diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2021-11-10 06:25:08 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2021-11-10 17:32:18 +1100 |
| commit | 239da797cbf07a640d7b1ea02d3f99ace3ef792d (patch) | |
| tree | 846436329ccb5a741a741c0591cbcbb5c6730476 /ssh-keysign.c | |
| parent | 6997a592ecb1013df0c6d7f8df3e6517827aef11 (diff) | |
| download | openssh-git-239da797cbf07a640d7b1ea02d3f99ace3ef792d.tar.gz | |
upstream: fix ssh-keysign for KEX algorithms that use SHA384/512
exchange hashes; feedback/ok markus@
OpenBSD-Commit-ID: 09a8fda1c081f5de1e3128df64f28b7bdadee239
Diffstat (limited to 'ssh-keysign.c')
| -rw-r--r-- | ssh-keysign.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/ssh-keysign.c b/ssh-keysign.c index d6ac98c6..8b3c9a29 100644 --- a/ssh-keysign.c +++ b/ssh-keysign.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keysign.c,v 1.67 2021/07/05 01:16:46 dtucker Exp $ */ +/* $OpenBSD: ssh-keysign.c,v 1.68 2021/11/10 06:25:08 djm Exp $ */ /* * Copyright (c) 2002 Markus Friedl. All rights reserved. * @@ -80,10 +80,13 @@ valid_request(struct passwd *pw, char *host, struct sshkey **ret, if ((b = sshbuf_from(data, datalen)) == NULL) fatal_f("sshbuf_from failed"); - /* session id, currently limited to SHA1 (20 bytes) or SHA256 (32) */ + /* session id */ if ((r = sshbuf_get_string(b, NULL, &len)) != 0) fatal_fr(r, "parse session ID"); - if (len != 20 && len != 32) + if (len != 20 && /* SHA1 */ + len != 32 && /* SHA256 */ + len != 48 && /* SHA384 */ + len != 64) /* SHA512 */ fail++; if ((r = sshbuf_get_u8(b, &type)) != 0) |