From 00bc2a11244526bb210884852f6fac031c70bb4c Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Fri, 30 Oct 2026 08:42:29 +0000 Subject: [PATCH] upstream: nul-delemit the concatenation of user/hosts/port/etc that is hashed to generate the %C token. This avoids ambiguiuties like 10.0.0.1 port 2222, 10.0.0.12 port 222 and 10.0.0.122 port 22 all hashing to the same value. Anthropic ANT-2026-WLVAFTWQ OpenBSD-Commit-ID: 31aa3dc883340c56e782a1600a7f4acde97b7ceb --- readconf.c | 17 +++++++++++------ ssh_config.5 | 4 ++-- 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/readconf.c b/readconf.c index 80788df85..10da79ff9 100644 --- a/readconf.c +++ b/readconf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: readconf.c,v 1.422 2026/10/30 08:07:36 djm Exp $ */ +/* $OpenBSD: readconf.c,v 1.423 2026/10/30 08:42:29 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -348,12 +348,17 @@ ssh_connection_hash(const char *thishost, const char *host, const char *portstr, struct ssh_digest_ctx *md; u_char conn_hash[SSH_DIGEST_MAX_LENGTH]; + /* + * Hash each field including its terminating NUL so that the field + * boundaries are unambiguous; otherwise e.g. host "10.0.0.1" port + * "2222" and host "10.0.0.12" port "222" would hash identically. + */ if ((md = ssh_digest_start(SSH_DIGEST_SHA1)) == NULL || - ssh_digest_update(md, thishost, strlen(thishost)) < 0 || - ssh_digest_update(md, host, strlen(host)) < 0 || - ssh_digest_update(md, portstr, strlen(portstr)) < 0 || - ssh_digest_update(md, user, strlen(user)) < 0 || - ssh_digest_update(md, jumphost, strlen(jumphost)) < 0 || + ssh_digest_update(md, thishost, strlen(thishost) + 1) < 0 || + ssh_digest_update(md, host, strlen(host) + 1) < 0 || + ssh_digest_update(md, portstr, strlen(portstr) + 1) < 0 || + ssh_digest_update(md, user, strlen(user) + 1) < 0 || + ssh_digest_update(md, jumphost, strlen(jumphost) + 1) < 0 || ssh_digest_final(md, conn_hash, sizeof(conn_hash)) < 0) fatal_f("mux digest failed"); ssh_digest_free(md); diff --git a/ssh_config.5 b/ssh_config.5 index f16c57f84..08d238bc5 100644 --- a/ssh_config.5 +++ b/ssh_config.5 @@ -33,7 +33,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: ssh_config.5,v 1.434 2026/10/30 06:03:54 djm Exp $ +.\" $OpenBSD: ssh_config.5,v 1.435 2026/10/30 08:42:29 djm Exp $ .Dd $Mdocdate: October 30 2026 $ .Dt SSH_CONFIG 5 .Os @@ -2356,7 +2356,7 @@ are: A literal .Sq % . .It \&%C -Hash of %l%h%p%r%j. +Hash of a delimited concatenation of %l, %h, %p, %r and %j. .It %d Local user's home directory. .It %f