52 lines
2.2 KiB
Diff
52 lines
2.2 KiB
Diff
Specifying "HostKeyAlgorithms +ssh-dds" does not work properly because
|
|
setting any value for HostKeyAlgorithms causes the known host keys to
|
|
be ignored for the purpose of determining the priority of algorithms.
|
|
This was fixed upstream for HostKeyAlgorithms in sshd_config, but not
|
|
in ssh_config. The fix is to apply order_hostkeyalgs() if the user
|
|
specifies a HostKeyAlgorithms starting with "+".
|
|
|
|
diff -ru -x '*~' openssh-7.2p2-orig/sshconnect2.c openssh-7.2p2/sshconnect2.c
|
|
--- openssh-7.2p2-orig/sshconnect2.c 2016-03-09 19:04:48.000000000 +0100
|
|
+++ openssh-7.2p2/sshconnect2.c 2016-04-01 15:39:45.140945902 +0200
|
|
@@ -100,7 +100,7 @@
|
|
}
|
|
|
|
static char *
|
|
-order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port)
|
|
+order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port, char *algs)
|
|
{
|
|
char *oavail, *avail, *first, *last, *alg, *hostname, *ret;
|
|
size_t maxlen;
|
|
@@ -116,7 +116,7 @@
|
|
for (i = 0; i < options.num_system_hostfiles; i++)
|
|
load_hostkeys(hostkeys, hostname, options.system_hostfiles[i]);
|
|
|
|
- oavail = avail = xstrdup(KEX_DEFAULT_PK_ALG);
|
|
+ oavail = avail = xstrdup(algs);
|
|
maxlen = strlen(avail) + 1;
|
|
first = xmalloc(maxlen);
|
|
last = xmalloc(maxlen);
|
|
@@ -181,18 +181,21 @@
|
|
myproposal[PROPOSAL_MAC_ALGS_CTOS] =
|
|
myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
|
|
if (options.hostkeyalgorithms != NULL) {
|
|
+ int append = options.hostkeyalgorithms[0] == '+';
|
|
if (kex_assemble_names(KEX_DEFAULT_PK_ALG,
|
|
&options.hostkeyalgorithms) != 0)
|
|
fatal("%s: kex_assemble_namelist", __func__);
|
|
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
|
|
- compat_pkalg_proposal(options.hostkeyalgorithms);
|
|
+ compat_pkalg_proposal(append
|
|
+ ? order_hostkeyalgs(host, hostaddr, port, options.hostkeyalgorithms)
|
|
+ : options.hostkeyalgorithms);
|
|
} else {
|
|
/* Enforce default */
|
|
options.hostkeyalgorithms = xstrdup(KEX_DEFAULT_PK_ALG);
|
|
/* Prefer algorithms that we already have keys for */
|
|
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
|
|
compat_pkalg_proposal(
|
|
- order_hostkeyalgs(host, hostaddr, port));
|
|
+ order_hostkeyalgs(host, hostaddr, port, KEX_DEFAULT_PK_ALG));
|
|
}
|
|
|
|
if (options.rekey_limit || options.rekey_interval)
|