1 files changed, 35 insertions, 37 deletions

diff --git a/auth.c b/auth.c
index 5e60682ce..f9b767301 100644
--- a/auth.c
+++ b/auth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.c,v 1.106 2014/07/15 15:54:14 millert Exp $ */
+/* $OpenBSD: auth.c,v 1.110 2015/02/25 17:29:38 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -27,7 +27,6 @@
 
 #include <sys/types.h>
 #include <sys/stat.h>
-#include <sys/param.h>
 
 #include <netinet/in.h>
 
@@ -50,6 +49,7 @@
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
+#include <limits.h>
 
 #include "xmalloc.h"
 #include "match.h"
@@ -71,7 +71,8 @@
 #endif
 #include "authfile.h"
 #include "monitor_wrap.h"
-#include "krl.h"
+#include "authfile.h"
+#include "ssherr.h"
 #include "compat.h"
 
 /* import */
@@ -330,13 +331,14 @@ auth_log(Authctxt *authctxt, int authenticated, int partial,
 void
 auth_maxtries_exceeded(Authctxt *authctxt)
 {
-        packet_disconnect("Too many authentication failures for "
+        error("maximum authentication attempts exceeded for "
             "%s%.100s from %.200s port %d %s",
             authctxt->valid ? "" : "invalid user ",
             authctxt->user,
             get_remote_ipaddr(),
             get_remote_port(),
             compat20 ? "ssh2" : "ssh1");
+        packet_disconnect("Too many authentication failures");
         /* NOTREACHED */
 }
 
@@ -375,7 +377,7 @@ auth_root_allowed(const char *method)
 char *
 expand_authorized_keys(const char *filename, struct passwd *pw)
 {
-        char *file, ret[MAXPATHLEN];
+        char *file, ret[PATH_MAX];
         int i;
 
         file = percent_expand(filename, "h", pw->pw_dir,
@@ -467,7 +469,7 @@ int
 auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
     uid_t uid, char *err, size_t errlen)
 {
-        char buf[MAXPATHLEN], homedir[MAXPATHLEN];
+        char buf[PATH_MAX], homedir[PATH_MAX];
         char *cp;
         int comparehome = 0;
         struct stat st;
@@ -673,43 +675,39 @@ getpwnamallow(const char *user)
 int
 auth_key_is_revoked(Key *key)
 {
-#ifdef WITH_OPENSSL
-        char *key_fp;
+        char *fp = NULL;
+        int r;
 
         if (options.revoked_keys_file == NULL)
                 return 0;
-        switch (ssh_krl_file_contains_key(options.revoked_keys_file, key)) {
-        case 0:
-                return 0;       /* Not revoked */
-        case -2:
-                break;          /* Not a KRL */
-        default:
-                goto revoked;
+        if ((fp = sshkey_fingerprint(key, options.fingerprint_hash,
+            SSH_FP_DEFAULT)) == NULL) {
+                r = SSH_ERR_ALLOC_FAIL;
+                error("%s: fingerprint key: %s", __func__, ssh_err(r));
+                goto out;
         }
-#endif
-        debug3("%s: treating %s as a key list", __func__,
-            options.revoked_keys_file);
-        switch (key_in_file(key, options.revoked_keys_file, 0)) {
+
+        r = sshkey_check_revoked(key, options.revoked_keys_file);
+        switch (r) {
         case 0:
-                /* key not revoked */
-                return 0;
-        case -1:
-                /* Error opening revoked_keys_file: refuse all keys */
-                error("Revoked keys file is unreadable: refusing public key "
-                    "authentication");
-                return 1;
-#ifdef WITH_OPENSSL
-        case 1:
- revoked:
-                /* Key revoked */
-                key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
-                error("WARNING: authentication attempt with a revoked "
-                    "%s key %s ", key_type(key), key_fp);
-                free(key_fp);
-                return 1;
-#endif
+                break; /* not revoked */
+        case SSH_ERR_KEY_REVOKED:
+                error("Authentication key %s %s revoked by file %s",
+                    sshkey_type(key), fp, options.revoked_keys_file);
+                goto out;
+        default:
+                error("Error checking authentication key %s %s in "
+                    "revoked keys file %s: %s", sshkey_type(key), fp,
+                    options.revoked_keys_file, ssh_err(r));
+                goto out;
         }
-        fatal("key_in_file returned junk");
+
+        /* Success */
+        r = 0;
+
+ out:
+        free(fp);
+        return r == 0 ? 0 : 1;
 }
 
 void