search for: match_host_and_ip

...@netgroup + */ +int +match_user_or_netgroup(const char *user, char *pattern) +{ + if(pattern[0] != '@') + return match_pattern(user, pattern); + +#ifdef HAVE_INNETGR + return innetgr(pattern + 1, NULL, user, NULL); +#else + return 0; +#endif +} + +/* + * match host in @netgroup + */ +int +match_host_and_ip_or_netgroup(const char *host, const char * ipaddr, char *pattern) +{ + if(pattern[0] != '@') + return match_host_and_ip(host, ipaddr, pattern); + +#ifdef HAVE_INNETGR + return innetgr(pattern + 1, host, NULL, NULL) + || innetgr(pattern + 1, ipaddr, NULL, NULL); +#else + return 0; +#endif...

Hello, I added the support for netgroups to be used in the AllowUsers and DenyUsers parameters. This has some advantages: * hostnames or ip addresses need not to be written or maintained in the sshd_config file, but can be kept abstract names what also simplifies a bit largescale openssh installations * sshd_config needs not change and sshd be restarted when changing the list of allowed /

On Wed, 20 Feb 2019 at 23:54, Corinna Vinschen <vinschen at redhat.com> wrote: > The previous revert enabled case-insensitive user names again. This > patch implements the case-insensitive user and group name matching. > To allow Unicode chars, implement the matcher using wchar_t chars in > Cygwin-specific code. Keep the generic code changes as small as possible. > Cygwin:

...ostIP-4.7p1/auth.c --- openssh-4.7p1/auth.c 2007-03-26 09:35:28.000000000 -0700 +++ osshGroupHostIP-4.7p1/auth.c 2007-11-02 14:52:58.000000000 -0700 @@ -210,8 +210,13 @@ /* Return false if one of user's groups is listed in DenyGroups */ if (options.num_deny_groups > 0) +#ifndef GROUP_MATCH_HOST_AND_IP if (ga_match(options.deny_groups, options.num_deny_groups)) { +#else /* GROUP_MATCH_HOST_AND_IP */ + if (ga_match_host_and_ip(options.deny_groups, + options.num_deny_groups, hostname, ipaddr)) { +#endif /* GROUP_MATCH_HOST_AND_IP */ ga_free(); logit("User %.100s f...

...NULL) + return 0; + for (;;) { /* If at end of pattern, accept if also at end of string. */ if (!*pattern) return !*s; if (*pattern == '*') { /* Skip the asterisk. */ pattern++; @@ -217,16 +220,58 @@ if ((ret = match_pattern(user, pat)) == 1) ret = match_host_and_ip(host, ipaddr, p); xfree(pat); return ret; } +int +match_user_fixedname(const char *user, const char *ipaddr, + const char *pattern) +{ + char *p, *pat; + int ret; + struct addrinfo hints, *ai, *aitop, ntop[NI_MAXHOST]; + + if ((p = strchr(pattern, '@')) == NULL) +...

...e or the ip * or if we get no match at all. returns 1 otherwise. diff -u -p openssh-3.4p1/match.h openssh-3.4p1-hash/match.h --- openssh-3.4p1/match.h Mon Mar 4 20:42:43 2002 +++ openssh-3.4p1-hash/match.h Mon Mar 3 17:30:44 2003 @@ -20,5 +20,8 @@ int match_hostname(const char *, const int match_host_and_ip(const char *, const char *, const char *); int match_user(const char *, const char *, const char *, const char *); char *match_list(const char *, const char *, u_int *); +#ifdef HASH_KNOWN_HOSTS +int match_hashed_hostname(const char *, const char *, u_int); +#endif #endif Common subdirec...

...64..d98b0cb87719 100644 --- a/match.h +++ b/match.h @@ -16,6 +16,7 @@ int match_pattern(const char *, const char *); int match_pattern_list(const char *, const char *, int); +int match_usergroup_pattern_list(const char *, const char *); int match_hostname(const char *, const char *); int match_host_and_ip(const char *, const char *, const char *); int match_user(const char *, const char *, const char *, const char *); diff --git a/openbsd-compat/bsd-cygwin_util.c b/openbsd-compat/bsd-cygwin_util.c index f721fca9d998..1e4cdc9280d4 100644 --- a/openbsd-compat/bsd-cygwin_util.c +++ b/openbsd-compat/b...