diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2015-01-26 07:10:03 +0100 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2015-01-26 14:00:57 +0100 |
| commit | 5104db7cbd6cdd9c5971f4358e74414862fc1022 (patch) | |
| tree | 94692c77a4888f8adade706324fdee3a999bc6b0 /kexc25519c.c | |
| parent | upstream commit (diff) | |
| download | openssh-5104db7cbd6cdd9c5971f4358e74414862fc1022.tar.xz openssh-5104db7cbd6cdd9c5971f4358e74414862fc1022.zip | |
upstream commit
correctly match ECDSA subtype (== curve) for
offered/recevied host keys. Fixes connection-killing host key mismatches when
a server offers multiple ECDSA keys with different curve type (an extremely
unlikely configuration).
ok markus, "looks mechanical" deraadt@
Diffstat (limited to 'kexc25519c.c')
| -rw-r--r-- | kexc25519c.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/kexc25519c.c b/kexc25519c.c index 833ce0544..b7ef65dc3 100644 --- a/kexc25519c.c +++ b/kexc25519c.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kexc25519c.c,v 1.6 2015/01/19 20:16:15 markus Exp $ */ +/* $OpenBSD: kexc25519c.c,v 1.7 2015/01/26 06:10:03 djm Exp $ */ /* * Copyright (c) 2001 Markus Friedl. All rights reserved. * Copyright (c) 2010 Damien Miller. All rights reserved. @@ -92,7 +92,9 @@ input_kex_c25519_reply(int type, u_int32_t seq, void *ctxt) (r = sshkey_from_blob(server_host_key_blob, sbloblen, &server_host_key)) != 0) goto out; - if (server_host_key->type != kex->hostkey_type) { + if (server_host_key->type != kex->hostkey_type || + (kex->hostkey_type == KEY_ECDSA && + server_host_key->ecdsa_nid != kex->hostkey_nid)) { r = SSH_ERR_KEY_TYPE_MISMATCH; goto out; } |