{"action":"created","comment":{"url":"https://api.github.com/repos/mscdex/ssh2-streams/pulls/comments/29559043","id":29559043,"diff_hunk":"@@ -4893,10 +4895,7 @@ function send(self, payload, cb, bypass) {\n     mac.update(outstate.bufSeqno);\n     mac.update(buf);\n     mac = mac.digest('binary');\n-    if (hmac.type.length > 3 && hmac.type.substr(-3) === '-96') {\n-      // only keep 96 bits of hash\n-      mac = new Buffer(mac, 'binary').toString('binary', 0, 96 / 8);\n-    }\n+    if (mac.length > outstate.hmac.size) mac = mac.slice(0, outstate.hmac.size);","path":"lib/ssh.js","position":19,"original_position":19,"commit_id":"cc99c2ba3eb324e634230ddc82c3256b4fcfd8b9","original_commit_id":"cc99c2ba3eb324e634230ddc82c3256b4fcfd8b9","user":{"login":"mscdex","id":54666,"avatar_url":"https://avatars.githubusercontent.com/u/54666?v=3","gravatar_id":"","url":"https://api.github.com/users/mscdex","html_url":"https://github.com/mscdex","followers_url":"https://api.github.com/users/mscdex/followers","following_url":"https://api.github.com/users/mscdex/following{/other_user}","gists_url":"https://api.github.com/users/mscdex/gists{/gist_id}","starred_url":"https://api.github.com/users/mscdex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mscdex/subscriptions","organizations_url":"https://api.github.com/users/mscdex/orgs","repos_url":"https://api.github.com/users/mscdex/repos","events_url":"https://api.github.com/users/mscdex/events{/privacy}","received_events_url":"https://api.github.com/users/mscdex/received_events","type":"User","site_admin":false},"body":"Style nit: same here","created_at":"2015-05-03T19:16:15Z","updated_at":"2015-05-03T19:16:15Z","html_url":"https://github.com/mscdex/ssh2-streams/pull/10#discussion_r29559043","pull_request_url":"https://api.github.com/repos/mscdex/ssh2-streams/pulls/10","_links":{"self":{"href":"https://api.github.com/repos/mscdex/ssh2-streams/pulls/comments/29559043"},"html":{"href":"https://github.com/mscdex/ssh2-streams/pull/10#discussion_r29559043"},"pull_request":{"href":"https://api.github.com/repos/mscdex/ssh2-streams/pulls/10"}}},"pull_request":{"url":"https://api.github.com/repos/mscdex/ssh2-streams/pulls/10","id":34595354,"html_url":"https://github.com/mscdex/ssh2-streams/pull/10","diff_url":"https://github.com/mscdex/ssh2-streams/pull/10.diff","patch_url":"https://github.com/mscdex/ssh2-streams/pull/10.patch","issue_url":"https://api.github.com/repos/mscdex/ssh2-streams/issues/10","number":10,"state":"open","locked":false,"title":"fix verification of truncated (\"-96\") hmacs.","user":{"login":"robey","id":172,"avatar_url":"https://avatars.githubusercontent.com/u/172?v=3","gravatar_id":"","url":"https://api.github.com/users/robey","html_url":"https://github.com/robey","followers_url":"https://api.github.com/users/robey/followers","following_url":"https://api.github.com/users/robey/following{/other_user}","gists_url":"https://api.github.com/users/robey/gists{/gist_id}","starred_url":"https://api.github.com/users/robey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robey/subscriptions","organizations_url":"https://api.github.com/users/robey/orgs","repos_url":"https://api.github.com/users/robey/repos","events_url":"https://api.github.com/users/robey/events{/privacy}","received_events_url":"https://api.github.com/users/robey/received_events","type":"User","site_admin":false},"body":"computed HMACs weren't being truncated to `hmac.size` during packet verification, so it would reject valid packets.\r\n\r\ni noticed this on an android ssh client that likes \"hmac-sha1-96\", but you can reproduce the bug by commenting out the HMACs around line 196 of constants.js, leaving only the last two with \"-96\".\r\n\r\noutput packets were fine for now (they were special-cased to the 96 case), but i changed the code to be the same each way, in case other hmac lengths are supported.\r\n","created_at":"2015-05-03T02:37:28Z","updated_at":"2015-05-03T19:16:15Z","closed_at":null,"merged_at":null,"merge_commit_sha":"9372e0bf4abdb00134115b1b426cee73633bea16","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/mscdex/ssh2-streams/pulls/10/commits","review_comments_url":"https://api.github.com/repos/mscdex/ssh2-streams/pulls/10/comments","review_comment_url":"https://api.github.com/repos/mscdex/ssh2-streams/pulls/comments{/number}","comments_url":"https://api.github.com/repos/mscdex/ssh2-streams/issues/10/comments","statuses_url":"https://api.github.com/repos/mscdex/ssh2-streams/statuses/cc99c2ba3eb324e634230ddc82c3256b4fcfd8b9","head":{"label":"robey:fix-hmac-sha1-96","ref":"fix-hmac-sha1-96","sha":"cc99c2ba3eb324e634230ddc82c3256b4fcfd8b9","user":{"login":"robey","id":172,"avatar_url":"https://avatars.githubusercontent.com/u/172?v=3","gravatar_id":"","url":"https://api.github.com/users/robey","html_url":"https://github.com/robey","followers_url":"https://api.github.com/users/robey/followers","following_url":"https://api.github.com/users/robey/following{/other_user}","gists_url":"https://api.github.com/users/robey/gists{/gist_id}","starred_url":"https://api.github.com/users/robey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robey/subscriptions","organizations_url":"https://api.github.com/users/robey/orgs","repos_url":"https://api.github.com/users/robey/repos","events_url":"https://api.github.com/users/robey/events{/privacy}","received_events_url":"https://api.github.com/users/robey/received_events","type":"User","site_admin":false},"repo":{"id":34970985,"name":"ssh2-streams","full_name":"robey/ssh2-streams","owner":{"login":"robey","id":172,"avatar_url":"https://avatars.githubusercontent.com/u/172?v=3","gravatar_id":"","url":"https://api.github.com/users/robey","html_url":"https://github.com/robey","followers_url":"https://api.github.com/users/robey/followers","following_url":"https://api.github.com/users/robey/following{/other_user}","gists_url":"https://api.github.com/users/robey/gists{/gist_id}","starred_url":"https://api.github.com/users/robey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robey/subscriptions","organizations_url":"https://api.github.com/users/robey/orgs","repos_url":"https://api.github.com/users/robey/repos","events_url":"https://api.github.com/users/robey/events{/privacy}","received_events_url":"https://api.github.com/users/robey/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/robey/ssh2-streams","description":"SSH2 and SFTP client/server protocol streams for node.js","fork":true,"url":"https://api.github.com/repos/robey/ssh2-streams","forks_url":"https://api.github.com/repos/robey/ssh2-streams/forks","keys_url":"https://api.github.com/repos/robey/ssh2-streams/keys{/key_id}","collaborators_url":"https://api.github.com/repos/robey/ssh2-streams/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/robey/ssh2-streams/teams","hooks_url":"https://api.github.com/repos/robey/ssh2-streams/hooks","issue_events_url":"https://api.github.com/repos/robey/ssh2-streams/issues/events{/number}","events_url":"https://api.github.com/repos/robey/ssh2-streams/events","assignees_url":"https://api.github.com/repos/robey/ssh2-streams/assignees{/user}","branches_url":"https://api.github.com/repos/robey/ssh2-streams/branches{/branch}","tags_url":"https://api.github.com/repos/robey/ssh2-streams/tags","blobs_url":"https://api.github.com/repos/robey/ssh2-streams/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/robey/ssh2-streams/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/robey/ssh2-streams/git/refs{/sha}","trees_url":"https://api.github.com/repos/robey/ssh2-streams/git/trees{/sha}","statuses_url":"https://api.github.com/repos/robey/ssh2-streams/statuses/{sha}","languages_url":"https://api.github.com/repos/robey/ssh2-streams/languages","stargazers_url":"https://api.github.com/repos/robey/ssh2-streams/stargazers","contributors_url":"https://api.github.com/repos/robey/ssh2-streams/contributors","subscribers_url":"https://api.github.com/repos/robey/ssh2-streams/subscribers","subscription_url":"https://api.github.com/repos/robey/ssh2-streams/subscription","commits_url":"https://api.github.com/repos/robey/ssh2-streams/commits{/sha}","git_commits_url":"https://api.github.com/repos/robey/ssh2-streams/git/commits{/sha}","comments_url":"https://api.github.com/repos/robey/ssh2-streams/comments{/number}","issue_comment_url":"https://api.github.com/repos/robey/ssh2-streams/issues/comments{/number}","contents_url":"https://api.github.com/repos/robey/ssh2-streams/contents/{+path}","compare_url":"https://api.github.com/repos/robey/ssh2-streams/compare/{base}...{head}","merges_url":"https://api.github.com/repos/robey/ssh2-streams/merges","archive_url":"https://api.github.com/repos/robey/ssh2-streams/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/robey/ssh2-streams/downloads","issues_url":"https://api.github.com/repos/robey/ssh2-streams/issues{/number}","pulls_url":"https://api.github.com/repos/robey/ssh2-streams/pulls{/number}","milestones_url":"https://api.github.com/repos/robey/ssh2-streams/milestones{/number}","notifications_url":"https://api.github.com/repos/robey/ssh2-streams/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/robey/ssh2-streams/labels{/name}","releases_url":"https://api.github.com/repos/robey/ssh2-streams/releases{/id}","created_at":"2015-05-03T02:27:08Z","updated_at":"2015-05-03T02:27:09Z","pushed_at":"2015-05-03T19:00:09Z","git_url":"git://github.com/robey/ssh2-streams.git","ssh_url":"git@github.com:robey/ssh2-streams.git","clone_url":"https://github.com/robey/ssh2-streams.git","svn_url":"https://github.com/robey/ssh2-streams","homepage":null,"size":926,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"mscdex:master","ref":"master","sha":"44d632ac68b27d87a6e859aa5d0f969293f1aecf","user":{"login":"mscdex","id":54666,"avatar_url":"https://avatars.githubusercontent.com/u/54666?v=3","gravatar_id":"","url":"https://api.github.com/users/mscdex","html_url":"https://github.com/mscdex","followers_url":"https://api.github.com/users/mscdex/followers","following_url":"https://api.github.com/users/mscdex/following{/other_user}","gists_url":"https://api.github.com/users/mscdex/gists{/gist_id}","starred_url":"https://api.github.com/users/mscdex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mscdex/subscriptions","organizations_url":"https://api.github.com/users/mscdex/orgs","repos_url":"https://api.github.com/users/mscdex/repos","events_url":"https://api.github.com/users/mscdex/events{/privacy}","received_events_url":"https://api.github.com/users/mscdex/received_events","type":"User","site_admin":false},"repo":{"id":26626196,"name":"ssh2-streams","full_name":"mscdex/ssh2-streams","owner":{"login":"mscdex","id":54666,"avatar_url":"https://avatars.githubusercontent.com/u/54666?v=3","gravatar_id":"","url":"https://api.github.com/users/mscdex","html_url":"https://github.com/mscdex","followers_url":"https://api.github.com/users/mscdex/followers","following_url":"https://api.github.com/users/mscdex/following{/other_user}","gists_url":"https://api.github.com/users/mscdex/gists{/gist_id}","starred_url":"https://api.github.com/users/mscdex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mscdex/subscriptions","organizations_url":"https://api.github.com/users/mscdex/orgs","repos_url":"https://api.github.com/users/mscdex/repos","events_url":"https://api.github.com/users/mscdex/events{/privacy}","received_events_url":"https://api.github.com/users/mscdex/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/mscdex/ssh2-streams","description":"SSH2 and SFTP client/server protocol streams for node.js","fork":false,"url":"https://api.github.com/repos/mscdex/ssh2-streams","forks_url":"https://api.github.com/repos/mscdex/ssh2-streams/forks","keys_url":"https://api.github.com/repos/mscdex/ssh2-streams/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mscdex/ssh2-streams/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mscdex/ssh2-streams/teams","hooks_url":"https://api.github.com/repos/mscdex/ssh2-streams/hooks","issue_events_url":"https://api.github.com/repos/mscdex/ssh2-streams/issues/events{/number}","events_url":"https://api.github.com/repos/mscdex/ssh2-streams/events","assignees_url":"https://api.github.com/repos/mscdex/ssh2-streams/assignees{/user}","branches_url":"https://api.github.com/repos/mscdex/ssh2-streams/branches{/branch}","tags_url":"https://api.github.com/repos/mscdex/ssh2-streams/tags","blobs_url":"https://api.github.com/repos/mscdex/ssh2-streams/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mscdex/ssh2-streams/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mscdex/ssh2-streams/git/refs{/sha}","trees_url":"https://api.github.com/repos/mscdex/ssh2-streams/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mscdex/ssh2-streams/statuses/{sha}","languages_url":"https://api.github.com/repos/mscdex/ssh2-streams/languages","stargazers_url":"https://api.github.com/repos/mscdex/ssh2-streams/stargazers","contributors_url":"https://api.github.com/repos/mscdex/ssh2-streams/contributors","subscribers_url":"https://api.github.com/repos/mscdex/ssh2-streams/subscribers","subscription_url":"https://api.github.com/repos/mscdex/ssh2-streams/subscription","commits_url":"https://api.github.com/repos/mscdex/ssh2-streams/commits{/sha}","git_commits_url":"https://api.github.com/repos/mscdex/ssh2-streams/git/commits{/sha}","comments_url":"https://api.github.com/repos/mscdex/ssh2-streams/comments{/number}","issue_comment_url":"https://api.github.com/repos/mscdex/ssh2-streams/issues/comments{/number}","contents_url":"https://api.github.com/repos/mscdex/ssh2-streams/contents/{+path}","compare_url":"https://api.github.com/repos/mscdex/ssh2-streams/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mscdex/ssh2-streams/merges","archive_url":"https://api.github.com/repos/mscdex/ssh2-streams/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mscdex/ssh2-streams/downloads","issues_url":"https://api.github.com/repos/mscdex/ssh2-streams/issues{/number}","pulls_url":"https://api.github.com/repos/mscdex/ssh2-streams/pulls{/number}","milestones_url":"https://api.github.com/repos/mscdex/ssh2-streams/milestones{/number}","notifications_url":"https://api.github.com/repos/mscdex/ssh2-streams/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mscdex/ssh2-streams/labels{/name}","releases_url":"https://api.github.com/repos/mscdex/ssh2-streams/releases{/id}","created_at":"2014-11-14T06:48:41Z","updated_at":"2015-05-01T20:55:56Z","pushed_at":"2015-05-03T19:00:10Z","git_url":"git://github.com/mscdex/ssh2-streams.git","ssh_url":"git@github.com:mscdex/ssh2-streams.git","clone_url":"https://github.com/mscdex/ssh2-streams.git","svn_url":"https://github.com/mscdex/ssh2-streams","homepage":null,"size":926,"stargazers_count":15,"watchers_count":15,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":9,"mirror_url":null,"open_issues_count":3,"forks":9,"open_issues":3,"watchers":15,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/mscdex/ssh2-streams/pulls/10"},"html":{"href":"https://github.com/mscdex/ssh2-streams/pull/10"},"issue":{"href":"https://api.github.com/repos/mscdex/ssh2-streams/issues/10"},"comments":{"href":"https://api.github.com/repos/mscdex/ssh2-streams/issues/10/comments"},"review_comments":{"href":"https://api.github.com/repos/mscdex/ssh2-streams/pulls/10/comments"},"review_comment":{"href":"https://api.github.com/repos/mscdex/ssh2-streams/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/mscdex/ssh2-streams/pulls/10/commits"},"statuses":{"href":"https://api.github.com/repos/mscdex/ssh2-streams/statuses/cc99c2ba3eb324e634230ddc82c3256b4fcfd8b9"}}}}