[Bug 1829] New: auth-rsa.c: move auth_key_is_revoked() call from auth_rsa_verify_response() to auth_rsa_key_allowed()
bugzilla-daemon at bugzilla.mindrot.org
bugzilla-daemon at bugzilla.mindrot.org
Tue Oct 19 09:07:14 EST 2010
https://bugzilla.mindrot.org/show_bug.cgi?id=1829
Summary: auth-rsa.c: move auth_key_is_revoked() call from
auth_rsa_verify_response() to auth_rsa_key_allowed()
Product: Portable OpenSSH
Version: 5.6p1
Platform: All
OS/Version: All
Status: NEW
Severity: normal
Priority: P2
Component: sshd
AssignedTo: unassigned-bugs at mindrot.org
ReportedBy: ldv at altlinux.org
Created attachment 1936
--> https://bugzilla.mindrot.org/attachment.cgi?id=1936
proposed patch
Both auth_rsa_verify_response() and auth_rsa_key_allowed() are
PRIVSEP'ed, so there should be no security degradation.
auth_rsa_key_allowed() is called from auth_rsa() only;
auth_rsa_verify_response() is called only from
auth_rsa_challenge_dialog(), which in turn is called
- either from auth_rsa(), right after auth_rsa_key_allowed() call,
- or from auth_rhosts_rsa(), right after auth_rhosts_rsa_key_allowed()
call, which already calls auth_key_is_revoked().
As result of this change, auth_rsa_key_allowed() will be called earlier
on the auth_rsa() path, before starting challenge-response, which is
good, and won't be called second time on the auth_rhosts_rsa() path,
which is also good.
--
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
More information about the openssh-bugs
mailing list