upstream commit

Account for packets buffered but not yet processed when
 computing whether or not it is time to perform rekeying.  bz#2521, based
 loosely on a patch from olo at fb.com, ok djm@

Upstream-ID: 67e268b547f990ed220f3cb70a5624d9bda12b8c

diff --git a/packet.c b/packet.c
index 9cf200cc3e1c219caffd89c5b8c02999e96f4eba..ffcd8eab91d1d3a97c68d479a997dfa6f42d2696 100644 (file)
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.222 2016/01/14 16:17:40 markus Exp $ */
+/* $OpenBSD: packet.c,v 1.223 2016/01/29 02:42:46 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -2251,16 +2251,21 @@ int
 ssh_packet_need_rekeying(struct ssh *ssh)
 {
        struct session_state *state = ssh->state;
+       u_int32_t buf_in, buf_out;
 
        if (ssh->compat & SSH_BUG_NOREKEY)
                return 0;
+       buf_in = roundup(sshbuf_len(state->input),
+           state->newkeys[MODE_IN]->enc.block_size);
+       buf_out = roundup(sshbuf_len(state->output),
+           state->newkeys[MODE_OUT]->enc.block_size);
        return
            (state->p_send.packets > MAX_PACKETS) ||
            (state->p_read.packets > MAX_PACKETS) ||
            (state->max_blocks_out &&
-               (state->p_send.blocks > state->max_blocks_out)) ||
+               (state->p_send.blocks + buf_out > state->max_blocks_out)) ||
            (state->max_blocks_in &&
-               (state->p_read.blocks > state->max_blocks_in)) ||
+               (state->p_read.blocks + buf_in > state->max_blocks_in)) ||
            (state->rekey_interval != 0 && state->rekey_time +
                 state->rekey_interval <= monotime());
 }