Bug 1390 - RekeyLimit max value is too restrictive
Summary: RekeyLimit max value is too restrictive
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh (show other bugs)
Version: 4.7p1
Hardware: All All
: P2 normal
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks: V_4_8
  Show dependency treegraph
 
Reported: 2007-11-10 04:14 AEDT by Jan Pechanec
Modified: 2008-03-31 15:22 AEDT (History)
2 users (show)

See Also:


Attachments
patch against 4.7p1 (1.18 KB, patch)
2007-11-10 04:14 AEDT, Jan Pechanec
no flags Details | Diff
fixed patch (1.54 KB, patch)
2007-11-13 09:53 AEDT, Jan Pechanec
dtucker: ok+
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jan Pechanec 2007-11-10 04:14:01 AEDT
Created attachment 1380 [details]
patch against 4.7p1

RekeyLimit option allows to set the limit up to 2^31 bytes only since it's a signed integer. However, the default value for rekeying limit is 2^32 since AES's block size is 16 bytes (limit set in packet.c).

2^(block_size * 2) = 2^32

since there is no support for ciphers with block sizes of 32 bytes it's enough to use u_int32_t for rekey_limit + fix the casting and replace INT_MAX with UINT_MAX.

patch attached.
Comment 1 Jan Pechanec 2007-11-13 09:53:18 AEDT
Created attachment 1381 [details]
fixed patch

I forgot about the initial -1 value... So, the following line was not correct in the patch then:

if (*activep && options->rekey_limit == -1)

possible solution is to use int64_t for options.rekey_limit and explicitly cast it to u_int32_t in set_packet_rekey_limit(). Since rekey_limit is tested against UINT_MAX it's OK.

corrected patch uploaded.
Comment 2 Darren Tucker 2007-12-31 23:56:23 AEDT
Target 4.8
Comment 3 Damien Miller 2008-01-20 08:12:20 AEDT
Comment on attachment 1381 [details]
fixed patch

This looks OK to me. Darren?
Comment 4 Damien Miller 2008-01-20 10:12:52 AEDT
fix applied - thanks!
Comment 5 Damien Miller 2008-03-31 15:22:30 AEDT
Fix shipped in 4.9/4.9p1 release.