diff options
| author | dtucker@openbsd.org <dtucker@openbsd.org> | 2023-03-09 07:11:05 +0000 |
|---|---|---|
| committer | Darren Tucker <dtucker@dtucker.net> | 2023-03-09 18:32:48 +1100 |
| commit | 733030840c4772f858de95d5940ec0c37663e8b0 (patch) | |
| tree | 198d8ffa5dc0031d6f419f38f1fe4437229e615e | |
| parent | 54ac4ab2b53ce9fcb66b8250dee91c070e4167ed (diff) | |
| download | openssh-git-733030840c4772f858de95d5940ec0c37663e8b0.tar.gz | |
upstream: Re-split the merge of the reorder-hostkeys test.
In the kex_proposal_populate_entries change I merged the the check for
reordering hostkeys with the actual reordering, but kex_assemble_names
mutates options.hostkeyalgorithms which renders the check ineffective.
Put the check back where it was. Spotted and tested by jsg@, ok djm@
OpenBSD-Commit-ID: a7469f25a738db5567395d1881e32479a7ffc9de
| -rw-r--r-- | sshconnect2.c | 23 |
1 files changed, 13 insertions, 10 deletions
diff --git a/sshconnect2.c b/sshconnect2.c index 613b69e0..bc05f021 100644 --- a/sshconnect2.c +++ b/sshconnect2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect2.c,v 1.365 2023/03/08 04:43:12 guenther Exp $ */ +/* $OpenBSD: sshconnect2.c,v 1.366 2023/03/09 07:11:05 dtucker Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved. @@ -222,7 +222,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, { char *myproposal[PROPOSAL_MAX]; char *s, *all_key, *hkalgs = NULL; - int r; + int r, use_known_hosts_order = 0; xxx_host = host; xxx_hostaddr = hostaddr; @@ -232,6 +232,16 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, ssh_packet_set_rekey_limits(ssh, options.rekey_limit, options.rekey_interval); + /* + * If the user has not specified HostkeyAlgorithms, or has only + * appended or removed algorithms from that list then prefer algorithms + * that are in the list that are supported by known_hosts keys. + */ + if (options.hostkeyalgorithms == NULL || + options.hostkeyalgorithms[0] == '-' || + options.hostkeyalgorithms[0] == '+') + use_known_hosts_order = 1; + /* Expand or fill in HostkeyAlgorithms */ all_key = sshkey_alg_list(0, 0, 1, ','); if ((r = kex_assemble_names(&options.hostkeyalgorithms, @@ -242,14 +252,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL) fatal_f("kex_names_cat"); - /* - * If the user has not specified HostkeyAlgorithms, or has only - * appended or removed algorithms from that list then prefer algorithms - * that are in the list that are supported by known_hosts keys. - */ - if (options.hostkeyalgorithms == NULL || - options.hostkeyalgorithms[0] == '-' || - options.hostkeyalgorithms[0] == '+') + if (use_known_hosts_order) hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo); kex_proposal_populate_entries(ssh, myproposal, s, options.ciphers, |