1 files changed, 119 insertions, 0 deletions

diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch
new file mode 100644
index 000000000..cf6febf31
--- /dev/null
+++ b/debian/patches/auth-log-verbosity.patch
@@ -0,0 +1,119 @@
+From b2b04daa38b264f346acd81e08d224dbf33bac5b Mon Sep 17 00:00:00 2001
+From: Colin Watson <cjwatson@debian.org>
+Date: Sun, 9 Feb 2014 16:10:02 +0000
+Subject: Quieten logs when multiple from= restrictions are used
+
+Bug-Debian: http://bugs.debian.org/630606
+Forwarded: no
+Last-Update: 2013-09-14
+
+Patch-Name: auth-log-verbosity.patch
+---
+ auth-options.c | 35 ++++++++++++++++++++++++++---------
+ auth-options.h |  1 +
+ auth2-pubkey.c |  3 +++
+ 3 files changed, 30 insertions(+), 9 deletions(-)
+
+diff --git a/auth-options.c b/auth-options.c
+index 57b49f7f..7eb87b35 100644
+--- a/auth-options.c
++++ b/auth-options.c
+@@ -59,9 +59,20 @@ int forced_tun_device = -1;
+ /* "principals=" option. */
+ char *authorized_principals = NULL;
+ 
++/* Throttle log messages. */
++int logged_from_hostip = 0;
++int logged_cert_hostip = 0;
++
+ extern ServerOptions options;
+ 
+ void
++auth_start_parse_options(void)
++{
++       logged_from_hostip = 0;
++       logged_cert_hostip = 0;
++}
++
++void
+ auth_clear_options(void)
+ {
+        no_agent_forwarding_flag = 0;
+@@ -316,10 +327,13 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
+                                /* FALLTHROUGH */
+                        case 0:
+                                free(patterns);
+-                               logit("Authentication tried for %.100s with "
+-                                   "correct key but not from a permitted "
+-                                   "host (host=%.200s, ip=%.200s).",
+-                                   pw->pw_name, remote_host, remote_ip);
++                               if (!logged_from_hostip) {
++                                       logit("Authentication tried for %.100s with "
++                                           "correct key but not from a permitted "
++                                           "host (host=%.200s, ip=%.200s).",
++                                           pw->pw_name, remote_host, remote_ip);
++                                       logged_from_hostip = 1;
++                               }
+                                auth_debug_add("Your host '%.200s' is not "
+                                    "permitted to use this key for login.",
+                                    remote_host);
+@@ -543,11 +557,14 @@ parse_option_list(struct sshbuf *oblob, struct passwd *pw,
+                                        break;
+                                case 0:
+                                        /* no match */
+-                                       logit("Authentication tried for %.100s "
+-                                           "with valid certificate but not "
+-                                           "from a permitted host "
+-                                           "(ip=%.200s).", pw->pw_name,
+-                                           remote_ip);
++                                       if (!logged_cert_hostip) {
++                                               logit("Authentication tried for %.100s "
++                                                   "with valid certificate but not "
++                                                   "from a permitted host "
++                                                   "(ip=%.200s).", pw->pw_name,
++                                                   remote_ip);
++                                               logged_cert_hostip = 1;
++                                       }
+                                        auth_debug_add("Your address '%.200s' "
+                                            "is not permitted to use this "
+                                            "certificate for login.",
+diff --git a/auth-options.h b/auth-options.h
+index 52cbb42a..82355276 100644
+--- a/auth-options.h
++++ b/auth-options.h
+@@ -33,6 +33,7 @@ extern int forced_tun_device;
+ extern int key_is_cert_authority;
+ extern char *authorized_principals;
+ 
++void   auth_start_parse_options(void);
+ int    auth_parse_options(struct passwd *, char *, char *, u_long);
+ void   auth_clear_options(void);
+ int    auth_cert_options(struct sshkey *, struct passwd *, const char **);
+diff --git a/auth2-pubkey.c b/auth2-pubkey.c
+index 20f3309e..add77136 100644
+--- a/auth2-pubkey.c
++++ b/auth2-pubkey.c
+@@ -566,6 +566,7 @@ process_principals(FILE *f, char *file, struct passwd *pw,
+        u_long linenum = 0;
+        u_int i;
+ 
++       auth_start_parse_options();
+        while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
+                /* Skip leading whitespace. */
+                for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
+@@ -764,6 +765,7 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
+        found_key = 0;
+ 
+        found = NULL;
++       auth_start_parse_options();
+        while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
+                char *cp, *key_options = NULL, *fp = NULL;
+                const char *reason = NULL;
+@@ -911,6 +913,7 @@ user_cert_trusted_ca(struct passwd *pw, Key *key)
+        if (key_cert_check_authority(key, 0, 1,
+            use_authorized_principals ? NULL : pw->pw_name, &reason) != 0)
+                goto fail_reason;
++       auth_start_parse_options();
+        if (auth_cert_options(key, pw, &reason) != 0)
+                goto fail_reason;
+