parse machine specifications for ssh keys

Ssh keys can now be prepended with a string
"allowed_hosts=machine1,machine2 ". Machine names are restricted to
sane characters. This patch only adds the parsing and throws away the
result.

diff --git a/ud-mailgate b/ud-mailgate
index 31aa9c1..87e2a04 100755 (executable)
--- a/ud-mailgate
+++ b/ud-mailgate
@@ -5,6 +5,7 @@
 #   Copyright (c) 2009 Stephen Gran <steve@lobefin.net>
 #   Copyright (c) 2008 Peter Palfrader <peter@palfrader.org>
 #   Copyright (c) 2008 Joerg Jaspert <joerg@debian.org>
+#   Copyright (c) 2010 Helmut Grohne <helmut@subdivi.de>
 
 import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os, commands
 import pwd, tempfile
@@ -264,6 +265,9 @@ def LoadBadSSH():
 
 # Handle an SSH authentication key, the line format is:
 #  [options] 1024 35 13188913666680[..] [comment]
+# maybe it really should be:
+# [allowed_hosts=machine1,machine2 ][options ]ssh-rsa keybytes [comment]
+machine_regex = re.compile("^[0-9a-zA-Z.-]+$")
 def DoSSH(Str, Attrs, badkeys, uid):
    Match = SSH2AuthSplit.match(Str);
    if Match == None:
@@ -276,6 +280,19 @@ def DoSSH(Str, Attrs, badkeys, uid):
          return "RSA1 keys not supported anymore"
       return None;
 
+   # lines can now be prepended with "allowed_hosts=machine1,machine2 "
+   if Str.startswith("allowed_hosts="):
+      Str = Str.split("=", 1)[1]
+      if ' ' not in Str:
+         return "invalid ssh key syntax with machine specification"
+      machines, Str = Str.split(' ', 1)
+      machines = machines.split(",")
+      for m in machines:
+         if not m:
+            return "empty machine specification for ssh key"
+         if not machine_regex.match(m):
+            return "machine specification for ssh key contains invalid characters"
+
    (fd, path) = tempfile.mkstemp(".pub", "sshkeytry", "/tmp")
    f = open(path, "w")
    f.write("%s\n" % (Str))