upstream commit

add support for additional fixed DH groups from
 draft-ietf-curdle-ssh-kex-sha2-03

diffie-hellman-group14-sha256 (2K group)
diffie-hellman-group16-sha512 (4K group)
diffie-hellman-group18-sha512 (8K group)

based on patch from Mark D. Baushke and Darren Tucker
ok markus@

Upstream-ID: ac00406ada4f0dfec41585ca0839f039545bc46f

1 files changed, 5 insertions, 4 deletions

diff --git a/kexdh.c b/kexdh.c
index feea6697d..0bf0dc138 100644
--- a/kexdh.c
+++ b/kexdh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexdh.c,v 1.25 2015/01/19 20:16:15 markus Exp $ */
+/* $OpenBSD: kexdh.c,v 1.26 2016/05/02 10:26:04 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  *
@@ -43,6 +43,7 @@
 
 int
 kex_dh_hash(
+    int hash_alg,
     const char *client_version_string,
     const char *server_version_string,
     const u_char *ckexinit, size_t ckexinitlen,
@@ -56,7 +57,7 @@ kex_dh_hash(
         struct sshbuf *b;
         int r;
 
-        if (*hashlen < ssh_digest_bytes(SSH_DIGEST_SHA1))
+        if (*hashlen < ssh_digest_bytes(hash_alg))
                 return SSH_ERR_INVALID_ARGUMENT;
         if ((b = sshbuf_new()) == NULL)
                 return SSH_ERR_ALLOC_FAIL;
@@ -79,12 +80,12 @@ kex_dh_hash(
 #ifdef DEBUG_KEX
         sshbuf_dump(b, stderr);
 #endif
-        if (ssh_digest_buffer(SSH_DIGEST_SHA1, b, hash, *hashlen) != 0) {
+        if (ssh_digest_buffer(hash_alg, b, hash, *hashlen) != 0) {
                 sshbuf_free(b);
                 return SSH_ERR_LIBCRYPTO_ERROR;
         }
         sshbuf_free(b);
-        *hashlen = ssh_digest_bytes(SSH_DIGEST_SHA1);
+        *hashlen = ssh_digest_bytes(hash_alg);
 #ifdef DEBUG_KEX
         dump_digest("hash", hash, *hashlen);
 #endif