1 files changed, 45 insertions, 4 deletions

diff --git a/auth.c b/auth.c
index c1e0f4812..2370e5c2c 100644
--- a/auth.c
+++ b/auth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.c,v 1.75 2006/08/03 03:34:41 deraadt Exp $ */
+/* $OpenBSD: auth.c,v 1.79 2008/07/02 12:03:51 dtucker Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -32,6 +32,7 @@
 #include <netinet/in.h>
 
 #include <errno.h>
+#include <fcntl.h>
 #ifdef HAVE_PATHS_H
 # include <paths.h>
 #endif
@@ -48,6 +49,7 @@
 #include <stdarg.h>
 #include <stdio.h>
 #include <string.h>
+#include <unistd.h>
 
 #include "xmalloc.h"
 #include "match.h"
@@ -113,6 +115,7 @@ allowed_user(struct passwd * pw)
 #endif /* USE_SHADOW */
 
         /* grab passwd field for locked account check */
+        passwd = pw->pw_passwd;
 #ifdef USE_SHADOW
         if (spw != NULL)
 #ifdef USE_LIBIAF
@@ -120,8 +123,6 @@ allowed_user(struct passwd * pw)
 #else
                 passwd = spw->sp_pwdp;
 #endif /* USE_LIBIAF */
-#else
-        passwd = pw->pw_passwd;
 #endif
 
         /* check for locked account */
@@ -410,7 +411,7 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
  *
  * Returns 0 on success and -1 on failure
  */
-int
+static int
 secure_filename(FILE *f, const char *file, struct passwd *pw,
     char *err, size_t errlen)
 {
@@ -470,6 +471,46 @@ secure_filename(FILE *f, const char *file, struct passwd *pw,
         return 0;
 }
 
+FILE *
+auth_openkeyfile(const char *file, struct passwd *pw, int strict_modes)
+{
+        char line[1024];
+        struct stat st;
+        int fd;
+        FILE *f;
+
+        /*
+         * Open the file containing the authorized keys
+         * Fail quietly if file does not exist
+         */
+        if ((fd = open(file, O_RDONLY|O_NONBLOCK)) == -1)
+                return NULL;
+
+        if (fstat(fd, &st) < 0) {
+                close(fd);
+                return NULL;
+        }
+        if (!S_ISREG(st.st_mode)) {
+                logit("User %s authorized keys %s is not a regular file",
+                    pw->pw_name, file);
+                close(fd);
+                return NULL;
+        }
+        unset_nonblock(fd);
+        if ((f = fdopen(fd, "r")) == NULL) {
+                close(fd);
+                return NULL;
+        }
+        if (options.strict_modes &&
+            secure_filename(f, file, pw, line, sizeof(line)) != 0) {
+                fclose(f);
+                logit("Authentication refused: %s", line);
+                return NULL;
+        }
+
+        return f;
+}
+
 struct passwd *
 getpwnamallow(const char *user)
 {