dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: fix CheckHostIP yes bypass in cases where a server

Browse Source 
sends a certificate hostkey. This will ignore any key recorded for the IP
address (as is supposed to happen when CheckHostIP is enabled and fall back
to the new-hostkey path if the hostname had not already matched

Anthropic ANT-2026-KDXJ0Q4K

OpenBSD-Commit-ID: a6313135b82d2b08ed9940b9391a0c804ed524c3
This commit is contained in:
djm@openbsd.org authored and Damien Miller committed 2026-10-30 20:17:00 +11:00
1 parent 1ec60f13ce
commit 025a8a72ba
1 file changed
+7 -2
Download Patch File Download Diff File Expand all files Collapse all files
sshconnect.c
+7 -2
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: sshconnect.c,v 1.389 2026/10/30 07:12:55 djm Exp $ */
/* $OpenBSD: sshconnect.c,v 1.390 2026/10/30 07:44:23 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1069,8 +1069,13 @@ check_host_key(char *hostname, const struct ssh_conn_info *cinfo,
system_hostfiles[i], 0);
}
/*
* Load the keys for the address unconditionally, even if we were
* offered a certificate: they are needed if the certificate doesn't
* match a CA and we downgrade to the plain key at "retry" below.
*/
ip_hostkeys = NULL;
if (!want_cert && options.check_host_ip) {
if (options.check_host_ip) {
ip_hostkeys = init_hostkeys();
for (i = 0; i < num_user_hostfiles; i++)
load_hostkeys(ip_hostkeys, ip, user_hostfiles[i], 0);