[openssh-commits] [openssh] 40/87: upstream: apply the existing limit for destination constraint

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 7b2fd9baa6897c1ac800098978b8f0885822ed62
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 04:22:15 2026 +0000

    upstream: apply the existing limit for destination constraint
    
    usernames to the usernames parsed from hostbound signature requests, as these
    are a potential DoS channel against a destination-constrained agent
    
    Anthropic ANT-2026-SE08NY49
    
    OpenBSD-Commit-ID: 827fe3d81bef1d4779a23982a0e40cd7de0f46b6
---
 ssh-agent.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/ssh-agent.c b/ssh-agent.c
index 542dd683c..705731702 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-agent.c,v 1.334 2026/10/30 04:08:33 djm Exp $ */
+/* $OpenBSD: ssh-agent.c,v 1.335 2026/10/30 04:22:15 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -920,6 +920,11 @@ process_sign_request2(SocketEntry *e)
 			   "to sign an unidentified signature");
 			goto send;
 		}
+		if (strlen(user) > AGENT_USER_CONSTRAINT_MAX_LEN) {
+			logit_f("refusing use of destination-constrained key: "
+			    "user name in signature request too long");
+			goto send;
+		}
 		/* XXX logspam */
 		debug_f("user=%s", user);
 		if (identity_permitted(id, e, user, &fwd_host, &dest_host) != 0)

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.