summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--kex.c5
-rw-r--r--kex.h2
-rw-r--r--servconf.c9
-rw-r--r--servconf.h2
-rw-r--r--sshconnect.c2
-rw-r--r--sshd.c2
-rw-r--r--sshd_config.55
7 files changed, 22 insertions, 5 deletions
diff --git a/kex.c b/kex.c
index 0e64bf760..aa5acaac3 100644
--- a/kex.c
+++ b/kex.c
@@ -1225,7 +1225,7 @@ send_error(struct ssh *ssh, char *msg)
1225 */ 1225 */
1226int 1226int
1227kex_exchange_identification(struct ssh *ssh, int timeout_ms, 1227kex_exchange_identification(struct ssh *ssh, int timeout_ms,
1228 const char *version_addendum) 1228 int debian_banner, const char *version_addendum)
1229{ 1229{
1230 int remote_major, remote_minor, mismatch, oerrno = 0; 1230 int remote_major, remote_minor, mismatch, oerrno = 0;
1231 size_t len, i, n; 1231 size_t len, i, n;
@@ -1243,7 +1243,8 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
1243 if (version_addendum != NULL && *version_addendum == '\0') 1243 if (version_addendum != NULL && *version_addendum == '\0')
1244 version_addendum = NULL; 1244 version_addendum = NULL;
1245 if ((r = sshbuf_putf(our_version, "SSH-%d.%d-%.100s%s%s\r\n", 1245 if ((r = sshbuf_putf(our_version, "SSH-%d.%d-%.100s%s%s\r\n",
1246 PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE, 1246 PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2,
1247 debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM,
1247 version_addendum == NULL ? "" : " ", 1248 version_addendum == NULL ? "" : " ",
1248 version_addendum == NULL ? "" : version_addendum)) != 0) { 1249 version_addendum == NULL ? "" : version_addendum)) != 0) {
1249 oerrno = errno; 1250 oerrno = errno;
diff --git a/kex.h b/kex.h
index fe7141414..938dca03b 100644
--- a/kex.h
+++ b/kex.h
@@ -194,7 +194,7 @@ char *kex_names_cat(const char *, const char *);
194int kex_assemble_names(char **, const char *, const char *); 194int kex_assemble_names(char **, const char *, const char *);
195int kex_gss_names_valid(const char *); 195int kex_gss_names_valid(const char *);
196 196
197int kex_exchange_identification(struct ssh *, int, const char *); 197int kex_exchange_identification(struct ssh *, int, int, const char *);
198 198
199struct kex *kex_new(void); 199struct kex *kex_new(void);
200int kex_ready(struct ssh *, char *[PROPOSAL_MAX]); 200int kex_ready(struct ssh *, char *[PROPOSAL_MAX]);
diff --git a/servconf.c b/servconf.c
index ff5b9436c..cf4e52f3b 100644
--- a/servconf.c
+++ b/servconf.c
@@ -194,6 +194,7 @@ initialize_server_options(ServerOptions *options)
194 options->fingerprint_hash = -1; 194 options->fingerprint_hash = -1;
195 options->disable_forwarding = -1; 195 options->disable_forwarding = -1;
196 options->expose_userauth_info = -1; 196 options->expose_userauth_info = -1;
197 options->debian_banner = -1;
197} 198}
198 199
199/* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */ 200/* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
@@ -468,6 +469,8 @@ fill_default_server_options(ServerOptions *options)
468 options->expose_userauth_info = 0; 469 options->expose_userauth_info = 0;
469 if (options->sk_provider == NULL) 470 if (options->sk_provider == NULL)
470 options->sk_provider = xstrdup("internal"); 471 options->sk_provider = xstrdup("internal");
472 if (options->debian_banner == -1)
473 options->debian_banner = 1;
471 474
472 assemble_algorithms(options); 475 assemble_algorithms(options);
473 476
@@ -556,6 +559,7 @@ typedef enum {
556 sStreamLocalBindMask, sStreamLocalBindUnlink, 559 sStreamLocalBindMask, sStreamLocalBindUnlink,
557 sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding, 560 sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding,
558 sExposeAuthInfo, sRDomain, sPubkeyAuthOptions, sSecurityKeyProvider, 561 sExposeAuthInfo, sRDomain, sPubkeyAuthOptions, sSecurityKeyProvider,
562 sDebianBanner,
559 sDeprecated, sIgnore, sUnsupported 563 sDeprecated, sIgnore, sUnsupported
560} ServerOpCodes; 564} ServerOpCodes;
561 565
@@ -719,6 +723,7 @@ static struct {
719 { "rdomain", sRDomain, SSHCFG_ALL }, 723 { "rdomain", sRDomain, SSHCFG_ALL },
720 { "casignaturealgorithms", sCASignatureAlgorithms, SSHCFG_ALL }, 724 { "casignaturealgorithms", sCASignatureAlgorithms, SSHCFG_ALL },
721 { "securitykeyprovider", sSecurityKeyProvider, SSHCFG_GLOBAL }, 725 { "securitykeyprovider", sSecurityKeyProvider, SSHCFG_GLOBAL },
726 { "debianbanner", sDebianBanner, SSHCFG_GLOBAL },
722 { NULL, sBadOption, 0 } 727 { NULL, sBadOption, 0 }
723}; 728};
724 729
@@ -2393,6 +2398,10 @@ process_server_config_line_depth(ServerOptions *options, char *line,
2393 *charptr = xstrdup(arg); 2398 *charptr = xstrdup(arg);
2394 break; 2399 break;
2395 2400
2401 case sDebianBanner:
2402 intptr = &options->debian_banner;
2403 goto parse_flag;
2404
2396 case sDeprecated: 2405 case sDeprecated:
2397 case sIgnore: 2406 case sIgnore:
2398 case sUnsupported: 2407 case sUnsupported:
diff --git a/servconf.h b/servconf.h
index 253cad97e..5a2b60512 100644
--- a/servconf.h
+++ b/servconf.h
@@ -226,6 +226,8 @@ typedef struct {
226 int expose_userauth_info; 226 int expose_userauth_info;
227 u_int64_t timing_secret; 227 u_int64_t timing_secret;
228 char *sk_provider; 228 char *sk_provider;
229
230 int debian_banner;
229} ServerOptions; 231} ServerOptions;
230 232
231/* Information about the incoming connection as used by Match */ 233/* Information about the incoming connection as used by Match */
diff --git a/sshconnect.c b/sshconnect.c
index f20d3e792..1e5b8ea5a 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -1293,7 +1293,7 @@ ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost,
1293 lowercase(host); 1293 lowercase(host);
1294 1294
1295 /* Exchange protocol version identification strings with the server. */ 1295 /* Exchange protocol version identification strings with the server. */
1296 if ((r = kex_exchange_identification(ssh, timeout_ms, NULL)) != 0) 1296 if ((r = kex_exchange_identification(ssh, timeout_ms, 1, NULL)) != 0)
1297 sshpkt_fatal(ssh, r, "banner exchange"); 1297 sshpkt_fatal(ssh, r, "banner exchange");
1298 1298
1299 /* Put the connection into non-blocking mode. */ 1299 /* Put the connection into non-blocking mode. */
diff --git a/sshd.c b/sshd.c
index e8b332ca4..baee13506 100644
--- a/sshd.c
+++ b/sshd.c
@@ -2181,7 +2181,7 @@ main(int ac, char **av)
2181 if (!debug_flag) 2181 if (!debug_flag)
2182 alarm(options.login_grace_time); 2182 alarm(options.login_grace_time);
2183 2183
2184 if ((r = kex_exchange_identification(ssh, -1, 2184 if ((r = kex_exchange_identification(ssh, -1, options.debian_banner,
2185 options.version_addendum)) != 0) 2185 options.version_addendum)) != 0)
2186 sshpkt_fatal(ssh, r, "banner exchange"); 2186 sshpkt_fatal(ssh, r, "banner exchange");
2187 2187
diff --git a/sshd_config.5 b/sshd_config.5
index 9f093be1f..753ceda10 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -540,6 +540,11 @@ or
540.Cm no . 540.Cm no .
541The default is 541The default is
542.Cm yes . 542.Cm yes .
543.It Cm DebianBanner
544Specifies whether the distribution-specified extra version suffix is
545included during initial protocol handshake.
546The default is
547.Cm yes .
543.It Cm DenyGroups 548.It Cm DenyGroups
544This keyword can be followed by a list of group name patterns, separated 549This keyword can be followed by a list of group name patterns, separated
545by spaces. 550by spaces.