[openssh-commits] [openssh] 02/02: upstream: Remove now-unused compat bit SSH_BUG_RSASIGMD5. The code
git+noreply at mindrot.org
git+noreply at mindrot.org
Fri Feb 17 15:44:17 AEDT 2023
This is an automated email from the git hooks/post-receive script.
dtucker pushed a commit to branch master
in repository openssh.
commit 2a7e3449908571af601a4c2d12ab140096442e47
Author: dtucker at openbsd.org <dtucker at openbsd.org>
Date: Fri Feb 17 04:22:50 2023 +0000
upstream: Remove now-unused compat bit SSH_BUG_RSASIGMD5. The code
to set this was removed in OpenSSH 7.7 when support for SSH implementations
dating back to before RFC standardization were removed. "burn it all" djm@
OpenBSD-Commit-ID: 6330935fbe23dd00be79891505e06d1ffdac7cda
---
auth2-hostbased.c | 8 +-------
auth2-pubkey.c | 8 +-------
compat.c | 12 ++----------
compat.h | 4 ++--
kex.c | 6 +-----
monitor.c | 7 +------
sshconnect2.c | 20 +++-----------------
7 files changed, 11 insertions(+), 54 deletions(-)
diff --git a/auth2-hostbased.c b/auth2-hostbased.c
index 6b517db4..cdfe7fd8 100644
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-hostbased.c,v 1.50 2022/09/17 10:34:29 djm Exp $ */
+/* $OpenBSD: auth2-hostbased.c,v 1.51 2023/02/17 04:22:50 dtucker Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -101,12 +101,6 @@ userauth_hostbased(struct ssh *ssh, const char *method)
"(received %d, expected %d)", key->type, pktype);
goto done;
}
- if (sshkey_type_plain(key->type) == KEY_RSA &&
- (ssh->compat & SSH_BUG_RSASIGMD5) != 0) {
- error("Refusing RSA key because peer uses unsafe "
- "signature format");
- goto done;
- }
if (match_pattern_list(pkalg, options.hostbased_accepted_algos, 0) != 1) {
logit_f("signature algorithm %s not in "
"HostbasedAcceptedAlgorithms", pkalg);
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index 5d59febc..b4f1f638 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.117 2022/09/17 10:34:29 djm Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.118 2023/02/17 04:22:50 dtucker Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@@ -153,12 +153,6 @@ userauth_pubkey(struct ssh *ssh, const char *method)
"(received %d, expected %d)", key->type, pktype);
goto done;
}
- if (sshkey_type_plain(key->type) == KEY_RSA &&
- (ssh->compat & SSH_BUG_RSASIGMD5) != 0) {
- logit("Refusing RSA key because client uses unsafe "
- "signature scheme");
- goto done;
- }
if (auth2_key_already_used(authctxt, key)) {
logit("refusing previously-used %s key", sshkey_type(key));
goto done;
diff --git a/compat.c b/compat.c
index ad04328d..f967fc82 100644
--- a/compat.c
+++ b/compat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: compat.c,v 1.124 2023/02/17 03:06:18 dtucker Exp $ */
+/* $OpenBSD: compat.c,v 1.125 2023/02/17 04:22:50 dtucker Exp $ */
/*
* Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved.
*
@@ -149,15 +149,7 @@ compat_cipher_proposal(struct ssh *ssh, char *cipher_prop)
char *
compat_pkalg_proposal(struct ssh *ssh, char *pkalg_prop)
{
- if (!(ssh->compat & SSH_BUG_RSASIGMD5))
- return xstrdup(pkalg_prop);
- debug2_f("original public key proposal: %s", pkalg_prop);
- if ((pkalg_prop = match_filter_denylist(pkalg_prop, "ssh-rsa")) == NULL)
- fatal("match_filter_denylist failed");
- debug2_f("compat public key proposal: %s", pkalg_prop);
- if (*pkalg_prop == '\0')
- fatal("No supported PK algorithms found");
- return pkalg_prop;
+ return xstrdup(pkalg_prop);
}
/* Always returns pointer to allocated memory, caller must free. */
diff --git a/compat.h b/compat.h
index 8d0ea2d6..1da367e8 100644
--- a/compat.h
+++ b/compat.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: compat.h,v 1.60 2023/02/17 03:06:18 dtucker Exp $ */
+/* $OpenBSD: compat.h,v 1.61 2023/02/17 04:22:50 dtucker Exp $ */
/*
* Copyright (c) 1999, 2000, 2001 Markus Friedl. All rights reserved.
@@ -40,7 +40,7 @@
/* #define unused 0x00000400 */
#define SSH_BUG_SCANNER 0x00000800
/* #define unused 0x00001000 */
-#define SSH_BUG_RSASIGMD5 0x00002000
+/* #define unused 0x00002000 */
#define SSH_OLD_DHGEX 0x00004000
#define SSH_BUG_NOREKEY 0x00008000
/* #define unused 0x00010000 */
diff --git a/kex.c b/kex.c
index 8cdefcf7..7731ca90 100644
--- a/kex.c
+++ b/kex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.c,v 1.173 2022/11/07 10:05:38 dtucker Exp $ */
+/* $OpenBSD: kex.c,v 1.174 2023/02/17 04:22:50 dtucker Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
*
@@ -1404,10 +1404,6 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
r = SSH_ERR_CONN_CLOSED; /* XXX */
goto out;
}
- if ((ssh->compat & SSH_BUG_RSASIGMD5) != 0) {
- logit("Remote version \"%.100s\" uses unsafe RSA signature "
- "scheme; disabling use of RSA keys", remote_version);
- }
/* success */
r = 0;
out:
diff --git a/monitor.c b/monitor.c
index 91e0e624..f856c873 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.234 2022/06/15 16:08:25 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.235 2023/02/17 04:22:50 dtucker Exp $ */
/*
* Copyright 2002 Niels Provos <provos at citi.umich.edu>
* Copyright 2002 Markus Friedl <markus at openbsd.org>
@@ -1161,11 +1161,6 @@ mm_answer_keyallowed(struct ssh *ssh, int sock, struct sshbuf *m)
fatal_fr(r, "parse");
if (key != NULL && authctxt->valid) {
- /* These should not make it past the privsep child */
- if (sshkey_type_plain(key->type) == KEY_RSA &&
- (ssh->compat & SSH_BUG_RSASIGMD5) != 0)
- fatal_f("passed a SSH_BUG_RSASIGMD5 key");
-
switch (type) {
case MM_USERKEY:
auth_method = "publickey";
diff --git a/sshconnect2.c b/sshconnect2.c
index 58fe98db..f0e6e662 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.361 2022/09/17 10:33:18 djm Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.362 2023/02/17 04:22:50 dtucker Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Damien Miller. All rights reserved.
@@ -1874,20 +1874,6 @@ pubkey_reset(Authctxt *authctxt)
id->tried = 0;
}
-static int
-try_identity(struct ssh *ssh, Identity *id)
-{
- if (!id->key)
- return (0);
- if (sshkey_type_plain(id->key->type) == KEY_RSA &&
- (ssh->compat & SSH_BUG_RSASIGMD5) != 0) {
- debug("Skipped %s key %s for RSA/MD5 server",
- sshkey_type(id->key), id->filename);
- return (0);
- }
- return 1;
-}
-
static int
userauth_pubkey(struct ssh *ssh)
{
@@ -1908,7 +1894,7 @@ userauth_pubkey(struct ssh *ssh)
* private key instead
*/
if (id->key != NULL) {
- if (try_identity(ssh, id)) {
+ if (id->key != NULL) {
ident = format_identity(id);
debug("Offering public key: %s", ident);
free(ident);
@@ -1918,7 +1904,7 @@ userauth_pubkey(struct ssh *ssh)
debug("Trying private key: %s", id->filename);
id->key = load_identity_file(id);
if (id->key != NULL) {
- if (try_identity(ssh, id)) {
+ if (id->key != NULL) {
id->isprivate = 1;
sent = sign_and_send_pubkey(ssh, id);
}
--
To stop receiving notification emails like this one, please contact
djm at mindrot.org.
More information about the openssh-commits
mailing list