|
 |
51f0aa |
commit 8b59c73386ddb64331ee03c29925a18dae547733
|
|
|
51f0aa |
Author: Carlos O'Donell <carlos@systemhalted.org>
|
|
|
51f0aa |
Date: Wed Jul 8 02:42:11 2015 -0400
|
|
|
51f0aa |
|
|
|
51f0aa |
Fix ruserok scalability with large ~/.rhosts file.
|
|
|
51f0aa |
|
|
|
51f0aa |
Fixes bug 18557.
|
|
|
51f0aa |
|
|
|
ce426f |
diff --git glibc-2.17-c758a686/inet/rcmd.c glibc-2.17-c758a686/inet/rcmd.c
|
|
|
ce426f |
index 98b3735..91623b0 100644
|
|
|
ce426f |
--- glibc-2.17-c758a686/inet/rcmd.c
|
|
|
ce426f |
+++ glibc-2.17-c758a686/inet/rcmd.c
|
|
|
ce426f |
@@ -809,29 +809,38 @@ __validuser2_sa(hostf, ra, ralen, luser, ruser, rhost)
|
|
|
ce426f |
*p = '\0'; /* <nul> terminate username (+host?) */
|
|
|
ce426f |
|
|
|
ce426f |
/* buf -> host(?) ; user -> username(?) */
|
|
|
ce426f |
+ if (*buf == '\0')
|
|
|
ce426f |
+ break;
|
|
|
ce426f |
+ if (*user == '\0')
|
|
|
ce426f |
+ user = luser;
|
|
|
ce426f |
+
|
|
|
ce426f |
+ /* First check the user part. This is an optimization, since
|
|
|
ce426f |
+ one should always check the host first in order to detect
|
|
|
ce426f |
+ negative host checks (which we check for later). */
|
|
|
ce426f |
+ ucheck = __icheckuser (user, ruser);
|
|
|
ce426f |
+
|
|
|
ce426f |
+ /* Either we found the user, or we didn't and this is a
|
|
|
ce426f |
+ negative host check. We must do the negative host lookup
|
|
|
ce426f |
+ in order to preserve the semantics of stopping on this line
|
|
|
ce426f |
+ before processing others. */
|
|
|
ce426f |
+ if (ucheck != 0 || *buf == '-') {
|
|
|
ce426f |
+
|
|
|
ce426f |
+ /* Next check host part */
|
|
|
ce426f |
+ hcheck = __checkhost_sa (ra, ralen, buf, rhost);
|
|
|
ce426f |
+
|
|
|
ce426f |
+ /* Negative '-host user(?)' match? */
|
|
|
ce426f |
+ if (hcheck < 0)
|
|
|
ce426f |
+ break;
|
|
|
ce426f |
|
|
|
ce426f |
- /* First check host part */
|
|
|
ce426f |
- hcheck = __checkhost_sa (ra, ralen, buf, rhost);
|
|
|
ce426f |
-
|
|
|
ce426f |
- if (hcheck < 0)
|
|
|
ce426f |
- break;
|
|
|
ce426f |
-
|
|
|
ce426f |
- if (hcheck) {
|
|
|
ce426f |
- /* Then check user part */
|
|
|
ce426f |
- if (! (*user))
|
|
|
ce426f |
- user = luser;
|
|
|
ce426f |
-
|
|
|
ce426f |
- ucheck = __icheckuser (user, ruser);
|
|
|
ce426f |
-
|
|
|
ce426f |
- /* Positive 'host user' match? */
|
|
|
ce426f |
- if (ucheck > 0) {
|
|
|
ce426f |
+ /* Positive 'host user' match? */
|
|
|
ce426f |
+ if (hcheck > 0 && ucheck > 0) {
|
|
|
ce426f |
retval = 0;
|
|
|
ce426f |
break;
|
|
|
ce426f |
}
|
|
|
ce426f |
|
|
|
ce426f |
- /* Negative 'host -user' match? */
|
|
|
ce426f |
- if (ucheck < 0)
|
|
|
ce426f |
- break;
|
|
|
ce426f |
+ /* Negative 'host -user' match? */
|
|
|
ce426f |
+ if (hcheck > 0 && ucheck < 0)
|
|
|
ce426f |
+ break;
|
|
|
ce426f |
|
|
|
ce426f |
/* Neither, go on looking for match */
|
|
|
ce426f |
}
|