1 files changed, 133 insertions, 0 deletions

diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch
new file mode 100644
index 000000000..96632057b
--- /dev/null
+++ b/debian/patches/auth-log-verbosity.patch
@@ -0,0 +1,133 @@
+From 283322f493ee7dc75511f6cf9e9b88e536de0874 Mon Sep 17 00:00:00 2001
+From: Colin Watson <cjwatson@debian.org>
+Date: Sun, 9 Feb 2014 16:10:02 +0000
+Subject: Quieten logs when multiple from= restrictions are used
+
+Bug-Debian: http://bugs.debian.org/630606
+Forwarded: no
+Last-Update: 2013-09-14
+
+Patch-Name: auth-log-verbosity.patch
+---
+ auth-options.c |   35 ++++++++++++++++++++++++++---------
+ auth-options.h |    1 +
+ auth-rsa.c     |    2 ++
+ auth2-pubkey.c |    3 +++
+ 4 files changed, 32 insertions(+), 9 deletions(-)
+
+diff --git a/auth-options.c b/auth-options.c
+index fa209ea..df61330 100644
+--- a/auth-options.c
++++ b/auth-options.c
+@@ -54,9 +54,20 @@ int forced_tun_device = -1;
+ /* "principals=" option. */
+ char *authorized_principals = NULL;
+ 
++/* Throttle log messages. */
++int logged_from_hostip = 0;
++int logged_cert_hostip = 0;
++
+ extern ServerOptions options;
+ 
+ void
++auth_start_parse_options(void)
++{
++       logged_from_hostip = 0;
++       logged_cert_hostip = 0;
++}
++
++void
+ auth_clear_options(void)
+ {
+        no_agent_forwarding_flag = 0;
+@@ -284,10 +295,13 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
+                                /* FALLTHROUGH */
+                        case 0:
+                                free(patterns);
+-                               logit("Authentication tried for %.100s with "
+-                                   "correct key but not from a permitted "
+-                                   "host (host=%.200s, ip=%.200s).",
+-                                   pw->pw_name, remote_host, remote_ip);
++                               if (!logged_from_hostip) {
++                                       logit("Authentication tried for %.100s with "
++                                           "correct key but not from a permitted "
++                                           "host (host=%.200s, ip=%.200s).",
++                                           pw->pw_name, remote_host, remote_ip);
++                                       logged_from_hostip = 1;
++                               }
+                                auth_debug_add("Your host '%.200s' is not "
+                                    "permitted to use this key for login.",
+                                    remote_host);
+@@ -510,11 +524,14 @@ parse_option_list(u_char *optblob, size_t optblob_len, struct passwd *pw,
+                                        break;
+                                case 0:
+                                        /* no match */
+-                                       logit("Authentication tried for %.100s "
+-                                           "with valid certificate but not "
+-                                           "from a permitted host "
+-                                           "(ip=%.200s).", pw->pw_name,
+-                                           remote_ip);
++                                       if (!logged_cert_hostip) {
++                                               logit("Authentication tried for %.100s "
++                                                   "with valid certificate but not "
++                                                   "from a permitted host "
++                                                   "(ip=%.200s).", pw->pw_name,
++                                                   remote_ip);
++                                               logged_cert_hostip = 1;
++                                       }
+                                        auth_debug_add("Your address '%.200s' "
+                                            "is not permitted to use this "
+                                            "certificate for login.",
+diff --git a/auth-options.h b/auth-options.h
+index 7455c94..a3f0a02 100644
+--- a/auth-options.h
++++ b/auth-options.h
+@@ -33,6 +33,7 @@ extern int forced_tun_device;
+ extern int key_is_cert_authority;
+ extern char *authorized_principals;
+ 
++void   auth_start_parse_options(void);
+ int    auth_parse_options(struct passwd *, char *, char *, u_long);
+ void   auth_clear_options(void);
+ int    auth_cert_options(Key *, struct passwd *);
+diff --git a/auth-rsa.c b/auth-rsa.c
+index 5dad6c3..260ce2f 100644
+--- a/auth-rsa.c
++++ b/auth-rsa.c
+@@ -178,6 +178,8 @@ rsa_key_allowed_in_file(struct passwd *pw, char *file,
+        if ((f = auth_openkeyfile(file, pw, options.strict_modes)) == NULL)
+                return 0;
+ 
++       auth_start_parse_options();
++
+        /*
+         * Go though the accepted keys, looking for the current key.  If
+         * found, perform a challenge-response dialog to verify that the
+diff --git a/auth2-pubkey.c b/auth2-pubkey.c
+index 0fd27bb..7c56927 100644
+--- a/auth2-pubkey.c
++++ b/auth2-pubkey.c
+@@ -263,6 +263,7 @@ match_principals_file(char *file, struct passwd *pw, struct KeyCert *cert)
+                restore_uid();
+                return 0;
+        }
++       auth_start_parse_options();
+        while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
+                /* Skip leading whitespace. */
+                for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
+@@ -324,6 +325,7 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
+        found_key = 0;
+ 
+        found = NULL;
++       auth_start_parse_options();
+        while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
+                char *cp, *key_options = NULL;
+                if (found != NULL)
+@@ -459,6 +461,7 @@ user_cert_trusted_ca(struct passwd *pw, Key *key)
+        if (key_cert_check_authority(key, 0, 1,
+            principals_file == NULL ? pw->pw_name : NULL, &reason) != 0)
+                goto fail_reason;
++       auth_start_parse_options();
+        if (auth_cert_options(key, pw) != 0)
+                goto out;
+