[openssh-commits] [openssh] 11/87: upstream: make `ssh-keygen -lf /key` more strict on detecting the

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 37bb397d9a78f84314456428543c6bc0a2fd043e
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Thu Oct 29 23:12:32 2026 +0000

    upstream: make `ssh-keygen -lf /key` more strict on detecting the
    
    start of private keys. Previously it would try to parse anything starting
    from any line that contained "PRIVATE KEY", now it looks for more of the key
    header. Anthropic ANT-2026-1T34TRV0
    
    OpenBSD-Commit-ID: 96b75d894cc24124c0c81a6467d28d70214f9624
---
 ssh-keygen.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/ssh-keygen.c b/ssh-keygen.c
index 5c2d645ac..1ad6f5571 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.496 2026/09/15 08:00:01 djm Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.497 2026/10/29 23:12:32 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -968,15 +968,18 @@ do_fingerprint(struct passwd *pw)
 
 		/*
 		 * Try private keys first. Assume a key is private if
-		 * "SSH PRIVATE KEY" appears on the first line and we're
-		 * not reading from stdin (XXX support private keys on stdin).
+		 * the first line is a "-----BEGIN ... PRIVATE KEY-----"
+		 * header and we're not reading from stdin (XXX support
+		 * private keys on stdin). Keep going afterwards: ssh(1)
+		 * and sshd(8) would use any public keys that follow, so
+		 * they must be listed too.
 		 */
 		if (lnum == 1 && strcmp(identity_file, "-") != 0 &&
-		    strstr(cp, "PRIVATE KEY") != NULL) {
-			free(line);
-			fclose(f);
+		    strncmp(line, "-----BEGIN ", 11) == 0 &&
+		    strstr(line, "PRIVATE KEY") != NULL) {
 			fingerprint_private(path);
-			exit(0);
+			invalid = 0;
+			continue;
 		}
 
 		/*

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.