Added wildcard authorization for authorized_keys.

4 files changed, 47 insertions, 1 deletions

diff --git a/auth-options.c b/auth-options.c
index 696ba6ac6..5614b8ef7 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -40,6 +40,9 @@
 #include "ssh2.h"
 #include "auth-options.h"
 
+char *wildcard_match = NULL;
+char *wildcard_fingerprint = NULL;
+
 static int
 dup_strings(char ***dstp, size_t *ndstp, char **src, size_t nsrc)
 {
diff --git a/auth-options.h b/auth-options.h
index d96ffedee..d79943876 100644
--- a/auth-options.h
+++ b/auth-options.h
@@ -73,6 +73,10 @@ struct sshauthopt {
         int no_require_user_presence;
 };
 
+
+extern char *wildcard_match;
+extern char *wildcard_fingerprint;
+
 struct sshauthopt *sshauthopt_new(void);
 struct sshauthopt *sshauthopt_new_with_keys_defaults(void);
 void sshauthopt_free(struct sshauthopt *opts);
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 815ea0f25..f89716a21 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -69,6 +69,7 @@
 #include "channels.h" /* XXX for session.h */
 #include "session.h" /* XXX for child_set_env(); refactor? */
 #include "sk-api.h"
+#include "digest.h"
 
 /* import */
 extern ServerOptions options;
@@ -590,6 +591,8 @@ check_authkey_line(struct ssh *ssh, struct passwd *pw, struct sshkey *key,
 
         /* XXX djm: peek at key type in line and skip if unwanted */
 
+        int wild = 0;
+
         if (sshkey_read(found, &cp) != 0) {
                 /* no key?  check for options */
                 debug2("%s: check options: '%s'", loc, cp);
@@ -599,7 +602,10 @@ check_authkey_line(struct ssh *ssh, struct passwd *pw, struct sshkey *key,
                         goto fail_reason;
                 }
                 skip_space(&cp);
-                if (sshkey_read(found, &cp) != 0) {
+                if (*cp == '*' && (cp[1] == ' ' || cp[1] == '\n' || cp[1] == '\t' || cp[1] == '\0')) {
+                        cp += 2;
+                        wild = 1;
+                } else if (sshkey_read(found, &cp) != 0) {
                         /* still no key?  advance to next line*/
                         debug2("%s: advance: '%s'", loc, cp);
                         goto out;
@@ -611,6 +617,32 @@ check_authkey_line(struct ssh *ssh, struct passwd *pw, struct sshkey *key,
                 auth_debug_add("%s: bad key options: %s", loc, reason);
                 goto out;
         }
+
+        if (wild) {
+                int r;
+                char *keytext = NULL;
+                if ((r = sshkey_to_base64(key, &keytext)) != 0) {
+                        error("%s: sshkey_to_base64 failed: %s", __func__, ssh_err(r));
+                        goto out;
+                }
+                if (!keyopts->force_command) {
+                        reason = "Wildcard login is not allowed without specifying a forced command";
+                        goto fail_reason;
+                }
+
+                wildcard_match = keytext;
+                wildcard_fingerprint = sshkey_fingerprint(key, SSH_DIGEST_SHA256, SSH_FP_HEX);
+
+                verbose("Accepted wildcard authorization for %s key %s with forced_command=%s",
+                                                sshkey_type(key),
+                                                wildcard_fingerprint,
+                                                keyopts->force_command);
+
+                finalopts = keyopts;
+                keyopts = NULL;
+                goto success;
+        }
+
         /* Ignore keys that don't match or incorrectly marked as CAs */
         if (sshkey_is_cert(key)) {
                 /* Certificate; check signature key against CA */
diff --git a/session.c b/session.c
index 837a8bacf..b75e71b38 100644
--- a/session.c
+++ b/session.c
@@ -1071,6 +1071,13 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell)
                 child_set_env(&env, &envsize, "TERM", s->term);
         if (s->display)
                 child_set_env(&env, &envsize, "DISPLAY", s->display);
+        if (wildcard_match) {
+                child_set_env(&env, &envsize, "SSH_REMOTE_KEY",
+                    wildcard_match);
+                child_set_env(&env, &envsize, "SSH_REMOTE_FINGERPRINT",
+                    wildcard_fingerprint);
+        }
+
 
         /*
          * Since we clear KRB5CCNAME at startup, if it's set now then it