[openssh-commits] [openssh] 64/87: upstream: fix `CheckHostIP yes` bypass in cases where a server

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 025a8a72ba7440a790512fe6410ee55f6f1266e0
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 07:44:23 2026 +0000

    upstream: fix `CheckHostIP yes` bypass in cases where a server
    
    sends a certificate hostkey. This will ignore any key recorded for the IP
    address (as is supposed to happen when CheckHostIP is enabled and fall back
    to the new-hostkey path if the hostname had not already matched
    
    Anthropic ANT-2026-KDXJ0Q4K
    
    OpenBSD-Commit-ID: a6313135b82d2b08ed9940b9391a0c804ed524c3
---
 sshconnect.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/sshconnect.c b/sshconnect.c
index fd00557d5..de1f89b45 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect.c,v 1.389 2026/10/30 07:12:55 djm Exp $ */
+/* $OpenBSD: sshconnect.c,v 1.390 2026/10/30 07:44:23 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -1069,8 +1069,13 @@ check_host_key(char *hostname, const struct ssh_conn_info *cinfo,
 			    system_hostfiles[i], 0);
 	}
 
+	/*
+	 * Load the keys for the address unconditionally, even if we were
+	 * offered a certificate: they are needed if the certificate doesn't
+	 * match a CA and we downgrade to the plain key at "retry" below.
+	 */
 	ip_hostkeys = NULL;
-	if (!want_cert && options.check_host_ip) {
+	if (options.check_host_ip) {
 		ip_hostkeys = init_hostkeys();
 		for (i = 0; i < num_user_hostfiles; i++)
 			load_hostkeys(ip_hostkeys, ip, user_hostfiles[i], 0);

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.