1 files changed, 27 insertions, 8 deletions

diff --git a/auth-options.c b/auth-options.c
index ca5e1c931..25361455e 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-options.c,v 1.40 2006/08/03 03:34:41 deraadt Exp $ */
+/* $OpenBSD: auth-options.c,v 1.43 2008/06/10 23:06:19 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -20,6 +20,7 @@
 #include <stdio.h>
 #include <stdarg.h>
 
+#include "openbsd-compat/sys-queue.h"
 #include "xmalloc.h"
 #include "match.h"
 #include "log.h"
@@ -42,6 +43,7 @@ int no_port_forwarding_flag = 0;
 int no_agent_forwarding_flag = 0;
 int no_x11_forwarding_flag = 0;
 int no_pty_flag = 0;
+int no_user_rc = 0;
 
 /* "command=" option. */
 char *forced_command = NULL;
@@ -61,6 +63,7 @@ auth_clear_options(void)
         no_port_forwarding_flag = 0;
         no_pty_flag = 0;
         no_x11_forwarding_flag = 0;
+        no_user_rc = 0;
         while (custom_environment) {
                 struct envstring *ce = custom_environment;
                 custom_environment = ce->next;
@@ -121,6 +124,13 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
                         opts += strlen(cp);
                         goto next_option;
                 }
+                cp = "no-user-rc";
+                if (strncasecmp(opts, cp, strlen(cp)) == 0) {
+                        auth_debug_add("User rc file execution disabled.");
+                        no_user_rc = 1;
+                        opts += strlen(cp);
+                        goto next_option;
+                }
                 cp = "command=\"";
                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {
                         opts += strlen(cp);
@@ -216,8 +226,19 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
                         }
                         patterns[i] = '\0';
                         opts++;
-                        if (match_host_and_ip(remote_host, remote_ip,
-                            patterns) != 1) {
+                        switch (match_host_and_ip(remote_host, remote_ip,
+                            patterns)) {
+                        case 1:
+                                xfree(patterns);
+                                /* Host name matches. */
+                                goto next_option;
+                        case -1:
+                                debug("%.100s, line %lu: invalid criteria",
+                                    file, linenum);
+                                auth_debug_add("%.100s, line %lu: "
+                                    "invalid criteria", file, linenum);
+                                /* FALLTHROUGH */
+                        case 0:
                                 xfree(patterns);
                                 logit("Authentication tried for %.100s with "
                                     "correct key but not from a permitted "
@@ -226,12 +247,10 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
                                 auth_debug_add("Your host '%.200s' is not "
                                     "permitted to use this key for login.",
                                     remote_host);
-                                /* deny access */
-                                return 0;
+                                break;
                         }
-                        xfree(patterns);
-                        /* Host name matches. */
-                        goto next_option;
+                        /* deny access */
+                        return 0;
                 }
                 cp = "permitopen=\"";
                 if (strncasecmp(opts, cp, strlen(cp)) == 0) {