diff options
author | 2014-07-03 22:23:46 +0000 | |
---|---|---|
committer | 2014-07-03 22:23:46 +0000 | |
commit | a7cf45a30b0997b396540494a7541c7c5586a6de (patch) | |
tree | a76131696ea50552fbf13e02a74d8fcb5ba86e42 /usr.bin/ssh/sshconnect.c | |
parent | MANDOCERR_NOARGS reported three completely unrelated classes of problems. (diff) | |
download | wireguard-openbsd-a7cf45a30b0997b396540494a7541c7c5586a6de.tar.xz wireguard-openbsd-a7cf45a30b0997b396540494a7541c7c5586a6de.zip |
when rekeying, skip file/DNS lookup if it is the same as the key sent
during initial key exchange. bz#2154 patch from Iain Morgan; ok markus@
Diffstat (limited to 'usr.bin/ssh/sshconnect.c')
-rw-r--r-- | usr.bin/ssh/sshconnect.c | 23 |
1 files changed, 19 insertions, 4 deletions
diff --git a/usr.bin/ssh/sshconnect.c b/usr.bin/ssh/sshconnect.c index d90d3a529fa..e528e02334a 100644 --- a/usr.bin/ssh/sshconnect.c +++ b/usr.bin/ssh/sshconnect.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect.c,v 1.249 2014/06/24 01:13:21 djm Exp $ */ +/* $OpenBSD: sshconnect.c,v 1.250 2014/07/03 22:23:46 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -55,6 +55,7 @@ char *client_version_string = NULL; char *server_version_string = NULL; +Key *previous_host_key = NULL; static int matching_host_key_dns = 0; @@ -1191,7 +1192,7 @@ fail: int verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key) { - int flags = 0; + int r = -1, flags = 0; char *fp; Key *plain = NULL; @@ -1199,6 +1200,11 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key) debug("Server host key: %s %s", key_type(host_key), fp); free(fp); + if (key_equal(previous_host_key, host_key)) { + debug("%s: server host key matches cached key", __func__); + return 0; + } + if (options.verify_host_key_dns) { /* * XXX certs are not yet supported for DNS, so downgrade @@ -1213,7 +1219,8 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key) flags & DNS_VERIFY_MATCH && flags & DNS_VERIFY_SECURE) { key_free(plain); - return 0; + r = 0; + goto done; } if (flags & DNS_VERIFY_MATCH) { matching_host_key_dns = 1; @@ -1228,9 +1235,17 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key) key_free(plain); } - return check_host_key(host, hostaddr, options.port, host_key, RDRW, + r = check_host_key(host, hostaddr, options.port, host_key, RDRW, options.user_hostfiles, options.num_user_hostfiles, options.system_hostfiles, options.num_system_hostfiles); + +done: + if (r == 0 && host_key != NULL) { + key_free(previous_host_key); + previous_host_key = key_from_private(host_key); + } + + return r; } /* |