Merge branch 'maint'

Conflicts:
	OTP_VERSION

11 files changed, 217 insertions, 15 deletions

diff --git a/lib/inets/doc/src/httpd.xml b/lib/inets/doc/src/httpd.xml
index 20c8a6b1b1..e40660ab39 100644
--- a/lib/inets/doc/src/httpd.xml
+++ b/lib/inets/doc/src/httpd.xml
@@ -315,7 +315,7 @@ text/plain	asc txt
       </item>
 
       <marker id="prop_server_tokens"></marker>
-      <tag>{server_tokens, prod|major|minor|minimal|os|full|{private, string()}}</tag>
+      <tag>{server_tokens, none|prod|major|minor|minimal|os|full|{private, string()}}</tag>
       <item>
 	<p>ServerTokens defines how the value of the server header 
 	should look. </p>
@@ -323,6 +323,7 @@ text/plain	asc txt
 	here is what the server header string could look like for
 	the different values of server-tokens:  </p>
 	<pre>
+none                  ""  % A Server: header will not be generated
 prod                  "inets"
 major                 "inets/5"
 minor                 "inets/5.8"
diff --git a/lib/inets/doc/src/notes.xml b/lib/inets/doc/src/notes.xml
index 2c3ee79f31..12bbc2b736 100644
--- a/lib/inets/doc/src/notes.xml
+++ b/lib/inets/doc/src/notes.xml
@@ -32,7 +32,28 @@
     <file>notes.xml</file>
   </header>
   
-  <section><title>Inets 5.10.6</title>
+  <section><title>Inets 5.10.7</title>
+
+    <section><title>Improvements and New Features</title>
+      <list>
+        <item>
+          <p>
+	    New value in <c>server_tokens</c> config for limiting
+	    banner grabbing attempts. </p>
+          <p>
+	    By setting <c>{server_tokens, none}</c> in
+	    <c>ServiceConfig</c> for <c>inets:start(httpd,
+	    ServiceConfig)</c>, the "Server:" header will not be set
+	    in messages from the server.</p>
+          <p>
+	    Own Id: OTP-12661 Aux Id: seq12840 </p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>Inets 5.10.6</title>
 
     <section><title>Fixed Bugs and Malfunctions</title>
       <list>
diff --git a/lib/inets/src/http_server/httpd_conf.erl b/lib/inets/src/http_server/httpd_conf.erl
index 78dda794db..dbdc1be272 100644
--- a/lib/inets/src/http_server/httpd_conf.erl
+++ b/lib/inets/src/http_server/httpd_conf.erl
@@ -219,14 +219,14 @@ load("ServerName " ++ ServerName, []) ->
 
 load("ServerTokens " ++ ServerTokens, []) ->
     %% These are the valid *plain* server tokens: 
-    %%     sprod, major, minor, minimum, os, full
+    %%     none, prod, major, minor, minimum, os, full
     %% It can also be a "private" server token: private:<any string>
     case string:tokens(ServerTokens, [$:]) of
 	["private", Private] ->
 	    {ok,[], {server_tokens, clean(Private)}};
 	[TokStr] ->
 	    Tok = list_to_atom(clean(TokStr)),
-	    case lists:member(Tok, [prod, major, minor, minimum, os, full]) of
+	    case lists:member(Tok, [none, prod, major, minor, minimum, os, full]) of
 		true ->
 		    {ok,[], {server_tokens, Tok}};
 		false ->
@@ -850,6 +850,8 @@ server(full = _ServerTokens) ->
     OS = os_info(full), 
     lists:flatten(
       io_lib:format("~s ~s OTP/~s", [?SERVER_SOFTWARE, OS, OTPRelease]));
+server(none = _ServerTokens) ->
+    "";
 server({private, Server} = _ServerTokens) when is_list(Server) -> 
     %% The user provide its own 
     Server;
@@ -1299,7 +1301,7 @@ ssl_ca_certificate_file(ConfigDB) ->
     end.
 
 plain_server_tokens() ->
-    [prod, major, minor, minimum, os, full].
+    [none, prod, major, minor, minimum, os, full].
 
 error_report(Where,M,F,Error) ->
     error_logger:error_report([{?MODULE, Where}, 
diff --git a/lib/inets/src/http_server/httpd_response.erl b/lib/inets/src/http_server/httpd_response.erl
index 0895729d05..2fa91d47a0 100644
--- a/lib/inets/src/http_server/httpd_response.erl
+++ b/lib/inets/src/http_server/httpd_response.erl
@@ -287,8 +287,11 @@ create_header(ConfigDb, KeyValueTupleHeaders) ->
     ContentType = "text/html", 
     Server      = server(ConfigDb),
     NewHeaders  = add_default_headers([{"date",         Date},
-				       {"content-type", ContentType},
-				       {"server",       Server}], 
+				       {"content-type", ContentType}
+				       | if Server=="" -> [];
+					    true -> [{"server",       Server}]
+					 end
+				      ], 
 				       KeyValueTupleHeaders),
     lists:map(fun fix_header/1, NewHeaders).
 
diff --git a/lib/inets/vsn.mk b/lib/inets/vsn.mk
index e5b63a6446..e9ecb2632a 100644
--- a/lib/inets/vsn.mk
+++ b/lib/inets/vsn.mk
@@ -18,6 +18,6 @@
 # %CopyrightEnd%
 
 APPLICATION = inets
-INETS_VSN   = 5.10.6
+INETS_VSN   = 5.10.7
 PRE_VSN     =
 APP_VSN     = "$(APPLICATION)-$(INETS_VSN)$(PRE_VSN)"
diff --git a/lib/ssh/doc/src/notes.xml b/lib/ssh/doc/src/notes.xml
index acbf3124ef..41885c684c 100644
--- a/lib/ssh/doc/src/notes.xml
+++ b/lib/ssh/doc/src/notes.xml
@@ -29,6 +29,27 @@
     <file>notes.xml</file>
   </header>
 
+<section><title>Ssh 3.2.2</title>
+
+    <section><title>Improvements and New Features</title>
+      <list>
+        <item>
+          <p>
+	    New option <c>id_string</c> for <c>ssh:daemon</c> and
+	    <c>ssh:connect</c> for limiting banner grabbing attempts.</p>
+          <p>
+	    The possible values are: <c>{id_string,string()}</c> and
+	    <c>{id_string,random}</c>. The latter will make ssh
+	    generate a random nonsence id-string for each new
+	    connection.</p>
+          <p>
+	    Own Id: OTP-12659</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
 <section><title>Ssh 3.2.1</title>
 
     <section><title>Fixed Bugs and Malfunctions</title>
diff --git a/lib/ssh/doc/src/ssh.xml b/lib/ssh/doc/src/ssh.xml
index 0e7e3848ad..72dafc0c09 100644
--- a/lib/ssh/doc/src/ssh.xml
+++ b/lib/ssh/doc/src/ssh.xml
@@ -180,6 +180,15 @@
 	  <item>
 	    <p>If true, the client will not print out anything on authorization.</p>
 	  </item>
+
+	  <tag><c><![CDATA[{id_string, random | string()}]]></c></tag>
+	  <item>
+	    <p>The string that the client presents to a connected server initially.  The default value is "Erlang/VSN" where VSN is the ssh application version number.
+	    </p>
+	    <p>The value <c>random</c> will cause a random string to be created at each connection attempt.  This is to make it a bit more difficult for a malicious peer to find the ssh software brand and version.
+	    </p>
+	  </item>
+
 	  <tag><c><![CDATA[{fd, file_descriptor()}]]></c></tag>
 	  <item>
 	    <p>Allow an existing file descriptor to be used
@@ -344,6 +353,14 @@
 	    </p>
 	  </item>
 
+	  <tag><c><![CDATA[{id_string, random | string()}]]></c></tag>
+	  <item>
+	    <p>The string the daemon will present to a connecting peer initially.  The default value is "Erlang/VSN" where VSN is the ssh application version number.
+	    </p>
+	    <p>The value <c>random</c> will cause a random string to be created at each connection attempt.  This is to make it a bit more difficult for a malicious peer to find the ssh software brand and version.
+	    </p>
+	  </item>
+
 	  <tag><c><![CDATA[{key_cb, atom()}]]></c></tag>
 	  <item>
 	    <p>Module implementing the behaviour <seealso marker="ssh_server_key_api">ssh_server_key_api</seealso>.
diff --git a/lib/ssh/src/ssh.erl b/lib/ssh/src/ssh.erl
index 51ad691ba2..d4b02a024e 100644
--- a/lib/ssh/src/ssh.erl
+++ b/lib/ssh/src/ssh.erl
@@ -347,6 +347,8 @@ handle_option([parallel_login|Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option({parallel_login,true}) | SshOptions]);
 handle_option([{minimal_remote_max_packet_size, _} = Opt|Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{id_string, _ID} = Opt|Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, [handle_inet_option(Opt) | SocketOptions], SshOptions).
 
@@ -439,6 +441,10 @@ handle_ssh_option({idle_time, Value} = Opt) when is_integer(Value), Value > 0 ->
     Opt;
 handle_ssh_option({rekey_limit, Value} = Opt) when is_integer(Value) -> 
     Opt;
+handle_ssh_option({id_string, random}) ->
+    {id_string, {random,2,5}}; %% 2 - 5 random characters
+handle_ssh_option({id_string, ID} = Opt) when is_list(ID) ->
+    Opt;
 handle_ssh_option(Opt) ->
     throw({error, {eoptions, Opt}}).
 
diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index 76fa776113..8669be570e 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -44,12 +44,34 @@
 
 versions(client, Options)->
     Vsn = proplists:get_value(vsn, Options, ?DEFAULT_CLIENT_VERSION),
-    Version = format_version(Vsn),
-    {Vsn, Version};
+    {Vsn, format_version(Vsn, software_version(Options))};
 versions(server, Options) ->
     Vsn = proplists:get_value(vsn, Options, ?DEFAULT_SERVER_VERSION),
-    Version = format_version(Vsn),
-    {Vsn, Version}.
+    {Vsn, format_version(Vsn, software_version(Options))}.
+
+software_version(Options) -> 
+    case proplists:get_value(id_string, Options) of
+	undefined ->
+	    "Erlang"++ssh_vsn();
+	{random,Nlo,Nup} ->
+	    random_id(Nlo,Nup);
+	ID ->
+	    ID
+    end.
+
+ssh_vsn() ->
+    try {ok,L} = application:get_all_key(ssh),
+	 proplists:get_value(vsn,L,"")
+    of 
+	"" -> "";
+	VSN when is_list(VSN) -> "/" ++ VSN;
+	_ -> ""
+    catch
+	_:_ -> ""
+    end.
+    
+random_id(Nlo, Nup) -> 
+    [crypto:rand_uniform($a,$z+1) || _<- lists:duplicate(crypto:rand_uniform(Nlo,Nup+1),x)  ].
 
 hello_version_msg(Data) ->
     [Data,"\r\n"].
@@ -77,9 +99,9 @@ is_valid_mac(Mac, Data, #ssh{recv_mac = Algorithm,
 yes_no(Ssh, Prompt)  ->
     (Ssh#ssh.io_cb):yes_no(Prompt, Ssh).
 
-format_version({Major,Minor}) ->
+format_version({Major,Minor}, SoftwareVersion) ->
     "SSH-" ++ integer_to_list(Major) ++ "." ++ 
-	integer_to_list(Minor) ++ "-Erlang".
+	integer_to_list(Minor) ++ "-" ++ SoftwareVersion.
 
 handle_hello_version(Version) ->
     try
diff --git a/lib/ssh/test/ssh_basic_SUITE.erl b/lib/ssh/test/ssh_basic_SUITE.erl
index 3331038450..bd029ad420 100644
--- a/lib/ssh/test/ssh_basic_SUITE.erl
+++ b/lib/ssh/test/ssh_basic_SUITE.erl
@@ -52,6 +52,12 @@ all() ->
      ssh_connect_arg4_timeout,
      packet_size_zero,
      ssh_daemon_minimal_remote_max_packet_size_option,
+     id_string_no_opt_client,
+     id_string_own_string_client,
+     id_string_random_client,
+     id_string_no_opt_server,
+     id_string_own_string_server,
+     id_string_random_server,
      {group, hardening_tests}
     ].
 
@@ -816,6 +822,66 @@ ssh_daemon_minimal_remote_max_packet_size_option(Config) ->
     ssh:stop_daemon(Server).
     
 %%--------------------------------------------------------------------
+id_string_no_opt_client(Config) ->
+    {Server, Host, Port} = fake_daemon(Config),
+    {error,_} = ssh:connect(Host, Port, []),
+    receive
+	{id,Server,"SSH-2.0-Erlang/"++Vsn} ->
+	    true = expected_ssh_vsn(Vsn);
+	{id,Server,Other} ->
+	    ct:fail("Unexpected id: ~s.",[Other])
+    end.
+
+%%--------------------------------------------------------------------
+id_string_own_string_client(Config) ->
+    {Server, Host, Port} = fake_daemon(Config),
+    {error,_} = ssh:connect(Host, Port, [{id_string,"Pelle"}]),
+    receive
+	{id,Server,"SSH-2.0-Pelle\r\n"} ->
+	    ok;
+	{id,Server,Other} ->
+	    ct:fail("Unexpected id: ~s.",[Other])
+    end.
+
+%%--------------------------------------------------------------------
+id_string_random_client(Config) ->
+    {Server, Host, Port} = fake_daemon(Config),
+    {error,_} = ssh:connect(Host, Port, [{id_string,random}]),
+    receive
+	{id,Server,Id="SSH-2.0-Erlang"++_} ->
+	    ct:fail("Unexpected id: ~s.",[Id]);
+	{id,Server,Rnd="SSH-2.0-"++_} ->
+	    ct:log("Got ~s.",[Rnd]);
+	{id,Server,Id} ->
+	    ct:fail("Unexpected id: ~s.",[Id])
+    end.
+
+%%--------------------------------------------------------------------
+id_string_no_opt_server(Config) ->
+    {_Server, Host, Port} = std_daemon(Config, []),
+    {ok,S1}=gen_tcp:connect(Host,Port,[{active,false}]),
+    {ok,"SSH-2.0-Erlang/"++Vsn} = gen_tcp:recv(S1, 0, 2000),
+    true = expected_ssh_vsn(Vsn).
+
+%%--------------------------------------------------------------------
+id_string_own_string_server(Config) ->
+    {_Server, Host, Port} = std_daemon(Config, [{id_string,"Olle"}]),
+    {ok,S1}=gen_tcp:connect(Host,Port,[{active,false}]),
+    {ok,"SSH-2.0-Olle\r\n"} = gen_tcp:recv(S1, 0, 2000).
+
+%%--------------------------------------------------------------------
+id_string_random_server(Config) ->
+    {_Server, Host, Port} = std_daemon(Config, [{id_string,random}]),
+    {ok,S1}=gen_tcp:connect(Host,Port,[{active,false}]),
+    {ok,"SSH-2.0-"++Rnd} = gen_tcp:recv(S1, 0, 2000),
+    case Rnd of
+	"Erlang"++_ -> ct:log("Id=~p",[Rnd]),
+		       {fail,got_default_id};
+	"Olle\r\n" -> {fail,got_previous_tests_value};
+	_ -> ct:log("Got ~s.",[Rnd])
+    end.
+
+%%--------------------------------------------------------------------
 ssh_connect_negtimeout_parallel(Config) -> ssh_connect_negtimeout(Config,true).
 ssh_connect_negtimeout_sequential(Config) -> ssh_connect_negtimeout(Config,false).
     
@@ -1094,3 +1160,46 @@ do_shell(IO, Shell) ->
     %% 	{'EXIT', Shell, killed} ->
     %% 	    ok
     %% end.
+
+
+std_daemon(Config, ExtraOpts) ->
+    SystemDir = ?config(data_dir, Config),
+    PrivDir = ?config(priv_dir, Config), 
+    UserDir = filename:join(PrivDir, nopubkey), % to make sure we don't use public-key-auth
+    file:make_dir(UserDir),
+    {_Server, _Host, _Port} = ssh_test_lib:daemon([{system_dir, SystemDir},
+						   {user_dir, UserDir},
+						   {failfun, fun ssh_test_lib:failfun/2} | ExtraOpts]).
+
+expected_ssh_vsn(Str) ->
+    try
+	{ok,L} = application:get_all_key(ssh),
+	proplists:get_value(vsn,L,"")++"\r\n"
+    of
+	Str -> true;
+	"\r\n" -> true;
+	_ -> false
+    catch
+	_:_ -> true %% ssh not started so we dont't know
+    end.
+	    
+	    
+fake_daemon(_Config) ->
+    Parent = self(),
+    %% start the server
+    Server = spawn(fun() ->
+			   {ok,Sl} = gen_tcp:listen(0,[]),
+			   {ok,{Host,Port}} = inet:sockname(Sl),
+			   Parent ! {sockname,self(),Host,Port},
+			   Rsa = gen_tcp:accept(Sl),
+			   ct:log("Server gen_tcp:accept got ~p",[Rsa]),
+			   {ok,S} = Rsa,
+			   receive
+			       {tcp, S, Id} -> Parent ! {id,self(),Id}
+			   end
+		   end),
+    %% Get listening host and port
+    receive
+	{sockname,Server,ServerHost,ServerPort} -> {Server, ServerHost, ServerPort}
+    end.
+
diff --git a/lib/ssh/vsn.mk b/lib/ssh/vsn.mk
index fec8dacab7..b2b85a717f 100644
--- a/lib/ssh/vsn.mk
+++ b/lib/ssh/vsn.mk
@@ -1,4 +1,4 @@
 #-*-makefile-*-   ; force emacs to enter makefile-mode
 
-SSH_VSN = 3.2.1
+SSH_VSN = 3.2.2
 APP_VSN    = "ssh-$(SSH_VSN)"