ int
 allowed_user(struct passwd * pw)
 {
        struct stat st;
-       const char *hostname = NULL, *ipaddr = NULL;
        char *shell;
        int i;
 #ifdef WITH_AIXAUTHENTICATE
@@ -110,22 +109,17 @@ allowed_user(struct passwd * pw)
        if (!((st.st_mode & S_IFREG) && (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP))))
                return 0;
 
-       if (options.num_deny_users > 0 || options.num_allow_users > 0) {
-               hostname = get_canonical_hostname(options.verify_reverse_mapping);
-               ipaddr = get_remote_ipaddr();
-       }
-
        /* Return false if user is listed in DenyUsers */
        if (options.num_deny_users > 0) {
                for (i = 0; i < options.num_deny_users; i++)
-                       if (match_user(pw->pw_name, hostname, ipaddr,
+                       if (match_user(pw->pw_name, options.verify_reverse_mapping,
                            options.deny_users[i]))
                                return 0;
        }
        /* Return false if AllowUsers isn't empty and user isn't listed there */
        if (options.num_allow_users > 0) {
                for (i = 0; i < options.num_allow_users; i++)
-                       if (match_user(pw->pw_name, hostname, ipaddr,
+                       if (match_user(pw->pw_name, options.verify_reverse_mapping,
                            options.allow_users[i]))
                                break;
                /* i < options.num_allow_users iff we break for loop */

diff --git a/match.c b/match.c
index c82c28a8b91043de8e4fee760099baee35516506..e73ed2aa2e81617d8fdfc468b3ff40384f035be8 100644 (file)
--- a/match.c
+++ b/match.c
@@ -35,9 +35,10 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: match.c,v 1.17 2002/02/11 16:21:42 markus Exp $");
+RCSID("$OpenBSD: match.c,v 1.18 2002/02/28 19:36:28 stevesk Exp $");
 
 #include "match.h"
+#include "canohost.h"
 #include "xmalloc.h"
 
 /*
@@ -202,7 +203,7 @@ match_host_and_ip(const char *host, const char *ipaddr,
  * match user, user@host_or_ip, user@host_or_ip_list against pattern
  */
 int
-match_user(const char *user, const char *host, const char *ipaddr,
+match_user(const char *user, int verify_reverse_mapping,
     const char *pattern)
 {
        char *p, *pat;
@@ -216,7 +217,9 @@ match_user(const char *user, const char *host, const char *ipaddr,
        *p++ = '\0';
 
        if ((ret = match_pattern(user, pat)) == 1)
-               ret = match_host_and_ip(host, ipaddr, p);
+               ret = match_host_and_ip(
+                   get_canonical_hostname(verify_reverse_mapping),
+                   get_remote_ipaddr(), p);
        xfree(pat);
 
        return ret;

diff --git a/match.h b/match.h
index 7b777de3d0489167e790f79f5f3627dd170a5ab2..a5e85a9d872869fc36cf0ed8c61cd0d9101f72a2 100644 (file)
--- a/match.h
+++ b/match.h
@@ -1,4 +1,4 @@
-/*     $OpenBSD: match.h,v 1.10 2001/12/05 16:54:51 markus Exp $       */
+/*     $OpenBSD: match.h,v 1.11 2002/02/28 19:36:28 stevesk Exp $      */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -18,7 +18,7 @@ int    match_pattern(const char *, const char *);
 int     match_pattern_list(const char *, const char *, u_int, int);
 int     match_hostname(const char *, const char *, u_int);
 int     match_host_and_ip(const char *, const char *, const char *);
-int     match_user(const char *, const char *, const char *, const char *);
+int     match_user(const char *, int, const char *);
 char   *match_list(const char *, const char *, u_int *);
 
 #endif