diff options
author | djm@openbsd.org <djm@openbsd.org> | 2015-01-26 06:10:03 +0000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2015-01-27 00:00:57 +1100 |
commit | 5104db7cbd6cdd9c5971f4358e74414862fc1022 (patch) | |
tree | 94692c77a4888f8adade706324fdee3a999bc6b0 /kexdhc.c | |
parent | 8d4f87258f31cb6def9b3b55b6a7321d84728ff2 (diff) |
upstream commit
correctly match ECDSA subtype (== curve) for
offered/recevied host keys. Fixes connection-killing host key mismatches when
a server offers multiple ECDSA keys with different curve type (an extremely
unlikely configuration).
ok markus, "looks mechanical" deraadt@
Diffstat (limited to 'kexdhc.c')
-rw-r--r-- | kexdhc.c | 6 |
1 files changed, 4 insertions, 2 deletions
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: kexdhc.c,v 1.17 2015/01/19 20:16:15 markus Exp $ */ | 1 | /* $OpenBSD: kexdhc.c,v 1.18 2015/01/26 06:10:03 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2001 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2001 Markus Friedl. All rights reserved. |
4 | * | 4 | * |
@@ -114,7 +114,9 @@ input_kex_dh(int type, u_int32_t seq, void *ctxt) | |||
114 | (r = sshkey_from_blob(server_host_key_blob, sbloblen, | 114 | (r = sshkey_from_blob(server_host_key_blob, sbloblen, |
115 | &server_host_key)) != 0) | 115 | &server_host_key)) != 0) |
116 | goto out; | 116 | goto out; |
117 | if (server_host_key->type != kex->hostkey_type) { | 117 | if (server_host_key->type != kex->hostkey_type || |
118 | (kex->hostkey_type == KEY_ECDSA && | ||
119 | server_host_key->ecdsa_nid != kex->hostkey_nid)) { | ||
118 | r = SSH_ERR_KEY_TYPE_MISMATCH; | 120 | r = SSH_ERR_KEY_TYPE_MISMATCH; |
119 | goto out; | 121 | goto out; |
120 | } | 122 | } |