- markus@cvs.openbsd.org 2001/04/04 23:09:18

     [dh.c kex.c packet.c]
     clear+free keys,iv for rekeying.
     + fix DH mem leaks. ok niels@

diff --git a/ChangeLog b/ChangeLog
index b2b588bf7abb334790c60e49509d6be0bde06cb8..afd63fe2597a635e9bb882ecc39626f68724a025 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -24,6 +24,10 @@
      [kex.c kexgex.c serverloop.c]
      parse full kexinit packet.
      make server-side more robust, too.
+   - markus@cvs.openbsd.org 2001/04/04 23:09:18
+     [dh.c kex.c packet.c]
+     clear+free keys,iv for rekeying.
+     + fix DH mem leaks. ok niels@
 
 20010404
  - OpenBSD CVS Sync

diff --git a/dh.c b/dh.c
index 03b9fd1b84eaf5ecf554d863ce5a381a932d2f09..982064f54a1aa7d18339cf2ebcdc875ab5e041a9 100644 (file)
--- a/dh.c
+++ b/dh.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: dh.c,v 1.12 2001/04/03 19:53:29 markus Exp $");
+RCSID("$OpenBSD: dh.c,v 1.13 2001/04/04 23:09:17 markus Exp $");
 
 #include "xmalloc.h"
 
@@ -151,11 +151,9 @@ choose_dh(int min, int wantbits, int max)
        while (fgets(line, sizeof(line), f)) {
                if (!parse_prime(linenum, line, &dhg))
                        continue;
-               if (dhg.size > max || dhg.size < min)
-                       continue;
-               if (dhg.size != best)
-                       continue;
-               if (linenum++ != which) {
+               if ((dhg.size > max || dhg.size < min) ||
+                   dhg.size != best ||
+                   linenum++ != which) {
                        BN_free(dhg.g);
                        BN_free(dhg.p);
                        continue;
@@ -163,6 +161,9 @@ choose_dh(int min, int wantbits, int max)
                break;
        }
        fclose(f);
+       if (linenum != which+1)
+               fatal("WARNING: line %d disappeared in %s, giving up",
+                   which, _PATH_DH_PRIMES);
 
        return (dh_new_group(dhg.g, dhg.p));
 }

diff --git a/kex.c b/kex.c
index 0720c073d4e28a2894c722833f3b34da916fa1e5..39f037b747481caa36e5fd9b638833b98936d5c1 100644 (file)
--- a/kex.c
+++ b/kex.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: kex.c,v 1.31 2001/04/04 22:04:34 markus Exp $");
+RCSID("$OpenBSD: kex.c,v 1.32 2001/04/04 23:09:18 markus Exp $");
 
 #include <openssl/crypto.h>
 
@@ -136,10 +136,13 @@ kex_finish(Kex *kex)
         debug("waiting for SSH2_MSG_NEWKEYS");
         packet_read_expect(&plen, SSH2_MSG_NEWKEYS);
        debug("SSH2_MSG_NEWKEYS received");
+
        kex->done = 1;
        buffer_clear(&kex->peer);
        /* buffer_clear(&kex->my); */
        kex->flags &= ~KEX_INIT_SENT;
+       xfree(kex->name);
+       kex->name = NULL;
 }
 
 void

diff --git a/packet.c b/packet.c
index cf081a0f81e660ab6e17a6834adc05b2fb78fc82..5b5fa08d2bfd06b21332ea243b3bb4d6c71e57ea 100644 (file)
--- a/packet.c
+++ b/packet.c
@@ -37,7 +37,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: packet.c,v 1.58 2001/04/04 09:48:34 markus Exp $");
+RCSID("$OpenBSD: packet.c,v 1.59 2001/04/04 23:09:18 markus Exp $");
 
 #include "xmalloc.h"
 #include "buffer.h"
@@ -123,16 +123,6 @@ int use_ssh2_packet_format = 0;
 /* Session key information for Encryption and MAC */
 Newkeys *newkeys[MODE_MAX];
 
-void
-clear_enc_keys(Enc *enc, int len)
-{
-       memset(enc->iv,  0, len);
-       memset(enc->key, 0, len);
-       xfree(enc->iv);
-       xfree(enc->key);
-       enc->iv = NULL;
-       enc->key = NULL;
-}
 void
 packet_set_ssh2_format(void)
 {
@@ -524,8 +514,18 @@ set_newkeys(int mode)
        cc = (mode == MODE_OUT) ? &send_context : &receive_context;
        if (newkeys[mode] != NULL) {
                debug("newkeys: rekeying");
-               memset(cc, 0, sizeof(*cc));
                /* todo: free old keys, reset compression/cipher-ctxt; */
+               memset(cc, 0, sizeof(*cc));
+               enc  = &newkeys[mode]->enc;
+               mac  = &newkeys[mode]->mac;
+               comp = &newkeys[mode]->comp;
+                memset(mac->key, 0, mac->key_len);
+               xfree(enc->name);
+               xfree(enc->iv);
+               xfree(enc->key);
+               xfree(mac->name);
+               xfree(mac->key);
+               xfree(comp->name);
                xfree(newkeys[mode]);
        }
        newkeys[mode] = kex_get_newkeys(mode);
@@ -539,7 +539,8 @@ set_newkeys(int mode)
        DBG(debug("cipher_init_context: %d", mode));
        cipher_init(cc, enc->cipher, enc->key, enc->cipher->key_len,
            enc->iv, enc->cipher->block_size);
-       clear_enc_keys(enc, enc->cipher->key_len);
+       memset(enc->iv,  0, enc->cipher->block_size);
+       memset(enc->key, 0, enc->cipher->key_len);
        if (comp->type != 0 && comp->enabled == 0) {
                comp->enabled = 1;
                if (! packet_compression)