shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-11 02:38:09 +09:00
Code Issues Packages Projects Releases Wiki Activity

packet_cb: adjust response to NEWKEYS w.r.t. GSSAPI

Browse Source 
Do not try to verify mic if gssapi-keyex was not performed,
and fix a memory leak of the mic on error.

Signed-off-by: Pavol Žáčik <pzacik@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
This commit is contained in:
Pavol Žáčik
2025-12-18 19:37:22 +01:00
committed by Jakub Jelen
parent e04d753ace
commit 11c4b29e20
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/packet_cb.c
View File

@@ -178,7 +178,7 @@ SSH_PACKET_CALLBACK(ssh_packet_newkeys)
session->dh_handshake_state=DH_STATE_FINISHED; session->dh_handshake_state=DH_STATE_FINISHED;
} else { } else {
#ifdef WITH_GSSAPI #ifdef WITH_GSSAPI
if (session->opts.gssapi_key_exchange) { if (ssh_kex_is_gss(session->next_crypto)) {
OM_uint32 maj_stat, min_stat; OM_uint32 maj_stat, min_stat;
gss_buffer_desc mic = GSS_C_EMPTY_BUFFER, msg = GSS_C_EMPTY_BUFFER; gss_buffer_desc mic = GSS_C_EMPTY_BUFFER, msg = GSS_C_EMPTY_BUFFER;
@@ -187,6 +187,13 @@ SSH_PACKET_CALLBACK(ssh_packet_newkeys)
goto error; goto error;
} }
if (session->gssapi_key_exchange_mic == NULL) {
ssh_set_error(session,
SSH_FATAL,
"GSSAPI mic not set");
goto error;
}
mic.length = ssh_string_len(session->gssapi_key_exchange_mic); mic.length = ssh_string_len(session->gssapi_key_exchange_mic);
mic.value = ssh_string_data(session->gssapi_key_exchange_mic); mic.value = ssh_string_data(session->gssapi_key_exchange_mic);
@@ -271,6 +278,9 @@ SSH_PACKET_CALLBACK(ssh_packet_newkeys)
return SSH_PACKET_USED; return SSH_PACKET_USED;
error: error:
#ifdef WITH_GSSAPI
SSH_STRING_FREE(session->gssapi_key_exchange_mic);
#endif
SSH_SIGNATURE_FREE(sig); SSH_SIGNATURE_FREE(sig);
ssh_string_burn(sig_blob); ssh_string_burn(sig_blob);
SSH_STRING_FREE(sig_blob); SSH_STRING_FREE(sig_blob);