diff options
author | djm@openbsd.org <djm@openbsd.org> | 2022-02-01 23:34:47 +0000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2022-02-02 10:38:59 +1100 |
commit | 15b7199a1fd37eff4c695e09d573f3db9f4274b7 (patch) | |
tree | 7abb88dbb5821b5db07b9c6f60500bd37b64ff9c | |
parent | 541667fe6dc26d7881e55f0bb3a4baa6f3171645 (diff) | |
download | openssh-git-15b7199a1fd37eff4c695e09d573f3db9f4274b7.tar.gz |
upstream: allow 'ssh-keygen -Y find-principals' to match wildcard
principals in allowed_signers files; from Fabian Stelzer
OpenBSD-Commit-ID: 1e970b9c025b80717dddff5018fe5e6f470c5098
-rw-r--r-- | sshsig.c | 26 |
1 files changed, 14 insertions, 12 deletions
@@ -1,4 +1,4 @@ -/* $OpenBSD: sshsig.c,v 1.27 2022/01/05 04:02:42 djm Exp $ */ +/* $OpenBSD: sshsig.c,v 1.28 2022/02/01 23:34:47 djm Exp $ */ /* * Copyright (c) 2019 Google LLC * @@ -820,6 +820,7 @@ cert_filter_principals(const char *path, u_long linenum, const char *reason; struct sshbuf *nprincipals; int r = SSH_ERR_INTERNAL_ERROR, success = 0; + u_int i; oprincipals = principals = *principalsp; *principalsp = NULL; @@ -830,22 +831,23 @@ cert_filter_principals(const char *path, u_long linenum, } while ((cp = strsep(&principals, ",")) != NULL && *cp != '\0') { - if (strcspn(cp, "!?*") != strlen(cp)) { - debug("%s:%lu: principal \"%s\" not authorized: " - "contains wildcards", path, linenum, cp); - continue; - } - /* Check against principals list in certificate */ + /* Check certificate validity */ if ((r = sshkey_cert_check_authority(cert, 0, 1, 0, - verify_time, cp, &reason)) != 0) { + verify_time, NULL, &reason)) != 0) { debug("%s:%lu: principal \"%s\" not authorized: %s", path, linenum, cp, reason); continue; } - if ((r = sshbuf_putf(nprincipals, "%s%s", - sshbuf_len(nprincipals) != 0 ? "," : "", cp)) != 0) { - error_f("buffer error"); - goto out; + /* Return all matching principal names from the cert */ + for (i = 0; i < cert->cert->nprincipals; i++) { + if (match_pattern(cert->cert->principals[i], cp)) { + if ((r = sshbuf_putf(nprincipals, "%s%s", + sshbuf_len(nprincipals) != 0 ? "," : "", + cert->cert->principals[i])) != 0) { + error_f("buffer error"); + goto out; + } + } } } if (sshbuf_len(nprincipals) == 0) { |