search for: sbloblen

...+#define CURVE25519_PUBKEY_SIZE crypto_scalarmult_curve25519_BYTES + +void +kex_c25519_hash( + const EVP_MD *evp_md, + char *client_version_string, + char *server_version_string, + char *ckexinit, int ckexinitlen, + char *skexinit, int skexinitlen, + u_char *serverhostkeyblob, int sbloblen, + const unsigned char client_dh_pub[CURVE25519_PUBKEY_SIZE], + const unsigned char server_dh_pub[CURVE25519_PUBKEY_SIZE], + const BIGNUM *shared_secret, + u_char **hash, u_int *hashlen) +{ + Buffer b; + EVP_MD_CTX md; + static u_char digest[EVP_MAX_MD_SIZE]; + + buffer_init(&b); +...

In sshconnect.c there are two global variables for server_version_string client_version_string. These are used just in a few functions and can easily be passed as parameters. Also, there is a strange construct, where their memory is allocated to the global pointers, then copies of these pointers are assigned to the kex structure. The kex_free finally frees them via cleanup of the kex

...dh.c openssh-3.7.1p2/kexdh.c --- openssh-3.7.1p2.orig/kexdh.c Mon Feb 24 02:03:03 2003 +++ openssh-3.7.1p2/kexdh.c Tue Oct 7 08:22:00 2003 @@ -60,7 +60,7 @@ buffer_put_char(&b, SSH2_MSG_KEXINIT); buffer_append(&b, skexinit, skexinitlen); - buffer_put_string(&b, serverhostkeyblob, sbloblen); + buffer_put_binary(&b, serverhostkeyblob, sbloblen); buffer_put_bignum2(&b, client_dh_pub); buffer_put_bignum2(&b, server_dh_pub); buffer_put_bignum2(&b, shared_secret); diff -bur openssh-3.7.1p2.orig/kexdhc.c openssh-3.7.1p2/kexdhc.c --- openssh-3.7.1p2.orig/kexdhc.c Mon F...

...t matter at > all.) > > +void > +kex_c25519_hash( > + const EVP_MD *evp_md, > + char *client_version_string, > + char *server_version_string, > + char *ckexinit, int ckexinitlen, > + char *skexinit, int skexinitlen, > + u_char *serverhostkeyblob, int sbloblen, > + const unsigned char client_dh_pub[CURVE25519_PUBKEY_SIZE], > + const unsigned char server_dh_pub[CURVE25519_PUBKEY_SIZE], > + const BIGNUM *shared_secret, > ... > + buffer_put_bignum2(&b, shared_secret); > > It would be simpler to pass the shared_secret as a...

...========================================================= RCS file: /cvs/src/usr.bin/ssh/kexgexs.c,v retrieving revision 1.10 diff -u -r1.10 kexgexs.c --- kexgexs.c 6 Nov 2006 21:25:28 -0000 1.10 +++ kexgexs.c 15 Nov 2006 14:14:33 -0000 @@ -183,6 +183,13 @@ packet_put_string(server_host_key_blob, sbloblen); packet_put_bignum2(dh->pub_key); /* f */ packet_put_string(signature, slen); + if (kex->kex_type == KEX_DH_GEX_CERT) { + if (server_host_key->cert != NULL) + packet_put_string(server_host_key->cert, + strlen(server_host_key->cert)); + else + packet_put_string("...