From af889a40ffc113af9105c03d7b32131eb4372d50 Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Sun, 4 Oct 2020 09:45:01 +0000 Subject: [PATCH] upstream: when ordering host key algorithms in the client, consider the ECDSA key subtype; ok markus@ OpenBSD-Commit-ID: 3097686f853c61ff61772ea35f8b699931392ece --- hostfile.c | 14 +++++++++----- hostfile.h | 4 ++-- sshconnect.c | 5 +++-- sshconnect2.c | 8 +++++--- 4 files changed, 19 insertions(+), 12 deletions(-) diff --git a/hostfile.c b/hostfile.c index 936d8c9be..00462555f 100644 --- a/hostfile.c +++ b/hostfile.c @@ -1,4 +1,4 @@ -/* $OpenBSD: hostfile.c,v 1.82 2020/06/26 05:42:16 djm Exp $ */ +/* $OpenBSD: hostfile.c,v 1.83 2020/10/04 09:45:01 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -338,7 +338,7 @@ check_key_not_revoked(struct hostkeys *hostkeys, struct sshkey *k) */ static HostStatus check_hostkeys_by_key_or_type(struct hostkeys *hostkeys, - struct sshkey *k, int keytype, const struct hostkey_entry **found) + struct sshkey *k, int keytype, int nid, const struct hostkey_entry **found) { u_int i; HostStatus end_return = HOST_NEW; @@ -354,6 +354,10 @@ check_hostkeys_by_key_or_type(struct hostkeys *hostkeys, if (k == NULL) { if (hostkeys->entries[i].key->type != keytype) continue; + if (nid != -1 && + sshkey_type_plain(keytype) == KEY_ECDSA && + hostkeys->entries[i].key->ecdsa_nid != nid) + continue; end_return = HOST_FOUND; if (found != NULL) *found = hostkeys->entries + i; @@ -396,14 +400,14 @@ check_key_in_hostkeys(struct hostkeys *hostkeys, struct sshkey *key, { if (key == NULL) fatal("no key to look up"); - return check_hostkeys_by_key_or_type(hostkeys, key, 0, found); + return check_hostkeys_by_key_or_type(hostkeys, key, 0, -1, found); } int -lookup_key_in_hostkeys_by_type(struct hostkeys *hostkeys, int keytype, +lookup_key_in_hostkeys_by_type(struct hostkeys *hostkeys, int keytype, int nid, const struct hostkey_entry **found) { - return (check_hostkeys_by_key_or_type(hostkeys, NULL, keytype, + return (check_hostkeys_by_key_or_type(hostkeys, NULL, keytype, nid, found) == HOST_FOUND); } diff --git a/hostfile.h b/hostfile.h index de8b677e3..7ea31444d 100644 --- a/hostfile.h +++ b/hostfile.h @@ -1,4 +1,4 @@ -/* $OpenBSD: hostfile.h,v 1.26 2020/06/26 05:02:03 dtucker Exp $ */ +/* $OpenBSD: hostfile.h,v 1.27 2020/10/04 09:45:01 djm Exp $ */ /* * Author: Tatu Ylonen @@ -37,7 +37,7 @@ void free_hostkeys(struct hostkeys *); HostStatus check_key_in_hostkeys(struct hostkeys *, struct sshkey *, const struct hostkey_entry **); -int lookup_key_in_hostkeys_by_type(struct hostkeys *, int, +int lookup_key_in_hostkeys_by_type(struct hostkeys *, int, int, const struct hostkey_entry **); int lookup_marker_in_hostkeys(struct hostkeys *, int); diff --git a/sshconnect.c b/sshconnect.c index b87dc0993..31e012df2 100644 --- a/sshconnect.c +++ b/sshconnect.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect.c,v 1.334 2020/10/03 09:22:26 djm Exp $ */ +/* $OpenBSD: sshconnect.c,v 1.335 2020/10/04 09:45:01 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -1336,7 +1336,8 @@ show_other_keys(struct hostkeys *hostkeys, struct sshkey *key) for (i = 0; type[i] != -1; i++) { if (type[i] == key->type) continue; - if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i], &found)) + if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i], + -1, &found)) continue; fp = sshkey_fingerprint(found->key, options.fingerprint_hash, SSH_FP_DEFAULT); diff --git a/sshconnect2.c b/sshconnect2.c index 44d7e6822..ec539afb3 100644 --- a/sshconnect2.c +++ b/sshconnect2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect2.c,v 1.327 2020/10/03 08:11:28 djm Exp $ */ +/* $OpenBSD: sshconnect2.c,v 1.328 2020/10/04 09:45:01 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved. @@ -146,7 +146,8 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port) */ best = first_alg(options.hostkeyalgorithms); if (lookup_key_in_hostkeys_by_type(hostkeys, - sshkey_type_plain(sshkey_type_from_name(best)), NULL)) { + sshkey_type_plain(sshkey_type_from_name(best)), + sshkey_ecdsa_nid_from_name(best), NULL)) { debug3("%s: have matching best-preference key type %s, " "using HostkeyAlgorithms verbatim", __func__, best); ret = xstrdup(options.hostkeyalgorithms); @@ -184,7 +185,8 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port) } /* If the key appears in known_hosts then prefer it */ if (lookup_key_in_hostkeys_by_type(hostkeys, - sshkey_type_plain(ktype), NULL)) { + sshkey_type_plain(ktype), + sshkey_ecdsa_nid_from_name(alg), NULL)) { ALG_APPEND(first, alg); continue; }