tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream commit 

make rekey_limit for sshd w/privsep work; ok djm@
 dtucker@
This commit is contained in:
markus@openbsd.org 2015-02-13 18:57:00 +00:00 committed by Damien Miller
parent 8ec67d505b
commit 02db468bf7
3 changed files with 12 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
monitor.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: monitor.c,v 1.142 2015/02/06 23:21:59 millert Exp $ */ /* $OpenBSD: monitor.c,v 1.143 2015/02/13 18:57:00 markus Exp $ */
/* /*
* Copyright 2002 Niels Provos <provos@citi.umich.edu> * Copyright 2002 Niels Provos <provos@citi.umich.edu>
* Copyright 2002 Markus Friedl <markus@openbsd.org> * Copyright 2002 Markus Friedl <markus@openbsd.org>
@ -1833,11 +1833,6 @@ monitor_apply_keystate(struct monitor *pmonitor)
(ssh_packet_comp_alloc_func *)mm_zalloc, (ssh_packet_comp_alloc_func *)mm_zalloc,
(ssh_packet_comp_free_func *)mm_zfree); (ssh_packet_comp_free_func *)mm_zfree);
} }
if (options.rekey_limit || options.rekey_interval)
ssh_packet_set_rekey_limits(ssh,
(u_int32_t)options.rekey_limit,
(time_t)options.rekey_interval);
} }
/* This function requries careful sanity checking */ /* This function requries careful sanity checking */

2
opacket.h
View File

@ -128,8 +128,6 @@ void packet_read_expect(int expected_type);
ssh_packet_send_ignore(active_state, (nbytes)) ssh_packet_send_ignore(active_state, (nbytes))
#define packet_need_rekeying() \ #define packet_need_rekeying() \
ssh_packet_need_rekeying(active_state) ssh_packet_need_rekeying(active_state)
#define packet_set_rekey_limit(bytes) \
ssh_packet_set_rekey_limit(active_state, (bytes))
#define packet_set_server() \ #define packet_set_server() \
ssh_packet_set_server(active_state) ssh_packet_set_server(active_state)
#define packet_set_authenticated() \ #define packet_set_authenticated() \

18
packet.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: packet.c,v 1.207 2015/02/11 01:20:38 djm Exp $ */ /* $OpenBSD: packet.c,v 1.208 2015/02/13 18:57:00 markus Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -185,7 +185,7 @@ struct session_state {
u_int32_t rekey_limit; u_int32_t rekey_limit;
/* Time-based rekeying */ /* Time-based rekeying */
time_t rekey_interval; /* how often in seconds */ u_int32_t rekey_interval; /* how often in seconds */
time_t rekey_time; /* time of last rekeying */ time_t rekey_time; /* time of last rekeying */
/* Session key for protocol v1 */ /* Session key for protocol v1 */
@ -2225,11 +2225,6 @@ ssh_packet_set_rekey_limits(struct ssh *ssh, u_int32_t bytes, time_t seconds)
(int)seconds); (int)seconds);
ssh->state->rekey_limit = bytes; ssh->state->rekey_limit = bytes;
ssh->state->rekey_interval = seconds; ssh->state->rekey_interval = seconds;
/*
* We set the time here so that in post-auth privsep slave we count
* from the completion of the authentication.
*/
ssh->state->rekey_time = monotime();
} }
time_t time_t
@ -2437,6 +2432,8 @@ ssh_packet_get_state(struct ssh *ssh, struct sshbuf *m)
if ((r = kex_to_blob(m, ssh->kex)) != 0 || if ((r = kex_to_blob(m, ssh->kex)) != 0 ||
(r = newkeys_to_blob(m, ssh, MODE_OUT)) != 0 || (r = newkeys_to_blob(m, ssh, MODE_OUT)) != 0 ||
(r = newkeys_to_blob(m, ssh, MODE_IN)) != 0 || (r = newkeys_to_blob(m, ssh, MODE_IN)) != 0 ||
(r = sshbuf_put_u32(m, state->rekey_limit)) != 0 ||
(r = sshbuf_put_u32(m, state->rekey_interval)) != 0 ||
(r = sshbuf_put_u32(m, state->p_send.seqnr)) != 0 || (r = sshbuf_put_u32(m, state->p_send.seqnr)) != 0 ||
(r = sshbuf_put_u64(m, state->p_send.blocks)) != 0 || (r = sshbuf_put_u64(m, state->p_send.blocks)) != 0 ||
(r = sshbuf_put_u32(m, state->p_send.packets)) != 0 || (r = sshbuf_put_u32(m, state->p_send.packets)) != 0 ||
@ -2624,6 +2621,8 @@ ssh_packet_set_state(struct ssh *ssh, struct sshbuf *m)
if ((r = kex_from_blob(m, &ssh->kex)) != 0 || if ((r = kex_from_blob(m, &ssh->kex)) != 0 ||
(r = newkeys_from_blob(m, ssh, MODE_OUT)) != 0 || (r = newkeys_from_blob(m, ssh, MODE_OUT)) != 0 ||
(r = newkeys_from_blob(m, ssh, MODE_IN)) != 0 || (r = newkeys_from_blob(m, ssh, MODE_IN)) != 0 ||
(r = sshbuf_get_u32(m, &state->rekey_limit)) != 0 ||
(r = sshbuf_get_u32(m, &state->rekey_interval)) != 0 ||
(r = sshbuf_get_u32(m, &state->p_send.seqnr)) != 0 || (r = sshbuf_get_u32(m, &state->p_send.seqnr)) != 0 ||
(r = sshbuf_get_u64(m, &state->p_send.blocks)) != 0 || (r = sshbuf_get_u64(m, &state->p_send.blocks)) != 0 ||
(r = sshbuf_get_u32(m, &state->p_send.packets)) != 0 || (r = sshbuf_get_u32(m, &state->p_send.packets)) != 0 ||
@ -2633,6 +2632,11 @@ ssh_packet_set_state(struct ssh *ssh, struct sshbuf *m)
(r = sshbuf_get_u32(m, &state->p_read.packets)) != 0 || (r = sshbuf_get_u32(m, &state->p_read.packets)) != 0 ||
(r = sshbuf_get_u64(m, &state->p_read.bytes)) != 0) (r = sshbuf_get_u64(m, &state->p_read.bytes)) != 0)
return r; return r;
/*
* We set the time here so that in post-auth privsep slave we
* count from the completion of the authentication.
*/
state->rekey_time = monotime();
/* XXX ssh_set_newkeys overrides p_read.packets? XXX */ /* XXX ssh_set_newkeys overrides p_read.packets? XXX */
if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0 || if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0 ||
(r = ssh_set_newkeys(ssh, MODE_OUT)) != 0) (r = ssh_set_newkeys(ssh, MODE_OUT)) != 0)