From nobody Wed Mar 01 14:20:09 2023 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4PRbwn6NH9z3tvjN; Wed, 1 Mar 2023 14:20:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4PRbwn5vCpz3HT5; Wed, 1 Mar 2023 14:20:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1677680409; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5dsAoWKzxO0x2jTvjoEQrbwYG+3lOXndd3rqOKK6Z8I=; b=TOuF+OInCRtqmKmBuYDJwSV5GhaPZC3l+y5ThJPq4QD1DKPTpEf+VybfhduqplYBXglkxo Fm0vBhXfCKsWzE9HGYeFo3Kcj3UxToa4MqsOtED4StPBOhW0WQCpoFRc93ULN1uMTR0DbK na+ZQhPGG3OL1kMorD3WnToTdr+X4iNg3DC3Z8li1zt7yWRLedhWPx/TjUIbtEGgZn0ICY o7Swc0NW0lpeJhc7Fbpkd4YLLQfqeuNgXaRPA+dqIS+wZxLEWBoQNAciFjE0vw/I6kKPun xR34DM/j5lZNQ3nnW4uD4VZUCreF9PGHt2sZknPK8nrMZ269d0d8P3WIaY47QA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1677680409; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=5dsAoWKzxO0x2jTvjoEQrbwYG+3lOXndd3rqOKK6Z8I=; b=SOzZvgglxezbZhSCVt/0AU9qJJsJDCiBDk3mnEOnEsw2deuv/JnpPbTXbY+TNvK+lASabN abRp1beRJMfGCCEjZt7kT+XnJa0mcQLV/fUfXx4idrIgk/1hn4exQwqZtXMmpOigggxjv3 wjNYVu54zYKMUmuy5oTrq6EeYyH7epn4SCgg/V9Rv70bFkZ5bkyEBd8KZHwP17KcCmXoC0 /YxHMQuM9IU1PFFhhIu1m4Yd9JT+MhrLhqjzoc8HOdLlnf3L5avysAxbJw0v/x/q7AFvWj 31QEVAxIclBs33LDXxHzBj7KbrUm17vrfUlir8s1HVG7Y1hIRmnFx49vAS1IVw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1677680409; a=rsa-sha256; cv=none; b=SpjvhLew3rZxF/DXxFgb6EQIpiwk09gCm9tfBJPlbBGY9sxxougHilv1RvjJ2hetUHa6RZ z3PpBJjFFSWJ1k+kfS5poQaiKm+ROH2smvnmAhAIakhunHB9hMQEYHAIbQPuhqcMmsqKZo kSVNAbbK9t5jon4JCG2OUPATiF2q4xNjH2ZKqTwiDFF43b5ByzHD1jf/cjVgyWoOzITu20 QOAMv76UEg60884QlplLifGyHcBJhl63sZenlLR+qe5RXLVFWNy2ni+Ph9jTIh97uOyUV3 PF0gn48aWWcVi97eglgbK0vcf4xOo2KsjdoYdWNK1scjo62tz8daz5PAbnw1oQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4PRbwn4y7kzd6G; Wed, 1 Mar 2023 14:20:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 321EK9uF076531; Wed, 1 Mar 2023 14:20:09 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 321EK9Fg076523; Wed, 1 Mar 2023 14:20:09 GMT (envelope-from git) Date: Wed, 1 Mar 2023 14:20:09 GMT Message-Id: <202303011420.321EK9Fg076523@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Ed Maste Subject: git: 41ff5ea22cb9 - main - ssh: default VerifyHostKeyDNS to no, following upstream List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 41ff5ea22cb95deb9e7415510eb2f5f00b91537a Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=41ff5ea22cb95deb9e7415510eb2f5f00b91537a commit 41ff5ea22cb95deb9e7415510eb2f5f00b91537a Author: Ed Maste AuthorDate: 2023-02-17 01:26:41 +0000 Commit: Ed Maste CommitDate: 2023-03-01 14:19:07 +0000 ssh: default VerifyHostKeyDNS to no, following upstream Revert to upstream's default. Using VerifyHostKeyDNS may depend on a trusted nameserver and network path. This reverts commit 83c6a5242c80160fff76fb85454938761645b0c4. Reported by: David Leadbeater, G-Research Reviewed by: gordon Relnotes: Yes Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D38648 --- crypto/openssh/FREEBSD-upgrade | 1 - crypto/openssh/readconf.c | 6 ------ crypto/openssh/ssh_config | 1 - crypto/openssh/ssh_config.5 | 5 +---- 4 files changed, 1 insertion(+), 12 deletions(-) diff --git a/crypto/openssh/FREEBSD-upgrade b/crypto/openssh/FREEBSD-upgrade index bc1122768790..92abda1d0e4c 100644 --- a/crypto/openssh/FREEBSD-upgrade +++ b/crypto/openssh/FREEBSD-upgrade @@ -122,7 +122,6 @@ We've modified some configuration defaults in ssh: - CheckHostIP defaults to "no". - - VerifyHostKeyDNS defaults to "yes" if built with LDNS. 3) Canonic host names diff --git a/crypto/openssh/readconf.c b/crypto/openssh/readconf.c index bbf03c8d953f..9ade0ffa0641 100644 --- a/crypto/openssh/readconf.c +++ b/crypto/openssh/readconf.c @@ -2592,14 +2592,8 @@ fill_default_options(Options * options) options->rekey_limit = 0; if (options->rekey_interval == -1) options->rekey_interval = 0; -#if HAVE_LDNS - if (options->verify_host_key_dns == -1) - /* automatically trust a verified SSHFP record */ - options->verify_host_key_dns = 1; -#else if (options->verify_host_key_dns == -1) options->verify_host_key_dns = 0; -#endif if (options->server_alive_interval == -1) options->server_alive_interval = 0; if (options->server_alive_count_max == -1) diff --git a/crypto/openssh/ssh_config b/crypto/openssh/ssh_config index 306e8f950efd..1eb1c00632b0 100644 --- a/crypto/openssh/ssh_config +++ b/crypto/openssh/ssh_config @@ -44,4 +44,3 @@ # ProxyCommand ssh -q -W %h:%p gateway.example.com # RekeyLimit 1G 1h # UserKnownHostsFile ~/.ssh/known_hosts.d/%k -# VerifyHostKeyDNS yes diff --git a/crypto/openssh/ssh_config.5 b/crypto/openssh/ssh_config.5 index 153dd9ea4ed8..7c24e12dfdee 100644 --- a/crypto/openssh/ssh_config.5 +++ b/crypto/openssh/ssh_config.5 @@ -1991,10 +1991,7 @@ need to confirm new host keys according to the .Cm StrictHostKeyChecking option. The default is -.Cm yes -if compiled with LDNS and -.Cm no -otherwise. +.Cm no . .Pp See also .Sx VERIFYING HOST KEYS