[openssh-commits] [openssh] branch master updated: upstream: correctly check sshauthopt->restricted merging

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

The following commit(s) were added to refs/heads/master by this push:
     new ded92bffa upstream: correctly check sshauthopt->restricted merging
ded92bffa is described below

commit ded92bffa2e2f2db9b83245c5061812791bfa47f
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Wed Sep 16 04:51:28 2026 +0000

    upstream: correctly check sshauthopt->restricted merging
    
    OpenBSD-Regress-ID: e81e9267514338d6cf6bd2f83dcb722538af528e
---
 regress/unittests/authopt/tests.c | 43 ++++++++++++++++++++-------------------
 1 file changed, 22 insertions(+), 21 deletions(-)

diff --git a/regress/unittests/authopt/tests.c b/regress/unittests/authopt/tests.c
index 2376b47dc..bc6b2ea9c 100644
--- a/regress/unittests/authopt/tests.c
+++ b/regress/unittests/authopt/tests.c
@@ -1,4 +1,4 @@
-/* 	$OpenBSD: tests.c,v 1.5 2025/11/20 05:07:57 dtucker Exp $ */
+/* 	$OpenBSD: tests.c,v 1.6 2026/09/16 04:51:28 djm Exp $ */
 
 /*
  * Regress test for keys options functions.
@@ -418,13 +418,14 @@ test_merge(void)
 	} while (0)
 
 	/* Check a single case of merging of flag options */
-#define FLAG_CASE(keybase, label, keyname, keywords, mostly_off, var, val) \
+#define FLAG_CASE(keybase, label, keyname, keywords, mostly_off, \
+	    rflag, var, val) \
 	do { \
 		PREPARE(keybase " " label, keyname, keywords); \
-		expected = mostly_off ? \
-		    sshauthopt_new() : default_authkey_opts(); \
-		expected->var = val; \
+		expected = rflag ? default_authkey_restrict_opts() : \
+		    (mostly_off ? sshauthopt_new() : default_authkey_opts()); \
 		ASSERT_PTR_NE(expected, NULL); \
+		expected->var = val; \
 		CHECK_SUCCESS_AND_CLEANUP(); \
 		TEST_DONE(); \
 	} while (0)
@@ -437,40 +438,40 @@ test_merge(void)
 #define FLAG_TEST(keybase, keyword, var) \
 	do { \
 		FLAG_CASE(keybase, "keys:default,yes cert:default,no", \
-		    "no_" keybase, keyword, 0, var, 0); \
+		    "no_" keybase, keyword, 0, 0, var, 0); \
 		FLAG_CASE(keybase,"keys:-*,yes cert:default,no", \
-		    "no_" keybase, "restrict," keyword, 1, var, 0); \
+		    "no_" keybase, "restrict," keyword, 1, 1, var, 0); \
 		FLAG_CASE(keybase, "keys:default,no cert:default,no", \
-		    "no_" keybase, "no-" keyword, 0, var, 0); \
+		    "no_" keybase, "no-" keyword, 0, 0, var, 0); \
 		FLAG_CASE(keybase, "keys:-*,no cert:default,no", \
-		    "no_" keybase, "restrict,no-" keyword, 1, var, 0); \
+		    "no_" keybase, "restrict,no-" keyword, 1, 1, var, 0); \
 		\
 		FLAG_CASE(keybase, "keys:default,yes cert:-*,yes", \
-		    "only_" keybase, keyword, 1, var, 1); \
+		    "only_" keybase, keyword, 1, 0, var, 1); \
 		FLAG_CASE(keybase,"keys:-*,yes cert:-*,yes", \
-		    "only_" keybase, "restrict," keyword, 1, var, 1); \
+		    "only_" keybase, "restrict," keyword, 1, 1, var, 1); \
 		FLAG_CASE(keybase, "keys:default,no cert:-*,yes", \
-		    "only_" keybase, "no-" keyword, 1, var, 0); \
+		    "only_" keybase, "no-" keyword, 1, 0, var, 0); \
 		FLAG_CASE(keybase, "keys:-*,no cert:-*,yes", \
-		    "only_" keybase, "restrict,no-" keyword, 1, var, 0); \
+		    "only_" keybase, "restrict,no-" keyword, 1, 1, var, 0); \
 		\
 		FLAG_CASE(keybase, "keys:default,yes cert:-*", \
-		    "no_permit", keyword, 1, var, 0); \
+		    "no_permit", keyword, 1, 0, var, 0); \
 		FLAG_CASE(keybase,"keys:-*,yes cert:-*", \
-		    "no_permit", "restrict," keyword, 1, var, 0); \
+		    "no_permit", "restrict," keyword, 1, 1, var, 0); \
 		FLAG_CASE(keybase, "keys:default,no cert:-*", \
-		    "no_permit", "no-" keyword, 1, var, 0); \
+		    "no_permit", "no-" keyword, 1, 0, var, 0); \
 		FLAG_CASE(keybase, "keys:-*,no cert:-*", \
-		    "no_permit", "restrict,no-" keyword, 1, var, 0); \
+		    "no_permit", "restrict,no-" keyword, 1, 1, var, 0); \
 		\
 		FLAG_CASE(keybase, "keys:default,yes cert:*", \
-		    "all_permit", keyword, 0, var, 1); \
+		    "all_permit", keyword, 0, 0, var, 1); \
 		FLAG_CASE(keybase,"keys:-*,yes cert:*", \
-		    "all_permit", "restrict," keyword, 1, var, 1); \
+		    "all_permit", "restrict," keyword, 1, 1, var, 1); \
 		FLAG_CASE(keybase, "keys:default,no cert:*", \
-		    "all_permit", "no-" keyword, 0, var, 0); \
+		    "all_permit", "no-" keyword, 0, 0, var, 0); \
 		FLAG_CASE(keybase, "keys:-*,no cert:*", \
-		    "all_permit", "restrict,no-" keyword, 1, var, 0); \
+		    "all_permit", "restrict,no-" keyword, 1, 1, var, 0); \
 		\
 	} while (0)
 	FLAG_TEST("portfwd", "port-forwarding", permit_port_forwarding_flag);

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.