|
1 # |
|
2 # This patch is to add a new DisableBanner option to the ssh client command, |
|
3 # which allows the ssh command to disable the display of the banner message. |
|
4 # We have contributed back this feature to the OpenSSH upstream community. For |
|
5 # more information, see https://bugzilla.mindrot.org/show_bug.cgi?id=2242. |
|
6 # In the future, if this feature is accepted by the upsteam in a later release, |
|
7 # we will remove this patch when we upgrade to that release. |
|
8 # |
|
9 --- orig/readconf.c Wed May 21 15:04:21 2014 |
|
10 +++ new/readconf.c Wed May 28 11:56:04 2014 |
|
11 @@ -148,7 +148,11 @@ |
|
12 oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, oProxyUseFdpass, |
|
13 oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots, |
|
14 oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs, |
|
15 +#ifdef DISABLE_BANNER |
|
16 + oDisableBanner, oIgnoredUnknownOption, oDeprecated, oUnsupported |
|
17 +#else |
|
18 oIgnoredUnknownOption, oDeprecated, oUnsupported |
|
19 +#endif |
|
20 } OpCodes; |
|
21 |
|
22 /* Textual representations of the tokens. */ |
|
23 @@ -266,6 +270,9 @@ |
|
24 { "canonicalizehostname", oCanonicalizeHostname }, |
|
25 { "canonicalizemaxdots", oCanonicalizeMaxDots }, |
|
26 { "canonicalizepermittedcnames", oCanonicalizePermittedCNAMEs }, |
|
27 +#ifdef DISABLE_BANNER |
|
28 + { "disablebanner", oDisableBanner }, |
|
29 +#endif |
|
30 { "ignoreunknown", oIgnoreUnknown }, |
|
31 |
|
32 { NULL, oBadOption } |
|
33 @@ -682,6 +689,17 @@ |
|
34 { NULL, -1 } |
|
35 }; |
|
36 |
|
37 +#ifdef DISABLE_BANNER |
|
38 +static const struct multistate multistate_disablebanner[] = { |
|
39 + { "true", SSH_DISABLEBANNER_YES }, |
|
40 + { "false", SSH_DISABLEBANNER_NO }, |
|
41 + { "yes", SSH_DISABLEBANNER_YES }, |
|
42 + { "no", SSH_DISABLEBANNER_NO }, |
|
43 + { "in-exec-mode", SSH_DISABLEBANNER_INEXECMODE }, |
|
44 + { NULL, -1 } |
|
45 +}; |
|
46 +#endif |
|
47 + |
|
48 /* |
|
49 * Processes a single option line as used in the configuration files. This |
|
50 * only sets those values that have not already been set. |
|
51 @@ -1392,6 +1410,13 @@ |
|
52 intptr = &options->canonicalize_fallback_local; |
|
53 goto parse_flag; |
|
54 |
|
55 +#ifdef DISABLE_BANNER |
|
56 + case oDisableBanner: |
|
57 + intptr = &options->disable_banner; |
|
58 + multistate_ptr = multistate_disablebanner; |
|
59 + goto parse_multistate; |
|
60 +#endif |
|
61 + |
|
62 case oDeprecated: |
|
63 debug("%s line %d: Deprecated option \"%s\"", |
|
64 filename, linenum, keyword); |
|
65 @@ -1554,6 +1579,9 @@ |
|
66 options->ip_qos_bulk = -1; |
|
67 options->request_tty = -1; |
|
68 options->proxy_use_fdpass = -1; |
|
69 +#ifdef DISABLE_BANNER |
|
70 + options->disable_banner = -1; |
|
71 +#endif |
|
72 options->ignored_unknown = NULL; |
|
73 options->num_canonical_domains = 0; |
|
74 options->num_permitted_cnames = 0; |
|
75 @@ -1721,6 +1749,12 @@ |
|
76 options->canonicalize_fallback_local = 1; |
|
77 if (options->canonicalize_hostname == -1) |
|
78 options->canonicalize_hostname = SSH_CANONICALISE_NO; |
|
79 + |
|
80 +#ifdef DISABLE_BANNER |
|
81 + if (options->disable_banner == -1) |
|
82 + options->disable_banner = 0; |
|
83 +#endif |
|
84 + |
|
85 #define CLEAR_ON_NONE(v) \ |
|
86 do { \ |
|
87 if (v != NULL && strcasecmp(v, "none") == 0) { \ |
|
88 --- orig/readconf.h Wed May 21 15:04:35 2014 |
|
89 +++ new/readconf.h Wed May 28 11:08:53 2014 |
|
90 @@ -155,6 +155,9 @@ |
|
91 struct allowed_cname permitted_cnames[MAX_CANON_DOMAINS]; |
|
92 |
|
93 char *ignored_unknown; /* Pattern list of unknown tokens to ignore */ |
|
94 +#ifdef DISABLE_BANNER |
|
95 + int disable_banner; /* Disable display of banner */ |
|
96 +#endif |
|
97 } Options; |
|
98 |
|
99 #define SSH_CANONICALISE_NO 0 |
|
100 @@ -175,6 +178,12 @@ |
|
101 #define SSHCONF_CHECKPERM 1 /* check permissions on config file */ |
|
102 #define SSHCONF_USERCONF 2 /* user provided config file not system */ |
|
103 |
|
104 +#ifdef DISABLE_BANNER |
|
105 +#define SSH_DISABLEBANNER_NO 0 |
|
106 +#define SSH_DISABLEBANNER_YES 1 |
|
107 +#define SSH_DISABLEBANNER_INEXECMODE 2 |
|
108 +#endif |
|
109 + |
|
110 void initialize_options(Options *); |
|
111 void fill_default_options(Options *); |
|
112 int process_config_line(Options *, struct passwd *, const char *, char *, |
|
113 --- orig/ssh_config.5 Thu May 22 15:05:04 2014 |
|
114 +++ new/ssh_config.5 Fri May 23 09:36:52 2014 |
|
115 @@ -507,6 +507,14 @@ |
|
116 then the backgrounded master connection will automatically terminate |
|
117 after it has remained idle (with no client connections) for the |
|
118 specified time. |
|
119 +.It Cm DisableBanner |
|
120 +If set to yes, disables the display of the banner message. |
|
121 +If set to in-exec-mode, disables the display of banner message when in remote |
|
122 +command mode only. |
|
123 +.Pp |
|
124 +The default value is no, which means that the banner is displayed unless the |
|
125 +log level is QUIET, FATAL, or ERROR. See also the Banner option in |
|
126 +.Xr sshd_config 4 . This option applies to protocol version 2 only. |
|
127 .It Cm DynamicForward |
|
128 Specifies that a TCP port on the local machine be forwarded |
|
129 over the secure channel, and the application |
|
130 --- orig/sshconnect2.c Wed May 21 15:05:27 2014 |
|
131 +++ new/sshconnect2.c Thu May 29 17:33:56 2014 |
|
132 @@ -82,6 +82,10 @@ |
|
133 extern char *server_version_string; |
|
134 extern Options options; |
|
135 |
|
136 +#ifdef DISABLE_BANNER |
|
137 +extern Buffer command; |
|
138 +#endif |
|
139 + |
|
140 /* |
|
141 * SSH2 key exchange |
|
142 */ |
|
143 @@ -480,7 +484,20 @@ |
|
144 debug3("input_userauth_banner"); |
|
145 raw = packet_get_string(&len); |
|
146 lang = packet_get_string(NULL); |
|
147 + |
|
148 +#ifdef DISABLE_BANNER |
|
149 + /* |
|
150 + * Banner is a warning message according to RFC 4252. So, never print |
|
151 + * a banner in error log level or lower. If the log level is higher, |
|
152 + * use DisableBanner option to decide whether to display it or not. |
|
153 + */ |
|
154 + if (len > 0 && options.log_level >= SYSLOG_LEVEL_INFO && |
|
155 + (options.disable_banner == SSH_DISABLEBANNER_NO || |
|
156 + (options.disable_banner == SSH_DISABLEBANNER_INEXECMODE && |
|
157 + buffer_len(&command) == 0))) { |
|
158 +#else |
|
159 if (len > 0 && options.log_level >= SYSLOG_LEVEL_INFO) { |
|
160 +#endif |
|
161 if (len > 65536) |
|
162 len = 65536; |
|
163 msg = xmalloc(len * 4 + 1); /* max expansion from strnvis() */ |