tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

- djm@cvs.openbsd.org 2014/07/03 22:23:46 

[sshconnect.c]
     when rekeying, skip file/DNS lookup if it is the same as the key sent
     during initial key exchange. bz#2154 patch from Iain Morgan; ok markus@
This commit is contained in:
Damien Miller 2014-07-04 08:59:24 +10:00
parent d2c3cd5f2e
commit 6b37fbb792
2 changed files with 23 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -6,7 +6,10 @@
makes it easier to verify that chacha_encrypt_bytes() is only called once makes it easier to verify that chacha_encrypt_bytes() is only called once
per chacha_ivsetup() call. per chacha_ivsetup() call.
ok djm@ ok djm@
- djm@cvs.openbsd.org 2014/07/03 22:23:46
[sshconnect.c]
when rekeying, skip file/DNS lookup if it is the same as the key sent
during initial key exchange. bz#2154 patch from Iain Morgan; ok markus@
20140703 20140703
- (djm) [digest-openssl.c configure.ac] Disable RIPEMD160 if libcrypto - (djm) [digest-openssl.c configure.ac] Disable RIPEMD160 if libcrypto

23
sshconnect.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshconnect.c,v 1.249 2014/06/24 01:13:21 djm Exp $ */ /* $OpenBSD: sshconnect.c,v 1.250 2014/07/03 22:23:46 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -65,6 +65,7 @@
char *client_version_string = NULL; char *client_version_string = NULL;
char *server_version_string = NULL; char *server_version_string = NULL;
Key *previous_host_key = NULL;
static int matching_host_key_dns = 0; static int matching_host_key_dns = 0;
@ -1217,7 +1218,7 @@ fail:
int int
verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key) verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
{ {
int flags = 0; int r = -1, flags = 0;
char *fp; char *fp;
Key *plain = NULL; Key *plain = NULL;
@ -1225,6 +1226,11 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
debug("Server host key: %s %s", key_type(host_key), fp); debug("Server host key: %s %s", key_type(host_key), fp);
free(fp); free(fp);
if (key_equal(previous_host_key, host_key)) {
debug("%s: server host key matches cached key", __func__);
return 0;
}
if (options.verify_host_key_dns) { if (options.verify_host_key_dns) {
/* /*
* XXX certs are not yet supported for DNS, so downgrade * XXX certs are not yet supported for DNS, so downgrade
@ -1239,7 +1245,8 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
flags & DNS_VERIFY_MATCH && flags & DNS_VERIFY_MATCH &&
flags & DNS_VERIFY_SECURE) { flags & DNS_VERIFY_SECURE) {
key_free(plain); key_free(plain);
return 0; r = 0;
goto done;
} }
if (flags & DNS_VERIFY_MATCH) { if (flags & DNS_VERIFY_MATCH) {
matching_host_key_dns = 1; matching_host_key_dns = 1;
@ -1254,9 +1261,17 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
key_free(plain); key_free(plain);
} }
return check_host_key(host, hostaddr, options.port, host_key, RDRW, r = check_host_key(host, hostaddr, options.port, host_key, RDRW,
options.user_hostfiles, options.num_user_hostfiles, options.user_hostfiles, options.num_user_hostfiles,
options.system_hostfiles, options.num_system_hostfiles); options.system_hostfiles, options.num_system_hostfiles);
done:
if (r == 0 && host_key != NULL) {
key_free(previous_host_key);
previous_host_key = key_from_private(host_key);
}
return r;
} }
/* /*