Patch to workaround host key size mismatch bug in old SSH sshd

[Dave Dykstra]

On Fri, Oct 12, 2001 at 11:47:38AM +1000, Damien Miller wrote:
> Subject: Re: Please test snapshots for 3.0 release
> Could everyone please test the latest snapshots as we will be making a
> new release soon.
> 
> If you have any patches you would like us to consider, please resend 
> them to the list ASAP.

I have posted this one twice.  I have tested it with the latest portable
CVS, but it needs to apply to the openbsd CVS.  It applies cleanly there.
Please apply it, Markus.

- Dave Dykstra


--- compat.h.O	Fri Oct 12 15:26:49 2001
+++ compat.h	Fri Oct 12 15:27:21 2001
@@ -51,6 +51,7 @@
 #define SSH_BUG_OPENFAILURE	0x00020000
 #define SSH_BUG_DERIVEKEY	0x00040000
 #define SSH_BUG_DUMMYCHAN	0x00100000
+#define SSH_BUG_SERVERLIESSIZE	0x00200000
 
 void     enable_compat13(void);
 void     enable_compat20(void);
--- compat.c.O	Fri Oct 12 14:42:39 2001
+++ compat.c	Fri Oct 12 15:27:50 2001
@@ -117,6 +117,8 @@
 		{ "^1\\.7 SecureFX",	SSH_OLD_SESSIONID },
 		{ "^1\\.2\\.1[89]",	SSH_BUG_IGNOREMSG },
 		{ "^1\\.2\\.2[012]",	SSH_BUG_IGNOREMSG },
+		{ "^1\\.2\\.2[3-9]",	SSH_BUG_SERVERLIESSIZE },
+		{ "^1\\.2\\.3[0-1]",	SSH_BUG_SERVERLIESSIZE },
 		{ "^1\\.3\\.2",		SSH_BUG_IGNOREMSG },	/* f-secure */
 		{ "^SSH Compatible Server",			/* Netscreen */
 					SSH_BUG_PASSWORDPAD },
--- sshconnect1.c.O	Fri Oct 12 14:42:43 2001
+++ sshconnect1.c	Fri Oct 12 15:30:16 2001
@@ -37,6 +37,7 @@
 #include "packet.h"
 #include "mpaux.h"
 #include "uidswap.h"
+#include "compat.h"
 #include "log.h"
 #include "readconf.h"
 #include "key.h"
@@ -960,7 +961,8 @@
 	sum_len += clen;
 
 	rbits = BN_num_bits(host_key->n);
-	if (bits != rbits) {
+	if (bits != rbits &&
+	    !((datafellows & SSH_BUG_SERVERLIESSIZE) && (rbits + 1 == bits))) {
 		log("Warning: Server lies about size of server host key: "
 		    "actual size is %d bits vs. announced %d.", rbits, bits);
 		log("Warning: This may be due to an old implementation of ssh.");
--- sshd.c.O	Fri Oct 12 14:42:43 2001
+++ sshd.c	Fri Oct 12 15:31:18 2001
@@ -1263,7 +1263,12 @@
 	packet_put_bignum(sensitive_data.server_key->rsa->n);
 
 	/* Store our public host RSA key. */
-	packet_put_int(BN_num_bits(sensitive_data.ssh1_host_key->rsa->n));
+	len = BN_num_bits(sensitive_data.ssh1_host_key->rsa->n);
+	if ((datafellows & SSH_BUG_SERVERLIESSIZE) && (len & 1)) {
+	    /* old ssh client expects even number for host key */
+	    len += 1;
+	}
+	packet_put_int(len);
 	packet_put_bignum(sensitive_data.ssh1_host_key->rsa->e);
 	packet_put_bignum(sensitive_data.ssh1_host_key->rsa->n);