[openssh-commits] [openssh] 60/87: upstream: when CheckHostIP=yes, ensure a known_hosts @revoked

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit cbd955ef9e4ee0bf3401b1633808c4942ba079cc
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 07:12:55 2026 +0000

    upstream: when CheckHostIP=yes, ensure a known_hosts @revoked
    
    marker is applied correctly
    
    Anthropic ANT-2026-D0S0MTZT
    
    OpenBSD-Commit-ID: 6e1de706e260a92a999fc9271cd1de424ac54ea7
---
 sshconnect.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sshconnect.c b/sshconnect.c
index a14e9be27..fd00557d5 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect.c,v 1.388 2026/10/30 06:31:49 djm Exp $ */
+/* $OpenBSD: sshconnect.c,v 1.389 2026/10/30 07:12:55 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -1123,6 +1123,12 @@ check_host_key(char *hostname, const struct ssh_conn_info *cinfo,
 	if (!want_cert && ip_hostkeys != NULL) {
 		ip_status = check_key_in_hostkeys(ip_hostkeys, host_key,
 		    &ip_found);
+		/*
+		 * A key that is revoked for the address must never be
+		 * accepted, regardless of what is recorded for the hostname.
+		 */
+		if (ip_status == HOST_REVOKED)
+			host_status = HOST_REVOKED;
 		if (host_status == HOST_CHANGED &&
 		    (ip_status != HOST_CHANGED ||
 		    (ip_found != NULL &&

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.