|
 |
152122 |
diff -up openssh-8.0p1/hostfile.c.cve-2020-14145 openssh-8.0p1/hostfile.c
|
|
|
152122 |
--- openssh-8.0p1/hostfile.c.cve-2020-14145 2019-04-18 00:52:57.000000000 +0200
|
|
|
152122 |
+++ openssh-8.0p1/hostfile.c 2021-05-17 16:53:38.694577251 +0200
|
|
|
152122 |
@@ -409,6 +409,18 @@ lookup_key_in_hostkeys_by_type(struct ho
|
|
|
152122 |
found) == HOST_FOUND);
|
|
|
152122 |
}
|
|
|
152122 |
|
|
|
152122 |
+int
|
|
|
152122 |
+lookup_marker_in_hostkeys(struct hostkeys *hostkeys, int want_marker)
|
|
|
152122 |
+{
|
|
|
152122 |
+ u_int i;
|
|
|
152122 |
+
|
|
|
152122 |
+ for (i = 0; i < hostkeys->num_entries; i++) {
|
|
|
152122 |
+ if (hostkeys->entries[i].marker == (HostkeyMarker)want_marker)
|
|
|
152122 |
+ return 1;
|
|
|
152122 |
+ }
|
|
|
152122 |
+ return 0;
|
|
|
152122 |
+}
|
|
|
152122 |
+
|
|
|
152122 |
static int
|
|
|
152122 |
write_host_entry(FILE *f, const char *host, const char *ip,
|
|
|
152122 |
const struct sshkey *key, int store_hash)
|
|
|
152122 |
diff -up openssh-8.0p1/hostfile.h.cve-2020-14145 openssh-8.0p1/hostfile.h
|
|
|
152122 |
--- openssh-8.0p1/hostfile.h.cve-2020-14145 2019-04-18 00:52:57.000000000 +0200
|
|
|
152122 |
+++ openssh-8.0p1/hostfile.h 2021-05-17 16:53:38.694577251 +0200
|
|
|
152122 |
@@ -39,6 +39,7 @@ HostStatus check_key_in_hostkeys(struct
|
|
|
152122 |
const struct hostkey_entry **);
|
|
|
152122 |
int lookup_key_in_hostkeys_by_type(struct hostkeys *, int,
|
|
|
152122 |
const struct hostkey_entry **);
|
|
|
152122 |
+int lookup_marker_in_hostkeys(struct hostkeys *, int);
|
|
|
152122 |
|
|
|
152122 |
int hostfile_read_key(char **, u_int *, struct sshkey *);
|
|
|
152122 |
int add_host_to_hostfile(const char *, const char *,
|
|
|
152122 |
diff -up openssh-8.0p1/sshconnect2.c.cve-2020-14145 openssh-8.0p1/sshconnect2.c
|
|
|
152122 |
--- openssh-8.0p1/sshconnect2.c.cve-2020-14145 2021-05-17 16:53:38.610576561 +0200
|
|
|
152122 |
+++ openssh-8.0p1/sshconnect2.c 2021-05-17 16:54:58.169230103 +0200
|
|
|
152122 |
@@ -98,12 +98,25 @@ verify_host_key_callback(struct sshkey *
|
|
|
152122 |
return 0;
|
|
|
152122 |
}
|
|
|
152122 |
|
|
|
152122 |
+/* Returns the first item from a comma-separated algorithm list */
|
|
|
152122 |
+static char *
|
|
|
152122 |
+first_alg(const char *algs)
|
|
|
152122 |
+{
|
|
|
152122 |
+ char *ret, *cp;
|
|
|
152122 |
+
|
|
|
152122 |
+ ret = xstrdup(algs);
|
|
|
152122 |
+ if ((cp = strchr(ret, ',')) != NULL)
|
|
|
152122 |
+ *cp = '\0';
|
|
|
152122 |
+ return ret;
|
|
|
152122 |
+}
|
|
|
152122 |
+
|
|
|
152122 |
static char *
|
|
|
152122 |
order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port)
|
|
|
152122 |
{
|
|
|
152122 |
- char *oavail, *avail, *first, *last, *alg, *hostname, *ret;
|
|
|
152122 |
+ char *oavail = NULL, *avail = NULL, *first = NULL, *last = NULL;
|
|
|
152122 |
+ char *alg = NULL, *hostname = NULL, *ret = NULL, *best = NULL;
|
|
|
152122 |
size_t maxlen;
|
|
|
152122 |
- struct hostkeys *hostkeys;
|
|
|
152122 |
+ struct hostkeys *hostkeys = NULL;
|
|
|
152122 |
int ktype;
|
|
|
152122 |
u_int i;
|
|
|
152122 |
|
|
|
152122 |
@@ -115,6 +128,26 @@ order_hostkeyalgs(char *host, struct soc
|
|
|
152122 |
for (i = 0; i < options.num_system_hostfiles; i++)
|
|
|
152122 |
load_hostkeys(hostkeys, hostname, options.system_hostfiles[i]);
|
|
|
152122 |
|
|
|
152122 |
+ /*
|
|
|
152122 |
+ * If a plain public key exists that matches the type of the best
|
|
|
152122 |
+ * preference HostkeyAlgorithms, then use the whole list as is.
|
|
|
152122 |
+ * Note that we ignore whether the best preference algorithm is a
|
|
|
152122 |
+ * certificate type, as sshconnect.c will downgrade certs to
|
|
|
152122 |
+ * plain keys if necessary.
|
|
|
152122 |
+ */
|
|
|
152122 |
+ best = first_alg(options.hostkeyalgorithms);
|
|
|
152122 |
+ if (lookup_key_in_hostkeys_by_type(hostkeys,
|
|
|
152122 |
+ sshkey_type_plain(sshkey_type_from_name(best)), NULL)) {
|
|
|
152122 |
+ debug3("%s: have matching best-preference key type %s, "
|
|
|
152122 |
+ "using HostkeyAlgorithms verbatim", __func__, best);
|
|
|
152122 |
+ ret = xstrdup(options.hostkeyalgorithms);
|
|
|
152122 |
+ goto out;
|
|
|
152122 |
+ }
|
|
|
152122 |
+
|
|
|
152122 |
+ /*
|
|
|
152122 |
+ * Otherwise, prefer the host key algorithms that match known keys
|
|
|
152122 |
+ * while keeping the ordering of HostkeyAlgorithms as much as possible.
|
|
|
152122 |
+ */
|
|
|
152122 |
oavail = avail = xstrdup(KEX_DEFAULT_PK_ALG);
|
|
|
152122 |
maxlen = strlen(avail) + 1;
|
|
|
152122 |
first = xmalloc(maxlen);
|
|
|
152122 |
@@ -131,11 +164,23 @@ order_hostkeyalgs(char *host, struct soc
|
|
|
152122 |
while ((alg = strsep(&avail, ",")) && *alg != '\0') {
|
|
|
152122 |
if ((ktype = sshkey_type_from_name(alg)) == KEY_UNSPEC)
|
|
|
152122 |
fatal("%s: unknown alg %s", __func__, alg);
|
|
|
152122 |
+ /*
|
|
|
152122 |
+ * If we have a @cert-authority marker in known_hosts then
|
|
|
152122 |
+ * prefer all certificate algorithms.
|
|
|
152122 |
+ */
|
|
|
152122 |
+ if (sshkey_type_is_cert(ktype) &&
|
|
|
152122 |
+ lookup_marker_in_hostkeys(hostkeys, MRK_CA)) {
|
|
|
152122 |
+ ALG_APPEND(first, alg);
|
|
|
152122 |
+ continue;
|
|
|
152122 |
+ }
|
|
|
152122 |
+ /* If the key appears in known_hosts then prefer it */
|
|
|
152122 |
if (lookup_key_in_hostkeys_by_type(hostkeys,
|
|
|
152122 |
- sshkey_type_plain(ktype), NULL))
|
|
|
152122 |
+ sshkey_type_plain(ktype), NULL)) {
|
|
|
152122 |
ALG_APPEND(first, alg);
|
|
|
152122 |
- else
|
|
|
152122 |
- ALG_APPEND(last, alg);
|
|
|
152122 |
+ continue;
|
|
|
152122 |
+ }
|
|
|
152122 |
+ /* Otherwise, put it last */
|
|
|
152122 |
+ ALG_APPEND(last, alg);
|
|
|
152122 |
}
|
|
|
152122 |
#undef ALG_APPEND
|
|
|
152122 |
xasprintf(&ret, "%s%s%s", first,
|
|
|
152122 |
@@ -143,6 +188,8 @@ order_hostkeyalgs(char *host, struct soc
|
|
|
152122 |
if (*first != '\0')
|
|
|
152122 |
debug3("%s: prefer hostkeyalgs: %s", __func__, first);
|
|
|
152122 |
|
|
|
152122 |
+ out:
|
|
|
152122 |
+ free(best);
|
|
|
152122 |
free(first);
|
|
|
152122 |
free(last);
|
|
|
152122 |
free(hostname);
|