[openssh-commits] [openssh] 04/09: upstream: disable UpdateHostkeys by default if VerifyHostKeyDNS is

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit e79957e877db42c4c68fabcf6ecff2268e53acb5
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Wed Oct 7 02:18:45 2020 +0000

    upstream: disable UpdateHostkeys by default if VerifyHostKeyDNS is
    
    enabled; suggested by Mark D. Baushke
    
    OpenBSD-Commit-ID: 85a1b88592c81bc85df7ee7787dbbe721a0542bf
---
 readconf.c   | 7 ++++---
 ssh_config.5 | 8 +++++---
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/readconf.c b/readconf.c
index a4f6cba0..8655646b 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.337 2020/10/03 09:22:26 djm Exp $ */
+/* $OpenBSD: readconf.c,v 1.338 2020/10/07 02:18:45 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -2168,9 +2168,10 @@ fill_default_options(Options * options)
 		    xstrdup(_PATH_SSH_SYSTEM_HOSTFILE2);
 	}
 	if (options->update_hostkeys == -1) {
-		if (options->num_user_hostfiles == 0 ||
+		if (options->verify_host_key_dns <= 0 &&
+		    (options->num_user_hostfiles == 0 ||
 		    (options->num_user_hostfiles == 1 && strcmp(options->
-		    user_hostfiles[0], _PATH_SSH_USER_HOSTFILE) == 0))
+		    user_hostfiles[0], _PATH_SSH_USER_HOSTFILE) == 0)))
 			options->update_hostkeys = SSH_UPDATE_HOSTKEYS_YES;
 		else
 			options->update_hostkeys = SSH_UPDATE_HOSTKEYS_NO;
diff --git a/ssh_config.5 b/ssh_config.5
index e085efff..2f1886a1 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.334 2020/10/03 08:30:47 djm Exp $
-.Dd $Mdocdate: October 3 2020 $
+.\" $OpenBSD: ssh_config.5,v 1.335 2020/10/07 02:18:45 djm Exp $
+.Dd $Mdocdate: October 7 2020 $
 .Dt SSH_CONFIG 5
 .Os
 .Sh NAME
@@ -1723,7 +1723,9 @@ host was already trusted or explicitly accepted by the user.
 .Cm UpdateHostKeys
 is enabled by default if the user has not overridden the default
 .Cm UserKnownHostsFile
-setting, otherwise
+setting and has not enabled
+.Cm VerifyHostKeyDNS ,
+otherwise
 .Cm UpdateHostKeys
 will be set to
 .Cm no .

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.