upstream: clean up passing of struct passwd from monitor to preauth

privsep process. No longer copy entire struct w/ pointer addresses, but pass
remaining scalar fields explicitly,

Prompted by Yuichiro NAITO, feedback Thorsten Glaser; ok dtucker@

OpenBSD-Commit-ID: 9925df75a56732c43f3663e70dd15ff413ab3e53

diff --git a/monitor.c b/monitor.c
index 10f8462429a6ac9eef52402575c77003922476e7..64a837f48efd7bf5b9e8540dbf61d49b48e2374d 100644 (file)
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.217 2020/10/18 11:32:01 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.218 2020/11/27 00:37:10 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -705,8 +705,14 @@ mm_answer_sign(struct ssh *ssh, int sock, struct sshbuf *m)
        return (0);
 }
 
-/* Retrieves the password entry and also checks if the user is permitted */
+#define PUTPW(b, id) \
+       do { \
+               if ((r = sshbuf_put_string(b, \
+                   &pwent->id, sizeof(pwent->id))) != 0) \
+                       fatal_fr(r, "assemble %s", #id); \
+       } while (0)
 
+/* Retrieves the password entry and also checks if the user is permitted */
 int
 mm_answer_pwnamallow(struct ssh *ssh, int sock, struct sshbuf *m)
 {
@@ -742,10 +748,18 @@ mm_answer_pwnamallow(struct ssh *ssh, int sock, struct sshbuf *m)
        authctxt->pw = pwent;
        authctxt->valid = 1;
 
-       /* XXX don't sent pwent to unpriv; send fake class/dir/shell too */
-       if ((r = sshbuf_put_u8(m, 1)) != 0 ||
-           (r = sshbuf_put_string(m, pwent, sizeof(*pwent))) != 0 ||
-           (r = sshbuf_put_cstring(m, pwent->pw_name)) != 0 ||
+       /* XXX send fake class/dir/shell, etc. */
+       if ((r = sshbuf_put_u8(m, 1)) != 0)
+               fatal_fr(r, "assemble ok");
+       PUTPW(m, pw_uid);
+       PUTPW(m, pw_gid);
+#ifdef HAVE_STRUCT_PASSWD_PW_CHANGE
+       PUTPW(m, pw_change);
+#endif
+#ifdef HAVE_STRUCT_PASSWD_PW_EXPIRE
+       PUTPW(m, pw_expire);
+#endif
+       if ((r = sshbuf_put_cstring(m, pwent->pw_name)) != 0 ||
            (r = sshbuf_put_cstring(m, "*")) != 0 ||
 #ifdef HAVE_STRUCT_PASSWD_PW_GECOS
            (r = sshbuf_put_cstring(m, pwent->pw_gecos)) != 0 ||

diff --git a/monitor_wrap.c b/monitor_wrap.c
index 5f40cc82efe684be9e8a1a77ff98953d907cc069..1226dfd0e4019f0666c36bebc3e3b5766c4cde12 100644 (file)
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_wrap.c,v 1.121 2020/10/18 11:32:01 djm Exp $ */
+/* $OpenBSD: monitor_wrap.c,v 1.122 2020/11/27 00:37:10 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -246,6 +246,15 @@ mm_sshkey_sign(struct ssh *ssh, struct sshkey *key, u_char **sigp, size_t *lenp,
        return (0);
 }
 
+#define GETPW(b, id) \
+       do { \
+               if ((r = sshbuf_get_string_direct(b, &p, &len)) != 0) \
+                       fatal_fr(r, "parse pw %s", #id); \
+               if (len != sizeof(pw->id)) \
+                       fatal_fr(r, "bad length for %s", #id); \
+               memcpy(&pw->id, p, len); \
+       } while (0)
+
 struct passwd *
 mm_getpwnamallow(struct ssh *ssh, const char *username)
 {
@@ -279,12 +288,14 @@ mm_getpwnamallow(struct ssh *ssh, const char *username)
 
        /* XXX don't like passing struct passwd like this */
        pw = xcalloc(sizeof(*pw), 1);
-       if ((r = sshbuf_get_string_direct(m, &p, &len)) != 0)
-               fatal_fr(r, "parse");
-       if (len != sizeof(*pw))
-               fatal_f("struct passwd size mismatch");
-       memcpy(pw, p, sizeof(*pw));
-
+       GETPW(m, pw_uid);
+       GETPW(m, pw_gid);
+#ifdef HAVE_STRUCT_PASSWD_PW_CHANGE
+       GETPW(m, pw_change);
+#endif
+#ifdef HAVE_STRUCT_PASSWD_PW_EXPIRE
+       GETPW(m, pw_expire);
+#endif
        if ((r = sshbuf_get_cstring(m, &pw->pw_name, NULL)) != 0 ||
            (r = sshbuf_get_cstring(m, &pw->pw_passwd, NULL)) != 0 ||
 #ifdef HAVE_STRUCT_PASSWD_PW_GECOS