[openssh-commits] [openssh] 75/87: upstream: nul-delemit the concatenation of user/hosts/port/etc

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 00bc2a11244526bb210884852f6fac031c70bb4c
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 08:42:29 2026 +0000

    upstream: nul-delemit the concatenation of user/hosts/port/etc
    
    that is hashed to generate the %C token. This avoids ambiguiuties like
    10.0.0.1 port 2222, 10.0.0.12 port 222 and 10.0.0.122 port 22 all hashing to
    the same value.
    
    Anthropic ANT-2026-WLVAFTWQ
    
    OpenBSD-Commit-ID: 31aa3dc883340c56e782a1600a7f4acde97b7ceb
---
 readconf.c   | 17 +++++++++++------
 ssh_config.5 |  4 ++--
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/readconf.c b/readconf.c
index 80788df85..10da79ff9 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.422 2026/10/30 08:07:36 djm Exp $ */
+/* $OpenBSD: readconf.c,v 1.423 2026/10/30 08:42:29 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -348,12 +348,17 @@ ssh_connection_hash(const char *thishost, const char *host, const char *portstr,
 	struct ssh_digest_ctx *md;
 	u_char conn_hash[SSH_DIGEST_MAX_LENGTH];
 
+	/*
+	 * Hash each field including its terminating NUL so that the field
+	 * boundaries are unambiguous; otherwise e.g. host "10.0.0.1" port
+	 * "2222" and host "10.0.0.12" port "222" would hash identically.
+	 */
 	if ((md = ssh_digest_start(SSH_DIGEST_SHA1)) == NULL ||
-	    ssh_digest_update(md, thishost, strlen(thishost)) < 0 ||
-	    ssh_digest_update(md, host, strlen(host)) < 0 ||
-	    ssh_digest_update(md, portstr, strlen(portstr)) < 0 ||
-	    ssh_digest_update(md, user, strlen(user)) < 0 ||
-	    ssh_digest_update(md, jumphost, strlen(jumphost)) < 0 ||
+	    ssh_digest_update(md, thishost, strlen(thishost) + 1) < 0 ||
+	    ssh_digest_update(md, host, strlen(host) + 1) < 0 ||
+	    ssh_digest_update(md, portstr, strlen(portstr) + 1) < 0 ||
+	    ssh_digest_update(md, user, strlen(user) + 1) < 0 ||
+	    ssh_digest_update(md, jumphost, strlen(jumphost) + 1) < 0 ||
 	    ssh_digest_final(md, conn_hash, sizeof(conn_hash)) < 0)
 		fatal_f("mux digest failed");
 	ssh_digest_free(md);
diff --git a/ssh_config.5 b/ssh_config.5
index f16c57f84..08d238bc5 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,7 +33,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.434 2026/10/30 06:03:54 djm Exp $
+.\" $OpenBSD: ssh_config.5,v 1.435 2026/10/30 08:42:29 djm Exp $
 .Dd $Mdocdate: October 30 2026 $
 .Dt SSH_CONFIG 5
 .Os
@@ -2356,7 +2356,7 @@ are:
 A literal
 .Sq % .
 .It \&%C
-Hash of %l%h%p%r%j.
+Hash of a delimited concatenation of %l, %h, %p, %r and %j.
 .It %d
 Local user's home directory.
 .It %f

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.