6 files changed, 118 insertions, 163 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index e8c4eb71a..6b27e0a3f 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-db4cdf7b763414af951c7f4031b10679c54d7988
-db4cdf7b763414af951c7f4031b10679c54d7988
+63d5fa28e16d96db6bac2dbe3fcecb65328f8966
+63d5fa28e16d96db6bac2dbe3fcecb65328f8966
 796ba4fd011b5d0d9d78d592ba2f30fc9d5ed2e7
 796ba4fd011b5d0d9d78d592ba2f30fc9d5ed2e7
 openssh_6.6p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index d92aac4a7..017f5bb0e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -11,7 +11,8 @@ openssh (1:6.6p1-1) UNRELEASED; urgency=medium
 
   [ Matthew Vernon ]
   * Fix failure to check SSHFP records if server presents a certificate
-    (bug reported by me, patch largely by Mark Wooding) (Closes: #742513)
+    (bug reported by me, patch by upstream's Damien Miller; thanks also to
+    Mark Wooding for his help in fixing this) (Closes: #742513)
 
  -- Colin Watson <cjwatson@debian.org>  Thu, 20 Mar 2014 00:32:46 +0000
 
diff --git a/debian/patches/series b/debian/patches/series
index 7bd72e6ed..de7c9902d 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -26,4 +26,4 @@ no-openssl-version-check.patch
 gnome-ssh-askpass2-icon.patch
 sigstop.patch
 debian-config.patch
-sshfp_with_server_cert
+sshfp_with_server_cert_upstr
diff --git a/debian/patches/sshfp_with_server_cert b/debian/patches/sshfp_with_server_cert
deleted file mode 100644
index 7e6a489e6..000000000
--- a/debian/patches/sshfp_with_server_cert
+++ /dev/null
@@ -1,112 +0,0 @@
-From db4cdf7b763414af951c7f4031b10679c54d7988 Mon Sep 17 00:00:00 2001
-From: Matthew Vernon <mcv21@cam.ac.uk>
-Date: Tue, 25 Mar 2014 11:02:33 +0000
-Subject: Attempt SSHFP lookup even if server presents a certificate
-
-If an ssh server presents a certificate to the client, then the client
-does not check the DNS for SSHFP records. This means that a malicious
-server can essentially disable DNS-host-key-checking, which means the
-client will fall back to asking the user (who will just say "yes" to
-the fingerprint, sadly).
-
-This patch means that the ssh client will, if necessary, extract the
-server key from the proffered certificate, and attempt to verify it
-against the DNS. The patch was written by Mark Wooding
-<mdw@distorted.org.uk>. I modified it to add one debug2 call, reviewed
-it, and tested it.
-
-Signed-off-by: Matthew Vernon <matthew@debian.org>
-Bug-Debian: http://bugs.debian.org/742513
-Patch-Name: sshfp_with_server_cert
----
- sshconnect.c |   67 ++++++++++++++++++++++++++++++++++++++++------------------
- 1 file changed, 47 insertions(+), 20 deletions(-)
-
-diff --git a/sshconnect.c b/sshconnect.c
-index 87c3770..b8510d2 100644
---- a/sshconnect.c
-+++ b/sshconnect.c
-@@ -1218,36 +1218,63 @@ fail:
-        return -1;
- }
- 
-+static int
-+check_host_key_sshfp(char *host, struct sockaddr *hostaddr, Key *host_key)
-+{
-+       int rc = -1;
-+       int flags = 0;
-+       Key *raw_key = NULL;
-+
-+       if (!options.verify_host_key_dns)
-+               goto done;
-+
-+       /* XXX certs are not yet supported for DNS; try looking the raw key
-+        * up in the DNS anyway.
-+        */
-+       if (key_is_cert(host_key)) {
-+         debug2("Extracting key from cert for SSHFP lookup");
-+               raw_key = key_from_private(host_key);
-+               if (key_drop_cert(raw_key))
-+                       fatal("Couldn't drop certificate");
-+               host_key = raw_key;
-+       }
-+
-+       if (verify_host_key_dns(host, hostaddr, host_key, &flags))
-+               goto done;
-+
-+       if (flags & DNS_VERIFY_FOUND) {
-+
-+               if (options.verify_host_key_dns == 1 &&
-+                   flags & DNS_VERIFY_MATCH &&
-+                   flags & DNS_VERIFY_SECURE) {
-+                       rc = 0;
-+               } else if (flags & DNS_VERIFY_MATCH) {
-+                       matching_host_key_dns = 1;
-+               } else {
-+                       warn_changed_key(host_key);
-+                       error("Update the SSHFP RR in DNS with the new "
-+                             "host key to get rid of this message.");
-+               }
-+       }
-+
-+done:
-+       if (raw_key)
-+               key_free(raw_key);
-+       return rc;
-+}
-+
- /* returns 0 if key verifies or -1 if key does NOT verify */
- int
- verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
- {
--       int flags = 0;
-        char *fp;
- 
-        fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
-        debug("Server host key: %s %s", key_type(host_key), fp);
-        free(fp);
- 
--       /* XXX certs are not yet supported for DNS */
--       if (!key_is_cert(host_key) && options.verify_host_key_dns &&
--           verify_host_key_dns(host, hostaddr, host_key, &flags) == 0) {
--               if (flags & DNS_VERIFY_FOUND) {
--
--                       if (options.verify_host_key_dns == 1 &&
--                           flags & DNS_VERIFY_MATCH &&
--                           flags & DNS_VERIFY_SECURE)
--                               return 0;
--
--                       if (flags & DNS_VERIFY_MATCH) {
--                               matching_host_key_dns = 1;
--                       } else {
--                               warn_changed_key(host_key);
--                               error("Update the SSHFP RR in DNS with the new "
--                                   "host key to get rid of this message.");
--                       }
--               }
--       }
-+       if (check_host_key_sshfp(host, hostaddr, host_key) == 0)
-+               return 0;
- 
-        return check_host_key(host, hostaddr, options.port, host_key, RDRW,
-            options.user_hostfiles, options.num_user_hostfiles,
diff --git a/debian/patches/sshfp_with_server_cert_upstr b/debian/patches/sshfp_with_server_cert_upstr
new file mode 100644
index 000000000..dd642d2a3
--- /dev/null
+++ b/debian/patches/sshfp_with_server_cert_upstr
@@ -0,0 +1,83 @@
+From 63d5fa28e16d96db6bac2dbe3fcecb65328f8966 Mon Sep 17 00:00:00 2001
+From: Matthew Vernon <mcv21@cam.ac.uk>
+Date: Wed, 26 Mar 2014 15:32:23 +0000
+Subject: Attempt SSHFP lookup even if server presents a certificate
+
+If an ssh server presents a certificate to the client, then the client
+does not check the DNS for SSHFP records. This means that a malicious
+server can essentially disable DNS-host-key-checking, which means the
+client will fall back to asking the user (who will just say "yes" to
+the fingerprint, sadly).
+
+This patch is by Damien Miller (of openssh upstream). It's simpler
+than the patch by Mark Wooding which I applied yesterday; a copy is
+taken of the proffered key/cert, the key extracted from the cert (if
+necessary), and then the DNS consulted.
+
+Signed-off-by: Matthew Vernon <matthew@debian.org>
+Bug-Debian: http://bugs.debian.org/742513
+Patch-Name: sshfp_with_server_cert_upstr
+---
+ sshconnect.c |   42 ++++++++++++++++++++++++++----------------
+ 1 file changed, 26 insertions(+), 16 deletions(-)
+
+diff --git a/sshconnect.c b/sshconnect.c
+index 87c3770..324f5e0 100644
+--- a/sshconnect.c
++++ b/sshconnect.c
+@@ -1224,29 +1224,39 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
+ {
+        int flags = 0;
+        char *fp;
++       Key *plain = NULL;
+ 
+        fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
+        debug("Server host key: %s %s", key_type(host_key), fp);
+        free(fp);
+ 
+-       /* XXX certs are not yet supported for DNS */
+-       if (!key_is_cert(host_key) && options.verify_host_key_dns &&
+-           verify_host_key_dns(host, hostaddr, host_key, &flags) == 0) {
+-               if (flags & DNS_VERIFY_FOUND) {
+-
+-                       if (options.verify_host_key_dns == 1 &&
+-                           flags & DNS_VERIFY_MATCH &&
+-                           flags & DNS_VERIFY_SECURE)
+-                               return 0;
+-
+-                       if (flags & DNS_VERIFY_MATCH) {
+-                               matching_host_key_dns = 1;
+-                       } else {
+-                               warn_changed_key(host_key);
+-                               error("Update the SSHFP RR in DNS with the new "
+-                                   "host key to get rid of this message.");
++       if (options.verify_host_key_dns) {
++               /*
++                * XXX certs are not yet supported for DNS, so downgrade
++                * them and try the plain key.
++                */
++               plain = key_from_private(host_key);
++               if (key_is_cert(plain))
++                       key_drop_cert(plain);
++               if (verify_host_key_dns(host, hostaddr, plain, &flags) == 0) {
++                       if (flags & DNS_VERIFY_FOUND) {
++                               if (options.verify_host_key_dns == 1 &&
++                                   flags & DNS_VERIFY_MATCH &&
++                                   flags & DNS_VERIFY_SECURE) {
++                                       key_free(plain);
++                                       return 0;
++                               }
++                               if (flags & DNS_VERIFY_MATCH) {
++                                       matching_host_key_dns = 1;
++                               } else {
++                                       warn_changed_key(plain);
++                                       error("Update the SSHFP RR in DNS "
++                                           "with the new host key to get rid "
++                                           "of this message.");
++                               }
+                        }
+                }
++               key_free(plain);
+        }
+ 
+        return check_host_key(host, hostaddr, options.port, host_key, RDRW,
diff --git a/sshconnect.c b/sshconnect.c
index b8510d201..324f5e0a3 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -1218,63 +1218,46 @@ fail:
         return -1;
 }
 
-static int
-check_host_key_sshfp(char *host, struct sockaddr *hostaddr, Key *host_key)
-{
-        int rc = -1;
-        int flags = 0;
-        Key *raw_key = NULL;
-
-        if (!options.verify_host_key_dns)
-                goto done;
-
-        /* XXX certs are not yet supported for DNS; try looking the raw key
-         * up in the DNS anyway.
-         */
-        if (key_is_cert(host_key)) {
-          debug2("Extracting key from cert for SSHFP lookup");
-                raw_key = key_from_private(host_key);
-                if (key_drop_cert(raw_key))
-                        fatal("Couldn't drop certificate");
-                host_key = raw_key;
-        }
-
-        if (verify_host_key_dns(host, hostaddr, host_key, &flags))
-                goto done;
-
-        if (flags & DNS_VERIFY_FOUND) {
-
-                if (options.verify_host_key_dns == 1 &&
-                    flags & DNS_VERIFY_MATCH &&
-                    flags & DNS_VERIFY_SECURE) {
-                        rc = 0;
-                } else if (flags & DNS_VERIFY_MATCH) {
-                        matching_host_key_dns = 1;
-                } else {
-                        warn_changed_key(host_key);
-                        error("Update the SSHFP RR in DNS with the new "
-                              "host key to get rid of this message.");
-                }
-        }
-
-done:
-        if (raw_key)
-                key_free(raw_key);
-        return rc;
-}
-
 /* returns 0 if key verifies or -1 if key does NOT verify */
 int
 verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
 {
+        int flags = 0;
         char *fp;
+        Key *plain = NULL;
 
         fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
         debug("Server host key: %s %s", key_type(host_key), fp);
         free(fp);
 
-        if (check_host_key_sshfp(host, hostaddr, host_key) == 0)
-                return 0;
+        if (options.verify_host_key_dns) {
+                /*
+                 * XXX certs are not yet supported for DNS, so downgrade
+                 * them and try the plain key.
+                 */
+                plain = key_from_private(host_key);
+                if (key_is_cert(plain))
+                        key_drop_cert(plain);
+                if (verify_host_key_dns(host, hostaddr, plain, &flags) == 0) {
+                        if (flags & DNS_VERIFY_FOUND) {
+                                if (options.verify_host_key_dns == 1 &&
+                                    flags & DNS_VERIFY_MATCH &&
+                                    flags & DNS_VERIFY_SECURE) {
+                                        key_free(plain);
+                                        return 0;
+                                }
+                                if (flags & DNS_VERIFY_MATCH) {
+                                        matching_host_key_dns = 1;
+                                } else {
+                                        warn_changed_key(plain);
+                                        error("Update the SSHFP RR in DNS "
+                                            "with the new host key to get rid "
+                                            "of this message.");
+                                }
+                        }
+                }
+                key_free(plain);
+        }
 
         return check_host_key(host, hostaddr, options.port, host_key, RDRW,
             options.user_hostfiles, options.num_user_hostfiles,