1 files changed, 56 insertions, 58 deletions

diff --git a/debian/patches/ssh-vulnkey.patch b/debian/patches/ssh-vulnkey.patch
index 03d6f15d9..a56911290 100644
--- a/debian/patches/ssh-vulnkey.patch
+++ b/debian/patches/ssh-vulnkey.patch
@@ -8,7 +8,7 @@ Description: Reject vulnerable keys to mitigate Debian OpenSSL flaw
  See CVE-2008-0166.
 Author: Colin Watson <cjwatson@ubuntu.com>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1469
-Last-Update: 2013-05-16
+Last-Update: 2013-09-14
 
 Index: b/Makefile.in
 ===================================================================
@@ -52,7 +52,7 @@ Index: b/Makefile.in
  MANTYPE                = @MANTYPE@
  
  CONFIGFILES=sshd_config.out ssh_config.out moduli.out
-@@ -174,6 +176,9 @@
+@@ -176,6 +178,9 @@
  sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o
         $(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
  
@@ -62,7 +62,7 @@ Index: b/Makefile.in
  # test driver for the loginrec code - not built by default
  logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
         $(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
-@@ -269,6 +274,7 @@
+@@ -272,6 +277,7 @@
         $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
         $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
         $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
@@ -70,7 +70,7 @@ Index: b/Makefile.in
         $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
         $(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
         $(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-@@ -283,6 +289,7 @@
+@@ -286,6 +292,7 @@
         $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
         $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
         $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
@@ -78,7 +78,7 @@ Index: b/Makefile.in
         -rm -f $(DESTDIR)$(bindir)/slogin
         ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
-@@ -364,6 +371,7 @@
+@@ -367,6 +374,7 @@
         -rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
         -rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
         -rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)
@@ -86,7 +86,7 @@ Index: b/Makefile.in
         -rm -f $(DESTDIR)$(bindir)/sftp$(EXEEXT)
         -rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
         -rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
-@@ -376,6 +384,7 @@
+@@ -379,6 +387,7 @@
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1
@@ -111,8 +111,8 @@ Index: b/auth-rsa.c
 ===================================================================
 --- a/auth-rsa.c
 +++ b/auth-rsa.c
-@@ -233,7 +233,7 @@
-                            file, linenum, BN_num_bits(key->rsa->n), bits);
+@@ -237,7 +237,7 @@
+                free(fp);
  
                 /* Never accept a revoked key */
 -               if (auth_key_is_revoked(key))
@@ -132,7 +132,7 @@ Index: b/auth.c
  #include "auth.h"
  #include "auth-options.h"
  #include "canohost.h"
-@@ -635,10 +636,34 @@
+@@ -657,10 +658,34 @@
  
  /* Returns 1 if key is revoked by revoked_keys_file, 0 otherwise */
  int
@@ -151,7 +151,7 @@ Index: b/auth.c
 +                               logit("Public key %s from %s blacklisted (see "
 +                                   "ssh-vulnkey(1)); continuing anyway",
 +                                   key_fp, get_remote_ipaddr());
-+                       xfree(key_fp);
++                       free(key_fp);
 +               } else {
 +                       if (hostkey)
 +                               error("Host key %s blacklisted (see "
@@ -160,7 +160,7 @@ Index: b/auth.c
 +                               logit("Public key %s from %s blacklisted (see "
 +                                   "ssh-vulnkey(1))",
 +                                   key_fp, get_remote_ipaddr());
-+                       xfree(key_fp);
++                       free(key_fp);
 +                       return 1;
 +               }
 +       }
@@ -172,7 +172,7 @@ Index: b/auth.h
 ===================================================================
 --- a/auth.h
 +++ b/auth.h
-@@ -185,7 +185,7 @@
+@@ -191,7 +191,7 @@
  
  FILE   *auth_openkeyfile(const char *, struct passwd *, int);
  FILE   *auth_openprincipals(const char *, struct passwd *, int);
@@ -185,7 +185,7 @@ Index: b/auth2-hostbased.c
 ===================================================================
 --- a/auth2-hostbased.c
 +++ b/auth2-hostbased.c
-@@ -146,7 +146,7 @@
+@@ -150,7 +150,7 @@
         int len;
         char *fp;
  
@@ -198,7 +198,7 @@ Index: b/auth2-pubkey.c
 ===================================================================
 --- a/auth2-pubkey.c
 +++ b/auth2-pubkey.c
-@@ -608,9 +608,10 @@
+@@ -647,9 +647,10 @@
         u_int success, i;
         char *file;
  
@@ -223,7 +223,7 @@ Index: b/authfile.c
  
  #define MAX_KEY_FILE_SIZE      (1024 * 1024)
  
-@@ -944,3 +945,140 @@
+@@ -944,3 +945,139 @@
         return ret;
  }
  
@@ -316,10 +316,9 @@ Index: b/authfile.c
 +       }
 +
 +out:
-+       if (dgst_packed)
-+               xfree(dgst_packed);
++       free(dgst_packed);
 +       if (ret != 1 && dgst_hex) {
-+               xfree(dgst_hex);
++               free(dgst_hex);
 +               dgst_hex = NULL;
 +       }
 +       if (fp)
@@ -347,7 +346,7 @@ Index: b/authfile.c
 +       xasprintf(&blacklist_file, "%s.%s-%u",
 +           _PATH_BLACKLIST, key_type(public), key_size(public));
 +       ret = blacklisted_key_in_file(public, blacklist_file, fp);
-+       xfree(blacklist_file);
++       free(blacklist_file);
 +       if (ret > 0) {
 +               key_free(public);
 +               return ret;
@@ -356,7 +355,7 @@ Index: b/authfile.c
 +       xasprintf(&blacklist_file, "%s.%s-%u",
 +           _PATH_BLACKLIST_CONFIG, key_type(public), key_size(public));
 +       ret2 = blacklisted_key_in_file(public, blacklist_file, fp);
-+       xfree(blacklist_file);
++       free(blacklist_file);
 +       if (ret2 > ret)
 +               ret = ret2;
 +
@@ -404,7 +403,7 @@ Index: b/readconf.c
 ===================================================================
 --- a/readconf.c
 +++ b/readconf.c
-@@ -125,6 +125,7 @@
+@@ -128,6 +128,7 @@
         oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
         oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
         oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
@@ -412,7 +411,7 @@ Index: b/readconf.c
         oHostKeyAlgorithms, oBindAddress, oPKCS11Provider,
         oClearAllForwardings, oNoHostAuthenticationForLocalhost,
         oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
-@@ -158,6 +159,7 @@
+@@ -161,6 +162,7 @@
         { "passwordauthentication", oPasswordAuthentication },
         { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
         { "kbdinteractivedevices", oKbdInteractiveDevices },
@@ -420,7 +419,7 @@ Index: b/readconf.c
         { "rsaauthentication", oRSAAuthentication },
         { "pubkeyauthentication", oPubkeyAuthentication },
         { "dsaauthentication", oPubkeyAuthentication },             /* alias */
-@@ -510,6 +512,10 @@
+@@ -523,6 +525,10 @@
                 intptr = &options->challenge_response_authentication;
                 goto parse_flag;
  
@@ -431,7 +430,7 @@ Index: b/readconf.c
         case oGssAuthentication:
                 intptr = &options->gss_authentication;
                 goto parse_flag;
-@@ -1200,6 +1206,7 @@
+@@ -1210,6 +1216,7 @@
         options->kbd_interactive_devices = NULL;
         options->rhosts_rsa_authentication = -1;
         options->hostbased_authentication = -1;
@@ -439,7 +438,7 @@ Index: b/readconf.c
         options->batch_mode = -1;
         options->check_host_ip = -1;
         options->strict_host_key_checking = -1;
-@@ -1310,6 +1317,8 @@
+@@ -1320,6 +1327,8 @@
                 options->rhosts_rsa_authentication = 0;
         if (options->hostbased_authentication == -1)
                 options->hostbased_authentication = 0;
@@ -464,7 +463,7 @@ Index: b/servconf.c
 ===================================================================
 --- a/servconf.c
 +++ b/servconf.c
-@@ -109,6 +109,7 @@
+@@ -114,6 +114,7 @@
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->challenge_response_authentication = -1;
@@ -472,7 +471,7 @@ Index: b/servconf.c
         options->permit_empty_passwd = -1;
         options->permit_user_env = -1;
         options->use_login = -1;
-@@ -250,6 +251,8 @@
+@@ -257,6 +258,8 @@
                 options->kbd_interactive_authentication = 0;
         if (options->challenge_response_authentication == -1)
                 options->challenge_response_authentication = 1;
@@ -481,16 +480,16 @@ Index: b/servconf.c
         if (options->permit_empty_passwd == -1)
                 options->permit_empty_passwd = 0;
         if (options->permit_user_env == -1)
-@@ -327,7 +330,7 @@
+@@ -338,7 +341,7 @@
         sListenAddress, sAddressFamily,
         sPrintMotd, sPrintLastLog, sIgnoreRhosts,
         sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
 -       sStrictModes, sEmptyPasswd, sTCPKeepAlive,
 +       sStrictModes, sPermitBlacklistedKeys, sEmptyPasswd, sTCPKeepAlive,
         sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
-        sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
+        sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
         sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
-@@ -439,6 +442,7 @@
+@@ -451,6 +454,7 @@
         { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
         { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
         { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
@@ -498,7 +497,7 @@ Index: b/servconf.c
         { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
         { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
         { "uselogin", sUseLogin, SSHCFG_GLOBAL },
-@@ -1134,6 +1138,10 @@
+@@ -1158,6 +1162,10 @@
                 intptr = &options->tcp_keep_alive;
                 goto parse_flag;
  
@@ -509,7 +508,7 @@ Index: b/servconf.c
         case sEmptyPasswd:
                 intptr = &options->permit_empty_passwd;
                 goto parse_flag;
-@@ -1980,6 +1988,7 @@
+@@ -2036,6 +2044,7 @@
         dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
         dump_cfg_fmtint(sStrictModes, o->strict_modes);
         dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
@@ -521,7 +520,7 @@ Index: b/servconf.h
 ===================================================================
 --- a/servconf.h
 +++ b/servconf.h
-@@ -120,6 +120,7 @@
+@@ -121,6 +121,7 @@
         int     challenge_response_authentication;
         int     zero_knowledge_password_authentication;
                                         /* If true, permit jpake auth */
@@ -572,9 +571,9 @@ Index: b/ssh-add.c
 +       if (blacklisted_key(private, &fp) == 1) {
 +               fprintf(stderr, "Public key %s blacklisted (see "
 +                   "ssh-vulnkey(1)); refusing to add it\n", fp);
-+               xfree(fp);
++               free(fp);
 +               key_free(private);
-+               xfree(comment);
++               free(comment);
 +               return -1;
 +       }
  
@@ -584,7 +583,7 @@ Index: b/ssh-keygen.1
 ===================================================================
 --- a/ssh-keygen.1
 +++ b/ssh-keygen.1
-@@ -810,6 +810,7 @@
+@@ -809,6 +809,7 @@
  .Xr ssh 1 ,
  .Xr ssh-add 1 ,
  .Xr ssh-agent 1 ,
@@ -843,7 +842,7 @@ Index: b/ssh-vulnkey.c
 ===================================================================
 --- /dev/null
 +++ b/ssh-vulnkey.c
-@@ -0,0 +1,387 @@
+@@ -0,0 +1,386 @@
 +/*
 + * Copyright (c) 2008 Canonical Ltd.  All rights reserved.
 + *
@@ -940,7 +939,7 @@ Index: b/ssh-vulnkey.c
 +               printf(":%lu: %s: %s %u %s %s\n", linenum, msg,
 +                   key_type(key), key_size(key), fp, comment);
 +       }
-+       xfree(fp);
++       free(fp);
 +}
 +
 +static int
@@ -1093,8 +1092,7 @@ Index: b/ssh-vulnkey.c
 +                               ret = 0;
 +                       found = 1;
 +               }
-+               if (comment)
-+                       xfree(comment);
++               free(comment);
 +       }
 +
 +       return ret;
@@ -1128,12 +1126,12 @@ Index: b/ssh-vulnkey.c
 +       for (i = 0; default_files[i]; i++) {
 +               xasprintf(&file, "%s/%s", dir, default_files[i]);
 +               if (stat(file, &st) < 0 && errno == ENOENT) {
-+                       xfree(file);
++                       free(file);
 +                       continue;
 +               }
 +               if (!do_filename(file, 0))
 +                       ret = 0;
-+               xfree(file);
++               free(file);
 +       }
 +
 +       return ret;
@@ -1235,7 +1233,7 @@ Index: b/ssh.1
 ===================================================================
 --- a/ssh.1
 +++ b/ssh.1
-@@ -1429,6 +1429,7 @@
+@@ -1447,6 +1447,7 @@
  .Xr ssh-agent 1 ,
  .Xr ssh-keygen 1 ,
  .Xr ssh-keyscan 1 ,
@@ -1247,7 +1245,7 @@ Index: b/ssh.c
 ===================================================================
 --- a/ssh.c
 +++ b/ssh.c
-@@ -1492,7 +1492,7 @@
+@@ -1525,7 +1525,7 @@
  static void
  load_public_identity_files(void)
  {
@@ -1256,7 +1254,7 @@ Index: b/ssh.c
         char *pwdir = NULL, *pwname = NULL;
         int i = 0;
         Key *public;
-@@ -1550,6 +1550,22 @@
+@@ -1583,6 +1583,22 @@
                 public = key_load_public(filename, NULL);
                 debug("identity file %s type %d", filename,
                     public ? public->type : -1);
@@ -1268,22 +1266,22 @@ Index: b/ssh.c
 +                               logit("Public key %s blacklisted (see "
 +                                   "ssh-vulnkey(1)); refusing to send it",
 +                                   fp);
-+                       xfree(fp);
++                       free(fp);
 +                       if (!options.use_blacklisted_keys) {
 +                               key_free(public);
-+                               xfree(filename);
++                               free(filename);
 +                               filename = NULL;
 +                               public = NULL;
 +                       }
 +               }
-                xfree(options.identity_files[i]);
+                free(options.identity_files[i]);
                 identity_files[n_ids] = filename;
                 identity_keys[n_ids] = public;
 Index: b/ssh_config.5
 ===================================================================
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -1201,6 +1201,23 @@
+@@ -1229,6 +1229,23 @@
  .Dq any .
  The default is
  .Dq any:any .
@@ -1320,7 +1318,7 @@ Index: b/sshconnect2.c
                 key = options.identity_keys[i];
                 if (key && key->type == KEY_RSA1)
                         continue;
-@@ -1609,7 +1611,7 @@
+@@ -1608,7 +1610,7 @@
                         debug("Offering %s public key: %s", key_type(id->key),
                             id->filename);
                         sent = send_pubkey_test(authctxt, id);
@@ -1333,7 +1331,7 @@ Index: b/sshd.8
 ===================================================================
 --- a/sshd.8
 +++ b/sshd.8
-@@ -953,6 +953,7 @@
+@@ -954,6 +954,7 @@
  .Xr ssh-agent 1 ,
  .Xr ssh-keygen 1 ,
  .Xr ssh-keyscan 1 ,
@@ -1345,23 +1343,23 @@ Index: b/sshd.c
 ===================================================================
 --- a/sshd.c
 +++ b/sshd.c
-@@ -1631,6 +1631,11 @@
-                        sensitive_data.host_keys[i] = NULL;
+@@ -1688,6 +1688,11 @@
+                        sensitive_data.host_pubkeys[i] = NULL;
                         continue;
                 }
-+               if (auth_key_is_revoked(key, 1)) {
-+                       key_free(key);
++               if (auth_key_is_revoked(key != NULL ? key : pubkey, 1)) {
 +                       sensitive_data.host_keys[i] = NULL;
++                       sensitive_data.host_pubkeys[i] = NULL;
 +                       continue;
 +               }
-                switch (key->type) {
+ 
+                switch (keytype) {
                 case KEY_RSA1:
-                        sensitive_data.ssh1_host_key = key;
 Index: b/sshd_config.5
 ===================================================================
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -870,6 +870,20 @@
+@@ -885,6 +885,20 @@
  Specifies whether password authentication is allowed.
  The default is
  .Dq yes .