[openssh-commits] [openssh] 02/10: upstream commit

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 02db468bf7e3281a8e3c058ced571b38b6407c34
Author: markus at openbsd.org <markus at openbsd.org>
Date:   Fri Feb 13 18:57:00 2015 +0000

    upstream commit
    
    make rekey_limit for sshd w/privsep work; ok djm@
     dtucker@
---
 monitor.c |  7 +------
 opacket.h |  2 --
 packet.c  | 18 +++++++++++-------
 3 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/monitor.c b/monitor.c
index 689586c..e97b20e 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.142 2015/02/06 23:21:59 millert Exp $ */
+/* $OpenBSD: monitor.c,v 1.143 2015/02/13 18:57:00 markus Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos at citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus at openbsd.org>
@@ -1833,11 +1833,6 @@ monitor_apply_keystate(struct monitor *pmonitor)
 		    (ssh_packet_comp_alloc_func *)mm_zalloc,
 		    (ssh_packet_comp_free_func *)mm_zfree);
 	}
-
-	if (options.rekey_limit || options.rekey_interval)
-		ssh_packet_set_rekey_limits(ssh,
-		    (u_int32_t)options.rekey_limit,
-		    (time_t)options.rekey_interval);
 }
 
 /* This function requries careful sanity checking */
diff --git a/opacket.h b/opacket.h
index e563d8d..16fcb9e 100644
--- a/opacket.h
+++ b/opacket.h
@@ -128,8 +128,6 @@ void	 packet_read_expect(int expected_type);
 	ssh_packet_send_ignore(active_state, (nbytes))
 #define packet_need_rekeying() \
 	ssh_packet_need_rekeying(active_state)
-#define packet_set_rekey_limit(bytes) \
-	ssh_packet_set_rekey_limit(active_state, (bytes))
 #define packet_set_server() \
 	ssh_packet_set_server(active_state)
 #define packet_set_authenticated() \
diff --git a/packet.c b/packet.c
index 4667739..b29d875 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.207 2015/02/11 01:20:38 djm Exp $ */
+/* $OpenBSD: packet.c,v 1.208 2015/02/13 18:57:00 markus Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -185,7 +185,7 @@ struct session_state {
 	u_int32_t rekey_limit;
 
 	/* Time-based rekeying */
-	time_t rekey_interval;	/* how often in seconds */
+	u_int32_t rekey_interval;	/* how often in seconds */
 	time_t rekey_time;	/* time of last rekeying */
 
 	/* Session key for protocol v1 */
@@ -2225,11 +2225,6 @@ ssh_packet_set_rekey_limits(struct ssh *ssh, u_int32_t bytes, time_t seconds)
 	    (int)seconds);
 	ssh->state->rekey_limit = bytes;
 	ssh->state->rekey_interval = seconds;
-	/*
-	 * We set the time here so that in post-auth privsep slave we count
-	 * from the completion of the authentication.
-	 */
-	ssh->state->rekey_time = monotime();
 }
 
 time_t
@@ -2437,6 +2432,8 @@ ssh_packet_get_state(struct ssh *ssh, struct sshbuf *m)
 		if ((r = kex_to_blob(m, ssh->kex)) != 0 ||
 		    (r = newkeys_to_blob(m, ssh, MODE_OUT)) != 0 ||
 		    (r = newkeys_to_blob(m, ssh, MODE_IN)) != 0 ||
+		    (r = sshbuf_put_u32(m, state->rekey_limit)) != 0 ||
+		    (r = sshbuf_put_u32(m, state->rekey_interval)) != 0 ||
 		    (r = sshbuf_put_u32(m, state->p_send.seqnr)) != 0 ||
 		    (r = sshbuf_put_u64(m, state->p_send.blocks)) != 0 ||
 		    (r = sshbuf_put_u32(m, state->p_send.packets)) != 0 ||
@@ -2624,6 +2621,8 @@ ssh_packet_set_state(struct ssh *ssh, struct sshbuf *m)
 		if ((r = kex_from_blob(m, &ssh->kex)) != 0 ||
 		    (r = newkeys_from_blob(m, ssh, MODE_OUT)) != 0 ||
 		    (r = newkeys_from_blob(m, ssh, MODE_IN)) != 0 ||
+		    (r = sshbuf_get_u32(m, &state->rekey_limit)) != 0 ||
+		    (r = sshbuf_get_u32(m, &state->rekey_interval)) != 0 ||
 		    (r = sshbuf_get_u32(m, &state->p_send.seqnr)) != 0 ||
 		    (r = sshbuf_get_u64(m, &state->p_send.blocks)) != 0 ||
 		    (r = sshbuf_get_u32(m, &state->p_send.packets)) != 0 ||
@@ -2633,6 +2632,11 @@ ssh_packet_set_state(struct ssh *ssh, struct sshbuf *m)
 		    (r = sshbuf_get_u32(m, &state->p_read.packets)) != 0 ||
 		    (r = sshbuf_get_u64(m, &state->p_read.bytes)) != 0)
 			return r;
+		/*
+		 * We set the time here so that in post-auth privsep slave we
+		 * count from the completion of the authentication.
+		 */
+		state->rekey_time = monotime();
 		/* XXX ssh_set_newkeys overrides p_read.packets? XXX */
 		if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0 ||
 		    (r = ssh_set_newkeys(ssh, MODE_OUT)) != 0)

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.