diff options
| author |   djm <djm@openbsd.org> | 2020-10-07 02:20:35 +0000 |
|---|---|---|
| committer | djm <djm@openbsd.org> | 2020-10-07 02:20:35 +0000 |
| commit | 3baefcba7d6f4c95648876b46febcc56d8454714 (patch) | |
| tree | cf4dfbb4e52a79132dee3d9aa88591af455fc5ae /usr.bin/ssh/sshconnect.c | |
| parent | disable UpdateHostkeys by default if VerifyHostKeyDNS is enabled; (diff) | |
| download | wireguard-openbsd-3baefcba7d6f4c95648876b46febcc56d8454714.tar.xz wireguard-openbsd-3baefcba7d6f4c95648876b46febcc56d8454714.zip | |
simply disable UpdateHostkeys when a certificate successfully
authenticated the host; simpler than the complicated plumbing via
kex->flags we have now.
ok markus@
Diffstat (limited to 'usr.bin/ssh/sshconnect.c')
| -rw-r--r-- | usr.bin/ssh/sshconnect.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/usr.bin/ssh/sshconnect.c b/usr.bin/ssh/sshconnect.c index 31f28ebc679..1d617275ee3 100644 --- a/usr.bin/ssh/sshconnect.c +++ b/usr.bin/ssh/sshconnect.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect.c,v 1.335 2020/10/04 09:45:01 djm Exp $ */ +/* $OpenBSD: sshconnect.c,v 1.336 2020/10/07 02:20:35 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -587,7 +587,12 @@ check_host_cert(const char *host, const struct sshkey *key) "(null)" : key->cert->signature_type, ssh_err(r)); return 0; } - + /* Do not attempt hostkey update if a certificate was successful */ + if (options.update_hostkeys != 0) { + options.update_hostkeys = 0; + debug3("%s: certificate host key in use; disabling " + "UpdateHostkeys", __func__); + } return 1; } |