From 826bc40010a7d26122f7568cd3dbb3a6db55d160 Mon Sep 17 00:00:00 2001 From: Markus Friedl Date: Fri, 13 Feb 2015 18:57:01 +0000 Subject: make rekey_limit for sshd w/privsep work; ok djm@ dtucker@ --- usr.bin/ssh/monitor.c | 7 +------ usr.bin/ssh/opacket.h | 2 -- usr.bin/ssh/packet.c | 18 +++++++++++------- 3 files changed, 12 insertions(+), 15 deletions(-) (limited to 'usr.bin/ssh') diff --git a/usr.bin/ssh/monitor.c b/usr.bin/ssh/monitor.c index 89ae8b4ee04..e6012451bed 100644 --- a/usr.bin/ssh/monitor.c +++ b/usr.bin/ssh/monitor.c @@ -1,4 +1,4 @@ -/* $OpenBSD: monitor.c,v 1.142 2015/02/06 23:21:59 millert Exp $ */ +/* $OpenBSD: monitor.c,v 1.143 2015/02/13 18:57:00 markus Exp $ */ /* * Copyright 2002 Niels Provos * Copyright 2002 Markus Friedl @@ -1500,11 +1500,6 @@ monitor_apply_keystate(struct monitor *pmonitor) (ssh_packet_comp_alloc_func *)mm_zalloc, (ssh_packet_comp_free_func *)mm_zfree); } - - if (options.rekey_limit || options.rekey_interval) - ssh_packet_set_rekey_limits(ssh, - (u_int32_t)options.rekey_limit, - (time_t)options.rekey_interval); } /* This function requries careful sanity checking */ diff --git a/usr.bin/ssh/opacket.h b/usr.bin/ssh/opacket.h index e563d8d3bae..16fcb9e28e1 100644 --- a/usr.bin/ssh/opacket.h +++ b/usr.bin/ssh/opacket.h @@ -128,8 +128,6 @@ void packet_read_expect(int expected_type); ssh_packet_send_ignore(active_state, (nbytes)) #define packet_need_rekeying() \ ssh_packet_need_rekeying(active_state) -#define packet_set_rekey_limit(bytes) \ - ssh_packet_set_rekey_limit(active_state, (bytes)) #define packet_set_server() \ ssh_packet_set_server(active_state) #define packet_set_authenticated() \ diff --git a/usr.bin/ssh/packet.c b/usr.bin/ssh/packet.c index 3e38e889e5b..f59964af5e5 100644 --- a/usr.bin/ssh/packet.c +++ b/usr.bin/ssh/packet.c @@ -1,4 +1,4 @@ -/* $OpenBSD: packet.c,v 1.207 2015/02/11 01:20:38 djm Exp $ */ +/* $OpenBSD: packet.c,v 1.208 2015/02/13 18:57:00 markus Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -179,7 +179,7 @@ struct session_state { u_int32_t rekey_limit; /* Time-based rekeying */ - time_t rekey_interval; /* how often in seconds */ + u_int32_t rekey_interval; /* how often in seconds */ time_t rekey_time; /* time of last rekeying */ /* Session key for protocol v1 */ @@ -2205,11 +2205,6 @@ ssh_packet_set_rekey_limits(struct ssh *ssh, u_int32_t bytes, time_t seconds) (int)seconds); ssh->state->rekey_limit = bytes; ssh->state->rekey_interval = seconds; - /* - * We set the time here so that in post-auth privsep slave we count - * from the completion of the authentication. - */ - ssh->state->rekey_time = monotime(); } time_t @@ -2417,6 +2412,8 @@ ssh_packet_get_state(struct ssh *ssh, struct sshbuf *m) if ((r = kex_to_blob(m, ssh->kex)) != 0 || (r = newkeys_to_blob(m, ssh, MODE_OUT)) != 0 || (r = newkeys_to_blob(m, ssh, MODE_IN)) != 0 || + (r = sshbuf_put_u32(m, state->rekey_limit)) != 0 || + (r = sshbuf_put_u32(m, state->rekey_interval)) != 0 || (r = sshbuf_put_u32(m, state->p_send.seqnr)) != 0 || (r = sshbuf_put_u64(m, state->p_send.blocks)) != 0 || (r = sshbuf_put_u32(m, state->p_send.packets)) != 0 || @@ -2604,6 +2601,8 @@ ssh_packet_set_state(struct ssh *ssh, struct sshbuf *m) if ((r = kex_from_blob(m, &ssh->kex)) != 0 || (r = newkeys_from_blob(m, ssh, MODE_OUT)) != 0 || (r = newkeys_from_blob(m, ssh, MODE_IN)) != 0 || + (r = sshbuf_get_u32(m, &state->rekey_limit)) != 0 || + (r = sshbuf_get_u32(m, &state->rekey_interval)) != 0 || (r = sshbuf_get_u32(m, &state->p_send.seqnr)) != 0 || (r = sshbuf_get_u64(m, &state->p_send.blocks)) != 0 || (r = sshbuf_get_u32(m, &state->p_send.packets)) != 0 || @@ -2613,6 +2612,11 @@ ssh_packet_set_state(struct ssh *ssh, struct sshbuf *m) (r = sshbuf_get_u32(m, &state->p_read.packets)) != 0 || (r = sshbuf_get_u64(m, &state->p_read.bytes)) != 0) return r; + /* + * We set the time here so that in post-auth privsep slave we + * count from the completion of the authentication. + */ + state->rekey_time = monotime(); /* XXX ssh_set_newkeys overrides p_read.packets? XXX */ if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0 || (r = ssh_set_newkeys(ssh, MODE_OUT)) != 0) -- cgit v1.2.3