New upstream release (7.8p1)

Closes: #907534

1 files changed, 39 insertions, 24 deletions

diff --git a/auth.c b/auth.c
index 68b9fe795..ad25631a5 100644
--- a/auth.c
+++ b/auth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.c,v 1.127 2018/03/12 00:52:01 djm Exp $ */
+/* $OpenBSD: auth.c,v 1.132 2018/07/11 08:19:35 martijn Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -55,10 +55,10 @@
 #include "match.h"
 #include "groupaccess.h"
 #include "log.h"
-#include "buffer.h"
+#include "sshbuf.h"
 #include "misc.h"
 #include "servconf.h"
-#include "key.h"
+#include "sshkey.h"
 #include "hostfile.h"
 #include "auth.h"
 #include "auth-options.h"
@@ -79,13 +79,12 @@
 /* import */
 extern ServerOptions options;
 extern int use_privsep;
-extern Buffer loginmsg;
+extern struct sshbuf *loginmsg;
 extern struct passwd *privsep_pw;
 extern struct sshauthopt *auth_opts;
 
 /* Debugging messages */
-Buffer auth_debug;
-int auth_debug_init;
+static struct sshbuf *auth_debug;
 
 /*
  * Check if the user is allowed to log in via ssh. If user is listed
@@ -281,7 +280,7 @@ format_method_key(Authctxt *authctxt)
         if (key == NULL)
                 return NULL;
 
-        if (key_is_cert(key)) {
+        if (sshkey_is_cert(key)) {
                 fp = sshkey_fingerprint(key->cert->signature_key,
                     options.fingerprint_hash, SSH_FP_DEFAULT);
                 xasprintf(&ret, "%s ID %s (serial %llu) CA %s %s%s%s",
@@ -423,11 +422,13 @@ auth_root_allowed(struct ssh *ssh, const char *method)
 char *
 expand_authorized_keys(const char *filename, struct passwd *pw)
 {
-        char *file, ret[PATH_MAX];
+        char *file, uidstr[32], ret[PATH_MAX];
         int i;
 
+        snprintf(uidstr, sizeof(uidstr), "%llu",
+            (unsigned long long)pw->pw_uid);
         file = percent_expand(filename, "h", pw->pw_dir,
-            "u", pw->pw_name, (char *)NULL);
+            "u", pw->pw_name, "U", uidstr, (char *)NULL);
 
         /*
          * Ensure that filename starts anchored. If not, be backward
@@ -670,26 +671,32 @@ auth_debug_add(const char *fmt,...)
 {
         char buf[1024];
         va_list args;
+        int r;
 
-        if (!auth_debug_init)
+        if (auth_debug == NULL)
                 return;
 
         va_start(args, fmt);
         vsnprintf(buf, sizeof(buf), fmt, args);
         va_end(args);
-        buffer_put_cstring(&auth_debug, buf);
+        if ((r = sshbuf_put_cstring(auth_debug, buf)) != 0)
+                fatal("%s: sshbuf_put_cstring: %s", __func__, ssh_err(r));
 }
 
 void
 auth_debug_send(void)
 {
+        struct ssh *ssh = active_state;         /* XXX */
         char *msg;
+        int r;
 
-        if (!auth_debug_init)
+        if (auth_debug == NULL)
                 return;
-        while (buffer_len(&auth_debug)) {
-                msg = buffer_get_string(&auth_debug, NULL);
-                packet_send_debug("%s", msg);
+        while (sshbuf_len(auth_debug) != 0) {
+                if ((r = sshbuf_get_cstring(auth_debug, &msg, NULL)) != 0)
+                        fatal("%s: sshbuf_get_cstring: %s",
+                            __func__, ssh_err(r));
+                ssh_packet_send_debug(ssh, "%s", msg);
                 free(msg);
         }
 }
@@ -697,12 +704,10 @@ auth_debug_send(void)
 void
 auth_debug_reset(void)
 {
-        if (auth_debug_init)
-                buffer_clear(&auth_debug);
-        else {
-                buffer_init(&auth_debug);
-                auth_debug_init = 1;
-        }
+        if (auth_debug != NULL)
+                sshbuf_reset(auth_debug);
+        else if ((auth_debug = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
 }
 
 struct passwd *
@@ -750,7 +755,7 @@ auth_get_canonical_hostname(struct ssh *ssh, int use_dns)
 }
 
 /*
- * Runs command in a subprocess wuth a minimal environment.
+ * Runs command in a subprocess with a minimal environment.
  * Returns pid on success, 0 on failure.
  * The child stdout and stderr maybe captured, left attached or sent to
  * /dev/null depending on the contents of flags.
@@ -910,17 +915,20 @@ auth_log_authopts(const char *loc, const struct sshauthopt *opts, int do_remote)
         int do_env = options.permit_user_env && opts->nenv > 0;
         int do_permitopen = opts->npermitopen > 0 &&
             (options.allow_tcp_forwarding & FORWARD_LOCAL) != 0;
+        int do_permitlisten = opts->npermitlisten > 0 &&
+            (options.allow_tcp_forwarding & FORWARD_REMOTE) != 0;
         size_t i;
         char msg[1024], buf[64];
 
         snprintf(buf, sizeof(buf), "%d", opts->force_tun_device);
         /* Try to keep this alphabetically sorted */
-        snprintf(msg, sizeof(msg), "key options:%s%s%s%s%s%s%s%s%s%s%s%s",
+        snprintf(msg, sizeof(msg), "key options:%s%s%s%s%s%s%s%s%s%s%s%s%s",
             opts->permit_agent_forwarding_flag ? " agent-forwarding" : "",
             opts->force_command == NULL ? "" : " command",
             do_env ?  " environment" : "",
             opts->valid_before == 0 ? "" : "expires",
             do_permitopen ?  " permitopen" : "",
+            do_permitlisten ?  " permitlisten" : "",
             opts->permit_port_forwarding_flag ? " port-forwarding" : "",
             opts->cert_principals == NULL ? "" : " principals",
             opts->permit_pty_flag ? " pty" : "",
@@ -954,12 +962,18 @@ auth_log_authopts(const char *loc, const struct sshauthopt *opts, int do_remote)
         }
         if (opts->force_command != NULL)
                 debug("%s: forced command: \"%s\"", loc, opts->force_command);
-        if ((options.allow_tcp_forwarding & FORWARD_LOCAL) != 0) {
+        if (do_permitopen) {
                 for (i = 0; i < opts->npermitopen; i++) {
                         debug("%s: permitted open: %s",
                             loc, opts->permitopen[i]);
                 }
         }
+        if (do_permitlisten) {
+                for (i = 0; i < opts->npermitlisten; i++) {
+                        debug("%s: permitted listen: %s",
+                            loc, opts->permitlisten[i]);
+                }
+        }
 }
 
 /* Activate a new set of key/cert options; merging with what is there. */
@@ -987,6 +1001,7 @@ auth_restrict_session(struct ssh *ssh)
 
         /* A blank sshauthopt defaults to permitting nothing */
         restricted = sshauthopt_new();
+        restricted->permit_pty_flag = 1;
         restricted->restricted = 1;
 
         if (auth_activate_options(ssh, restricted) != 0)