Check RSA1 keys without the need for a separate blacklist. Thanks to

Simon Tatham for the idea.

1 files changed, 9 insertions, 2 deletions

diff --git a/ssh-vulnkey.c b/ssh-vulnkey.c
index 3297c431a..f13eb1619 100644
--- a/ssh-vulnkey.c
+++ b/ssh-vulnkey.c
@@ -86,21 +86,28 @@ describe_key(const char *msg, const Key *key, const char *comment)
 int
 do_key(const Key *key, const char *comment)
 {
+        Key *public;
         char *blacklist_file;
         struct stat st;
         int ret = 1;
 
-        blacklist_file = blacklist_filename(key);
+        public = key_demote(key);
+        if (public->type == KEY_RSA1)
+                public->type = KEY_RSA;
+
+        blacklist_file = blacklist_filename(public);
         if (stat(blacklist_file, &st) < 0)
                 describe_key("Unknown (no blacklist information)",
                     key, comment);
-        else if (blacklisted_key(key)) {
+        else if (blacklisted_key(public)) {
                 describe_key("COMPROMISED", key, comment);
                 ret = 0;
         } else
                 describe_key("Not blacklisted", key, comment);
         xfree(blacklist_file);
 
+        key_free(public);
+
         return ret;
 }