diff options
Diffstat (limited to 'debian/patches/debian-banner.patch')
-rw-r--r-- | debian/patches/debian-banner.patch | 111 |
1 files changed, 111 insertions, 0 deletions
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch new file mode 100644 index 000000000..98d97dce8 --- /dev/null +++ b/debian/patches/debian-banner.patch | |||
@@ -0,0 +1,111 @@ | |||
1 | From 905ffae23105d59b013aac809da6195d231b0395 Mon Sep 17 00:00:00 2001 | ||
2 | From: Kees Cook <kees@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:06 +0000 | ||
4 | Subject: Add DebianBanner server configuration option | ||
5 | |||
6 | Setting this to "no" causes sshd to omit the Debian revision from its | ||
7 | initial protocol handshake, for those scared by package-versioning.patch. | ||
8 | |||
9 | Bug-Debian: http://bugs.debian.org/562048 | ||
10 | Forwarded: not-needed | ||
11 | Last-Update: 2018-08-24 | ||
12 | |||
13 | Patch-Name: debian-banner.patch | ||
14 | --- | ||
15 | servconf.c | 9 +++++++++ | ||
16 | servconf.h | 2 ++ | ||
17 | sshd.c | 3 ++- | ||
18 | sshd_config.5 | 5 +++++ | ||
19 | 4 files changed, 18 insertions(+), 1 deletion(-) | ||
20 | |||
21 | diff --git a/servconf.c b/servconf.c | ||
22 | index e49984a81..bb43a649c 100644 | ||
23 | --- a/servconf.c | ||
24 | +++ b/servconf.c | ||
25 | @@ -181,6 +181,7 @@ initialize_server_options(ServerOptions *options) | ||
26 | options->fingerprint_hash = -1; | ||
27 | options->disable_forwarding = -1; | ||
28 | options->expose_userauth_info = -1; | ||
29 | + options->debian_banner = -1; | ||
30 | } | ||
31 | |||
32 | /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */ | ||
33 | @@ -413,6 +414,8 @@ fill_default_server_options(ServerOptions *options) | ||
34 | options->disable_forwarding = 0; | ||
35 | if (options->expose_userauth_info == -1) | ||
36 | options->expose_userauth_info = 0; | ||
37 | + if (options->debian_banner == -1) | ||
38 | + options->debian_banner = 1; | ||
39 | |||
40 | assemble_algorithms(options); | ||
41 | |||
42 | @@ -500,6 +503,7 @@ typedef enum { | ||
43 | sStreamLocalBindMask, sStreamLocalBindUnlink, | ||
44 | sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding, | ||
45 | sExposeAuthInfo, sRDomain, | ||
46 | + sDebianBanner, | ||
47 | sDeprecated, sIgnore, sUnsupported | ||
48 | } ServerOpCodes; | ||
49 | |||
50 | @@ -656,6 +660,7 @@ static struct { | ||
51 | { "disableforwarding", sDisableForwarding, SSHCFG_ALL }, | ||
52 | { "exposeauthinfo", sExposeAuthInfo, SSHCFG_ALL }, | ||
53 | { "rdomain", sRDomain, SSHCFG_ALL }, | ||
54 | + { "debianbanner", sDebianBanner, SSHCFG_GLOBAL }, | ||
55 | { NULL, sBadOption, 0 } | ||
56 | }; | ||
57 | |||
58 | @@ -2164,6 +2169,10 @@ process_server_config_line(ServerOptions *options, char *line, | ||
59 | *charptr = xstrdup(arg); | ||
60 | break; | ||
61 | |||
62 | + case sDebianBanner: | ||
63 | + intptr = &options->debian_banner; | ||
64 | + goto parse_flag; | ||
65 | + | ||
66 | case sDeprecated: | ||
67 | case sIgnore: | ||
68 | case sUnsupported: | ||
69 | diff --git a/servconf.h b/servconf.h | ||
70 | index 9b117fe27..76098119b 100644 | ||
71 | --- a/servconf.h | ||
72 | +++ b/servconf.h | ||
73 | @@ -211,6 +211,8 @@ typedef struct { | ||
74 | int fingerprint_hash; | ||
75 | int expose_userauth_info; | ||
76 | u_int64_t timing_secret; | ||
77 | + | ||
78 | + int debian_banner; | ||
79 | } ServerOptions; | ||
80 | |||
81 | /* Information about the incoming connection as used by Match */ | ||
82 | diff --git a/sshd.c b/sshd.c | ||
83 | index ffd3dad6a..698593605 100644 | ||
84 | --- a/sshd.c | ||
85 | +++ b/sshd.c | ||
86 | @@ -384,7 +384,8 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out) | ||
87 | char remote_version[256]; /* Must be at least as big as buf. */ | ||
88 | |||
89 | xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s\r\n", | ||
90 | - PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE, | ||
91 | + PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, | ||
92 | + options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM, | ||
93 | *options.version_addendum == '\0' ? "" : " ", | ||
94 | options.version_addendum); | ||
95 | |||
96 | diff --git a/sshd_config.5 b/sshd_config.5 | ||
97 | index 0fbbccbde..96a69ab55 100644 | ||
98 | --- a/sshd_config.5 | ||
99 | +++ b/sshd_config.5 | ||
100 | @@ -532,6 +532,11 @@ or | ||
101 | .Cm no . | ||
102 | The default is | ||
103 | .Cm yes . | ||
104 | +.It Cm DebianBanner | ||
105 | +Specifies whether the distribution-specified extra version suffix is | ||
106 | +included during initial protocol handshake. | ||
107 | +The default is | ||
108 | +.Cm yes . | ||
109 | .It Cm DenyGroups | ||
110 | This keyword can be followed by a list of group name patterns, separated | ||
111 | by spaces. | ||