diff options
| author | Damien Miller <djm@cvs.openbsd.org> | 2014-11-17 00:21:41 +0000 |
|---|---|---|
| committer | Damien Miller <djm@cvs.openbsd.org> | 2014-11-17 00:21:41 +0000 |
| commit | 882f236011421171b95dede9640543610ec7d633 (patch) | |
| tree | aa9e7f9811c703eb4fe327088318d306acceb34d /usr.bin/ssh/krl.c | |
| parent | b70ce01628cd5072c969d0d542d3b005b8ad5c2f (diff) | |
fix KRL generation when multiple CAs are in use
We would generate an invalid KRL when revoking certs by serial
number for multiple CA keys due to a section being written out
twice.
Also extend the regress test to catch this case by having it
produce a multi-CA KRL.
Reported by peter AT pean.org
Diffstat (limited to 'usr.bin/ssh/krl.c')
| -rw-r--r-- | usr.bin/ssh/krl.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/usr.bin/ssh/krl.c b/usr.bin/ssh/krl.c index ccc330c7421..3444c049f32 100644 --- a/usr.bin/ssh/krl.c +++ b/usr.bin/ssh/krl.c @@ -14,7 +14,7 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $OpenBSD: krl.c,v 1.17 2014/06/24 01:13:21 djm Exp $ */ +/* $OpenBSD: krl.c,v 1.18 2014/11/17 00:21:40 djm Exp $ */ #include <sys/types.h> #include <sys/param.h> @@ -684,6 +684,7 @@ ssh_krl_to_blob(struct ssh_krl *krl, Buffer *buf, const Key **sign_keys, /* Store sections for revoked certificates */ TAILQ_FOREACH(rc, &krl->revoked_certs, entry) { + buffer_clear(§); if (revoked_certs_generate(rc, §) != 0) goto out; buffer_put_char(buf, KRL_SECTION_CERTIFICATES); |