1 files changed, 13 insertions, 7 deletions

diff --git a/kexgexs.c b/kexgexs.c
index 8515568b3..f4156af96 100644
--- a/kexgexs.c
+++ b/kexgexs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexgexs.c,v 1.12 2009/06/21 07:37:15 dtucker Exp $ */
+/* $OpenBSD: kexgexs.c,v 1.13 2010/02/26 20:29:54 djm Exp $ */
 /*
  * Copyright (c) 2000 Niels Provos.  All rights reserved.
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
@@ -52,18 +52,24 @@ void
 kexgex_server(Kex *kex)
 {
         BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
-        Key *server_host_key;
+        Key *server_host_public, *server_host_private;
         DH *dh;
         u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
         u_int sbloblen, klen, slen, hashlen;
         int omin = -1, min = -1, omax = -1, max = -1, onbits = -1, nbits = -1;
         int type, kout;
 
-        if (kex->load_host_key == NULL)
+        if (kex->load_host_public_key == NULL ||
+            kex->load_host_private_key == NULL)
                 fatal("Cannot load hostkey");
-        server_host_key = kex->load_host_key(kex->hostkey_type);
-        if (server_host_key == NULL)
+        server_host_public = kex->load_host_public_key(kex->hostkey_type);
+        if (server_host_public == NULL)
                 fatal("Unsupported hostkey type %d", kex->hostkey_type);
+        server_host_private = kex->load_host_private_key(kex->hostkey_type);
+        if (server_host_private == NULL)
+                fatal("Missing private key for hostkey type %d",
+                    kex->hostkey_type);
+
 
         type = packet_read();
         switch (type) {
@@ -149,7 +155,7 @@ kexgex_server(Kex *kex)
         memset(kbuf, 0, klen);
         xfree(kbuf);
 
-        key_to_blob(server_host_key, &server_host_key_blob, &sbloblen);
+        key_to_blob(server_host_public, &server_host_key_blob, &sbloblen);
 
         if (type == SSH2_MSG_KEX_DH_GEX_REQUEST_OLD)
                 omin = min = omax = max = -1;
@@ -179,7 +185,7 @@ kexgex_server(Kex *kex)
         }
 
         /* sign H */
-        if (PRIVSEP(key_sign(server_host_key, &signature, &slen, hash,
+        if (PRIVSEP(key_sign(server_host_private, &signature, &slen, hash,
             hashlen)) < 0)
                 fatal("kexgex_server: key_sign failed");