diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2021-11-10 07:25:08 +0100 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2021-11-10 07:32:18 +0100 |
| commit | 239da797cbf07a640d7b1ea02d3f99ace3ef792d (patch) | |
| tree | 846436329ccb5a741a741c0591cbcbb5c6730476 /ssh-keysign.c | |
| parent | upstream: improve error message when trying to expand a ~user path (diff) | |
| download | openssh-239da797cbf07a640d7b1ea02d3f99ace3ef792d.tar.xz openssh-239da797cbf07a640d7b1ea02d3f99ace3ef792d.zip | |
upstream: fix ssh-keysign for KEX algorithms that use SHA384/512
exchange hashes; feedback/ok markus@
OpenBSD-Commit-ID: 09a8fda1c081f5de1e3128df64f28b7bdadee239
Diffstat (limited to 'ssh-keysign.c')
| -rw-r--r-- | ssh-keysign.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/ssh-keysign.c b/ssh-keysign.c index d6ac98c6c..8b3c9a296 100644 --- a/ssh-keysign.c +++ b/ssh-keysign.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keysign.c,v 1.67 2021/07/05 01:16:46 dtucker Exp $ */ +/* $OpenBSD: ssh-keysign.c,v 1.68 2021/11/10 06:25:08 djm Exp $ */ /* * Copyright (c) 2002 Markus Friedl. All rights reserved. * @@ -80,10 +80,13 @@ valid_request(struct passwd *pw, char *host, struct sshkey **ret, if ((b = sshbuf_from(data, datalen)) == NULL) fatal_f("sshbuf_from failed"); - /* session id, currently limited to SHA1 (20 bytes) or SHA256 (32) */ + /* session id */ if ((r = sshbuf_get_string(b, NULL, &len)) != 0) fatal_fr(r, "parse session ID"); - if (len != 20 && len != 32) + if (len != 20 && /* SHA1 */ + len != 32 && /* SHA256 */ + len != 48 && /* SHA384 */ + len != 64) /* SHA512 */ fail++; if ((r = sshbuf_get_u8(b, &type)) != 0) |