Re: Feature request/EOI: Match interactive config?

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

 



On Mon, 6 May 2024, openssh@xxxxxxxx wrote:

> ... and I guess your next question will be about compilation environment, so:
> 
> ```
> $ gcc --version
> gcc (Gentoo 13.2.1_p20240210 p14) 13.2.1 20240210
> Copyright (C) 2023 Free Software Foundation, Inc.
> This is free software; see the source for copying conditions.  There is NO
> warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
> ```
> 
> I'm running on gentoo. I tested that the code from github compiles and passes make tests before applying the patch, it looked okay.
> 
> I also did a diff between `git diff` and the patch you provided, and I don't see any changes which might have arisen from copy-paste errors.

It works for me. I'll attach the patch dirctly, in case the problem is
that the mail ate it.

[djm@djm-desktop ~]$ cd /tmp
[djm@djm-desktop tmp]$ git clone https://github.com/openssh/openssh-portable
Cloning into 'openssh-portable'...
remote: Enumerating objects: 66343, done.
remote: Counting objects: 100% (72/72), done.
remote: Compressing objects: 100% (41/41), done.
remote: Total 66343 (delta 41), reused 58 (delta 31), pack-reused 66271
Receiving objects: 100% (66343/66343), 27.05 MiB | 17.23 MiB/s, done.
Resolving deltas: 100% (51319/51319), done.
[djm@djm-desktop tmp]$ cd openssh-portable
[djm@djm-desktop openssh-portable]$ patch -sp1 < /tmp/match.diff 
[djm@djm-desktop openssh-portable]$ autoreconf
[djm@djm-desktop openssh-portable]$ ./configure && make -j16
...
[djm@djm-desktop openssh-portable]$ echo $?
0
[djm@djm-desktop openssh-portable]$ ./ssh -V
OpenSSH_9.7p1, OpenSSL 3.0.10 1 Aug 2023
diff --git a/readconf.c b/readconf.c
index 3a64a0441..dff6a9df6 100644
--- a/readconf.c
+++ b/readconf.c
@@ -70,6 +70,7 @@
 #include "uidswap.h"
 #include "myproposal.h"
 #include "digest.h"
+#include "sshbuf.h"
 
 /* Format of the configuration file:
 
@@ -133,11 +134,11 @@
 */
 
 static int read_config_file_depth(const char *filename, struct passwd *pw,
-    const char *host, const char *original_host, Options *options,
-    int flags, int *activep, int *want_final_pass, int depth);
+    const char *host, const char *original_host, struct sshbuf *remote_command,
+    Options *options, int flags, int *activep, int *want_final_pass, int depth);
 static int process_config_line_depth(Options *options, struct passwd *pw,
-    const char *host, const char *original_host, char *line,
-    const char *filename, int linenum, int *activep, int flags,
+    const char *host, const char *original_host, struct sshbuf *remote_command,
+    char *line, const char *filename, int linenum, int *activep, int flags,
     int *want_final_pass, int depth);
 
 /* Keyword tokens. */
@@ -650,8 +651,9 @@ check_match_ifaddrs(const char *addrlist)
  */
 static int
 match_cfg_line(Options *options, char **condition, struct passwd *pw,
-    const char *host_arg, const char *original_host, int final_pass,
-    int *want_final_pass, const char *filename, int linenum)
+    const char *host_arg, const char *original_host,
+    struct sshbuf *rcommand, int final_pass, int *want_final_pass,
+    const char *filename, int linenum)
 {
 	char *arg, *oattrib, *attrib, *cmd, *cp = *condition, *host, *criteria;
 	const char *ruser;
@@ -764,6 +766,30 @@ match_cfg_line(Options *options, char **condition, struct passwd *pw,
 			r = match_pattern_list(criteria, arg, 0) == 1;
 			if (r == (negate ? 1 : 0))
 				this_result = result = 0;
+		} else if (strcasecmp(attrib, "sessiontype") == 0) {
+			if (options->session_type == SESSION_TYPE_SUBSYSTEM)
+				criteria = xstrdup("subsystem");
+			else if (options->session_type == SESSION_TYPE_NONE)
+				criteria = xstrdup("none");
+			else if (rcommand != NULL && sshbuf_len(rcommand) > 0)
+				criteria = xstrdup("exec");
+			else
+				criteria = xstrdup("shell");
+			r = match_pattern_list(criteria, arg, 0) == 1;
+			if (r == (negate ? 1 : 0))
+				this_result = result = 0;
+		} else if (strcasecmp(attrib, "remotecommand") == 0) {
+			if (rcommand != NULL && sshbuf_len(rcommand) > 0) {
+				if ((criteria =
+				    sshbuf_dup_string(rcommand)) == NULL)
+					fatal_f("dup command failed");
+			} else if (options->remote_command != NULL)
+				criteria = xstrdup(options->remote_command);
+			else
+				criteria = xstrdup("none");
+			r = match_pattern_list(criteria, arg, 0) == 1;
+			if (r == (negate ? 1 : 0))
+				this_result = result = 0;
 		} else if (strcasecmp(attrib, "exec") == 0) {
 			char *conn_hash_hex, *keyalias, *jmphost;
 
@@ -1031,18 +1057,19 @@ parse_multistate_value(const char *arg, const char *filename, int linenum,
  */
 int
 process_config_line(Options *options, struct passwd *pw, const char *host,
-    const char *original_host, char *line, const char *filename,
-    int linenum, int *activep, int flags)
+    const char *original_host, struct sshbuf *remote_command,
+    char *line, const char *filename, int linenum, int *activep, int flags)
 {
 	return process_config_line_depth(options, pw, host, original_host,
-	    line, filename, linenum, activep, flags, NULL, 0);
+	    remote_command, line, filename, linenum, activep, flags, NULL, 0);
 }
 
 #define WHITESPACE " \t\r\n"
 static int
 process_config_line_depth(Options *options, struct passwd *pw, const char *host,
-    const char *original_host, char *line, const char *filename,
-    int linenum, int *activep, int flags, int *want_final_pass, int depth)
+    const char *original_host, struct sshbuf *remote_command, char *line,
+    const char *filename, int linenum, int *activep, int flags,
+    int *want_final_pass, int depth)
 {
 	char *str, **charptr, *endofnumber, *keyword, *arg, *arg2, *p;
 	char **cpptr, ***cppptr, fwdarg[256];
@@ -1779,7 +1806,7 @@ parse_pubkey_algos:
 			goto out;
 		}
 		value = match_cfg_line(options, &str, pw, host, original_host,
-		    flags & SSHCONF_FINAL, want_final_pass,
+		    remote_command, flags & SSHCONF_FINAL, want_final_pass,
 		    filename, linenum);
 		if (value < 0) {
 			error("%.200s line %d: Bad Match condition", filename,
@@ -2028,8 +2055,8 @@ parse_pubkey_algos:
 				    gl.gl_pathv[i], depth,
 				    oactive ? "" : " (parse only)");
 				r = read_config_file_depth(gl.gl_pathv[i],
-				    pw, host, original_host, options,
-				    flags | SSHCONF_CHECKPERM |
+				    pw, host, original_host, remote_command,
+				    options, flags | SSHCONF_CHECKPERM |
 				    (oactive ? 0 : SSHCONF_NEVERMATCH),
 				    activep, want_final_pass, depth + 1);
 				if (r != 1 && errno != ENOENT) {
@@ -2429,20 +2456,20 @@ parse_pubkey_algos:
  */
 int
 read_config_file(const char *filename, struct passwd *pw, const char *host,
-    const char *original_host, Options *options, int flags,
-    int *want_final_pass)
+    const char *original_host, struct sshbuf *remote_command,
+    Options *options, int flags, int *want_final_pass)
 {
 	int active = 1;
 
 	return read_config_file_depth(filename, pw, host, original_host,
-	    options, flags, &active, want_final_pass, 0);
+	    remote_command, options, flags, &active, want_final_pass, 0);
 }
 
 #define READCONF_MAX_DEPTH	16
 static int
 read_config_file_depth(const char *filename, struct passwd *pw,
-    const char *host, const char *original_host, Options *options,
-    int flags, int *activep, int *want_final_pass, int depth)
+    const char *host, const char *original_host, struct sshbuf *remote_command,
+    Options *options, int flags, int *activep, int *want_final_pass, int depth)
 {
 	FILE *f;
 	char *line = NULL;
@@ -2482,8 +2509,8 @@ read_config_file_depth(const char *filename, struct passwd *pw,
 		 * line numbers later for error messages.
 		 */
 		if (process_config_line_depth(options, pw, host, original_host,
-		    line, filename, linenum, activep, flags, want_final_pass,
-		    depth) != 0)
+		    remote_command, line, filename, linenum, activep, flags,
+		    want_final_pass, depth) != 0)
 			bad_options++;
 	}
 	free(line);
diff --git a/readconf.h b/readconf.h
index 9447d5d6e..3da495e38 100644
--- a/readconf.h
+++ b/readconf.h
@@ -231,6 +231,8 @@ typedef struct {
 #define SSH_KEYSTROKE_CHAFF_MIN_MS		1024
 #define SSH_KEYSTROKE_CHAFF_RNG_MS		2048
 
+struct sshbuf;
+
 const char *kex_default_pk_alg(void);
 char	*ssh_connection_hash(const char *thishost, const char *host,
     const char *portstr, const char *user, const char *jump_host);
@@ -239,9 +241,9 @@ int      fill_default_options(Options *);
 void	 fill_default_options_for_canonicalization(Options *);
 void	 free_options(Options *o);
 int	 process_config_line(Options *, struct passwd *, const char *,
-    const char *, char *, const char *, int, int *, int);
+    const char *, struct sshbuf *, char *, const char *, int, int *, int);
 int	 read_config_file(const char *, struct passwd *, const char *,
-    const char *, Options *, int, int *);
+    const char *, struct sshbuf *, Options *, int, int *);
 int	 parse_forward(struct Forward *, const char *, int, int);
 int	 parse_jump(const char *, Options *, int);
 int	 parse_ssh_uri(const char *, char **, char **, int *);
diff --git a/ssh-keysign.c b/ssh-keysign.c
index 968344e79..4913b540d 100644
--- a/ssh-keysign.c
+++ b/ssh-keysign.c
@@ -222,7 +222,7 @@ main(int argc, char **argv)
 
 	/* verify that ssh-keysign is enabled by the admin */
 	initialize_options(&options);
-	(void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "",
+	(void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "", NULL,
 	    &options, 0, NULL);
 	(void)fill_default_options(&options);
 	if (options.enable_ssh_keysign != 1)
diff --git a/ssh.c b/ssh.c
index 0019281f4..ecaff3844 100644
--- a/ssh.c
+++ b/ssh.c
@@ -566,7 +566,8 @@ process_config_files(const char *host_name, struct passwd *pw, int final_pass,
 
 	if (config != NULL) {
 		if (strcasecmp(config, "none") != 0 &&
-		    !read_config_file(config, pw, host, host_name, &options,
+		    !read_config_file(config, pw, host, host_name,
+		    command, &options,
 		    SSHCONF_USERCONF | (final_pass ? SSHCONF_FINAL : 0),
 		    want_final_pass))
 			fatal("Can't open user config file %.100s: "
@@ -576,12 +577,13 @@ process_config_files(const char *host_name, struct passwd *pw, int final_pass,
 		    _PATH_SSH_USER_CONFFILE);
 		if (r > 0 && (size_t)r < sizeof(buf))
 			(void)read_config_file(buf, pw, host, host_name,
-			    &options, SSHCONF_CHECKPERM | SSHCONF_USERCONF |
+			    command, &options,
+			    SSHCONF_CHECKPERM | SSHCONF_USERCONF |
 			    (final_pass ? SSHCONF_FINAL : 0), want_final_pass);
 
 		/* Read systemwide configuration file after user config. */
 		(void)read_config_file(_PATH_HOST_CONFIG_FILE, pw,
-		    host, host_name, &options,
+		    host, host_name, command, &options,
 		    final_pass ? SSHCONF_FINAL : 0, want_final_pass);
 	}
 }
@@ -1074,7 +1076,7 @@ main(int ac, char **av)
 		case 'o':
 			line = xstrdup(optarg);
 			if (process_config_line(&options, pw,
-			    host ? host : "", host ? host : "", line,
+			    host ? host : "", host ? host : "", NULL, line,
 			    "command-line", 0, NULL, SSHCONF_USERCONF) != 0)
 				exit(255);
 			free(line);
diff --git a/ssh_config.5 b/ssh_config.5
index 2931d807e..0500bc049 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -145,6 +145,8 @@ The available criteria keywords are:
 .Cm host ,
 .Cm originalhost ,
 .Cm tagged ,
+.Cm sessiontype ,
+.Cm remotecommand ,
 .Cm user ,
 and
 .Cm localuser .
@@ -212,6 +214,7 @@ The other keywords' criteria must be single entries or comma-separated
 lists and may use the wildcard and negation operators described in the
 .Sx PATTERNS
 section.
+.Pp
 The criteria for the
 .Cm host
 keyword are matched against the target hostname, after any substitution
@@ -223,6 +226,7 @@ options.
 The
 .Cm originalhost
 keyword matches against the hostname as it was specified on the command-line.
+.Pp
 The
 .Cm tagged
 keyword matches a tag name specified by a prior
@@ -232,6 +236,7 @@ directive or on the
 command-line using the
 .Fl P
 flag.
+.Pp
 The
 .Cm user
 keyword matches against the target username on the remote host.
@@ -242,6 +247,31 @@ keyword matches against the name of the local user running
 (this keyword may be useful in system-wide
 .Nm
 files).
+.Pp
+The
+.Cm sessiontype
+keyword matches the requested remote session type as a pattern-list, that may
+contain any of
+.Cm shell ,
+.Cm exec
+(for command execution),
+.Cm subsystem
+(e.g. for
+.Xr sftp 1
+sessions),
+or
+.Xr none
+for empty sessions, such as when
+.Xr ssh 1
+is started with the
+.Fl N
+flag.
+The
+.Cm remotecommand
+keyword matches against the remote command as a pattern-list.
+For example
+.Dq shutdown,reboot,halt*
+would match any of these commands.
 .It Cm AddKeysToAgent
 Specifies whether keys should be automatically added to a running
 .Xr ssh-agent 1 .
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux