diff options
Diffstat (limited to 'debian/patches/debian-banner.patch')
-rw-r--r-- | debian/patches/debian-banner.patch | 111 |
1 files changed, 111 insertions, 0 deletions
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch new file mode 100644 index 000000000..d02e8ffcb --- /dev/null +++ b/debian/patches/debian-banner.patch | |||
@@ -0,0 +1,111 @@ | |||
1 | From 8a75df792931443e868e574408ed1666208a28c2 Mon Sep 17 00:00:00 2001 | ||
2 | From: Kees Cook <kees@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:06 +0000 | ||
4 | Subject: Add DebianBanner server configuration option | ||
5 | |||
6 | Setting this to "no" causes sshd to omit the Debian revision from its | ||
7 | initial protocol handshake, for those scared by package-versioning.patch. | ||
8 | |||
9 | Bug-Debian: http://bugs.debian.org/562048 | ||
10 | Forwarded: not-needed | ||
11 | Last-Update: 2013-09-14 | ||
12 | |||
13 | Patch-Name: debian-banner.patch | ||
14 | --- | ||
15 | servconf.c | 9 +++++++++ | ||
16 | servconf.h | 2 ++ | ||
17 | sshd.c | 3 ++- | ||
18 | sshd_config.5 | 5 +++++ | ||
19 | 4 files changed, 18 insertions(+), 1 deletion(-) | ||
20 | |||
21 | diff --git a/servconf.c b/servconf.c | ||
22 | index 9155a8b..a2928ff 100644 | ||
23 | --- a/servconf.c | ||
24 | +++ b/servconf.c | ||
25 | @@ -157,6 +157,7 @@ initialize_server_options(ServerOptions *options) | ||
26 | options->ip_qos_interactive = -1; | ||
27 | options->ip_qos_bulk = -1; | ||
28 | options->version_addendum = NULL; | ||
29 | + options->debian_banner = -1; | ||
30 | } | ||
31 | |||
32 | void | ||
33 | @@ -310,6 +311,8 @@ fill_default_server_options(ServerOptions *options) | ||
34 | options->ip_qos_bulk = IPTOS_THROUGHPUT; | ||
35 | if (options->version_addendum == NULL) | ||
36 | options->version_addendum = xstrdup(""); | ||
37 | + if (options->debian_banner == -1) | ||
38 | + options->debian_banner = 1; | ||
39 | /* Turn privilege separation on by default */ | ||
40 | if (use_privsep == -1) | ||
41 | use_privsep = PRIVSEP_NOSANDBOX; | ||
42 | @@ -360,6 +363,7 @@ typedef enum { | ||
43 | sKexAlgorithms, sIPQoS, sVersionAddendum, | ||
44 | sAuthorizedKeysCommand, sAuthorizedKeysCommandUser, | ||
45 | sAuthenticationMethods, sHostKeyAgent, | ||
46 | + sDebianBanner, | ||
47 | sDeprecated, sUnsupported | ||
48 | } ServerOpCodes; | ||
49 | |||
50 | @@ -501,6 +505,7 @@ static struct { | ||
51 | { "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL }, | ||
52 | { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL }, | ||
53 | { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL }, | ||
54 | + { "debianbanner", sDebianBanner, SSHCFG_GLOBAL }, | ||
55 | { NULL, sBadOption, 0 } | ||
56 | }; | ||
57 | |||
58 | @@ -1648,6 +1653,10 @@ process_server_config_line(ServerOptions *options, char *line, | ||
59 | } | ||
60 | return 0; | ||
61 | |||
62 | + case sDebianBanner: | ||
63 | + intptr = &options->debian_banner; | ||
64 | + goto parse_int; | ||
65 | + | ||
66 | case sDeprecated: | ||
67 | logit("%s line %d: Deprecated option %s", | ||
68 | filename, linenum, arg); | ||
69 | diff --git a/servconf.h b/servconf.h | ||
70 | index f655c5b..fd72ce2 100644 | ||
71 | --- a/servconf.h | ||
72 | +++ b/servconf.h | ||
73 | @@ -188,6 +188,8 @@ typedef struct { | ||
74 | |||
75 | u_int num_auth_methods; | ||
76 | char *auth_methods[MAX_AUTH_METHODS]; | ||
77 | + | ||
78 | + int debian_banner; | ||
79 | } ServerOptions; | ||
80 | |||
81 | /* Information about the incoming connection as used by Match */ | ||
82 | diff --git a/sshd.c b/sshd.c | ||
83 | index 7efa7ef..6b988fe 100644 | ||
84 | --- a/sshd.c | ||
85 | +++ b/sshd.c | ||
86 | @@ -440,7 +440,8 @@ sshd_exchange_identification(int sock_in, int sock_out) | ||
87 | } | ||
88 | |||
89 | xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s", | ||
90 | - major, minor, SSH_RELEASE, | ||
91 | + major, minor, | ||
92 | + options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM, | ||
93 | *options.version_addendum == '\0' ? "" : " ", | ||
94 | options.version_addendum, newline); | ||
95 | |||
96 | diff --git a/sshd_config.5 b/sshd_config.5 | ||
97 | index 510cc7c..eaf8d01 100644 | ||
98 | --- a/sshd_config.5 | ||
99 | +++ b/sshd_config.5 | ||
100 | @@ -404,6 +404,11 @@ or | ||
101 | .Dq no . | ||
102 | The default is | ||
103 | .Dq delayed . | ||
104 | +.It Cm DebianBanner | ||
105 | +Specifies whether the distribution-specified extra version suffix is | ||
106 | +included during initial protocol handshake. | ||
107 | +The default is | ||
108 | +.Dq yes . | ||
109 | .It Cm DenyGroups | ||
110 | This keyword can be followed by a list of group name patterns, separated | ||
111 | by spaces. | ||