From 1fbe81444fcbb3f043ad5df7769fc53c7fd7cc00 Mon Sep 17 00:00:00 2001 From: Helmut Grohne Date: Fri, 22 Jan 2010 23:35:48 +0100 Subject: [PATCH] parse machine specifications for ssh keys Ssh keys can now be prepended with a string "allowed_hosts=machine1,machine2 ". Machine names are restricted to sane characters. This patch only adds the parsing and throws away the result. --- ud-mailgate | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/ud-mailgate b/ud-mailgate index 31aa9c1..87e2a04 100755 --- a/ud-mailgate +++ b/ud-mailgate @@ -5,6 +5,7 @@ # Copyright (c) 2009 Stephen Gran # Copyright (c) 2008 Peter Palfrader # Copyright (c) 2008 Joerg Jaspert +# Copyright (c) 2010 Helmut Grohne import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os, commands import pwd, tempfile @@ -264,6 +265,9 @@ def LoadBadSSH(): # Handle an SSH authentication key, the line format is: # [options] 1024 35 13188913666680[..] [comment] +# maybe it really should be: +# [allowed_hosts=machine1,machine2 ][options ]ssh-rsa keybytes [comment] +machine_regex = re.compile("^[0-9a-zA-Z.-]+$") def DoSSH(Str, Attrs, badkeys, uid): Match = SSH2AuthSplit.match(Str); if Match == None: @@ -276,6 +280,19 @@ def DoSSH(Str, Attrs, badkeys, uid): return "RSA1 keys not supported anymore" return None; + # lines can now be prepended with "allowed_hosts=machine1,machine2 " + if Str.startswith("allowed_hosts="): + Str = Str.split("=", 1)[1] + if ' ' not in Str: + return "invalid ssh key syntax with machine specification" + machines, Str = Str.split(' ', 1) + machines = machines.split(",") + for m in machines: + if not m: + return "empty machine specification for ssh key" + if not machine_regex.match(m): + return "machine specification for ssh key contains invalid characters" + (fd, path) = tempfile.mkstemp(".pub", "sshkeytry", "/tmp") f = open(path, "w") f.write("%s\n" % (Str)) -- 2.20.1