1 files changed, 2 insertions, 94 deletions

diff --git a/auth.c b/auth.c
index 24527dd7c..f56dcc6cf 100644
--- a/auth.c
+++ b/auth.c
@@ -363,7 +363,8 @@ auth_root_allowed(const char *method)
         case PERMIT_NO_PASSWD:
                 if (strcmp(method, "publickey") == 0 ||
                     strcmp(method, "hostbased") == 0 ||
-                    strcmp(method, "gssapi-with-mic") == 0)
+                    strcmp(method, "gssapi-with-mic") == 0 ||
+                    strcmp(method, "gssapi-keyex") == 0)
                         return 1;
                 break;
         case PERMIT_FORCED_ONLY:
@@ -786,99 +787,6 @@ fakepw(void)
 }
 
 /*
- * Returns the remote DNS hostname as a string. The returned string must not
- * be freed. NB. this will usually trigger a DNS query the first time it is
- * called.
- * This function does additional checks on the hostname to mitigate some
- * attacks on legacy rhosts-style authentication.
- * XXX is RhostsRSAAuthentication vulnerable to these?
- * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?)
- */
-
-static char *
-remote_hostname(struct ssh *ssh)
-{
-        struct sockaddr_storage from;
-        socklen_t fromlen;
-        struct addrinfo hints, *ai, *aitop;
-        char name[NI_MAXHOST], ntop2[NI_MAXHOST];
-        const char *ntop = ssh_remote_ipaddr(ssh);
-
-        /* Get IP address of client. */
-        fromlen = sizeof(from);
-        memset(&from, 0, sizeof(from));
-        if (getpeername(ssh_packet_get_connection_in(ssh),
-            (struct sockaddr *)&from, &fromlen) < 0) {
-                debug("getpeername failed: %.100s", strerror(errno));
-                return strdup(ntop);
-        }
-
-        ipv64_normalise_mapped(&from, &fromlen);
-        if (from.ss_family == AF_INET6)
-                fromlen = sizeof(struct sockaddr_in6);
-
-        debug3("Trying to reverse map address %.100s.", ntop);
-        /* Map the IP address to a host name. */
-        if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
-            NULL, 0, NI_NAMEREQD) != 0) {
-                /* Host name not found.  Use ip address. */
-                return strdup(ntop);
-        }
-
-        /*
-         * if reverse lookup result looks like a numeric hostname,
-         * someone is trying to trick us by PTR record like following:
-         *      1.1.1.10.in-addr.arpa.  IN PTR  2.3.4.5
-         */
-        memset(&hints, 0, sizeof(hints));
-        hints.ai_socktype = SOCK_DGRAM; /*dummy*/
-        hints.ai_flags = AI_NUMERICHOST;
-        if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
-                logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
-                    name, ntop);
-                freeaddrinfo(ai);
-                return strdup(ntop);
-        }
-
-        /* Names are stored in lowercase. */
-        lowercase(name);
-
-        /*
-         * Map it back to an IP address and check that the given
-         * address actually is an address of this host.  This is
-         * necessary because anyone with access to a name server can
-         * define arbitrary names for an IP address. Mapping from
-         * name to IP address can be trusted better (but can still be
-         * fooled if the intruder has access to the name server of
-         * the domain).
-         */
-        memset(&hints, 0, sizeof(hints));
-        hints.ai_family = from.ss_family;
-        hints.ai_socktype = SOCK_STREAM;
-        if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
-                logit("reverse mapping checking getaddrinfo for %.700s "
-                    "[%s] failed.", name, ntop);
-                return strdup(ntop);
-        }
-        /* Look for the address from the list of addresses. */
-        for (ai = aitop; ai; ai = ai->ai_next) {
-                if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
-                    sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
-                    (strcmp(ntop, ntop2) == 0))
-                                break;
-        }
-        freeaddrinfo(aitop);
-        /* If we reached the end of the list, the address was not there. */
-        if (ai == NULL) {
-                /* Address not found for the host name. */
-                logit("Address %.100s maps to %.600s, but this does not "
-                    "map back to the address.", ntop, name);
-                return strdup(ntop);
-        }
-        return strdup(name);
-}
-
-/*
  * Return the canonical name of the host in the other side of the current
  * connection.  The host name is cached, so it is efficient to call this
  * several times.