[openssh-commits] [openssh] 03/03: upstream: don't send new-style rsa-sha2-*-cert-v01 at openssh.com names to

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 1a4a9cf80f5b92b9d1dadd0bfa8867c04d195391
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Thu Oct 11 03:48:04 2018 +0000

    upstream: don't send new-style rsa-sha2-*-cert-v01 at openssh.com names to
    
    older OpenSSH that can't handle them. spotted by Adam Eijdenberg; ok dtucker
    
    OpenBSD-Commit-ID: 662bbc402e3d7c9b6c322806269698106a6ae631
---
 sshconnect2.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sshconnect2.c b/sshconnect2.c
index 86a0254b..1675f393 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.287 2018/09/14 05:26:27 djm Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.288 2018/10/11 03:48:04 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -1088,7 +1088,8 @@ key_sig_algorithm(struct ssh *ssh, const struct sshkey *key)
 	 * newer (SHA2) algorithms.
 	 */
 	if (ssh == NULL || ssh->kex->server_sig_algs == NULL ||
-	    (key->type != KEY_RSA && key->type != KEY_RSA_CERT)) {
+	    (key->type != KEY_RSA && key->type != KEY_RSA_CERT) ||
+	    (key->type == KEY_RSA_CERT && (datafellows & SSH_BUG_SIGTYPE))) {
 		/* Filter base key signature alg against our configuration */
 		return match_list(sshkey_ssh_name(key),
 		    options.pubkey_key_types, NULL);

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.