From 239da797cbf07a640d7b1ea02d3f99ace3ef792d Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Wed, 10 Nov 2021 06:25:08 +0000 Subject: [PATCH] upstream: fix ssh-keysign for KEX algorithms that use SHA384/512 exchange hashes; feedback/ok markus@ OpenBSD-Commit-ID: 09a8fda1c081f5de1e3128df64f28b7bdadee239 --- ssh-keysign.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/ssh-keysign.c b/ssh-keysign.c index d6ac98c6c..8b3c9a296 100644 --- a/ssh-keysign.c +++ b/ssh-keysign.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keysign.c,v 1.67 2021/07/05 01:16:46 dtucker Exp $ */ +/* $OpenBSD: ssh-keysign.c,v 1.68 2021/11/10 06:25:08 djm Exp $ */ /* * Copyright (c) 2002 Markus Friedl. All rights reserved. * @@ -80,10 +80,13 @@ valid_request(struct passwd *pw, char *host, struct sshkey **ret, if ((b = sshbuf_from(data, datalen)) == NULL) fatal_f("sshbuf_from failed"); - /* session id, currently limited to SHA1 (20 bytes) or SHA256 (32) */ + /* session id */ if ((r = sshbuf_get_string(b, NULL, &len)) != 0) fatal_fr(r, "parse session ID"); - if (len != 20 && len != 32) + if (len != 20 && /* SHA1 */ + len != 32 && /* SHA256 */ + len != 48 && /* SHA384 */ + len != 64) /* SHA512 */ fail++; if ((r = sshbuf_get_u8(b, &type)) != 0)