shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-09 09:54:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2023-6004: torture_config: Allow multiple '@' in usernames

Browse Source 
Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
This commit is contained in:
Norbert Pocs
2023-11-05 13:12:47 +01:00
committed by Andreas Schneider
parent 75a177f8d6
commit 57ec9a35c6
1 changed files with 28 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
tests/unittests/torture_config.c
View File

@@ -1049,6 +1049,34 @@ static void torture_config_proxyjump(void **state,
assert_string_equal(session->opts.ProxyCommand, assert_string_equal(session->opts.ProxyCommand,
"ssh -W '[%h]:%p' 2620:52:0::fed"); "ssh -W '[%h]:%p' 2620:52:0::fed");
/* Multiple @ is allowed in second jump */
config = "Host allowed-hostname\n"
"\tProxyJump localhost,user@principal.com@jumpbox:22\n";
if (file != NULL) {
torture_write_file(file, config);
} else {
string = config;
}
torture_reset_config(session);
ssh_options_set(session, SSH_OPTIONS_HOST, "allowed-hostname");
_parse_config(session, file, string, SSH_OK);
assert_string_equal(session->opts.ProxyCommand,
"ssh -J user@principal.com@jumpbox:22 -W '[%h]:%p' localhost");
/* Multiple @ is allowed */
config = "Host allowed-hostname\n"
"\tProxyJump user@principal.com@jumpbox:22\n";
if (file != NULL) {
torture_write_file(file, config);
} else {
string = config;
}
torture_reset_config(session);
ssh_options_set(session, SSH_OPTIONS_HOST, "allowed-hostname");
_parse_config(session, file, string, SSH_OK);
assert_string_equal(session->opts.ProxyCommand,
"ssh -l user@principal.com -p 22 -W '[%h]:%p' jumpbox");
/* In this part, we try various other config files and strings. */ /* In this part, we try various other config files and strings. */
/* Try to create some invalid configurations */ /* Try to create some invalid configurations */
@@ -1064,18 +1092,6 @@ static void torture_config_proxyjump(void **state,
ssh_options_set(session, SSH_OPTIONS_HOST, "bad-port"); ssh_options_set(session, SSH_OPTIONS_HOST, "bad-port");
_parse_config(session, file, string, SSH_ERROR); _parse_config(session, file, string, SSH_ERROR);
/* Too many @ */
config = "Host bad-hostname\n"
"\tProxyJump user@principal.com@jumpbox:22\n";
if (file != NULL) {
torture_write_file(file, config);
} else {
string = config;
}
torture_reset_config(session);
ssh_options_set(session, SSH_OPTIONS_HOST, "bad-hostname");
_parse_config(session, file, string, SSH_ERROR);
/* Braces mismatch in hostname */ /* Braces mismatch in hostname */
config = "Host mismatch\n" config = "Host mismatch\n"
"\tProxyJump [::1\n"; "\tProxyJump [::1\n";
@@ -1148,18 +1164,6 @@ static void torture_config_proxyjump(void **state,
ssh_options_set(session, SSH_OPTIONS_HOST, "bad-port-2"); ssh_options_set(session, SSH_OPTIONS_HOST, "bad-port-2");
_parse_config(session, file, string, SSH_ERROR); _parse_config(session, file, string, SSH_ERROR);
/* Too many @ in second jump */
config = "Host bad-hostname\n"
"\tProxyJump localhost,user@principal.com@jumpbox:22\n";
if (file != NULL) {
torture_write_file(file, config);
} else {
string = config;
}
torture_reset_config(session);
ssh_options_set(session, SSH_OPTIONS_HOST, "bad-hostname");
_parse_config(session, file, string, SSH_ERROR);
/* Braces mismatch in second jump */ /* Braces mismatch in second jump */
config = "Host mismatch\n" config = "Host mismatch\n"
"\tProxyJump localhost,[::1:20\n"; "\tProxyJump localhost,[::1:20\n";