src/usr.bin/ssh/clientloop.c - diff

Return to clientloop.c CVS log

Up to [local] / src / usr.bin / ssh

version 1.308, 2017/12/18 02:25:15

version 1.309, 2017/12/18 23:16:23

Line 1878

struct hostkeys_update_ctx *ctx = (struct hostkeys_update_ctx *)_ctx;

size_t i, ndone;

struct sshbuf *signdata;

int r;

int r, kexsigtype, use_kexsigtype;

const u_char *sig;

size_t siglen;

Line 1890

hostkeys_update_ctx_free(ctx);

return;

}

kexsigtype = sshkey_type_plain(

sshkey_type_from_name(ssh->kex->hostkey_alg));

if ((signdata = sshbuf_new()) == NULL)

fatal("%s: sshbuf_new failed", __func__);

/* Don't want to accidentally accept an unbound signature */

Line 1918

Line 1921

__func__, ssh_err(r));

goto out;

}

* For RSA keys, prefer to use the signature type negotiated

* during KEX to the default (SHA1).

use_kexsigtype = kexsigtype == KEY_RSA &&

sshkey_type_plain(ctx->keys[i]->type) == KEY_RSA;

if ((r = sshkey_verify(ctx->keys[i], sig, siglen,

sshbuf_ptr(signdata), sshbuf_len(signdata),

ssh->kex->hostkey_alg, 0)) != 0) {

use_kexsigtype ? ssh->kex->hostkey_alg : NULL, 0)) != 0) {

error("%s: server gave bad signature for %s key %zu",

__func__, sshkey_type(ctx->keys[i]), i);

goto out;