diff options
Diffstat (limited to 'debian/patches/debian-banner.patch')
-rw-r--r-- | debian/patches/debian-banner.patch | 111 |
1 files changed, 111 insertions, 0 deletions
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch new file mode 100644 index 000000000..5bc70a566 --- /dev/null +++ b/debian/patches/debian-banner.patch | |||
@@ -0,0 +1,111 @@ | |||
1 | From 2c31a85436f1eac46e185382c2aa15406ae6c0ac Mon Sep 17 00:00:00 2001 | ||
2 | From: Kees Cook <kees@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:06 +0000 | ||
4 | Subject: Add DebianBanner server configuration option | ||
5 | |||
6 | Setting this to "no" causes sshd to omit the Debian revision from its | ||
7 | initial protocol handshake, for those scared by package-versioning.patch. | ||
8 | |||
9 | Bug-Debian: http://bugs.debian.org/562048 | ||
10 | Forwarded: not-needed | ||
11 | Last-Update: 2015-08-19 | ||
12 | |||
13 | Patch-Name: debian-banner.patch | ||
14 | --- | ||
15 | servconf.c | 9 +++++++++ | ||
16 | servconf.h | 2 ++ | ||
17 | sshd.c | 3 ++- | ||
18 | sshd_config.5 | 5 +++++ | ||
19 | 4 files changed, 18 insertions(+), 1 deletion(-) | ||
20 | |||
21 | diff --git a/servconf.c b/servconf.c | ||
22 | index b3a2841..bec53e0 100644 | ||
23 | --- a/servconf.c | ||
24 | +++ b/servconf.c | ||
25 | @@ -166,6 +166,7 @@ initialize_server_options(ServerOptions *options) | ||
26 | options->ip_qos_bulk = -1; | ||
27 | options->version_addendum = NULL; | ||
28 | options->fingerprint_hash = -1; | ||
29 | + options->debian_banner = -1; | ||
30 | } | ||
31 | |||
32 | /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */ | ||
33 | @@ -342,6 +343,8 @@ fill_default_server_options(ServerOptions *options) | ||
34 | options->fwd_opts.streamlocal_bind_unlink = 0; | ||
35 | if (options->fingerprint_hash == -1) | ||
36 | options->fingerprint_hash = SSH_FP_HASH_DEFAULT; | ||
37 | + if (options->debian_banner == -1) | ||
38 | + options->debian_banner = 1; | ||
39 | /* Turn privilege separation on by default */ | ||
40 | if (use_privsep == -1) | ||
41 | use_privsep = PRIVSEP_NOSANDBOX; | ||
42 | @@ -412,6 +415,7 @@ typedef enum { | ||
43 | sAuthenticationMethods, sHostKeyAgent, sPermitUserRC, | ||
44 | sStreamLocalBindMask, sStreamLocalBindUnlink, | ||
45 | sAllowStreamLocalForwarding, sFingerprintHash, | ||
46 | + sDebianBanner, | ||
47 | sDeprecated, sUnsupported | ||
48 | } ServerOpCodes; | ||
49 | |||
50 | @@ -556,6 +560,7 @@ static struct { | ||
51 | { "streamlocalbindunlink", sStreamLocalBindUnlink, SSHCFG_ALL }, | ||
52 | { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL }, | ||
53 | { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL }, | ||
54 | + { "debianbanner", sDebianBanner, SSHCFG_GLOBAL }, | ||
55 | { NULL, sBadOption, 0 } | ||
56 | }; | ||
57 | |||
58 | @@ -1777,6 +1782,10 @@ process_server_config_line(ServerOptions *options, char *line, | ||
59 | options->fingerprint_hash = value; | ||
60 | break; | ||
61 | |||
62 | + case sDebianBanner: | ||
63 | + intptr = &options->debian_banner; | ||
64 | + goto parse_int; | ||
65 | + | ||
66 | case sDeprecated: | ||
67 | logit("%s line %d: Deprecated option %s", | ||
68 | filename, linenum, arg); | ||
69 | diff --git a/servconf.h b/servconf.h | ||
70 | index d2ed4d7..ed0f171 100644 | ||
71 | --- a/servconf.h | ||
72 | +++ b/servconf.h | ||
73 | @@ -192,6 +192,8 @@ typedef struct { | ||
74 | char *auth_methods[MAX_AUTH_METHODS]; | ||
75 | |||
76 | int fingerprint_hash; | ||
77 | + | ||
78 | + int debian_banner; | ||
79 | } ServerOptions; | ||
80 | |||
81 | /* Information about the incoming connection as used by Match */ | ||
82 | diff --git a/sshd.c b/sshd.c | ||
83 | index c362209..5435968 100644 | ||
84 | --- a/sshd.c | ||
85 | +++ b/sshd.c | ||
86 | @@ -442,7 +442,8 @@ sshd_exchange_identification(int sock_in, int sock_out) | ||
87 | } | ||
88 | |||
89 | xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s", | ||
90 | - major, minor, SSH_RELEASE, | ||
91 | + major, minor, | ||
92 | + options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM, | ||
93 | *options.version_addendum == '\0' ? "" : " ", | ||
94 | options.version_addendum, newline); | ||
95 | |||
96 | diff --git a/sshd_config.5 b/sshd_config.5 | ||
97 | index d14576e..ec58635 100644 | ||
98 | --- a/sshd_config.5 | ||
99 | +++ b/sshd_config.5 | ||
100 | @@ -476,6 +476,11 @@ or | ||
101 | .Dq no . | ||
102 | The default is | ||
103 | .Dq delayed . | ||
104 | +.It Cm DebianBanner | ||
105 | +Specifies whether the distribution-specified extra version suffix is | ||
106 | +included during initial protocol handshake. | ||
107 | +The default is | ||
108 | +.Dq yes . | ||
109 | .It Cm DenyGroups | ||
110 | This keyword can be followed by a list of group name patterns, separated | ||
111 | by spaces. | ||