|
 |
07d1ba |
diff --color -rup a/regress/hostkey-agent.sh b/regress/hostkey-agent.sh
|
|
|
07d1ba |
--- a/regress/hostkey-agent.sh 2021-08-20 06:03:49.000000000 +0200
|
|
|
07d1ba |
+++ b/regress/hostkey-agent.sh 2022-07-14 11:58:12.172786060 +0200
|
|
|
07d1ba |
@@ -13,8 +13,12 @@ r=$?
|
|
|
07d1ba |
grep -vi 'hostkey' $OBJ/sshd_proxy > $OBJ/sshd_proxy.orig
|
|
|
07d1ba |
echo "HostKeyAgent $SSH_AUTH_SOCK" >> $OBJ/sshd_proxy.orig
|
|
|
07d1ba |
|
|
|
07d1ba |
+PUBKEY_ACCEPTED_ALGOS=`$SSH -G "example.com" | \
|
|
|
07d1ba |
+ grep -i "PubkeyAcceptedAlgorithms" | cut -d ' ' -f2- | tr "," "|"`
|
|
|
07d1ba |
+SSH_ACCEPTED_KEYTYPES=`echo "$SSH_KEYTYPES" | egrep "$PUBKEY_ACCEPTED_ALGOS"`
|
|
|
07d1ba |
+
|
|
|
07d1ba |
trace "load hostkeys"
|
|
|
07d1ba |
-for k in $SSH_KEYTYPES ; do
|
|
|
07d1ba |
+for k in $SSH_ACCEPTED_KEYTYPES ; do
|
|
|
07d1ba |
${SSHKEYGEN} -qt $k -f $OBJ/agent-key.$k -N '' || fatal "ssh-keygen $k"
|
|
|
07d1ba |
(
|
|
|
07d1ba |
printf 'localhost-with-alias,127.0.0.1,::1 '
|
|
|
07d1ba |
@@ -31,7 +35,7 @@ cp $OBJ/known_hosts.orig $OBJ/known_host
|
|
|
07d1ba |
unset SSH_AUTH_SOCK
|
|
|
07d1ba |
|
|
|
07d1ba |
for ps in yes; do
|
|
|
07d1ba |
- for k in $SSH_KEYTYPES ; do
|
|
|
07d1ba |
+ for k in $SSH_ACCEPTED_KEYTYPES ; do
|
|
|
07d1ba |
verbose "key type $k privsep=$ps"
|
|
|
07d1ba |
cp $OBJ/sshd_proxy.orig $OBJ/sshd_proxy
|
|
|
07d1ba |
echo "UsePrivilegeSeparation $ps" >> $OBJ/sshd_proxy
|
|
|
07d1ba |
diff --color -rup a/sshconnect2.c b/sshconnect2.c
|
|
|
07d1ba |
--- a/sshconnect2.c 2022-07-14 10:10:07.262975710 +0200
|
|
|
07d1ba |
+++ b/sshconnect2.c 2022-07-14 10:10:32.068452067 +0200
|
|
|
07d1ba |
@@ -222,6 +222,7 @@ ssh_kex2(struct ssh *ssh, char *host, st
|
|
|
07d1ba |
{
|
|
|
07d1ba |
char *myproposal[PROPOSAL_MAX] = { KEX_CLIENT };
|
|
|
07d1ba |
char *s, *all_key;
|
|
|
07d1ba |
+ char *hostkeyalgs = NULL, *pkalg = NULL;
|
|
|
07d1ba |
char *prop_kex = NULL, *prop_enc = NULL, *prop_hostkey = NULL;
|
|
|
07d1ba |
int r, use_known_hosts_order = 0;
|
|
|
07d1ba |
|
|
|
07d1ba |
@@ -264,14 +265,19 @@ ssh_kex2(struct ssh *ssh, char *host, st
|
|
|
07d1ba |
myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
|
|
|
07d1ba |
if (use_known_hosts_order) {
|
|
|
07d1ba |
/* Query known_hosts and prefer algorithms that appear there */
|
|
|
07d1ba |
- myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = prop_hostkey =
|
|
|
07d1ba |
- compat_pkalg_proposal(ssh,
|
|
|
07d1ba |
- order_hostkeyalgs(host, hostaddr, port, cinfo));
|
|
|
07d1ba |
+ if ((hostkeyalgs = order_hostkeyalgs(host, hostaddr, port, cinfo)) == NULL)
|
|
|
07d1ba |
+ fatal_f("order_hostkeyalgs");
|
|
|
07d1ba |
+ pkalg = match_filter_allowlist(hostkeyalgs, options.pubkey_accepted_algos);
|
|
|
07d1ba |
+ free(hostkeyalgs);
|
|
|
07d1ba |
} else {
|
|
|
07d1ba |
- /* Use specified HostkeyAlgorithms exactly */
|
|
|
07d1ba |
- myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = prop_hostkey =
|
|
|
07d1ba |
- compat_pkalg_proposal(ssh, options.hostkeyalgorithms);
|
|
|
07d1ba |
+ /* Use specified HostkeyAlgorithms */
|
|
|
07d1ba |
+ pkalg = match_filter_allowlist(options.hostkeyalgorithms, options.pubkey_accepted_algos);
|
|
|
07d1ba |
}
|
|
|
07d1ba |
+ if (pkalg == NULL)
|
|
|
07d1ba |
+ fatal_f("match_filter_allowlist");
|
|
|
07d1ba |
+ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = prop_hostkey =
|
|
|
07d1ba |
+ compat_pkalg_proposal(ssh, pkalg);
|
|
|
07d1ba |
+ free(pkalg);
|
|
|
07d1ba |
|
|
|
07d1ba |
#if defined(GSSAPI) && defined(WITH_OPENSSL)
|
|
|
07d1ba |
if (options.gss_keyex) {
|