summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authormarkus@openbsd.org <markus@openbsd.org>2017-03-15 07:07:39 +0000
committerDamien Miller <djm@mindrot.org>2017-03-17 17:12:44 +1100
commit2adbe1e63bc313d03e8e84e652cc623af8ebb163 (patch)
tree7e0b20c631d1c3427b3e8a1eea988577692e5b2c
parent2fbf91684d76d38b9cf06550b69c9e41bca5a71c (diff)
upstream commit
disallow KEXINIT before NEWKEYS; ok djm; report by vegard.nossum at oracle.com Upstream-ID: 3668852d1f145050e62f1da08917de34cb0c5234
-rw-r--r--kex.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/kex.c b/kex.c
index 8ac00299c..cf4ac0dc5 100644
--- a/kex.c
+++ b/kex.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: kex.c,v 1.130 2017/03/10 04:07:20 djm Exp $ */ 1/* $OpenBSD: kex.c,v 1.131 2017/03/15 07:07:39 markus Exp $ */
2/* 2/*
3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
4 * 4 *
@@ -341,7 +341,6 @@ kex_reset_dispatch(struct ssh *ssh)
341{ 341{
342 ssh_dispatch_range(ssh, SSH2_MSG_TRANSPORT_MIN, 342 ssh_dispatch_range(ssh, SSH2_MSG_TRANSPORT_MIN,
343 SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error); 343 SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
344 ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_input_kexinit);
345} 344}
346 345
347static int 346static int
@@ -431,6 +430,7 @@ kex_input_newkeys(int type, u_int32_t seq, void *ctxt)
431 430
432 debug("SSH2_MSG_NEWKEYS received"); 431 debug("SSH2_MSG_NEWKEYS received");
433 ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error); 432 ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error);
433 ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_input_kexinit);
434 if ((r = sshpkt_get_end(ssh)) != 0) 434 if ((r = sshpkt_get_end(ssh)) != 0)
435 return r; 435 return r;
436 if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0) 436 if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0)
@@ -545,6 +545,7 @@ kex_new(struct ssh *ssh, char *proposal[PROPOSAL_MAX], struct kex **kexp)
545 goto out; 545 goto out;
546 kex->done = 0; 546 kex->done = 0;
547 kex_reset_dispatch(ssh); 547 kex_reset_dispatch(ssh);
548 ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_input_kexinit);
548 r = 0; 549 r = 0;
549 *kexp = kex; 550 *kexp = kex;
550 out: 551 out: