diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2016-11-06 05:46:37 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2016-11-06 16:48:29 +1100 |
| commit | 010359b32659f455fddd2bd85fd7cc4d7a3b994a (patch) | |
| tree | 3e7256e7255cac73e3ab1e9e3bde697a66b60865 /servconf.c | |
| parent | efb494e81d1317209256b38b49f4280897c61e69 (diff) | |
| download | openssh-git-010359b32659f455fddd2bd85fd7cc4d7a3b994a.tar.gz | |
upstream commit
Validate address ranges for AllowUser/DenyUsers at
configuration load time and refuse to accept bad ones. It was previously
possible to specify invalid CIDR address ranges (e.g. djm@127.1.2.3/55) and
these would always match.
Thanks to Laurence Parry for a detailed bug report. ok markus (for
a previous diff version)
Upstream-ID: 9dfcdd9672b06e65233ea4434c38226680d40bfb
Diffstat (limited to 'servconf.c')
| -rw-r--r-- | servconf.c | 8 |
1 files changed, 7 insertions, 1 deletions
@@ -1,5 +1,5 @@ -/* $OpenBSD: servconf.c,v 1.298 2016/10/24 01:09:17 dtucker Exp $ */ +/* $OpenBSD: servconf.c,v 1.299 2016/11/06 05:46:37 djm Exp $ */ /* * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * All rights reserved @@ -1366,6 +1366,9 @@ process_server_config_line(ServerOptions *options, char *line, if (options->num_allow_users >= MAX_ALLOW_USERS) fatal("%s line %d: too many allow users.", filename, linenum); + if (match_user(NULL, NULL, NULL, arg) == -1) + fatal("%s line %d: invalid AllowUsers pattern: " + "\"%.100s\"", filename, linenum, arg); if (!*activep) continue; options->allow_users[options->num_allow_users++] = @@ -1378,6 +1381,9 @@ process_server_config_line(ServerOptions *options, char *line, if (options->num_deny_users >= MAX_DENY_USERS) fatal("%s line %d: too many deny users.", filename, linenum); + if (match_user(NULL, NULL, NULL, arg) == -1) + fatal("%s line %d: invalid DenyUsers pattern: " + "\"%.100s\"", filename, linenum, arg); if (!*activep) continue; options->deny_users[options->num_deny_users++] = |