romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 18:03:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

libssh: Fix matching user-specified MD5 hex key

Browse source 
Prior to this change a match would never be successful because it
was mistakenly coded to compare binary data from libssh to a
user-specified hex string (ie CURLOPT_SSH_HOST_PUBLIC_KEY_MD5).

Reported-by: fds242@users.noreply.github.com

Fixes https://github.com/curl/curl/issues/4971
Closes https://github.com/curl/curl/pull/4974
This commit is contained in:
Jay Satiro 2020-02-23 18:37:09 -05:00
parent e54b1885d1
commit 09aa807240
9 changed files with 159 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

20
lib/vssh/libssh.c
View file

@ -345,13 +345,27 @@ static int myssh_is_known(struct connectdata *conn)
return rc;
if(data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5]) {
int i;
char md5buffer[33];
const char *pubkey_md5 = data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5];
rc = ssh_get_publickey_hash(pubkey, SSH_PUBLICKEY_HASH_MD5,
&hash, &hlen);
if(rc != SSH_OK)
if(rc != SSH_OK || hlen != 16) {
failf(data,
"Denied establishing ssh session: md5 fingerprint not available");
goto cleanup;
}
if(hlen != strlen(data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5]) ||
memcmp(&data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5], hash, hlen)) {
for(i = 0; i < 16; i++)
msnprintf(&md5buffer[i*2], 3, "%02x", (unsigned char)hash[i]);
infof(data, "SSH MD5 fingerprint: %s\n", md5buffer);
if(!strcasecompare(md5buffer, pubkey_md5)) {
failf(data,
"Denied establishing ssh session: mismatch md5 fingerprint. "
"Remote %s is not equal to %s", md5buffer, pubkey_md5);
rc = SSH_ERROR;
goto cleanup;
}