- djm@cvs.openbsd.org 2005/03/02 01:27:41

     [ssh-keygen.c]
     ignore hostnames with metachars when hashing; ok deraadt@

diff --git a/ChangeLog b/ChangeLog
index 097d142f739f383332890b8c5450ee719e513a85..1ef122d4b690fc0f3822bcbf0f180f213f736105 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -39,6 +39,9 @@
      [sshconnect.c]
      fix addition of new hashed hostnames when CheckHostIP=yes;
      found and ok dtucker@
+   - djm@cvs.openbsd.org 2005/03/02 01:27:41
+     [ssh-keygen.c]
+     ignore hostnames with metachars when hashing; ok deraadt@
 
 20050301
  - (djm) OpenBSD CVS sync:

diff --git a/ssh-keygen.c b/ssh-keygen.c
index 00ddb90c8a6fcad796862d1b120d75757168aa2b..a9931d4d846ad5cfce652dbc8498f72a5f6dd65f 100644 (file)
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keygen.c,v 1.119 2005/03/01 10:42:49 djm Exp $");
+RCSID("$OpenBSD: ssh-keygen.c,v 1.120 2005/03/02 01:27:41 djm Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/pem.h>
@@ -686,8 +686,15 @@ do_known_hosts(struct passwd *pw, const char *name)
                        } else if (hash_hosts) {
                                for(cp2 = strsep(&cp, ",");
                                    cp2 != NULL && *cp2 != '\0';
-                                   cp2 = strsep(&cp, ","))
-                                       print_host(out, cp2, public, 1);
+                                   cp2 = strsep(&cp, ",")) {
+                                       if (strcspn(cp2, "*?!") != strlen(cp2))
+                                               fprintf(stderr, "Warning: "
+                                                   "ignoring host name with "
+                                                   "metacharacters: %.64s\n",
+                                                   cp2);
+                                       else
+                                               print_host(out, cp2, public, 1);
+                               }
                                has_unhashed = 1;
                        }
                }