[openssh-commits] [openssh] 02/09: upstream: when ordering host key algorithms in the client, consider

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit af889a40ffc113af9105c03d7b32131eb4372d50
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Sun Oct 4 09:45:01 2020 +0000

    upstream: when ordering host key algorithms in the client, consider
    
    the ECDSA key subtype; ok markus@
    
    OpenBSD-Commit-ID: 3097686f853c61ff61772ea35f8b699931392ece
---
 hostfile.c    | 14 +++++++++-----
 hostfile.h    |  4 ++--
 sshconnect.c  |  5 +++--
 sshconnect2.c |  8 +++++---
 4 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/hostfile.c b/hostfile.c
index 936d8c9b..00462555 100644
--- a/hostfile.c
+++ b/hostfile.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: hostfile.c,v 1.82 2020/06/26 05:42:16 djm Exp $ */
+/* $OpenBSD: hostfile.c,v 1.83 2020/10/04 09:45:01 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -338,7 +338,7 @@ check_key_not_revoked(struct hostkeys *hostkeys, struct sshkey *k)
  */
 static HostStatus
 check_hostkeys_by_key_or_type(struct hostkeys *hostkeys,
-    struct sshkey *k, int keytype, const struct hostkey_entry **found)
+    struct sshkey *k, int keytype, int nid, const struct hostkey_entry **found)
 {
 	u_int i;
 	HostStatus end_return = HOST_NEW;
@@ -354,6 +354,10 @@ check_hostkeys_by_key_or_type(struct hostkeys *hostkeys,
 		if (k == NULL) {
 			if (hostkeys->entries[i].key->type != keytype)
 				continue;
+			if (nid != -1 &&
+			    sshkey_type_plain(keytype) == KEY_ECDSA &&
+			    hostkeys->entries[i].key->ecdsa_nid != nid)
+				continue;
 			end_return = HOST_FOUND;
 			if (found != NULL)
 				*found = hostkeys->entries + i;
@@ -396,14 +400,14 @@ check_key_in_hostkeys(struct hostkeys *hostkeys, struct sshkey *key,
 {
 	if (key == NULL)
 		fatal("no key to look up");
-	return check_hostkeys_by_key_or_type(hostkeys, key, 0, found);
+	return check_hostkeys_by_key_or_type(hostkeys, key, 0, -1, found);
 }
 
 int
-lookup_key_in_hostkeys_by_type(struct hostkeys *hostkeys, int keytype,
+lookup_key_in_hostkeys_by_type(struct hostkeys *hostkeys, int keytype, int nid,
     const struct hostkey_entry **found)
 {
-	return (check_hostkeys_by_key_or_type(hostkeys, NULL, keytype,
+	return (check_hostkeys_by_key_or_type(hostkeys, NULL, keytype, nid,
 	    found) == HOST_FOUND);
 }
 
diff --git a/hostfile.h b/hostfile.h
index de8b677e..7ea31444 100644
--- a/hostfile.h
+++ b/hostfile.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: hostfile.h,v 1.26 2020/06/26 05:02:03 dtucker Exp $ */
+/* $OpenBSD: hostfile.h,v 1.27 2020/10/04 09:45:01 djm Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -37,7 +37,7 @@ void	 free_hostkeys(struct hostkeys *);
 
 HostStatus check_key_in_hostkeys(struct hostkeys *, struct sshkey *,
     const struct hostkey_entry **);
-int	 lookup_key_in_hostkeys_by_type(struct hostkeys *, int,
+int	 lookup_key_in_hostkeys_by_type(struct hostkeys *, int, int,
     const struct hostkey_entry **);
 int	 lookup_marker_in_hostkeys(struct hostkeys *, int);
 
diff --git a/sshconnect.c b/sshconnect.c
index b87dc099..31e012df 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect.c,v 1.334 2020/10/03 09:22:26 djm Exp $ */
+/* $OpenBSD: sshconnect.c,v 1.335 2020/10/04 09:45:01 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -1336,7 +1336,8 @@ show_other_keys(struct hostkeys *hostkeys, struct sshkey *key)
 	for (i = 0; type[i] != -1; i++) {
 		if (type[i] == key->type)
 			continue;
-		if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i], &found))
+		if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i],
+		    -1, &found))
 			continue;
 		fp = sshkey_fingerprint(found->key,
 		    options.fingerprint_hash, SSH_FP_DEFAULT);
diff --git a/sshconnect2.c b/sshconnect2.c
index 44d7e682..ec539afb 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.327 2020/10/03 08:11:28 djm Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.328 2020/10/04 09:45:01 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -146,7 +146,8 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port)
 	 */
 	best = first_alg(options.hostkeyalgorithms);
 	if (lookup_key_in_hostkeys_by_type(hostkeys,
-	    sshkey_type_plain(sshkey_type_from_name(best)), NULL)) {
+	    sshkey_type_plain(sshkey_type_from_name(best)),
+	    sshkey_ecdsa_nid_from_name(best), NULL)) {
 		debug3("%s: have matching best-preference key type %s, "
 		    "using HostkeyAlgorithms verbatim", __func__, best);
 		ret = xstrdup(options.hostkeyalgorithms);
@@ -184,7 +185,8 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port)
 		}
 		/* If the key appears in known_hosts then prefer it */
 		if (lookup_key_in_hostkeys_by_type(hostkeys,
-		    sshkey_type_plain(ktype), NULL)) {
+		    sshkey_type_plain(ktype),
+		    sshkey_ecdsa_nid_from_name(alg), NULL)) {
 			ALG_APPEND(first, alg);
 			continue;
 		}

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.