diff options
| author | Damien Miller <djm@cvs.openbsd.org> | 2021-11-10 06:25:09 +0000 |
|---|---|---|
| committer | Damien Miller <djm@cvs.openbsd.org> | 2021-11-10 06:25:09 +0000 |
| commit | 5ee990382ce7b27200eef1e61f0450e14c1cee38 (patch) | |
| tree | 8c19c6e9a25ccf41dc72aa5aaee06b50ff2a0a64 /usr.bin | |
| parent | d5e3ba350ecb39db3b7ad0481232cca8e5df81f3 (diff) | |
fix ssh-keysign for KEX algorithms that use SHA384/512 exchange hashes;
feedback/ok markus@
Diffstat (limited to 'usr.bin')
| -rw-r--r-- | usr.bin/ssh/ssh-keysign.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/usr.bin/ssh/ssh-keysign.c b/usr.bin/ssh/ssh-keysign.c index df77c034737..f0815d202d5 100644 --- a/usr.bin/ssh/ssh-keysign.c +++ b/usr.bin/ssh/ssh-keysign.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keysign.c,v 1.67 2021/07/05 01:16:46 dtucker Exp $ */ +/* $OpenBSD: ssh-keysign.c,v 1.68 2021/11/10 06:25:08 djm Exp $ */ /* * Copyright (c) 2002 Markus Friedl. All rights reserved. * @@ -75,10 +75,13 @@ valid_request(struct passwd *pw, char *host, struct sshkey **ret, if ((b = sshbuf_from(data, datalen)) == NULL) fatal_f("sshbuf_from failed"); - /* session id, currently limited to SHA1 (20 bytes) or SHA256 (32) */ + /* session id */ if ((r = sshbuf_get_string(b, NULL, &len)) != 0) fatal_fr(r, "parse session ID"); - if (len != 20 && len != 32) + if (len != 20 && /* SHA1 */ + len != 32 && /* SHA256 */ + len != 48 && /* SHA384 */ + len != 64) /* SHA512 */ fail++; if ((r = sshbuf_get_u8(b, &type)) != 0) |