Quieten logs when multiple from= restrictions are used

Bug-Debian: http://bugs.debian.org/630606
Forwarded: no
Last-Update: 2017-10-04

Patch-Name: auth-log-verbosity.patch

1 files changed, 26 insertions, 9 deletions

diff --git a/auth-options.c b/auth-options.c
index bed00eef0..ccdd0b20a 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -59,11 +59,22 @@ int forced_tun_device = -1;
 /* "principals=" option. */
 char *authorized_principals = NULL;
 
+/* Throttle log messages. */
+int logged_from_hostip = 0;
+int logged_cert_hostip = 0;
+
 extern ServerOptions options;
 
 /* XXX refactor to be stateless */
 
 void
+auth_start_parse_options(void)
+{
+        logged_from_hostip = 0;
+        logged_cert_hostip = 0;
+}
+
+void
 auth_clear_options(void)
 {
         struct ssh *ssh = active_state;         /* XXX */
@@ -322,10 +333,13 @@ auth_parse_options(struct passwd *pw, char *opts, const char *file,
                                 /* FALLTHROUGH */
                         case 0:
                                 free(patterns);
-                                logit("Authentication tried for %.100s with "
-                                    "correct key but not from a permitted "
-                                    "host (host=%.200s, ip=%.200s).",
-                                    pw->pw_name, remote_host, remote_ip);
+                                if (!logged_from_hostip) {
+                                        logit("Authentication tried for %.100s with "
+                                            "correct key but not from a permitted "
+                                            "host (host=%.200s, ip=%.200s).",
+                                            pw->pw_name, remote_host, remote_ip);
+                                        logged_from_hostip = 1;
+                                }
                                 auth_debug_add("Your host '%.200s' is not "
                                     "permitted to use this key for login.",
                                     remote_host);
@@ -549,11 +563,14 @@ parse_option_list(struct sshbuf *oblob, struct passwd *pw,
                                         break;
                                 case 0:
                                         /* no match */
-                                        logit("Authentication tried for %.100s "
-                                            "with valid certificate but not "
-                                            "from a permitted host "
-                                            "(ip=%.200s).", pw->pw_name,
-                                            remote_ip);
+                                        if (!logged_cert_hostip) {
+                                                logit("Authentication tried for %.100s "
+                                                    "with valid certificate but not "
+                                                    "from a permitted host "
+                                                    "(ip=%.200s).", pw->pw_name,
+                                                    remote_ip);
+                                                logged_cert_hostip = 1;
+                                        }
                                         auth_debug_add("Your address '%.200s' "
                                             "is not permitted to use this "
                                             "certificate for login.",