summaryrefslogtreecommitdiffstats
path: root/usr.bin/ssh/sshconnect.c
diff options
context:
space:
mode:
authordjm <djm@openbsd.org>2014-07-03 22:23:46 +0000
committerdjm <djm@openbsd.org>2014-07-03 22:23:46 +0000
commita7cf45a30b0997b396540494a7541c7c5586a6de (patch)
treea76131696ea50552fbf13e02a74d8fcb5ba86e42 /usr.bin/ssh/sshconnect.c
parentMANDOCERR_NOARGS reported three completely unrelated classes of problems. (diff)
downloadwireguard-openbsd-a7cf45a30b0997b396540494a7541c7c5586a6de.tar.xz
wireguard-openbsd-a7cf45a30b0997b396540494a7541c7c5586a6de.zip
when rekeying, skip file/DNS lookup if it is the same as the key sent
during initial key exchange. bz#2154 patch from Iain Morgan; ok markus@
Diffstat (limited to 'usr.bin/ssh/sshconnect.c')
-rw-r--r--usr.bin/ssh/sshconnect.c23
1 files changed, 19 insertions, 4 deletions
diff --git a/usr.bin/ssh/sshconnect.c b/usr.bin/ssh/sshconnect.c
index d90d3a529fa..e528e02334a 100644
--- a/usr.bin/ssh/sshconnect.c
+++ b/usr.bin/ssh/sshconnect.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect.c,v 1.249 2014/06/24 01:13:21 djm Exp $ */
+/* $OpenBSD: sshconnect.c,v 1.250 2014/07/03 22:23:46 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -55,6 +55,7 @@
char *client_version_string = NULL;
char *server_version_string = NULL;
+Key *previous_host_key = NULL;
static int matching_host_key_dns = 0;
@@ -1191,7 +1192,7 @@ fail:
int
verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
{
- int flags = 0;
+ int r = -1, flags = 0;
char *fp;
Key *plain = NULL;
@@ -1199,6 +1200,11 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
debug("Server host key: %s %s", key_type(host_key), fp);
free(fp);
+ if (key_equal(previous_host_key, host_key)) {
+ debug("%s: server host key matches cached key", __func__);
+ return 0;
+ }
+
if (options.verify_host_key_dns) {
/*
* XXX certs are not yet supported for DNS, so downgrade
@@ -1213,7 +1219,8 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
flags & DNS_VERIFY_MATCH &&
flags & DNS_VERIFY_SECURE) {
key_free(plain);
- return 0;
+ r = 0;
+ goto done;
}
if (flags & DNS_VERIFY_MATCH) {
matching_host_key_dns = 1;
@@ -1228,9 +1235,17 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
key_free(plain);
}
- return check_host_key(host, hostaddr, options.port, host_key, RDRW,
+ r = check_host_key(host, hostaddr, options.port, host_key, RDRW,
options.user_hostfiles, options.num_user_hostfiles,
options.system_hostfiles, options.num_system_hostfiles);
+
+done:
+ if (r == 0 && host_key != NULL) {
+ key_free(previous_host_key);
+ previous_host_key = key_from_private(host_key);
+ }
+
+ return r;
}
/*