upstream commit

Drop compatibility hacks for some ancient SSH
implementations, including ssh.com <=2.* and OpenSSH <= 3.*.

These versions were all released in or before 2001 and predate the
final SSH RFCs. The hacks in question aren't necessary for RFC-
compliant SSH implementations.

ok markus@

OpenBSD-Commit-ID: 4be81c67db57647f907f4e881fb9341448606138

1 files changed, 30 insertions, 51 deletions

diff --git a/ssh-dss.c b/ssh-dss.c
index 7af59fa6e..cda498a87 100644
--- a/ssh-dss.c
+++ b/ssh-dss.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-dss.c,v 1.35 2016/04/21 06:08:02 djm Exp $ */
+/* $OpenBSD: ssh-dss.c,v 1.36 2018/01/23 05:27:21 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -86,38 +86,25 @@ ssh_dss_sign(const struct sshkey *key, u_char **sigp, size_t *lenp,
 	BN_bn2bin(sig->r, sigblob + SIGBLOB_LEN - INTBLOB_LEN - rlen);
 	BN_bn2bin(sig->s, sigblob + SIGBLOB_LEN - slen);
 
-	if (compat & SSH_BUG_SIGBLOB) {
-		if (sigp != NULL) {
-			if ((*sigp = malloc(SIGBLOB_LEN)) == NULL) {
-				ret = SSH_ERR_ALLOC_FAIL;
-				goto out;
-			}
-			memcpy(*sigp, sigblob, SIGBLOB_LEN);
-		}
-		if (lenp != NULL)
-			*lenp = SIGBLOB_LEN;
-		ret = 0;
-	} else {
-		/* ietf-drafts */
-		if ((b = sshbuf_new()) == NULL) {
+	if ((b = sshbuf_new()) == NULL) {
+		ret = SSH_ERR_ALLOC_FAIL;
+		goto out;
+	}
+	if ((ret = sshbuf_put_cstring(b, "ssh-dss")) != 0 ||
+	    (ret = sshbuf_put_string(b, sigblob, SIGBLOB_LEN)) != 0)
+		goto out;
+
+	len = sshbuf_len(b);
+	if (sigp != NULL) {
+		if ((*sigp = malloc(len)) == NULL) {
 			ret = SSH_ERR_ALLOC_FAIL;
 			goto out;
 		}
-		if ((ret = sshbuf_put_cstring(b, "ssh-dss")) != 0 ||
-		    (ret = sshbuf_put_string(b, sigblob, SIGBLOB_LEN)) != 0)
-			goto out;
-		len = sshbuf_len(b);
-		if (sigp != NULL) {
-			if ((*sigp = malloc(len)) == NULL) {
-				ret = SSH_ERR_ALLOC_FAIL;
-				goto out;
-			}
-			memcpy(*sigp, sshbuf_ptr(b), len);
-		}
-		if (lenp != NULL)
-			*lenp = len;
-		ret = 0;
+		memcpy(*sigp, sshbuf_ptr(b), len);
 	}
+	if (lenp != NULL)
+		*lenp = len;
+	ret = 0;
  out:
 	explicit_bzero(digest, sizeof(digest));
 	if (sig != NULL)
@@ -146,28 +133,20 @@ ssh_dss_verify(const struct sshkey *key,
 		return SSH_ERR_INTERNAL_ERROR;
 
 	/* fetch signature */
-	if (compat & SSH_BUG_SIGBLOB) {
-		if ((sigblob = malloc(signaturelen)) == NULL)
-			return SSH_ERR_ALLOC_FAIL;
-		memcpy(sigblob, signature, signaturelen);
-		len = signaturelen;
-	} else {
-		/* ietf-drafts */
-		if ((b = sshbuf_from(signature, signaturelen)) == NULL)
-			return SSH_ERR_ALLOC_FAIL;
-		if (sshbuf_get_cstring(b, &ktype, NULL) != 0 ||
-		    sshbuf_get_string(b, &sigblob, &len) != 0) {
-			ret = SSH_ERR_INVALID_FORMAT;
-			goto out;
-		}
-		if (strcmp("ssh-dss", ktype) != 0) {
-			ret = SSH_ERR_KEY_TYPE_MISMATCH;
-			goto out;
-		}
-		if (sshbuf_len(b) != 0) {
-			ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
-			goto out;
-		}
+	if ((b = sshbuf_from(signature, signaturelen)) == NULL)
+		return SSH_ERR_ALLOC_FAIL;
+	if (sshbuf_get_cstring(b, &ktype, NULL) != 0 ||
+	    sshbuf_get_string(b, &sigblob, &len) != 0) {
+		ret = SSH_ERR_INVALID_FORMAT;
+		goto out;
+	}
+	if (strcmp("ssh-dss", ktype) != 0) {
+		ret = SSH_ERR_KEY_TYPE_MISMATCH;
+		goto out;
+	}
+	if (sshbuf_len(b) != 0) {
+		ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
+		goto out;
 	}
 
 	if (len != SIGBLOB_LEN) {