- djm@cvs.openbsd.org 2008/07/04 03:44:59

     [servconf.c groupaccess.h groupaccess.c]
     support negation of groups in "Match group" block (bz#1315); ok dtucker@

diff --git a/ChangeLog b/ChangeLog
index ce004fee6160293dacdf22cf3b63ea9de2ebd18b..c73e0b825921f5b510f3dad5e2d19ae805dd1a82 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,6 +12,9 @@
    - otto@cvs.openbsd.org 2008/07/03 21:46:58
      [auth2-pubkey.c]
      avoid nasty double free; ok dtucker@ djm@
+   - djm@cvs.openbsd.org 2008/07/04 03:44:59
+     [servconf.c groupaccess.h groupaccess.c]
+     support negation of groups in "Match group" block (bz#1315); ok dtucker@
 
 20080702
  - (dtucker) OpenBSD CVS Sync

diff --git a/groupaccess.c b/groupaccess.c
index e73f62b22fdf29bfa6ac29a54f7abc8aef5d87cf..2381aeb15b57edf4deefacd0084ba5697a522149 100644 (file)
--- a/groupaccess.c
+++ b/groupaccess.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: groupaccess.c,v 1.12 2006/08/03 03:34:42 deraadt Exp $ */
+/* $OpenBSD: groupaccess.c,v 1.13 2008/07/04 03:44:59 djm Exp $ */
 /*
  * Copyright (c) 2001 Kevin Steves.  All rights reserved.
  *
@@ -31,6 +31,7 @@
 #include <grp.h>
 #include <unistd.h>
 #include <stdarg.h>
+#include <string.h>
 
 #include "xmalloc.h"
 #include "groupaccess.h"
@@ -87,6 +88,30 @@ ga_match(char * const *groups, int n)
        return 0;
 }
 
+/*
+ * Return 1 if one of user's groups matches group_pattern list.
+ * Return 0 on negated or no match.
+ */
+int
+ga_match_pattern_list(const char *group_pattern)
+{
+       int i, found = 0;
+       size_t len = strlen(group_pattern);
+
+       for (i = 0; i < ngroups; i++) {
+               switch (match_pattern_list(groups_byname[i],
+                   group_pattern, len, 0)) {
+               case -1:
+                       return 0;       /* Negated match wins */
+               case 0:
+                       continue;
+               case 1:
+                       found = 1;
+               }
+       }
+       return found;
+}
+
 /*
  * Free memory allocated for group access list.
  */

diff --git a/groupaccess.h b/groupaccess.h
index 04b4498940161059726c293857c018f57c452368..000578e76461df6ccbef1dcad35f3399f40ac68d 100644 (file)
--- a/groupaccess.h
+++ b/groupaccess.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: groupaccess.h,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */
+/* $OpenBSD: groupaccess.h,v 1.8 2008/07/04 03:44:59 djm Exp $ */
 
 /*
  * Copyright (c) 2001 Kevin Steves.  All rights reserved.
@@ -29,6 +29,7 @@
 
 int     ga_init(const char *, gid_t);
 int     ga_match(char * const *, int);
+int     ga_match_pattern_list(const char *);
 void    ga_free(void);
 
 #endif

diff --git a/servconf.c b/servconf.c
index 9d9c9508ea18707e3805da90cf3e9c401e963fc5..66e22979f926eec8c6ae490f408edeeac522deef 100644 (file)
--- a/servconf.c
+++ b/servconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.c,v 1.185 2008/07/02 02:24:18 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.186 2008/07/04 03:44:59 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -525,24 +525,8 @@ static int
 match_cfg_line_group(const char *grps, int line, const char *user)
 {
        int result = 0;
-       u_int ngrps = 0;
-       char *arg, *p, *cp, *grplist[MAX_MATCH_GROUPS];
        struct passwd *pw;
 
-       /*
-        * Even if we do not have a user yet, we still need to check for
-        * valid syntax.
-        */
-       arg = cp = xstrdup(grps);
-       while ((p = strsep(&cp, ",")) != NULL && *p != '\0') {
-               if (ngrps >= MAX_MATCH_GROUPS) {
-                       error("line %d: too many groups in Match Group", line);
-                       result = -1;
-                       goto out;
-               }
-               grplist[ngrps++] = p;
-       }
-
        if (user == NULL)
                goto out;
 
@@ -552,17 +536,16 @@ match_cfg_line_group(const char *grps, int line, const char *user)
        } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
                debug("Can't Match group because user %.100s not in any group "
                    "at line %d", user, line);
-       } else if (ga_match(grplist, ngrps) != 1) {
-               debug("user %.100s does not match group %.100s at line %d",
-                   user, arg, line);
+       } else if (ga_match_pattern_list(grps) != 1) {
+               debug("user %.100s does not match group list %.100s at line %d",
+                   user, grps, line);
        } else {
-               debug("user %.100s matched group %.100s at line %d", user,
-                   arg, line);
+               debug("user %.100s matched group list %.100s at line %d", user,
+                   grps, line);
                result = 1;
        }
 out:
        ga_free();
-       xfree(arg);
        return result;
 }