[openssh-commits] [openssh] 05/12: upstream: when signing hostkey proofs for a client UpdateHostKeys

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit df67bcaf563726f215b1b126872978b88b7d012d
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Thu Jul 9 02:22:10 2026 +0000

    upstream: when signing hostkey proofs for a client UpdateHostKeys
    
    request, allow each hostkey to perform at most one signature operation. ok
    dtucker@
    
    OpenBSD-Commit-ID: ad4149015634f8156ba723656035ec26140875e8
---
 monitor.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/monitor.c b/monitor.c
index 73a85408e..0b865fd68 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.256 2026/05/31 11:30:50 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.257 2026/07/09 02:22:10 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos at citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus at openbsd.org>
@@ -716,6 +716,7 @@ mm_answer_sign(struct ssh *ssh, int sock, struct sshbuf *m)
 	int r, is_proof = 0, keyid;
 	u_int compat;
 	const char proof_req[] = "hostkeys-prove-00 at openssh.com";
+	static int nhostkey_proofs_done, *hostkey_proofs_done;
 
 	debug3_f("entering");
 
@@ -754,6 +755,17 @@ mm_answer_sign(struct ssh *ssh, int sock, struct sshbuf *m)
 			fatal_f("bad data length: %zu", datlen);
 		if ((key = get_hostkey_public_by_index(keyid, ssh)) == NULL)
 			fatal_f("no hostkey for index %d", keyid);
+		if (keyid >= nhostkey_proofs_done) {
+			hostkey_proofs_done = xrecallocarray(
+			    hostkey_proofs_done, nhostkey_proofs_done,
+			    keyid + 1, sizeof(*hostkey_proofs_done));
+			nhostkey_proofs_done = keyid + 1;
+		}
+		if (hostkey_proofs_done[keyid]) {
+			fatal_f("hostkeys proof requested for %s key %d "
+			    "multiple times", sshkey_type(key), keyid);
+		}
+		hostkey_proofs_done[keyid] = 1;
 		if ((sigbuf = sshbuf_new()) == NULL)
 			fatal_f("sshbuf_new");
 		if ((r = sshbuf_put_cstring(sigbuf, proof_req)) != 0 ||

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.