upstream commit

correctly match ECDSA subtype (== curve) for
 offered/recevied host keys. Fixes connection-killing host key mismatches when
 a server offers multiple ECDSA keys with different curve type (an extremely
 unlikely configuration).

ok markus, "looks mechanical" deraadt@

1 files changed, 7 insertions, 1 deletions

diff --git a/kexgexc.c b/kexgexc.c
index 0898824f3..e8e059a88 100644
--- a/kexgexc.c
+++ b/kexgexc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexgexc.c,v 1.19 2015/01/19 20:16:15 markus Exp $ */
+/* $OpenBSD: kexgexc.c,v 1.20 2015/01/26 06:10:03 djm Exp $ */
 /*
  * Copyright (c) 2000 Niels Provos.  All rights reserved.
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
@@ -176,6 +176,12 @@ input_kex_dh_gex_reply(int type, u_int32_t seq, void *ctxt)
                 r = SSH_ERR_KEY_TYPE_MISMATCH;
                 goto out;
         }
+        if (server_host_key->type != kex->hostkey_type ||
+            (kex->hostkey_type == KEY_ECDSA &&
+            server_host_key->ecdsa_nid != kex->hostkey_nid)) {
+                r = SSH_ERR_KEY_TYPE_MISMATCH;
+                goto out;
+        }
         if (kex->verify_host_key(server_host_key, ssh) == -1) {
                 r = SSH_ERR_SIGNATURE_INVALID;
                 goto out;