===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/auth2-pubkey.c,v
retrieving revision 1.118
retrieving revision 1.119
diff -u -r1.118 -r1.119
--- src/usr.bin/ssh/auth2-pubkey.c	2023/02/17 04:22:50	1.118
+++ src/usr.bin/ssh/auth2-pubkey.c	2023/07/27 22:25:17	1.119
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.118 2023/02/17 04:22:50 dtucker Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.119 2023/07/27 22:25:17 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2010 Damien Miller.  All rights reserved.
@@ -337,8 +337,8 @@
  * returns 1 if the principal is allowed or 0 otherwise.
  */
 static int
-match_principals_command(struct passwd *user_pw,
-    const struct sshkey *key, struct sshauthopt **authoptsp)
+match_principals_command(struct passwd *user_pw, const struct sshkey *key,
+    const char *conn_id, const char *rdomain, struct sshauthopt **authoptsp)
 {
 	struct passwd *runas_pw = NULL;
 	const struct sshkey_cert *cert = key->cert;
@@ -413,6 +413,8 @@
 	    (unsigned long long)user_pw->pw_uid);
 	for (i = 1; i < ac; i++) {
 		tmp = percent_expand(av[i],
+		    "C", conn_id,
+		    "D", rdomain,
 		    "U", uidstr,
 		    "u", user_pw->pw_name,
 		    "h", user_pw->pw_dir,
@@ -474,7 +476,7 @@
 static int
 user_cert_trusted_ca(struct passwd *pw, struct sshkey *key,
     const char *remote_ip, const char *remote_host,
-    struct sshauthopt **authoptsp)
+    const char *conn_id, const char *rdomain, struct sshauthopt **authoptsp)
 {
 	char *ca_fp, *principals_file = NULL;
 	const char *reason;
@@ -511,7 +513,7 @@
 	}
 	/* Try querying command if specified */
 	if (!found_principal && match_principals_command(pw, key,
-	    &principals_opts))
+	    conn_id, rdomain, &principals_opts))
 		found_principal = 1;
 	/* If principals file or command is specified, then require a match */
 	use_authorized_principals = principals_file != NULL ||
@@ -610,7 +612,7 @@
 static int
 user_key_command_allowed2(struct passwd *user_pw, struct sshkey *key,
     const char *remote_ip, const char *remote_host,
-    struct sshauthopt **authoptsp)
+    const char *conn_id, const char *rdomain, struct sshauthopt **authoptsp)
 {
 	struct passwd *runas_pw = NULL;
 	FILE *f = NULL;
@@ -672,6 +674,8 @@
 	    (unsigned long long)user_pw->pw_uid);
 	for (i = 1; i < ac; i++) {
 		tmp = percent_expand(av[i],
+		    "C", conn_id,
+		    "D", rdomain,
 		    "U", uidstr,
 		    "u", user_pw->pw_name,
 		    "h", user_pw->pw_dir,
@@ -746,11 +750,9 @@
     int auth_attempt, struct sshauthopt **authoptsp)
 {
 	u_int success = 0, i;
-	char *file;
+	char *file, *conn_id;
 	struct sshauthopt *opts = NULL;
-	const char *remote_ip = ssh_remote_ipaddr(ssh);
-	const char *remote_host = auth_get_canonical_hostname(ssh,
-	    options.use_dns);
+	const char *rdomain, *remote_ip, *remote_host;
 
 	if (authoptsp != NULL)
 		*authoptsp = NULL;
@@ -761,6 +763,14 @@
 	    auth_key_is_revoked(key->cert->signature_key))
 		return 0;
 
+	if ((rdomain = ssh_packet_rdomain_in(ssh)) == NULL)
+		rdomain = "";
+	remote_ip = ssh_remote_ipaddr(ssh);
+	remote_host = auth_get_canonical_hostname(ssh, options.use_dns);
+	xasprintf(&conn_id, "%s %d %s %d",
+	    ssh_local_ipaddr(ssh), ssh_local_port(ssh),
+	    remote_ip, ssh_remote_port(ssh));
+
 	for (i = 0; !success && i < options.num_authkeys_files; i++) {
 		if (strcasecmp(options.authorized_keys_files[i], "none") == 0)
 			continue;
@@ -778,18 +788,19 @@
 		goto out;
 
 	if ((success = user_cert_trusted_ca(pw, key, remote_ip, remote_host,
-	    &opts)) != 0)
+	    conn_id, rdomain, &opts)) != 0)
 		goto out;
 	sshauthopt_free(opts);
 	opts = NULL;
 
 	if ((success = user_key_command_allowed2(pw, key, remote_ip,
-	    remote_host, &opts)) != 0)
+	    remote_host, conn_id, rdomain, &opts)) != 0)
 		goto out;
 	sshauthopt_free(opts);
 	opts = NULL;
 
  out:
+	free(conn_id);
 	if (success && authoptsp != NULL) {
 		*authoptsp = opts;
 		opts = NULL;