+ else
+ error("Host key %s blacklisted (see "
+ "ssh-vulnkey(1))", fp);
-+ xfree(fp);
++ free(fp);
+ if (!options.permit_blacklisted_keys) {
+ sensitive_data.host_keys[i] = NULL;
+ continue;
+ }
+ }
+ pubkey = key_load_public(options.host_key_files[i], NULL);
sensitive_data.host_keys[i] = key;
- if (key == NULL) {
- error("Could not load host key: %s",
+ sensitive_data.host_pubkeys[i] = pubkey;
--- openssh-4.7p1.orig/servconf.c
+++ openssh-4.7p1/servconf.c
@@ -96,6 +96,7 @@
--- openssh-4.7p1.orig/servconf.h
+++ openssh-4.7p1/servconf.h
@@ -94,6 +94,7 @@
- * authentication. */
+ * authentication. /
int kbd_interactive_authentication; /* If true, permit */
int challenge_response_authentication;
+ int permit_blacklisted_keys; /* If true, permit */
INSTALL_SSH_PRNG_CMDS=@INSTALL_SSH_PRNG_CMDS@
INSTALL_SSH_RAND_HELPER=@INSTALL_SSH_RAND_HELPER@
--TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT)
-+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-vulnkey$(EXEEXT)
+-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
++TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-vulnkey$(EXEEXT)
LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
audit.o audit-bsm.o platform.o sftp-server.o sftp-common.o \
roaming_common.o roaming_serv.o ldapauth.o
--MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
--MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
-+MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out ssh-vulnkey.1.out
-+MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5 ssh-vulnkey.1
+-MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-ldap-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap.conf.5.out
+-MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-ldap-helper.8 sshd_config.5 ssh_config.5 ssh-ldap.conf.5
++MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-ldap-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap.conf.5.out ssh-vulnkey.1.out
++MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-ldap-helper.8 sshd_config.5 ssh_config.5 ssh-ldap.conf.5 ssh-vulnkey.1
MANTYPE = @MANTYPE@
CONFIGFILES=sshd_config.out ssh_config.out moduli.out
# test driver for the loginrec code - not built by default
logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
-@@ -264,6 +267,7 @@
- $(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign $(DESTDIR)$(SSH_KEYSIGN)
- $(INSTALL) -m 0755 $(STRIP_OPT) sftp $(DESTDIR)$(bindir)/sftp
- $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server $(DESTDIR)$(SFTP_SERVER)
-+ $(INSTALL) -m 0755 $(STRIP_OPT) ssh-vulnkey $(DESTDIR)$(bindir)/ssh-vulnkey
+@@ -271,6 +274,7 @@
+ $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
+ $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
+ $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
++ $(INSTALL) -m 0755 $(STRIP_OPT) ssh-vulnkey$(EXEEXT) $(DESTDIR)$(bindir)/ssh-vulnkey$(EXEEXT)
$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-@@ -289,6 +289,7 @@
+@@ -289,6 +293,7 @@
$(INSTALL) -m 644 sftp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
+ else
+ logit("Public key %s blacklisted (see "
+ "ssh-vulnkey(1))", fp);
-+ xfree(fp);
++ free(fp);
+ if (!options.permit_blacklisted_keys)
+ return 0;
+ }
+of processing
+.Xr ssh-keyscan 1
+output.
---- openssh-4.7p1.orig/auth2-hostbased.c
-+++ openssh-4.7p1/auth2-hostbased.c
+--- openssh-5.6p1/auth2-hostbased.c~ 2010-08-24 14:10:03.000000000 +0300
++++ openssh-5.6p1/auth2-hostbased.c 2010-08-24 14:12:10.632553591 +0300
@@ -40,6 +40,7 @@
#include "compat.h"
#include "key.h"
#include "auth.h"
#include "canohost.h"
#ifdef GSSAPI
-@@ -141,10 +142,24 @@
- hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
- Key *key)
- {
-+ char *fp;
- const char *resolvedname, *ipaddr, *lookup;
- HostStatus host_status;
+@@ -147,6 +148,19 @@
int len;
+ char *fp;
+ if (blacklisted_key(key)) {
+ fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ else
+ logit("Public key %s blacklisted (see "
+ "ssh-vulnkey(1))", fp);
-+ xfree(fp);
++ free(fp);
+ if (!options.permit_blacklisted_keys)
+ return 0;
+ }
+
+out:
+ if (dgst_packed)
-+ xfree(dgst_packed);
++ free(dgst_packed);
+ if (dgst_hex)
-+ xfree(dgst_hex);
++ free(dgst_hex);
+ if (fd >= 0)
+ close(fd);
-+ xfree(blacklist_file);
++ free(blacklist_file);
+ return ret;
+}
--- openssh-4.7p1.orig/ssh-vulnkey.c
+ fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ if (!quiet)
+ printf("%s: %u %s %s\n", msg, key_size(key), fp, comment);
-+ xfree(fp);
++ free(fp);
+}
+
+int
+ ret = 0;
+ } else
+ describe_key("Not blacklisted", key, comment);
-+ xfree(blacklist_file);
++ free(blacklist_file);
+
+ return ret;
+}
+ found = 1;
+ }
+ if (comment)
-+ xfree(comment);
++ free(comment);
+ }
+
+ return ret;
+ /* We don't need the RNG ourselves, but symbol references here allow
+ * ld to link us properly.
+ */
-+ init_rng();
-+ seed_rng();
++ //init_rng();
++ //seed_rng();
+
+ while ((opt = getopt(argc, argv, "ahq")) != -1) {
+ switch (opt) {
+ else
+ logit("Public key %s blacklisted (see "
+ "ssh-vulnkey(1))", fp);
-+ xfree(fp);
++ free(fp);
+ if (!options.permit_blacklisted_keys)
+ continue;
+ }
#ifndef _PATH_SSH_PROGRAM
#define _PATH_SSH_PROGRAM "/usr/bin/ssh"
#endif
---- openssh-4.7p1.orig/auth2-pubkey.c
-+++ openssh-4.7p1/auth2-pubkey.c
+--- openssh-5.9p1/auth2-pubkey.c~ 2011-09-29 00:36:17.000000000 +0300
++++ openssh-5.9p1/auth2-pubkey.c 2011-09-29 00:37:17.847762648 +0300
@@ -42,6 +42,7 @@
#include "compat.h"
#include "key.h"
#include "auth.h"
#include "pathnames.h"
#include "uidswap.h"
-@@ -269,9 +270,23 @@
- int
- user_key_allowed(struct passwd *pw, Key *key)
+@@ -608,6 +609,20 @@
{
-+ char *fp;
- int success;
+ u_int success, i;
char *file;
-
++ char *fp;
++
+ if (blacklisted_key(key)) {
+ fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ if (options.permit_blacklisted_keys)
+ logit("Public key %s blacklisted (see "
-+ "ssh-vulnkey(1)); continuing anyway", fp);
++ "ssh-vulnkey(1)); continuing anyway", fp);
+ else
+ logit("Public key %s blacklisted (see "
-+ "ssh-vulnkey(1))", fp);
-+ xfree(fp);
++ "ssh-vulnkey(1))", fp);
++ free(fp);
+ if (!options.permit_blacklisted_keys)
+ return 0;
+ }
-+
+
if (auth_key_is_revoked(key))
return 0;
- if (key_is_cert(key) && auth_key_is_revoked(key->cert->signature_key))
+
projects / packages / openssh.git / blobdiff