From d1315bf155f5541e769bac58bdbb1cf343a70952 Mon Sep 17 00:00:00 2001

From: Norbert Pocs <npocs@redhat.com>

Date: Mon, 7 Nov 2022 13:08:02 +0100

Subject: [PATCH 1/6] tokens: Add low-level function to exlclude, prepend lists

These functions are needed for openssh -,^ features.

Signed-off-by: Norbert Pocs <npocs@redhat.com>

Reviewed-by: Jakub Jelen <jjelen@redhat.com>

---

 include/libssh/token.h |   8 +++

 src/token.c            | 141 +++++++++++++++++++++++++++++++++++++++--

 2 files changed, 145 insertions(+), 4 deletions(-)

diff --git a/include/libssh/token.h b/include/libssh/token.h

index 9896fb06..2d07f8c4 100644

--- a/include/libssh/token.h

+++ b/include/libssh/token.h

@@ -45,4 +45,12 @@ char *ssh_remove_duplicates(const char *list);

 char *ssh_append_without_duplicates(const char *list,

                                     const char *appended_list);

+char *ssh_prefix_without_duplicates(const char *list,

+                                    const char *prefixed_list);

+char *ssh_remove_all_matching(const char *list,

+                              const char *remove_list);

+

+#ifdef __cplusplus

+}

+#endif

 #endif /* TOKEN_H_ */

diff --git a/src/token.c b/src/token.c

index 0924d3bd..58befe1d 100644

--- a/src/token.c

+++ b/src/token.c

@@ -376,6 +376,7 @@ char *ssh_append_without_duplicates(const char *list,

 {

     size_t concat_len = 0;

     char *ret = NULL, *concat = NULL;

+    int rc = 0;

     if (list != NULL) {

         concat_len = strlen(list);

@@ -396,12 +397,144 @@ char *ssh_append_without_duplicates(const char *list,

         return NULL;

     }

+    rc = snprintf(concat, concat_len, "%s%s%s",

+                  list == NULL ? "" : list,

+                  list == NULL ? "" : ",",

+                  appended_list == NULL ? "" : appended_list);

+    if (rc < 0) {

+        SAFE_FREE(concat);

+        return NULL;

+    }

+

+    ret = ssh_remove_duplicates(concat);

+

+    SAFE_FREE(concat);

+

+    return ret;

+}

+

+/**

+ * @internal

+ *

+ * @brief Given two strings containing lists of tokens, return a newly

+ * allocated string containing the elements of the first list without the

+ * elements of the second list. The order of the elements will be preserved.

+ *

+ * @param[in] list             The first list

+ * @param[in] remove_list      The list to be removed

+ *

+ * @return  A newly allocated copy list containing elements of the

+ * list without the elements of remove_list; NULL in case of error.

+ */

+char *ssh_remove_all_matching(const char *list,

+                              const char *remove_list)

+{

+    struct ssh_tokens_st *l_tok = NULL, *r_tok = NULL;

+    int i, j, cmp;

+    char *ret = NULL;

+    size_t len, pos = 0;

+    bool exclude;

+

+    if ((list == NULL)) {

+        return NULL;

+    }

+    if (remove_list == NULL) {

+        return strdup (list);

+    }

+

+    l_tok = ssh_tokenize(list, ',');

+    if (l_tok == NULL) {

+        goto out;

+    }

+

+    r_tok = ssh_tokenize(remove_list, ',');

+    if (r_tok == NULL) {

+        goto out;

+    }

+

+    ret = calloc(1, strlen(list) + 1);

+    if (ret == NULL) {

+        goto out;

+    }

+

+    for (i = 0; l_tok->tokens[i]; i++) {

+        exclude = false;

+        for (j = 0; r_tok->tokens[j]; j++) {

+            cmp = strcmp(l_tok->tokens[i], r_tok->tokens[j]);

+            if (cmp == 0) {

+                exclude = true;

+                break;

+            }

+        }

+        if (exclude == false) {

+            if (pos != 0) {

+                ret[pos] = ',';

+                pos++;

+            }

+

+            len = strlen(l_tok->tokens[i]);

+            memcpy(&ret[pos], l_tok->tokens[i], len);

+            pos += len;

+        }

+    }

+

+    if (ret[0] == '\0') {

+        SAFE_FREE(ret);

+    }

+

+out:

+    ssh_tokens_free(l_tok);

+    ssh_tokens_free(r_tok);

+    return ret;

+}

+

+/**

+ * @internal

+ *

+ * @brief Given two strings containing lists of tokens, return a newly

+ * allocated string containing all the elements of the first list prefixed at

+ * the beginning of the second list, without duplicates.

+ *

+ * @param[in] list             The first list

+ * @param[in] prefixed_list    The list to use as a prefix

+ *

+ * @return  A newly allocated list containing all the elements

+ * of the list prefixed with the elements of the prefixed_list without

+ * duplicates; NULL in case of error.

+ */

+char *ssh_prefix_without_duplicates(const char *list,

+                                    const char *prefixed_list)

+{

+    size_t concat_len = 0;

+    char *ret = NULL, *concat = NULL;

+    int rc = 0;

+

     if (list != NULL) {

-        strcpy(concat, list);

-        strncat(concat, ",", concat_len - strlen(concat) - 1);

+        concat_len = strlen(list);

     }

-    if (appended_list != NULL) {

-        strncat(concat, appended_list, concat_len - strlen(concat) - 1);

+

+    if (prefixed_list != NULL) {

+        concat_len += strlen(prefixed_list);

+    }

+

+    if (concat_len == 0) {

+        return NULL;

+    }

+

+    /* Add room for ending '\0' and for middle ',' */

+    concat_len += 2;

+    concat = calloc(concat_len, 1);

+    if (concat == NULL) {

+        return NULL;

+    }

+

+    rc = snprintf(concat, concat_len, "%s%s%s",

+                  prefixed_list == NULL ? "" : prefixed_list,

+                  prefixed_list == NULL ? "" : ",",

+                  list == NULL ? "" : list);

+    if (rc < 0) {

+        SAFE_FREE(concat);

+        return NULL;

     }

     ret = ssh_remove_duplicates(concat);

-- 

2.38.1

From f4516b9d43c4730ca5f60d73567596d65a672e16 Mon Sep 17 00:00:00 2001

From: Norbert Pocs <npocs@redhat.com>

Date: Fri, 11 Nov 2022 17:47:22 +0100

Subject: [PATCH 2/6] torture_tokens.c: Add tests for new token functions

Functions `ssh_remove_all_matching` and `ssh_prefix_without_duplicates` were

added; a little test suite will suite them.

Signed-off-by: Norbert Pocs <npocs@redhat.com>

Reviewed-by: Jakub Jelen <jjelen@redhat.com>

---

 tests/unittests/torture_tokens.c | 64 ++++++++++++++++++++++++++++++++

 1 file changed, 64 insertions(+)

diff --git a/tests/unittests/torture_tokens.c b/tests/unittests/torture_tokens.c

index 6b52b847..438538de 100644

--- a/tests/unittests/torture_tokens.c

+++ b/tests/unittests/torture_tokens.c

@@ -265,6 +265,68 @@ static void torture_append_without_duplicate(UNUSED_PARAM(void **state))

     }

 }

+static void torture_remove_all_matching (UNUSED_PARAM(void** state)) {

+    char *p;

+

+    p = ssh_remove_all_matching(NULL, NULL);

+    assert_null(p);

+

+    p = ssh_remove_all_matching("don't remove", NULL);

+    assert_non_null(p);

+    assert_string_equal(p, "don't remove");

+    free(p);

+

+    p = ssh_remove_all_matching("a,b,c", "b");

+    assert_non_null(p);

+    assert_string_equal(p, "a,c");

+    free(p);

+

+    p = ssh_remove_all_matching("a,b,c", "a,b");

+    assert_non_null(p);

+    assert_string_equal(p, "c");

+    free(p);

+

+    p = ssh_remove_all_matching("a,b,c", "d");

+    assert_non_null(p);

+    assert_string_equal(p, "a,b,c");

+    free(p);

+

+    p = ssh_remove_all_matching("a,b,c", "a,b,c");

+    assert_null(p);

+}

+

+static void torture_prefix_without_duplicates (UNUSED_PARAM(void** state)) {

+    char *p;

+

+    p = ssh_prefix_without_duplicates(NULL, NULL);

+    assert_null(p);

+

+    p = ssh_prefix_without_duplicates("a,b,c", NULL);

+    assert_non_null(p);

+    assert_string_equal(p, "a,b,c");

+    free(p);

+

+    p = ssh_prefix_without_duplicates("a,b,c", "a");

+    assert_non_null(p);

+    assert_string_equal(p, "a,b,c");

+    free(p);

+

+    p = ssh_prefix_without_duplicates("a,b,c", "b");

+    assert_non_null(p);

+    assert_string_equal(p, "b,a,c");

+    free(p);

+

+    p = ssh_prefix_without_duplicates("a,b,c", "x");

+    assert_non_null(p);

+    assert_string_equal(p, "x,a,b,c");

+    free(p);

+

+    p = ssh_prefix_without_duplicates("a,b,c", "c,x");

+    assert_non_null(p);

+    assert_string_equal(p, "c,x,a,b");

+    free(p);

+}

+

 int torture_run_tests(void)

 {

@@ -275,6 +337,8 @@ int torture_run_tests(void)

         cmocka_unit_test(torture_find_all_matching),

         cmocka_unit_test(torture_remove_duplicate),

         cmocka_unit_test(torture_append_without_duplicate),

+        cmocka_unit_test(torture_remove_all_matching),

+        cmocka_unit_test(torture_prefix_without_duplicates),

     };

     ssh_init();

-- 

2.38.1

From be50b4296574ba59537415b9903e8e4aa94cce53 Mon Sep 17 00:00:00 2001

From: Norbert Pocs <npocs@redhat.com>

Date: Mon, 7 Nov 2022 08:23:30 +0100

Subject: [PATCH 3/6] kex: Add functions for openssh +,-,^ features

The funcions can:

- add a list to the default list

- remove a list from the default list

- prepend a list to the default list

Signed-off-by: Norbert Pocs <npocs@redhat.com>

Reviewed-by: Jakub Jelen <jjelen@redhat.com>

---

 include/libssh/kex.h |   4 ++

 src/kex.c            | 105 +++++++++++++++++++++++++++++++++++++++++++

 2 files changed, 109 insertions(+)

diff --git a/include/libssh/kex.h b/include/libssh/kex.h

index 3a1f4a6f..23b93924 100644

--- a/include/libssh/kex.h

+++ b/include/libssh/kex.h

@@ -40,6 +40,10 @@ int ssh_kex_select_methods(ssh_session session);

 int ssh_verify_existing_algo(enum ssh_kex_types_e algo, const char *name);

 char *ssh_keep_known_algos(enum ssh_kex_types_e algo, const char *list);

 char *ssh_keep_fips_algos(enum ssh_kex_types_e algo, const char *list);

+char *ssh_add_to_default_algos(enum ssh_kex_types_e algo, const char *list);

+char *ssh_remove_from_default_algos(enum ssh_kex_types_e algo,

+                                    const char *list);

+char *ssh_prefix_default_algos(enum ssh_kex_types_e algo, const char *list);

 char **ssh_space_tokenize(const char *chain);

 int ssh_get_kex1(ssh_session session);

 char *ssh_find_matching(const char *in_d, const char *what_d);

diff --git a/src/kex.c b/src/kex.c

index 64083997..1155b9c7 100644

--- a/src/kex.c

+++ b/src/kex.c

@@ -983,6 +983,111 @@ char *ssh_keep_fips_algos(enum ssh_kex_types_e algo, const char *list)

     return ssh_find_all_matching(fips_methods[algo], list);

 }

+/**

+ * @internal

+ *

+ * @brief Return a newly allocated string containing the default

+ * algorithms plus the algorithms specified in list. If the system

+ * runs in fips mode, this will add only fips approved algorithms.

+ * Empty list will cause error.

+ *

+ * @param[in] algo  The type of the methods to filter

+ * @param[in] list  The list to be appended

+ *

+ * @return A newly allocated list containing the default algorithms and the

+ * algorithms in list at the end; NULL in case of error.

+ */

+char *ssh_add_to_default_algos(enum ssh_kex_types_e algo, const char *list)

+{

+    char *tmp = NULL, *ret = NULL;

+

+    if (algo > SSH_LANG_S_C || list == NULL || list[0] == '\0') {

+        return NULL;

+    }

+

+    if (ssh_fips_mode()) {

+        tmp = ssh_append_without_duplicates(fips_methods[algo], list);

+        ret = ssh_find_all_matching(fips_methods[algo], tmp);

+    } else {

+        tmp = ssh_append_without_duplicates(default_methods[algo], list);

+        ret = ssh_find_all_matching(supported_methods[algo], tmp);

+    }

+

+    free(tmp);

+    return ret;

+}

+

+/**

+ * @internal

+ *

+ * @brief Return a newly allocated string containing the default

+ * algorithms excluding the algorithms specified in list. If the system

+ * runs in fips mode, this will remove from the fips_methods list.

+ *

+ * @param[in] algo  The type of the methods to filter

+ * @param[in] list  The list to be exclude

+ *

+ * @return A newly allocated list containing the default algorithms without the

+ * algorithms in list; NULL in case of error.

+ */

+char *ssh_remove_from_default_algos(enum ssh_kex_types_e algo, const char *list)

+{

+    if (algo > SSH_LANG_S_C) {

+        return NULL;

+    }

+

+    if (list == NULL || list[0] == '\0') {

+        if (ssh_fips_mode()) {

+            return strdup(fips_methods[algo]);

+        } else {

+            return strdup(default_methods[algo]);

+        }

+    }

+

+    if (ssh_fips_mode()) {

+        return ssh_remove_all_matching(fips_methods[algo], list);

+    } else {

+        return ssh_remove_all_matching(default_methods[algo], list);

+    }

+}

+

+/**

+ * @internal

+ *

+ * @brief Return a newly allocated string containing the default

+ * algorithms with prioritized algorithms specified in list. If the

+ * algorithms are present in the default list they get prioritized, if not

+ * they are added to the front of the default list. If the system

+ * runs in fips mode, this will work with the fips_methods list.

+ * Empty list will cause error.

+ *

+ * @param[in] algo  The type of the methods to filter

+ * @param[in] list  The list to be pushed to priority

+ *

+ * @return A newly allocated list containing the default algorithms prioritized

+ * with the algorithms in list at the beginning of the list; NULL in case

+ * of error.

+ */

+char *ssh_prefix_default_algos(enum ssh_kex_types_e algo, const char *list)

+{

+    char *ret = NULL, *tmp = NULL;

+

+    if (algo > SSH_LANG_S_C || list == NULL || list[0] == '\0') {

+        return NULL;

+    }

+

+    if (ssh_fips_mode()) {

+        tmp = ssh_prefix_without_duplicates(fips_methods[algo], list);

+        ret = ssh_find_all_matching(fips_methods[algo], tmp);

+    } else {

+        tmp = ssh_prefix_without_duplicates(default_methods[algo], list);

+        ret = ssh_find_all_matching(supported_methods[algo], tmp);

+    }

+

+    free(tmp);

+    return ret;

+}

+

 int ssh_make_sessionid(ssh_session session)

 {

     ssh_string num = NULL;

-- 

2.38.1

From 0d5d6e750a0c25700a47a760cb066b6027a54b09 Mon Sep 17 00:00:00 2001

From: Norbert Pocs <npocs@redhat.com>

Date: Mon, 7 Nov 2022 13:13:20 +0100

Subject: [PATCH 4/6] options.c: Add support for openssh config +,-,^

These features allow for options Ciphers, HostKeyAlgorithms, KexAlgorithms and

MACs to append, remove and prepend to the default list of algorithms

respectively

Signed-off-by: Norbert Pocs <npocs@redhat.com>

Reviewed-by: Jakub Jelen <jjelen@redhat.com>

---

 include/libssh/options.h |   3 +-

 src/options.c            | 244 +++++++++++++++++++++++++--------------

 src/server.c             |   3 +-

 3 files changed, 161 insertions(+), 89 deletions(-)

diff --git a/include/libssh/options.h b/include/libssh/options.h

index e8dc6c69..dd04c8af 100644

--- a/include/libssh/options.h

+++ b/include/libssh/options.h

@@ -25,7 +25,8 @@ int ssh_config_parse_file(ssh_session session, const char *filename);

 int ssh_config_parse_string(ssh_session session, const char *input);

 int ssh_options_set_algo(ssh_session session,

                          enum ssh_kex_types_e algo,

-                         const char *list);

+                         const char *list,

+                         char **place);

 int ssh_options_apply(ssh_session session);

 #endif /* _OPTIONS_H */

diff --git a/src/options.c b/src/options.c

index 49aaefa2..56e09c65 100644

--- a/src/options.c

+++ b/src/options.c

@@ -221,14 +221,30 @@ int ssh_options_copy(ssh_session src, ssh_session *dest)

 int ssh_options_set_algo(ssh_session session,

                          enum ssh_kex_types_e algo,

-                         const char *list)

+                         const char *list,

+                         char **place)

 {

-    char *p = NULL;

+    /* When the list start with +,-,^ the filtration of unknown algorithms

+     * gets handled inside the helper functions, otherwise the list is taken

+     * as it is. */

+    char *p = (char *)list;

+

+    if (algo < SSH_COMP_C_S) {

+        if (list[0] == '+') {

+            p = ssh_add_to_default_algos(algo, list+1);

+        } else if (list[0] == '-') {

+            p = ssh_remove_from_default_algos(algo, list+1);

+        } else if (list[0] == '^') {

+            p = ssh_prefix_default_algos(algo, list+1);

+        }

+    }

-    if (ssh_fips_mode()) {

-        p = ssh_keep_fips_algos(algo, list);

-    } else {

-        p = ssh_keep_known_algos(algo, list);

+    if (p == list) {

+        if (ssh_fips_mode()) {

+            p = ssh_keep_fips_algos(algo, list);

+        } else {

+            p = ssh_keep_known_algos(algo, list);

+        }

     }

     if (p == NULL) {

@@ -238,8 +254,8 @@ int ssh_options_set_algo(ssh_session session,

         return -1;

     }

-    SAFE_FREE(session->opts.wanted_methods[algo]);

-    session->opts.wanted_methods[algo] = p;

+    SAFE_FREE(*place);

+    *place = p;

     return 0;

 }

@@ -356,34 +372,60 @@ int ssh_options_set_algo(ssh_session session,

  *

  *              - SSH_OPTIONS_CIPHERS_C_S:

  *                Set the symmetric cipher client to server (const char *,

- *                comma-separated list).

+ *                comma-separated list). The list can be prepended by +,-,^

+ *                which can append, remove or move to the beginning

+ *                (prioritizing) of the default list respectively. Giving an

+ *                empty list after + and ^ will cause error.

  *

  *              - SSH_OPTIONS_CIPHERS_S_C:

  *                Set the symmetric cipher server to client (const char *,

- *                comma-separated list).

+ *                comma-separated list). The list can be prepended by +,-,^

+ *                which can append, remove or move to the beginning

+ *                (prioritizing) of the default list respectively. Giving an

+ *                empty list after + and ^ will cause error.

  *

  *              - SSH_OPTIONS_KEY_EXCHANGE:

  *                Set the key exchange method to be used (const char *,

  *                comma-separated list). ex:

  *                "ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1"

+ *                The list can be prepended by +,-,^ which will append,

+ *                remove or move to the beginning (prioritizing) of the

+ *                default list respectively. Giving an empty list

+ *                after + and ^ will cause error.

  *

  *              - SSH_OPTIONS_HMAC_C_S:

  *                Set the Message Authentication Code algorithm client to server

- *                (const char *, comma-separated list).

+ *                (const char *, comma-separated list). The list can be

+ *                prepended by +,-,^ which will append, remove or move to

+ *                the beginning (prioritizing) of the default list

+ *                respectively. Giving an empty list after + and ^ will

+ *                cause error.

  *

  *              - SSH_OPTIONS_HMAC_S_C:

  *                Set the Message Authentication Code algorithm server to client

- *                (const char *, comma-separated list).

+ *                (const char *, comma-separated list). The list can be

+ *                prepended by +,-,^ which will append, remove or move to

+ *                the beginning (prioritizing) of the default list

+ *                respectively. Giving an empty list after + and ^ will

+ *                cause error.

  *

  *              - SSH_OPTIONS_HOSTKEYS:

  *                Set the preferred server host key types (const char *,

  *                comma-separated list). ex:

- *                "ssh-rsa,ssh-dss,ecdh-sha2-nistp256"

+ *                "ssh-rsa,ssh-dss,ecdh-sha2-nistp256". The list can be

+ *                prepended by +,-,^ which will append, remove or move to

+ *                the beginning (prioritizing) of the default list

+ *                respectively. Giving an empty list after + and ^ will

+ *                cause error.

  *

  *              - SSH_OPTIONS_PUBLICKEY_ACCEPTED_TYPES:

  *                Set the preferred public key algorithms to be used for

  *                authentication (const char *, comma-separated list). ex:

  *                "ssh-rsa,rsa-sha2-256,ssh-dss,ecdh-sha2-nistp256"

+ *                The list can be prepended by +,-,^ which will append,

+ *                remove or move to the beginning (prioritizing) of the

+ *                default list respectively. Giving an empty list

+ *                after + and ^ will cause error.

  *

  *              - SSH_OPTIONS_COMPRESSION_C_S:

  *                Set the compression to use for client to server

@@ -496,6 +538,7 @@ int ssh_options_set(ssh_session session, enum ssh_options_e type,

     long int i;

     unsigned int u;

     int rc;

+    char **wanted_methods = session->opts.wanted_methods;

     if (session == NULL) {

         return -1;

@@ -779,7 +822,11 @@ int ssh_options_set(ssh_session session, enum ssh_options_e type,

                 ssh_set_error_invalid(session);

                 return -1;

             } else {

-                if (ssh_options_set_algo(session, SSH_CRYPT_C_S, v) < 0)

+                rc = ssh_options_set_algo(session,

+                                          SSH_CRYPT_C_S,

+                                          v,

+                                          &wanted_methods[SSH_CRYPT_C_S]);

+                if (rc < 0)

                     return -1;

             }

             break;

@@ -789,7 +836,11 @@ int ssh_options_set(ssh_session session, enum ssh_options_e type,

                 ssh_set_error_invalid(session);

                 return -1;

             } else {

-                if (ssh_options_set_algo(session, SSH_CRYPT_S_C, v) < 0)

+                rc = ssh_options_set_algo(session,

+                                          SSH_CRYPT_S_C,

+                                          v,

+                                          &wanted_methods[SSH_CRYPT_S_C]);

+                if (rc < 0)

                     return -1;

             }

             break;

@@ -799,7 +850,11 @@ int ssh_options_set(ssh_session session, enum ssh_options_e type,

                 ssh_set_error_invalid(session);

                 return -1;

             } else {

-                if (ssh_options_set_algo(session, SSH_KEX, v) < 0)

+                rc = ssh_options_set_algo(session,

+                                          SSH_KEX,

+                                          v,

+                                          &wanted_methods[SSH_KEX]);

+                if (rc < 0)

                     return -1;

             }

             break;

@@ -809,7 +864,11 @@ int ssh_options_set(ssh_session session, enum ssh_options_e type,

                 ssh_set_error_invalid(session);

                 return -1;

             } else {

-                if (ssh_options_set_algo(session, SSH_HOSTKEYS, v) < 0)

+                rc = ssh_options_set_algo(session,

+                                          SSH_HOSTKEYS,

+                                          v,

+                                          &wanted_methods[SSH_HOSTKEYS]);

+                if (rc < 0)

                     return -1;

             }

             break;

@@ -819,20 +878,12 @@ int ssh_options_set(ssh_session session, enum ssh_options_e type,

                 ssh_set_error_invalid(session);

                 return -1;

             } else {

-                if (ssh_fips_mode()) {

-                    p = ssh_keep_fips_algos(SSH_HOSTKEYS, v);

-                } else {

-                    p = ssh_keep_known_algos(SSH_HOSTKEYS, v);

-                }

-                if (p == NULL) {

-                    ssh_set_error(session, SSH_REQUEST_DENIED,

-                        "Setting method: no known public key algorithm (%s)",

-                         v);

+                rc = ssh_options_set_algo(session,

+                                          SSH_HOSTKEYS,

+                                          v,

+                                          &session->opts.pubkey_accepted_types);

+                if (rc < 0)

                     return -1;

-                }

-

-                SAFE_FREE(session->opts.pubkey_accepted_types);

-                session->opts.pubkey_accepted_types = p;

             }

             break;

         case SSH_OPTIONS_HMAC_C_S:

@@ -841,7 +892,11 @@ int ssh_options_set(ssh_session session, enum ssh_options_e type,

                 ssh_set_error_invalid(session);

                 return -1;

             } else {

-                if (ssh_options_set_algo(session, SSH_MAC_C_S, v) < 0)

+                rc = ssh_options_set_algo(session,

+                                          SSH_MAC_C_S,

+                                          v,

+                                          &wanted_methods[SSH_MAC_C_S]);

+                if (rc < 0)

                     return -1;

             }

             break;

@@ -851,7 +906,11 @@ int ssh_options_set(ssh_session session, enum ssh_options_e type,

                 ssh_set_error_invalid(session);

                 return -1;

             } else {

-                if (ssh_options_set_algo(session, SSH_MAC_S_C, v) < 0)

+                rc = ssh_options_set_algo(session,

+                                          SSH_MAC_S_C,

+                                          v,

+                                          &wanted_methods[SSH_MAC_S_C]);

+                if (rc < 0)

                     return -1;

             }

             break;

@@ -861,16 +920,18 @@ int ssh_options_set(ssh_session session, enum ssh_options_e type,

                 ssh_set_error_invalid(session);

                 return -1;

             } else {

-                if (strcasecmp(value,"yes")==0){

-                    if(ssh_options_set_algo(session,SSH_COMP_C_S,"zlib@openssh.com,zlib,none") < 0)

-                        return -1;

-                } else if (strcasecmp(value,"no")==0){

-                    if(ssh_options_set_algo(session,SSH_COMP_C_S,"none,zlib@openssh.com,zlib") < 0)

-                        return -1;