1 files changed, 29 insertions, 7 deletions

diff --git a/auth.c b/auth.c
index 9a36f1dac..7f6c6c8ad 100644
--- a/auth.c
+++ b/auth.c
@@ -59,6 +59,7 @@
 #include "servconf.h"
 #include "key.h"
 #include "hostfile.h"
+#include "authfile.h"
 #include "auth.h"
 #include "auth-options.h"
 #include "canohost.h"
@@ -407,8 +408,7 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
                 user_hostfile = tilde_expand_filename(userfile, pw->pw_uid);
                 if (options.strict_modes &&
                     (stat(user_hostfile, &st) == 0) &&
-                    ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
-                    (st.st_mode & 022) != 0)) {
+                    !secure_permissions(&st, pw->pw_uid)) {
                         logit("Authentication refused for %.100s: "
                             "bad owner or modes for %.200s",
                             pw->pw_name, user_hostfile);
@@ -470,8 +470,7 @@ auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
                 snprintf(err, errlen, "%s is not a regular file", buf);
                 return -1;
         }
-        if ((!platform_sys_dir_uid(stp->st_uid) && stp->st_uid != uid) ||
-            (stp->st_mode & 022) != 0) {
+        if (!secure_permissions(stp, uid)) {
                 snprintf(err, errlen, "bad ownership or modes for file %s",
                     buf);
                 return -1;
@@ -486,8 +485,7 @@ auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
                 strlcpy(buf, cp, sizeof(buf));
 
                 if (stat(buf, &st) < 0 ||
-                    (!platform_sys_dir_uid(st.st_uid) && st.st_uid != uid) ||
-                    (st.st_mode & 022) != 0) {
+                    !secure_permissions(&st, uid)) {
                         snprintf(err, errlen,
                             "bad ownership or modes for directory %s", buf);
                         return -1;
@@ -657,10 +655,34 @@ getpwnamallow(const char *user)
 
 /* Returns 1 if key is revoked by revoked_keys_file, 0 otherwise */
 int
-auth_key_is_revoked(Key *key)
+auth_key_is_revoked(Key *key, int hostkey)
 {
         char *key_fp;
 
+        if (blacklisted_key(key, &key_fp) == 1) {
+                if (options.permit_blacklisted_keys) {
+                        if (hostkey)
+                                error("Host key %s blacklisted (see "
+                                    "ssh-vulnkey(1)); continuing anyway",
+                                    key_fp);
+                        else
+                                logit("Public key %s from %s blacklisted (see "
+                                    "ssh-vulnkey(1)); continuing anyway",
+                                    key_fp, get_remote_ipaddr());
+                        free(key_fp);
+                } else {
+                        if (hostkey)
+                                error("Host key %s blacklisted (see "
+                                    "ssh-vulnkey(1))", key_fp);
+                        else
+                                logit("Public key %s from %s blacklisted (see "
+                                    "ssh-vulnkey(1))",
+                                    key_fp, get_remote_ipaddr());
+                        free(key_fp);
+                        return 1;
+                }
+        }
+
         if (options.revoked_keys_file == NULL)
                 return 0;
         switch (ssh_krl_file_contains_key(options.revoked_keys_file, key)) {