diff options
| author | Darren Tucker <dtucker@cvs.openbsd.org> | 2006-03-13 10:26:53 +0000 |
|---|---|---|
| committer | Darren Tucker <dtucker@cvs.openbsd.org> | 2006-03-13 10:26:53 +0000 |
| commit | 92b47854b05a356be3dd5233876b97388ea5fd40 (patch) | |
| tree | a344acfc35218c0a39a551422492db4c87857854 | |
| parent | 0a4da4ac3b66b5ac2fe7f91cba3f6b643afb5a3a (diff) | |
Make ssh-add check file permissions before attempting to load private
key files multiple times; it will fail anyway and this prevents confusing
multiple prompts and warnings. mindrot #1138, ok djm@
| -rw-r--r-- | usr.bin/ssh/authfile.c | 4 | ||||
| -rw-r--r-- | usr.bin/ssh/authfile.h | 3 | ||||
| -rw-r--r-- | usr.bin/ssh/ssh-add.c | 17 |
3 files changed, 17 insertions, 7 deletions
diff --git a/usr.bin/ssh/authfile.c b/usr.bin/ssh/authfile.c index 65f392506a5..1a18b922004 100644 --- a/usr.bin/ssh/authfile.c +++ b/usr.bin/ssh/authfile.c @@ -36,7 +36,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: authfile.c,v 1.62 2006/02/20 17:19:54 stevesk Exp $"); +RCSID("$OpenBSD: authfile.c,v 1.63 2006/03/13 10:26:52 dtucker Exp $"); #include <sys/types.h> #include <sys/stat.h> @@ -510,7 +510,7 @@ key_load_private_pem(int fd, int type, const char *passphrase, return prv; } -static int +int key_perm_ok(int fd, const char *filename) { struct stat st; diff --git a/usr.bin/ssh/authfile.h b/usr.bin/ssh/authfile.h index 7f92701ec05..a16caa7a8fc 100644 --- a/usr.bin/ssh/authfile.h +++ b/usr.bin/ssh/authfile.h @@ -1,4 +1,4 @@ -/* $OpenBSD: authfile.h,v 1.10 2002/05/23 19:24:30 markus Exp $ */ +/* $OpenBSD: authfile.h,v 1.11 2006/03/13 10:26:52 dtucker Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> @@ -21,5 +21,6 @@ Key *key_load_public_type(int, const char *, char **); Key *key_load_private(const char *, const char *, char **); Key *key_load_private_type(int, const char *, const char *, char **); Key *key_load_private_pem(int, int, const char *, char **); +int key_perm_ok(int, const char *); #endif diff --git a/usr.bin/ssh/ssh-add.c b/usr.bin/ssh/ssh-add.c index 2e1998b78ad..1bf5744cf3a 100644 --- a/usr.bin/ssh/ssh-add.c +++ b/usr.bin/ssh/ssh-add.c @@ -35,7 +35,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: ssh-add.c,v 1.75 2006/02/20 17:19:54 stevesk Exp $"); +RCSID("$OpenBSD: ssh-add.c,v 1.76 2006/03/13 10:26:52 dtucker Exp $"); #include <sys/types.h> #include <sys/stat.h> @@ -127,16 +127,25 @@ delete_all(AuthenticationConnection *ac) static int add_file(AuthenticationConnection *ac, const char *filename) { - struct stat st; Key *private; char *comment = NULL; char msg[1024]; - int ret = -1; + int fd, perms_ok, ret = -1; - if (stat(filename, &st) < 0) { + if ((fd = open(filename, 0)) < 0) { perror(filename); return -1; } + + /* + * Since we'll try to load a keyfile multiple times, permission errors + * will occur multiple times, so check perms first and bail if wrong. + */ + perms_ok = key_perm_ok(fd, filename); + close(fd); + if (!perms_ok) + return -1; + /* At first, try empty passphrase */ private = key_load_private(filename, "", &comment); if (comment == NULL) |