View | Details | Raw Unified | Return to bug 148 | Differences between
and this patch

Collapse All | Expand All

(-)openssh-3.5p1/kex.c (-5 / +42 lines)
Lines 74-80 Link Here
74
74
75
/* parse buffer and return algorithm proposal */
75
/* parse buffer and return algorithm proposal */
76
static char **
76
static char **
77
kex_buf2prop(Buffer *raw)
77
kex_buf2prop(Buffer *raw,int *first_kex_follows)
78
{
78
{
79
	Buffer b;
79
	Buffer b;
80
	int i;
80
	int i;
Lines 93-100 Link Here
93
		debug2("kex_parse_kexinit: %s", proposal[i]);
93
		debug2("kex_parse_kexinit: %s", proposal[i]);
94
	}
94
	}
95
	/* first kex follows / reserved */
95
	/* first kex follows / reserved */
96
	i = buffer_get_char(&b);
96
	*first_kex_follows = buffer_get_char(&b);
97
	debug2("kex_parse_kexinit: first_kex_follows %d ", i);
97
	debug2("kex_parse_kexinit: first_kex_follows %d ",*first_kex_follows );
98
	i = buffer_get_int(&b);
98
	i = buffer_get_int(&b);
99
	debug2("kex_parse_kexinit: reserved %d ", i);
99
	debug2("kex_parse_kexinit: reserved %d ", i);
100
	buffer_free(&b);
100
	buffer_free(&b);
Lines 317-322 Link Here
317
	xfree(hostkeyalg);
317
	xfree(hostkeyalg);
318
}
318
}
319
319
320
/* After kex_choose_conf each entry in the proposal array is NULL terminated so
321
   Only the fist index should be checked*/
322
static int 
323
check_guess(char *my[PROPOSAL_MAX],char *peer[PROPOSAL_MAX]){
324
  if(strcmp(my[PROPOSAL_KEX_ALGS],peer[PROPOSAL_KEX_ALGS])!=0)
325
    return 1;
326
  if(strcmp(my[PROPOSAL_SERVER_HOST_KEY_ALGS],peer[PROPOSAL_SERVER_HOST_KEY_ALGS])!=0)
327
    return 1;
328
  if(strcmp(my[PROPOSAL_ENC_ALGS_CTOS],peer[PROPOSAL_ENC_ALGS_STOC])!=0)
329
    return 1;
330
  if(strcmp(my[PROPOSAL_ENC_ALGS_STOC],peer[PROPOSAL_ENC_ALGS_CTOS])!=0)
331
    return 1;
332
  if(strcmp(my[PROPOSAL_MAC_ALGS_CTOS],peer[PROPOSAL_MAC_ALGS_STOC])!=0)
333
    return 1;
334
  if(strcmp(my[PROPOSAL_MAC_ALGS_STOC],peer[PROPOSAL_MAC_ALGS_CTOS])!=0)
335
    return 1;
336
  if(strcmp(my[PROPOSAL_COMP_ALGS_CTOS],peer[PROPOSAL_COMP_ALGS_STOC])!=0)
337
    return 1;
338
  if(strcmp(my[PROPOSAL_COMP_ALGS_STOC],peer[PROPOSAL_COMP_ALGS_CTOS])!=0)
339
    return 1;
340
  if(strcmp(my[PROPOSAL_LANG_CTOS],peer[PROPOSAL_LANG_STOC])!=0)
341
    return 1;
342
  if(strcmp(my[PROPOSAL_LANG_STOC],peer[PROPOSAL_LANG_CTOS])!=0)
343
    return 1;
344
  return 0;
345
}
346
320
static void
347
static void
321
kex_choose_conf(Kex *kex)
348
kex_choose_conf(Kex *kex)
322
{
349
{
Lines 327-335 Link Here
327
	int mode;
354
	int mode;
328
	int ctos;				/* direction: if true client-to-server */
355
	int ctos;				/* direction: if true client-to-server */
329
	int need;
356
	int need;
357
        int first_kex_follows;
330
358
331
	my   = kex_buf2prop(&kex->my);
359
	my   = kex_buf2prop(&kex->my,&first_kex_follows);
332
	peer = kex_buf2prop(&kex->peer);
360
	peer = kex_buf2prop(&kex->peer,&first_kex_follows);/* Only the peer value have meaning*/
333
361
334
	if (kex->server) {
362
	if (kex->server) {
335
		cprop=peer;
363
		cprop=peer;
Lines 372-377 Link Here
372
	}
400
	}
373
	/* XXX need runden? */
401
	/* XXX need runden? */
374
	kex->we_need = need;
402
	kex->we_need = need;
403
404
        if(first_kex_follows){
405
          /* If the guess is correct continue as usual*/
406
          first_kex_follows=check_guess(my,peer);
407
        }
408
        if(first_kex_follows){/* nor correct guess*/
409
          /* casuse to ignore the following message */
410
          packet_read_expect(SSH2_MSG_MAX);
411
        }
375
412
376
	kex_prop_free(my);
413
	kex_prop_free(my);
377
	kex_prop_free(peer);
414
	kex_prop_free(peer);
(-)openssh-3.5p1/packet.c (-1 / +1 lines)
Lines 812-818 Link Here
812
	int type;
812
	int type;
813
813
814
	type = packet_read();
814
	type = packet_read();
815
	if (type != expected_type)
815
        if ((type != expected_type) && (expected_type != SSH2_MSG_MAX))
816
		packet_disconnect("Protocol error: expected packet type %d, got %d",
816
		packet_disconnect("Protocol error: expected packet type %d, got %d",
817
		    expected_type, type);
817
		    expected_type, type);
818
}
818
}

Return to bug 148