# HG changeset patch
# User Matt Johnston <matt@ucc.asn.au>
# Date 1519312005 -28800
# Node ID b918ad1c5b256e4cf3e4b6a98e4c104a1fe69db7
# Parent  2e9b6d9c7e7d55e4a86e7ffd1345a73ed9bd484d# Parent  ed930fd6f60f35ad4f83a4cf05a433a8a593f778
Merge branch 'master' of git://github.com/stellarpower/dropbear into stellarpower-master

diff -r 2e9b6d9c7e7d -r b918ad1c5b25 runopts.h
--- a/runopts.h	Thu Feb 22 21:57:47 2018 +0800
+++ b/runopts.h	Thu Feb 22 23:06:45 2018 +0800
@@ -92,6 +92,8 @@
 #endif
 
 	int norootlogin;
+        char *grouploginname;
+        gid_t *grouploginid;
 
 	int noauthpass;
 	int norootpass;
diff -r 2e9b6d9c7e7d -r b918ad1c5b25 svr-auth.c
--- a/svr-auth.c	Thu Feb 22 21:57:47 2018 +0800
+++ b/svr-auth.c	Thu Feb 22 23:06:45 2018 +0800
@@ -25,6 +25,8 @@
 /* This file (auth.c) handles authentication requests, passing it to the
  * particular type (auth-passwd, auth-pubkey). */
 
+#include <limits.h>
+
 #include "includes.h"
 #include "dbutil.h"
 #include "session.h"
@@ -232,6 +234,10 @@
 	char* listshell = NULL;
 	char* usershell = NULL;
 	uid_t uid;
+        int ngroups = 32, ret;
+        gid_t *grouplist;
+
+
 	TRACE(("enter checkusername"))
 	if (userlen > MAX_USERNAME_LEN) {
 		return DROPBEAR_FAILURE;
@@ -278,6 +284,46 @@
 		return DROPBEAR_FAILURE;
 	}
 
+        /* check for login restricted to certain group if desired */
+        if (svr_opts.grouploginid) {
+
+            for ( ; (ngroups <= NGROUPS_MAX) && (ngroups <= INT_MAX / 8); ngroups *= 2){
+
+                    grouplist = malloc(sizeof(gid_t) * ngroups);
+
+                    ret = getgrouplist(ses.authstate.pw_name, ses.authstate.pw_gid, grouplist, &ngroups);
+
+                    if (ret != -1){
+                        break;
+                    }
+
+                    free(grouplist);
+                    ngroups *= 2;
+            }
+
+            if ((ngroups > NGROUPS_MAX / 8) || (ngroups > INT_MAX / 8)){
+
+                    TRACE(("Cannot walk group structure for current user, too many groups"))
+                    dropbear_log(LOG_ERR, "Cannot walk group structure for current user, too many groups");
+                    return DROPBEAR_FAILURE;
+            }
+
+            ngroups = 0;
+            for (int i = 0; i < ret; i++){
+                    if (grouplist[i] == *svr_opts.grouploginid){
+                    ngroups = 1; //Just used as a flag to indicate success;
+                    break;
+                }
+
+            }
+
+            if (!ngroups){
+                    TRACE(("leave checkusername: user not in permitted group"))
+                    dropbear_log(LOG_WARNING, "logins are restricted to the group %s but user %s is not a member", svr_opts.grouploginname, ses.authstate.pw_name);
+                    return DROPBEAR_FAILURE;
+            }
+        }
+
 	TRACE(("shell is %s", ses.authstate.pw_shell))
 
 	/* check that the shell is set */
diff -r 2e9b6d9c7e7d -r b918ad1c5b25 svr-runopts.c
--- a/svr-runopts.c	Thu Feb 22 21:57:47 2018 +0800
+++ b/svr-runopts.c	Thu Feb 22 23:06:45 2018 +0800
@@ -30,6 +30,8 @@
 #include "algo.h"
 #include "ecdsa.h"
 
+#include <grp.h>
+
 svr_runopts svr_opts; /* GLOBAL */
 
 static void printhelp(const char * progname);
@@ -68,6 +70,7 @@
 					"-m		Don't display the motd on login\n"
 #endif
 					"-w		Disallow root logins\n"
+                                        "-G		Restrict logins to members of specified group\n"
 #if DROPBEAR_SVR_PASSWORD_AUTH || DROPBEAR_SVR_PAM_AUTH
 					"-s		Disable password logins\n"
 					"-g		Disable password logins for root\n"
@@ -132,6 +135,8 @@
 	svr_opts.forced_command = NULL;
 	svr_opts.forkbg = 1;
 	svr_opts.norootlogin = 0;
+        svr_opts.grouploginname = NULL;
+        svr_opts.grouploginid = NULL;
 	svr_opts.noauthpass = 0;
 	svr_opts.norootpass = 0;
 	svr_opts.allowblankpass = 0;
@@ -230,6 +235,11 @@
 				case 'w':
 					svr_opts.norootlogin = 1;
 					break;
+
+                                case 'G':
+                                        next = &svr_opts.grouploginname;
+                                        break;
+
 				case 'W':
 					next = &recv_window_arg;
 					break;
@@ -331,6 +341,18 @@
 		}
 		buf_setpos(svr_opts.banner, 0);
 	}
+
+        if (svr_opts.grouploginname) {
+                struct group *restrictedgroup = getgrnam(svr_opts.grouploginname);
+
+                if (restrictedgroup){
+                    svr_opts.grouploginid = malloc(sizeof(gid_t));
+                    *svr_opts.grouploginid = restrictedgroup->gr_gid;
+                } else {
+                    dropbear_exit("Cannot restrict logins to group '%s' as the group does not exist", svr_opts.grouploginname);
+                }
+
+        }
 	
 	if (recv_window_arg) {
 		opts.recv_window = atol(recv_window_arg);