1 files changed, 20 insertions, 7 deletions

diff --git a/ssh.c b/ssh.c
index 9409fa713..aa2ad4a2f 100644
--- a/ssh.c
+++ b/ssh.c
@@ -641,7 +641,7 @@ main(int ac, char **av)
                 tty_flag = 0;
         /* Do not allocate a tty if stdin is not a tty. */
         if ((!isatty(fileno(stdin)) || stdin_null_flag) && !force_tty_flag) {
-                if (tty_flag)
+                if (tty_flag && options.log_level != SYSLOG_LEVEL_QUIET)
                         logit("Pseudo-terminal will not be allocated because "
                             "stdin is not a terminal.");
                 tty_flag = 0;
@@ -852,15 +852,12 @@ main(int ac, char **av)
             strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR);
         if (r > 0 && (size_t)r < sizeof(buf) && stat(buf, &st) < 0) {
 #ifdef WITH_SELINUX
-                char *scon;
-
-                matchpathcon(buf, 0700, &scon);
-                setfscreatecon(scon);
+                ssh_selinux_setfscreatecon(buf);
 #endif
                 if (mkdir(buf, 0700) < 0)
                         error("Could not create directory '%.200s'.", buf);
 #ifdef WITH_SELINUX
-                setfscreatecon(NULL);
+                ssh_selinux_setfscreatecon(NULL);
 #endif
         }
         /* load options.identity_files */
@@ -1448,7 +1445,7 @@ ssh_session2(void)
 static void
 load_public_identity_files(void)
 {
-        char *filename, *cp, thishost[NI_MAXHOST];
+        char *filename, *cp, thishost[NI_MAXHOST], *fp;
         char *pwdir = NULL, *pwname = NULL;
         int i = 0;
         Key *public;
@@ -1505,6 +1502,22 @@ load_public_identity_files(void)
                 public = key_load_public(filename, NULL);
                 debug("identity file %s type %d", filename,
                     public ? public->type : -1);
+                if (public && blacklisted_key(public, &fp) == 1) {
+                        if (options.use_blacklisted_keys)
+                                logit("Public key %s blacklisted (see "
+                                    "ssh-vulnkey(1)); continuing anyway", fp);
+                        else
+                                logit("Public key %s blacklisted (see "
+                                    "ssh-vulnkey(1)); refusing to send it",
+                                    fp);
+                        xfree(fp);
+                        if (!options.use_blacklisted_keys) {
+                                key_free(public);
+                                xfree(filename);
+                                filename = NULL;
+                                public = NULL;
+                        }
+                }
                 xfree(options.identity_files[i]);
                 identity_files[n_ids] = filename;
                 identity_keys[n_ids] = public;