search for: got_positive

Windows usernames are case-insensitive and almost any Unicode character is allowed in a username. The user should be able to login with her username given in any case and not be refused. However, this opens up a security problem in terms of the sshd_config Match rules. The match rules for user and group names have to operate case-insensitive as well, otherwise the user can override her settings

Greetings, This request is in the grey area between a bug report and an enhancement request. Request ------- Please apply the following diff (or something functionally similar) to file ``match.c'' in OpenSSH-5.1p1: 161a162,164 > } else { > if (negated) > got_positive = 1; /* Negative match, negated = Positive */ In case the lines above wrapped in the email transmission, the diff is attached as a .gz file. -------------- next part -------------- A non-text attachment was scrubbed... Name: match.c.diff.gz Type: application/x-gzip Size: 104 bytes Desc: not ava...

...f (low_string) free(low_string); > low_string = malloc(strlen(string) + 1); > for (j = 0; j < strlen(string); ++j) low_string[j] = tolower(string[j]); > low_string[j] = 0; > } > if (match_pattern((dolower ? low_string : string), sub)) { > if (negated) { > got_positive = -1; /* Negative */ > break; > } else 165,166c174,175 < * Return success if got a positive match. If there was a negative < * match, we have already returned -1 and never get here. --- > * Return success if there was a positive match; > * return -1 if there was a...

...rking with the 3.9p1 version; the code is consistent in these versions. The meaning of the additional code is the following: - If a string fails to match the subpattern of the configuration, then execution will flow into ``else'' branch. - Normally, the failure of a match is a failure (``got_positive'' retains its initialized value of zero). - However, where a failure is desired (the ``!'' in the specification subpattern), then the occurrence of a failure is a ``success'', so ``got_positive'' should be set to one. -- Configure bugmail: https://bugzilla.mindrot...

On Wed, 20 Feb 2019 at 23:54, Corinna Vinschen <vinschen at redhat.com> wrote: > The previous revert enabled case-insensitive user names again. This > patch implements the case-insensitive user and group name matching. > To allow Unicode chars, implement the matcher using wchar_t chars in > Cygwin-specific code. Keep the generic code changes as small as possible. > Cygwin:

...def HAVE_CYGWIN /* Cygwin version in openbsd-compat/bsd-cygwin_util.c */ - /* * Tries to match the string against the * comma-separated sequence of subpatterns (each possibly preceded by ! to @@ -172,7 +170,17 @@ match_pattern_list(const char *string, const char *pattern, int dolower) return got_positive; } +int +match_usergroup_pattern_list(const char *string, const char *pattern) +{ +#ifdef HAVE_CYGWIN + /* Windows usernames may be Unicode and are not case sensitive */ + return cygwin_ug_match_pattern_list(string, pattern); +#else + /* On most systems usernames are case sensitive. */ + return...