RepoMirrors
/
openssh
mirror of git://anongit.mindrot.org/openssh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream: when ordering host key algorithms in the client, consider 

the ECDSA key subtype; ok markus@

OpenBSD-Commit-ID: 3097686f853c61ff61772ea35f8b699931392ece
This commit is contained in:
djm@openbsd.org 2020-10-04 09:45:01 +00:00 committed by Damien Miller
parent 2d39fc9f7e
commit af889a40ff
4 changed files with 19 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
hostfile.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: hostfile.c,v 1.82 2020/06/26 05:42:16 djm Exp $ */ /* $OpenBSD: hostfile.c,v 1.83 2020/10/04 09:45:01 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -338,7 +338,7 @@ check_key_not_revoked(struct hostkeys *hostkeys, struct sshkey *k)
*/ */
static HostStatus static HostStatus
check_hostkeys_by_key_or_type(struct hostkeys *hostkeys, check_hostkeys_by_key_or_type(struct hostkeys *hostkeys,
struct sshkey *k, int keytype, const struct hostkey_entry **found) struct sshkey *k, int keytype, int nid, const struct hostkey_entry **found)
{ {
u_int i; u_int i;
HostStatus end_return = HOST_NEW; HostStatus end_return = HOST_NEW;
@ -354,6 +354,10 @@ check_hostkeys_by_key_or_type(struct hostkeys *hostkeys,
if (k == NULL) { if (k == NULL) {
if (hostkeys->entries[i].key->type != keytype) if (hostkeys->entries[i].key->type != keytype)
continue; continue;
if (nid != -1 &&
sshkey_type_plain(keytype) == KEY_ECDSA &&
hostkeys->entries[i].key->ecdsa_nid != nid)
continue;
end_return = HOST_FOUND; end_return = HOST_FOUND;
if (found != NULL) if (found != NULL)
*found = hostkeys->entries + i; *found = hostkeys->entries + i;
@ -396,14 +400,14 @@ check_key_in_hostkeys(struct hostkeys *hostkeys, struct sshkey *key,
{ {
if (key == NULL) if (key == NULL)
fatal("no key to look up"); fatal("no key to look up");
return check_hostkeys_by_key_or_type(hostkeys, key, 0, found); return check_hostkeys_by_key_or_type(hostkeys, key, 0, -1, found);
} }
int int
lookup_key_in_hostkeys_by_type(struct hostkeys *hostkeys, int keytype, lookup_key_in_hostkeys_by_type(struct hostkeys *hostkeys, int keytype, int nid,
const struct hostkey_entry **found) const struct hostkey_entry **found)
{ {
return (check_hostkeys_by_key_or_type(hostkeys, NULL, keytype, return (check_hostkeys_by_key_or_type(hostkeys, NULL, keytype, nid,
found) == HOST_FOUND); found) == HOST_FOUND);
} }

4
hostfile.h
View File

@ -1,4 +1,4 @@
/* $OpenBSD: hostfile.h,v 1.26 2020/06/26 05:02:03 dtucker Exp $ */ /* $OpenBSD: hostfile.h,v 1.27 2020/10/04 09:45:01 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
@ -37,7 +37,7 @@ void free_hostkeys(struct hostkeys *);
HostStatus check_key_in_hostkeys(struct hostkeys *, struct sshkey *, HostStatus check_key_in_hostkeys(struct hostkeys *, struct sshkey *,
const struct hostkey_entry **); const struct hostkey_entry **);
int lookup_key_in_hostkeys_by_type(struct hostkeys *, int, int lookup_key_in_hostkeys_by_type(struct hostkeys *, int, int,
const struct hostkey_entry **); const struct hostkey_entry **);
int lookup_marker_in_hostkeys(struct hostkeys *, int); int lookup_marker_in_hostkeys(struct hostkeys *, int);

5
sshconnect.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshconnect.c,v 1.334 2020/10/03 09:22:26 djm Exp $ */ /* $OpenBSD: sshconnect.c,v 1.335 2020/10/04 09:45:01 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -1336,7 +1336,8 @@ show_other_keys(struct hostkeys *hostkeys, struct sshkey *key)
for (i = 0; type[i] != -1; i++) { for (i = 0; type[i] != -1; i++) {
if (type[i] == key->type) if (type[i] == key->type)
continue; continue;
if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i], &found)) if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i],
-1, &found))
continue; continue;
fp = sshkey_fingerprint(found->key, fp = sshkey_fingerprint(found->key,
options.fingerprint_hash, SSH_FP_DEFAULT); options.fingerprint_hash, SSH_FP_DEFAULT);

8
sshconnect2.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshconnect2.c,v 1.327 2020/10/03 08:11:28 djm Exp $ */ /* $OpenBSD: sshconnect2.c,v 1.328 2020/10/04 09:45:01 djm Exp $ */
/* /*
* Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Damien Miller. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved.
@ -146,7 +146,8 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port)
*/ */
best = first_alg(options.hostkeyalgorithms); best = first_alg(options.hostkeyalgorithms);
if (lookup_key_in_hostkeys_by_type(hostkeys, if (lookup_key_in_hostkeys_by_type(hostkeys,
sshkey_type_plain(sshkey_type_from_name(best)), NULL)) { sshkey_type_plain(sshkey_type_from_name(best)),
sshkey_ecdsa_nid_from_name(best), NULL)) {
debug3("%s: have matching best-preference key type %s, " debug3("%s: have matching best-preference key type %s, "
"using HostkeyAlgorithms verbatim", __func__, best); "using HostkeyAlgorithms verbatim", __func__, best);
ret = xstrdup(options.hostkeyalgorithms); ret = xstrdup(options.hostkeyalgorithms);
@ -184,7 +185,8 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port)
} }
/* If the key appears in known_hosts then prefer it */ /* If the key appears in known_hosts then prefer it */
if (lookup_key_in_hostkeys_by_type(hostkeys, if (lookup_key_in_hostkeys_by_type(hostkeys,
sshkey_type_plain(ktype), NULL)) { sshkey_type_plain(ktype),
sshkey_ecdsa_nid_from_name(alg), NULL)) {
ALG_APPEND(first, alg); ALG_APPEND(first, alg);
continue; continue;
} }