Attachment 2402 Details for Bug 2040 – Fix downgrade attack vulnerability in handling SSHFP records

[patch] Fix downgrade attack vulnerability in handling SSHFP records

0001-Fix-downgrade-attack-vulnerability-in-handling-SSHFP.patch (text/plain), 3.05 KB, created by Ondrej Caletka on 2014-01-28 23:05:27 AEDT

(hide)

Description:

Filename:

MIME Type:

Creator: Ondrej Caletka

Created: 2014-01-28 23:05:27 AEDT

Size: 3.05 KB

patch

obsolete

>From 92b8737f44d4fff21d849ccb57d0895c21b25da6 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Ond=C5=99ej=20Caletka?= <ondrej@caletka.cz>
>Date: Tue, 28 Jan 2014 12:29:22 +0100
>Subject: [PATCH 1/5] Fix downgrade attack vulnerability in handling SSHFP
>
>RFC 6594, section 4.1.:
>   SSHFP-aware Secure Shell implementations SHOULD support the SHA-256
>   fingerprints for verification of the public key.  Secure Shell
>   implementations that support SHA-256 fingerprints MUST prefer a SHA-
>   256 fingerprint over SHA-1 if both are available for a server.  If
>   the SHA-256 fingerprint is tested and does not match the SSH public
>   key received from the SSH server, then the key MUST be rejected
>   rather than testing the alternative SHA-1 fingerprint.
>---
> dns.c | 32 ++++++++++++++++++++++++++------
> 1 file changed, 26 insertions(+), 6 deletions(-)
>
>diff --git a/dns.c b/dns.c
>index 630b97a..0c2e9b2 100644
>--- a/dns.c
>+++ b/dns.c
>@@ -208,6 +208,11 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
> 	u_char *dnskey_digest;
> 	u_int dnskey_digest_len;
> 
>+	u_int found_cnt[256];
>+	u_int match_cnt[256];
>+	memset(&found_cnt, 0, sizeof(found_cnt));
>+	memset(&match_cnt, 0, sizeof(match_cnt));
>+
> 	*flags = 0;
> 
> 	debug3("verify_host_key_dns");
>@@ -273,13 +278,16 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
> 			}
> 		}
> 
>+		if (hostkey_algorithm == dnskey_algorithm)
>+			found_cnt[dnskey_digest_type]++;
>+
> 		/* Check if the current key is the same as the given key */
> 		if (hostkey_algorithm == dnskey_algorithm &&
> 		    hostkey_digest_type == dnskey_digest_type) {
> 			if (hostkey_digest_len == dnskey_digest_len &&
> 			    timingsafe_bcmp(hostkey_digest, dnskey_digest,
> 			    hostkey_digest_len) == 0)
>-				*flags |= DNS_VERIFY_MATCH;
>+				match_cnt[dnskey_digest_type]++;
> 		}
> 		free(dnskey_digest);
> 	}
>@@ -287,12 +295,24 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
> 	free(hostkey_digest); /* from key_fingerprint_raw() */
> 	freerrset(fingerprints);
> 
>-	if (*flags & DNS_VERIFY_FOUND)
>-		if (*flags & DNS_VERIFY_MATCH)
>-			debug("matching host key fingerprint found in DNS");
>+	if (*flags & DNS_VERIFY_FOUND) {
>+		debug("found %d SHA1 fingerprints and %d SHA256 fingerprints",
>+			found_cnt[SSHFP_HASH_SHA1], found_cnt[SSHFP_HASH_SHA256]);
>+		debug("matched %d SHA1 fingerprints and %d SHA256 fingerprints",
>+			match_cnt[SSHFP_HASH_SHA1], match_cnt[SSHFP_HASH_SHA256]);
>+		if (found_cnt[SSHFP_HASH_SHA256] > 0)
>+			if (match_cnt[SSHFP_HASH_SHA256] > 0) {
>+				debug("matching SHA256 host key fingerprint found in DNS");
>+				*flags |= DNS_VERIFY_MATCH;
>+			} else
>+				debug("no matching SHA256 host key fingerprint found in DNS");
> 		else
>-			debug("mismatching host key fingerprint found in DNS");
>-	else
>+			if (match_cnt[SSHFP_HASH_SHA1] > 0 && hostkey_algorithm < SSHFP_KEY_ECDSA ) {
>+				debug("matching SHA1 host key fingerprint found in DNS");
>+				*flags |= DNS_VERIFY_MATCH;
>+			} else
>+				debug("no matching SHA1 host key fingerprint found in DNS");
>+	} else
> 		debug("no host key fingerprint found in DNS");
> 
> 	return 0;
>-- 
>1.8.3.2
>

Actions: View | Diff

Attachments on bug 2040: 2183 | 2184 | 2188 | 2211 | 2402 | 2403