New upstream release (6.8p1).

1 files changed, 28 insertions, 8 deletions

diff --git a/auth2-hostbased.c b/auth2-hostbased.c
index 6787e4ca4..eebfe8fc3 100644
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-hostbased.c,v 1.18 2014/07/15 15:54:14 millert Exp $ */
+/* $OpenBSD: auth2-hostbased.c,v 1.24 2015/01/28 22:36:00 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -48,6 +48,7 @@
 #endif
 #include "monitor_wrap.h"
 #include "pathnames.h"
+#include "match.h"
 
 /* import */
 extern ServerOptions options;
@@ -107,6 +108,14 @@ userauth_hostbased(Authctxt *authctxt)
                     "signature format");
                 goto done;
         }
+        if (match_pattern_list(sshkey_ssh_name(key),
+            options.hostbased_key_types,
+            strlen(options.hostbased_key_types), 0) != 1) {
+                logit("%s: key type %s not in HostbasedAcceptedKeyTypes",
+                    __func__, sshkey_type(key));
+                goto done;
+        }
+
         service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
             authctxt->service;
         buffer_init(&b);
@@ -163,7 +172,7 @@ hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
         resolvedname = get_canonical_hostname(options.use_dns);
         ipaddr = get_remote_ipaddr();
 
-        debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s",
+        debug2("%s: chost %s resolvedname %s ipaddr %s", __func__,
             chost, resolvedname, ipaddr);
 
         if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') {
@@ -172,19 +181,27 @@ hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
         }
 
         if (options.hostbased_uses_name_from_packet_only) {
-                if (auth_rhosts2(pw, cuser, chost, chost) == 0)
+                if (auth_rhosts2(pw, cuser, chost, chost) == 0) {
+                        debug2("%s: auth_rhosts2 refused "
+                            "user \"%.100s\" host \"%.100s\" (from packet)",
+                            __func__, cuser, chost);
                         return 0;
+                }
                 lookup = chost;
         } else {
                 if (strcasecmp(resolvedname, chost) != 0)
                         logit("userauth_hostbased mismatch: "
                             "client sends %s, but we resolve %s to %s",
                             chost, ipaddr, resolvedname);
-                if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0)
+                if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0) {
+                        debug2("%s: auth_rhosts2 refused "
+                            "user \"%.100s\" host \"%.100s\" addr \"%.100s\"",
+                            __func__, cuser, resolvedname, ipaddr);
                         return 0;
+                }
                 lookup = resolvedname;
         }
-        debug2("userauth_hostbased: access allowed by auth_rhosts2");
+        debug2("%s: access allowed by auth_rhosts2", __func__);
 
         if (key_is_cert(key) && 
             key_cert_check_authority(key, 1, 0, lookup, &reason)) {
@@ -207,14 +224,17 @@ hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
 
         if (host_status == HOST_OK) {
                 if (key_is_cert(key)) {
-                        fp = key_fingerprint(key->cert->signature_key,
-                            SSH_FP_MD5, SSH_FP_HEX);
+                        if ((fp = sshkey_fingerprint(key->cert->signature_key,
+                            options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
+                                fatal("%s: sshkey_fingerprint fail", __func__);
                         verbose("Accepted certificate ID \"%s\" signed by "
                             "%s CA %s from %s@%s", key->cert->key_id,
                             key_type(key->cert->signature_key), fp,
                             cuser, lookup);
                 } else {
-                        fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+                        if ((fp = sshkey_fingerprint(key,
+                            options.fingerprint_hash, SSH_FP_DEFAULT)) == NULL)
+                                fatal("%s: sshkey_fingerprint fail", __func__);
                         verbose("Accepted %s public key %s from %s@%s",
                             key_type(key), fp, cuser, lookup);
                 }