summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authordjm@openbsd.org <djm@openbsd.org>2018-06-09 02:58:02 +0000
committerDamien Miller <djm@mindrot.org>2018-06-09 13:11:00 +1000
commit3b9798bda15bd3f598f5ef07595d64e23504da91 (patch)
tree1e57a3cd7c061f9cbcda922641646c4db5f0cc46
parent0368889f82f63c82ff8db9f8c944d89e7c657db4 (diff)
upstream: reorder child environment preparation so that variables
read from ~/.ssh/environment (if enabled) do not override SSH_* variables set by the server. OpenBSD-Commit-ID: 59f9d4c213cdcef2ef21f4b4ae006594dcf2aa7a
-rw-r--r--session.c94
1 files changed, 48 insertions, 46 deletions
diff --git a/session.c b/session.c
index 511fc4e87..7b15e32cc 100644
--- a/session.c
+++ b/session.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: session.c,v 1.298 2018/06/06 18:29:18 markus Exp $ */ 1/* $OpenBSD: session.c,v 1.299 2018/06/09 02:58:02 djm Exp $ */
2/* 2/*
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved 4 * All rights reserved
@@ -1078,46 +1078,10 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell)
1078 1078
1079 if (getenv("TZ")) 1079 if (getenv("TZ"))
1080 child_set_env(&env, &envsize, "TZ", getenv("TZ")); 1080 child_set_env(&env, &envsize, "TZ", getenv("TZ"));
1081
1082 /* Set custom environment options from pubkey authentication. */
1083 if (options.permit_user_env) {
1084 for (n = 0 ; n < auth_opts->nenv; n++) {
1085 ocp = xstrdup(auth_opts->env[n]);
1086 cp = strchr(ocp, '=');
1087 if (*cp == '=') {
1088 *cp = '\0';
1089 child_set_env(&env, &envsize, ocp, cp + 1);
1090 }
1091 free(ocp);
1092 }
1093 }
1094
1095 /* SSH_CLIENT deprecated */
1096 snprintf(buf, sizeof buf, "%.50s %d %d",
1097 ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
1098 ssh_local_port(ssh));
1099 child_set_env(&env, &envsize, "SSH_CLIENT", buf);
1100
1101 laddr = get_local_ipaddr(packet_get_connection_in());
1102 snprintf(buf, sizeof buf, "%.50s %d %.50s %d",
1103 ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
1104 laddr, ssh_local_port(ssh));
1105 free(laddr);
1106 child_set_env(&env, &envsize, "SSH_CONNECTION", buf);
1107
1108 if (tun_fwd_ifnames != NULL)
1109 child_set_env(&env, &envsize, "SSH_TUNNEL", tun_fwd_ifnames);
1110 if (auth_info_file != NULL)
1111 child_set_env(&env, &envsize, "SSH_USER_AUTH", auth_info_file);
1112 if (s->ttyfd != -1)
1113 child_set_env(&env, &envsize, "SSH_TTY", s->tty);
1114 if (s->term) 1081 if (s->term)
1115 child_set_env(&env, &envsize, "TERM", s->term); 1082 child_set_env(&env, &envsize, "TERM", s->term);
1116 if (s->display) 1083 if (s->display)
1117 child_set_env(&env, &envsize, "DISPLAY", s->display); 1084 child_set_env(&env, &envsize, "DISPLAY", s->display);
1118 if (original_command)
1119 child_set_env(&env, &envsize, "SSH_ORIGINAL_COMMAND",
1120 original_command);
1121 1085
1122 /* 1086 /*
1123 * Since we clear KRB5CCNAME at startup, if it's set now then it 1087 * Since we clear KRB5CCNAME at startup, if it's set now then it
@@ -1145,6 +1109,31 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell)
1145 child_set_env(&env, &envsize, "KRB5CCNAME", 1109 child_set_env(&env, &envsize, "KRB5CCNAME",
1146 s->authctxt->krb5_ccname); 1110 s->authctxt->krb5_ccname);
1147#endif 1111#endif
1112 if (auth_sock_name != NULL)
1113 child_set_env(&env, &envsize, SSH_AUTHSOCKET_ENV_NAME,
1114 auth_sock_name);
1115
1116
1117 /* Set custom environment options from pubkey authentication. */
1118 if (options.permit_user_env) {
1119 for (n = 0 ; n < auth_opts->nenv; n++) {
1120 ocp = xstrdup(auth_opts->env[n]);
1121 cp = strchr(ocp, '=');
1122 if (*cp == '=') {
1123 *cp = '\0';
1124 child_set_env(&env, &envsize, ocp, cp + 1);
1125 }
1126 free(ocp);
1127 }
1128 }
1129
1130 /* read $HOME/.ssh/environment. */
1131 if (options.permit_user_env) {
1132 snprintf(buf, sizeof buf, "%.200s/.ssh/environment",
1133 pw->pw_dir);
1134 read_environment_file(&env, &envsize, buf);
1135 }
1136
1148#ifdef USE_PAM 1137#ifdef USE_PAM
1149 /* 1138 /*
1150 * Pull in any environment variables that may have 1139 * Pull in any environment variables that may have
@@ -1167,16 +1156,29 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell)
1167 } 1156 }
1168#endif /* USE_PAM */ 1157#endif /* USE_PAM */
1169 1158
1170 if (auth_sock_name != NULL) 1159 /* SSH_CLIENT deprecated */
1171 child_set_env(&env, &envsize, SSH_AUTHSOCKET_ENV_NAME, 1160 snprintf(buf, sizeof buf, "%.50s %d %d",
1172 auth_sock_name); 1161 ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
1162 ssh_local_port(ssh));
1163 child_set_env(&env, &envsize, "SSH_CLIENT", buf);
1164
1165 laddr = get_local_ipaddr(packet_get_connection_in());
1166 snprintf(buf, sizeof buf, "%.50s %d %.50s %d",
1167 ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
1168 laddr, ssh_local_port(ssh));
1169 free(laddr);
1170 child_set_env(&env, &envsize, "SSH_CONNECTION", buf);
1171
1172 if (tun_fwd_ifnames != NULL)
1173 child_set_env(&env, &envsize, "SSH_TUNNEL", tun_fwd_ifnames);
1174 if (auth_info_file != NULL)
1175 child_set_env(&env, &envsize, "SSH_USER_AUTH", auth_info_file);
1176 if (s->ttyfd != -1)
1177 child_set_env(&env, &envsize, "SSH_TTY", s->tty);
1178 if (original_command)
1179 child_set_env(&env, &envsize, "SSH_ORIGINAL_COMMAND",
1180 original_command);
1173 1181
1174 /* read $HOME/.ssh/environment. */
1175 if (options.permit_user_env) {
1176 snprintf(buf, sizeof buf, "%.200s/.ssh/environment",
1177 strcmp(pw->pw_dir, "/") ? pw->pw_dir : "");
1178 read_environment_file(&env, &envsize, buf);
1179 }
1180 if (debug_flag) { 1182 if (debug_flag) {
1181 /* dump the environment */ 1183 /* dump the environment */
1182 fprintf(stderr, "Environment:\n"); 1184 fprintf(stderr, "Environment:\n");