lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-05-20 17:53:40 +03:00
Code

ecdh: fix SSH_MSG_KEXDH_REPLY for libcrypto

Browse Source 
Ensure to provide the `ssh_string` pubkey blob to the buffer packing
routine when computing the SSH_MSG_KEXDH_REPLY message, rather than
the new `ssh_key` type.

Introduced with 16217454d576511f37f39c3169963629f9d5082f.

Testing done: with this change, `pkd_hello` test is passing on an
OpenSSL 1.1.0 build for me.  Previously it would segfault during
pubkey exchange with "ecdh-sha2-nistp256".

Signed-off-by: Jon Simons <jon@jonsimons.org>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
This commit is contained in:
Jon Simons 2018-05-25 03:00:33 -07:00 committed by Andreas Schneider
parent cd3170fcb1
commit 0b90ab102e
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/ecdh_crypto.c
View File

@ -206,6 +206,7 @@ int ssh_server_ecdh_init(ssh_session session, ssh_buffer packet){
/* SSH host keys (rsa,dsa,ecdsa) */ /* SSH host keys (rsa,dsa,ecdsa) */
ssh_key privkey; ssh_key privkey;
ssh_string sig_blob = NULL; ssh_string sig_blob = NULL;
ssh_string pubkey_blob = NULL;
int curve; int curve;
int len; int len;
int rc; int rc;
@ -289,14 +290,22 @@ int ssh_server_ecdh_init(ssh_session session, ssh_buffer packet){
return SSH_ERROR; return SSH_ERROR;
} }
rc = ssh_dh_get_next_server_publickey_blob(session, &pubkey_blob);
if (rc != SSH_OK) {
ssh_set_error(session, SSH_FATAL, "Could not export server public key");
ssh_string_free(sig_blob);
return SSH_ERROR;
}
rc = ssh_buffer_pack(session->out_buffer, rc = ssh_buffer_pack(session->out_buffer,
"bSSS", "bSSS",
SSH2_MSG_KEXDH_REPLY, SSH2_MSG_KEXDH_REPLY,
session->next_crypto->server_pubkey, /* host's pubkey */ pubkey_blob, /* host's pubkey */
q_s_string, /* ecdh public key */ q_s_string, /* ecdh public key */
sig_blob); /* signature blob */ sig_blob); /* signature blob */
ssh_string_free(sig_blob); ssh_string_free(sig_blob);
ssh_string_free(pubkey_blob);
if (rc != SSH_OK) { if (rc != SSH_OK) {
ssh_set_error_oom(session); ssh_set_error_oom(session);