* Backport from upstream:

  - Do not fall back to adding keys without contraints (ssh-add -c / -t
    ...) when the agent refuses the constrained add request. This was a
    useful migration measure back in 2002 when constraints were new, but
    just adds risk now (LP: #209447).

4 files changed, 5 insertions, 10 deletions

diff --git a/authfd.c b/authfd.c
index 61faad123..5dba87d26 100644
--- a/authfd.c
+++ b/authfd.c
@@ -545,12 +545,6 @@ ssh_add_identity_constrained(AuthenticationConnection *auth, Key *key,
         return decode_reply(type);
 }
 
-int
-ssh_add_identity(AuthenticationConnection *auth, Key *key, const char *comment)
-{
-        return ssh_add_identity_constrained(auth, key, comment, 0, 0);
-}
-
 /*
  * Removes an identity from the authentication server.  This call is not
  * meant to be used by normal applications.
diff --git a/authfd.h b/authfd.h
index 3da256112..31b24e173 100644
--- a/authfd.h
+++ b/authfd.h
@@ -75,7 +75,6 @@ void	ssh_close_authentication_connection(AuthenticationConnection *);
 int      ssh_get_num_identities(AuthenticationConnection *, int);
 Key     *ssh_get_first_identity(AuthenticationConnection *, char **, int);
 Key     *ssh_get_next_identity(AuthenticationConnection *, char **, int);
-int      ssh_add_identity(AuthenticationConnection *, Key *, const char *);
 int      ssh_add_identity_constrained(AuthenticationConnection *, Key *,
     const char *, u_int, u_int);
 int      ssh_remove_identity(AuthenticationConnection *, Key *);
diff --git a/debian/changelog b/debian/changelog
index 8ff7c54ac..ed90f6561 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,11 @@ openssh (1:5.3p1-1) UNRELEASED; urgency=low
   * New upstream release.
   * Update to GSSAPI patch from
     http://www.sxw.org.uk/computing/patches/openssh-5.3p1-gsskex-all-20100124.patch.
+  * Backport from upstream:
+    - Do not fall back to adding keys without contraints (ssh-add -c / -t
+      ...) when the agent refuses the constrained add request. This was a
+      useful migration measure back in 2002 when constraints were new, but
+      just adds risk now (LP: #209447).
 
  -- Colin Watson <cjwatson@debian.org>  Sun, 24 Jan 2010 22:32:25 +0000
 
diff --git a/ssh-add.c b/ssh-add.c
index d58c82156..b31a88636 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -203,9 +203,6 @@ add_file(AuthenticationConnection *ac, const char *filename)
                 if (confirm != 0)
                         fprintf(stderr,
                             "The user has to confirm each use of the key\n");
-        } else if (ssh_add_identity(ac, private, comment)) {
-                fprintf(stderr, "Identity added: %s (%s)\n", filename, comment);
-                ret = 0;
         } else {
                 fprintf(stderr, "Could not add identity: %s\n", filename);
         }