11 files changed, 63 insertions, 88 deletions

diff --git a/auth-rh-rsa.c b/auth-rh-rsa.c
index cd272e4ca..20ee7c6c4 100644
--- a/auth-rh-rsa.c
+++ b/auth-rh-rsa.c
@@ -20,7 +20,6 @@
 #include <pwd.h>
 #include <stdarg.h>
 
-#include "xmalloc.h"
 #include "packet.h"
 #include "uidswap.h"
 #include "log.h"
@@ -28,7 +27,6 @@
 #include "servconf.h"
 #include "key.h"
 #include "hostfile.h"
-#include "authfile.h"
 #include "pathnames.h"
 #include "auth.h"
 #include "canohost.h"
@@ -44,23 +42,10 @@ int
 auth_rhosts_rsa_key_allowed(struct passwd *pw, char *cuser, char *chost,
     Key *client_host_key)
 {
-        char *fp;
         HostStatus host_status;
 
-        if (blacklisted_key(client_host_key) == 1) {
-                fp = key_fingerprint(client_host_key, SSH_FP_MD5, SSH_FP_HEX);
-                if (options.permit_blacklisted_keys)
-                        logit("Public key %s from %s blacklisted (see "
-                            "ssh-vulnkey(1)); continuing anyway",
-                            fp, get_remote_ipaddr());
-                else
-                        logit("Public key %s from %s blacklisted (see "
-                            "ssh-vulnkey(1))",
-                            fp, get_remote_ipaddr());
-                xfree(fp);
-                if (!options.permit_blacklisted_keys)
-                        return 0;
-        }
+        if (reject_blacklisted_key(client_host_key, 0) == 1)
+                return 0;
 
         /* Check if we would accept it using rhosts authentication. */
         if (!auth_rhosts(pw, cuser))
diff --git a/auth-rsa.c b/auth-rsa.c
index 898e9eb50..b7cbc0fe5 100644
--- a/auth-rsa.c
+++ b/auth-rsa.c
@@ -40,9 +40,7 @@
 #include "servconf.h"
 #include "key.h"
 #include "hostfile.h"
-#include "authfile.h"
 #include "auth.h"
-#include "canohost.h"
 #ifdef GSSAPI
 #include "ssh-gss.h"
 #endif
@@ -223,7 +221,6 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
                 char *cp;
                 char *key_options;
                 int keybits;
-                char *fp;
 
                 /* Skip leading whitespace, empty and comment lines. */
                 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
@@ -268,20 +265,8 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
                             "actual %d vs. announced %d.",
                             file, linenum, BN_num_bits(key->rsa->n), bits);
 
-                if (blacklisted_key(key) == 1) {
-                        fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
-                        if (options.permit_blacklisted_keys)
-                                logit("Public key %s from %s blacklisted (see "
-                                    "ssh-vulnkey(1)); continuing anyway",
-                                    fp, get_remote_ipaddr());
-                        else
-                                logit("Public key %s from %s blacklisted (see "
-                                    "ssh-vulnkey(1))",
-                                    fp, get_remote_ipaddr());
-                        xfree(fp);
-                        if (!options.permit_blacklisted_keys)
-                                continue;
-                }
+                if (reject_blacklisted_key(key, 0) == 1)
+                        continue;
 
                 /* We have found the desired key. */
                 /*
diff --git a/auth.c b/auth.c
index c1e0f4812..fa32da70f 100644
--- a/auth.c
+++ b/auth.c
@@ -57,6 +57,7 @@
 #include "servconf.h"
 #include "key.h"
 #include "hostfile.h"
+#include "authfile.h"
 #include "auth.h"
 #include "auth-options.h"
 #include "canohost.h"
@@ -397,6 +398,38 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
         return host_status;
 }
 
+int
+reject_blacklisted_key(Key *key, int hostkey)
+{
+        char *fp;
+
+        if (blacklisted_key(key, &fp) != 1)
+                return 0;
+
+        if (options.permit_blacklisted_keys) {
+                if (hostkey)
+                        error("Host key %s blacklisted (see "
+                            "ssh-vulnkey(1)); continuing anyway", fp);
+                else
+                        logit("Public key %s from %s blacklisted (see "
+                            "ssh-vulnkey(1)); continuing anyway",
+                            fp, get_remote_ipaddr());
+                xfree(fp);
+        } else {
+                if (hostkey)
+                        error("Host key %s blacklisted (see "
+                            "ssh-vulnkey(1))", fp);
+                else
+                        logit("Public key %s from %s blacklisted (see "
+                            "ssh-vulnkey(1))",
+                            fp, get_remote_ipaddr());
+                xfree(fp);
+                return 1;
+        }
+
+        return 0;
+}
+
 
 /*
  * Check a given file for security. This is defined as all components
diff --git a/auth.h b/auth.h
index 6c22fabcc..e286b33b5 100644
--- a/auth.h
+++ b/auth.h
@@ -175,6 +175,8 @@ HostStatus
 check_key_in_hostfiles(struct passwd *, Key *, const char *,
     const char *, const char *);
 
+int     reject_blacklisted_key(Key *, int);
+
 /* hostkey handling */
 Key     *get_hostkey_by_index(int);
 Key     *get_hostkey_by_type(int);
diff --git a/auth2-hostbased.c b/auth2-hostbased.c
index d7009eeb0..f6fb74043 100644
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
@@ -40,7 +40,6 @@
 #include "compat.h"
 #include "key.h"
 #include "hostfile.h"
-#include "authfile.h"
 #include "auth.h"
 #include "canohost.h"
 #ifdef GSSAPI
@@ -142,25 +141,12 @@ int
 hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
     Key *key)
 {
-        char *fp;
         const char *resolvedname, *ipaddr, *lookup;
         HostStatus host_status;
         int len;
 
-        if (blacklisted_key(key) == 1) {
-                fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
-                if (options.permit_blacklisted_keys)
-                        logit("Public key %s from %s blacklisted (see "
-                            "ssh-vulnkey(1)); continuing anyway",
-                            fp, get_remote_ipaddr());
-                else
-                        logit("Public key %s from %s blacklisted (see "
-                            "ssh-vulnkey(1))",
-                            fp, get_remote_ipaddr());
-                xfree(fp);
-                if (!options.permit_blacklisted_keys)
-                        return 0;
-        }
+        if (reject_blacklisted_key(key, 0) == 1)
+                return 0;
 
         resolvedname = get_canonical_hostname(options.use_dns);
         ipaddr = get_remote_ipaddr();
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 0870d64f6..4f305ef1b 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -42,7 +42,6 @@
 #include "compat.h"
 #include "key.h"
 #include "hostfile.h"
-#include "authfile.h"
 #include "auth.h"
 #include "pathnames.h"
 #include "uidswap.h"
@@ -270,24 +269,11 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file)
 int
 user_key_allowed(struct passwd *pw, Key *key)
 {
-        char *fp;
         int success;
         char *file;
 
-        if (blacklisted_key(key) == 1) {
-                fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
-                if (options.permit_blacklisted_keys)
-                        logit("Public key %s from %s blacklisted (see "
-                            "ssh-vulnkey(1)); continuing anyway",
-                            fp, get_remote_ipaddr());
-                else
-                        logit("Public key %s from %s blacklisted (see "
-                            "ssh-vulnkey(1))",
-                            fp, get_remote_ipaddr());
-                xfree(fp);
-                if (!options.permit_blacklisted_keys)
-                        return 0;
-        }
+        if (reject_blacklisted_key(key, 0) == 1)
+                return 0;
 
         file = authorized_keys_file(pw);
         success = user_key_allowed2(pw, key, file);
diff --git a/authfile.c b/authfile.c
index cffea2a6c..0d837b9bd 100644
--- a/authfile.c
+++ b/authfile.c
@@ -681,7 +681,7 @@ key_load_public(const char *filename, char **commentp)
 
 /* Scan a blacklist of known-vulnerable keys in blacklist_file. */
 static int
-blacklisted_key_in_file(const Key *key, const char *blacklist_file)
+blacklisted_key_in_file(const Key *key, const char *blacklist_file, char **fp)
 {
         int fd = -1;
         char *dgst_hex = NULL;
@@ -770,16 +770,23 @@ blacklisted_key_in_file(const Key *key, const char *blacklist_file)
 out:
         if (dgst_packed)
                 xfree(dgst_packed);
-        if (dgst_hex)
+        if (ret != 1 && dgst_hex) {
                 xfree(dgst_hex);
+                dgst_hex = NULL;
+        }
+        if (fp)
+                *fp = dgst_hex;
         if (fd >= 0)
                 close(fd);
         return ret;
 }
 
-/* Scan blacklists of known-vulnerable keys. */
+/*
+ * Scan blacklists of known-vulnerable keys. If a vulnerable key is found,
+ * its fingerprint is returned in *fp, unless fp is NULL.
+ */
 int
-blacklisted_key(const Key *key)
+blacklisted_key(const Key *key, char **fp)
 {
         Key *public;
         char *blacklist_file;
@@ -791,7 +798,7 @@ blacklisted_key(const Key *key)
 
         xasprintf(&blacklist_file, "%s.%s-%u",
             _PATH_BLACKLIST, key_type(public), key_size(public));
-        ret = blacklisted_key_in_file(public, blacklist_file);
+        ret = blacklisted_key_in_file(public, blacklist_file, fp);
         xfree(blacklist_file);
         if (ret > 0) {
                 key_free(public);
@@ -800,7 +807,7 @@ blacklisted_key(const Key *key)
 
         xasprintf(&blacklist_file, "%s.%s-%u",
             _PATH_BLACKLIST_CONFIG, key_type(public), key_size(public));
-        ret2 = blacklisted_key_in_file(public, blacklist_file);
+        ret2 = blacklisted_key_in_file(public, blacklist_file, fp);
         xfree(blacklist_file);
         if (ret2 > ret)
                 ret = ret2;
diff --git a/authfile.h b/authfile.h
index 91557e4a2..e4f59fddb 100644
--- a/authfile.h
+++ b/authfile.h
@@ -23,6 +23,6 @@ Key	*key_load_private_type(int, const char *, const char *, char **, int *);
 Key     *key_load_private_pem(int, int, const char *, char **);
 int      key_perm_ok(int, const char *);
 
-int      blacklisted_key(const Key *key);
+int      blacklisted_key(const Key *key, char **fp);
 
 #endif
diff --git a/debian/changelog b/debian/changelog
index 81db5f171..c42a3c50d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,8 @@
 openssh (1:4.7p1-12) UNRELEASED; urgency=low
 
   * Fill in CVE identifier for ssh-vulnkey bug fixed in 1:4.7p1-10.
+  * Refactor rejection of blacklisted user keys into a single
+    reject_blacklisted_key function in auth.c (thanks, Dmitry V. Levin).
   * debconf template translations:
     - Update Dutch (thanks, Bart Cornelis; closes: #483004).
 
diff --git a/ssh-vulnkey.c b/ssh-vulnkey.c
index e0e3f4c2f..31d252b43 100644
--- a/ssh-vulnkey.c
+++ b/ssh-vulnkey.c
@@ -105,7 +105,7 @@ do_key(const char *filename, u_long linenum,
         if (public->type == KEY_RSA1)
                 public->type = KEY_RSA;
 
-        blacklist_status = blacklisted_key(public);
+        blacklist_status = blacklisted_key(public, NULL);
         if (blacklist_status == -1)
                 describe_key(filename, linenum,
                     "Unknown (blacklist file not installed)", key, comment, 0);
diff --git a/sshd.c b/sshd.c
index df025906f..80cfd56d8 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1496,20 +1496,9 @@ main(int ac, char **av)
 
         for (i = 0; i < options.num_host_key_files; i++) {
                 key = key_load_private(options.host_key_files[i], "", NULL);
-                if (key && blacklisted_key(key) == 1) {
-                        char *fp;
-                        fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
-                        if (options.permit_blacklisted_keys)
-                                error("Host key %s blacklisted (see "
-                                    "ssh-vulnkey(1)); continuing anyway", fp);
-                        else
-                                error("Host key %s blacklisted (see "
-                                    "ssh-vulnkey(1))", fp);
-                        xfree(fp);
-                        if (!options.permit_blacklisted_keys) {
-                                sensitive_data.host_keys[i] = NULL;
-                                continue;
-                        }
+                if (key && reject_blacklisted_key(key, 1) == 1) {
+                        sensitive_data.host_keys[i] = NULL;
+                        continue;
                 }
                 sensitive_data.host_keys[i] = key;
                 if (key == NULL) {