tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream: Re-split the merge of the reorder-hostkeys test. 

In the kex_proposal_populate_entries change I merged the the check for
reordering hostkeys with the actual reordering, but kex_assemble_names
mutates options.hostkeyalgorithms which renders the check ineffective.
Put the check back where it was.  Spotted and tested by jsg@, ok djm@

OpenBSD-Commit-ID: a7469f25a738db5567395d1881e32479a7ffc9de
This commit is contained in:
dtucker@openbsd.org 2023-03-09 07:11:05 +00:00 committed by Darren Tucker
parent 54ac4ab2b5
commit 733030840c
No known key found for this signature in database
1 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
sshconnect2.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshconnect2.c,v 1.365 2023/03/08 04:43:12 guenther Exp $ */
/* $OpenBSD: sshconnect2.c,v 1.366 2023/03/09 07:11:05 dtucker Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Damien Miller. All rights reserved.
@ -222,7 +222,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
{
char *myproposal[PROPOSAL_MAX];
char *s, *all_key, *hkalgs = NULL;
int r;
int r, use_known_hosts_order = 0;
xxx_host = host;
xxx_hostaddr = hostaddr;
@ -232,6 +232,16 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
options.rekey_interval);
/*
* If the user has not specified HostkeyAlgorithms, or has only
* appended or removed algorithms from that list then prefer algorithms
* that are in the list that are supported by known_hosts keys.
*/
if (options.hostkeyalgorithms == NULL ||
options.hostkeyalgorithms[0] == '-' ||
options.hostkeyalgorithms[0] == '+')
use_known_hosts_order = 1;
/* Expand or fill in HostkeyAlgorithms */
all_key = sshkey_alg_list(0, 0, 1, ',');
if ((r = kex_assemble_names(&options.hostkeyalgorithms,
@ -242,14 +252,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL)
fatal_f("kex_names_cat");
/*
* If the user has not specified HostkeyAlgorithms, or has only
* appended or removed algorithms from that list then prefer algorithms
* that are in the list that are supported by known_hosts keys.
*/
if (options.hostkeyalgorithms == NULL ||
options.hostkeyalgorithms[0] == '-' ||
options.hostkeyalgorithms[0] == '+')
if (use_known_hosts_order)
hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
kex_proposal_populate_entries(ssh, myproposal, s, options.ciphers,