[openssh-commits] [openssh] 85/87: upstream: regress test for "PubkeyAcceptedAlgorithms -*" and

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 65390d6328d2e59e610361707a53e7a31cd9b40a
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 08:12:58 2026 +0000

    upstream: regress test for "PubkeyAcceptedAlgorithms -*" and
    
    friends
    
    Anthropic ANT-2026-O2RQ9GNA
    
    OpenBSD-Regress-ID: 9117f7d1f821f95e6610f830c7f6a1b434c6b19f
---
 regress/cfgparse.sh    | 11 ++++++++++-
 regress/sshcfgparse.sh |  5 ++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/regress/cfgparse.sh b/regress/cfgparse.sh
index 55ce3ed5b..de6ff5537 100644
--- a/regress/cfgparse.sh
+++ b/regress/cfgparse.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: cfgparse.sh,v 1.12 2026/07/22 00:37:24 dtucker Exp $
+#	$OpenBSD: cfgparse.sh,v 1.13 2026/10/30 08:12:58 djm Exp $
 #	Placed in the Public Domain.
 
 tid="sshd config parse"
@@ -84,5 +84,14 @@ EOD
  diff -i $OBJ/sshd_config.0 $OBJ/sshd_config.2) || \
  fail "maxstartups idempotence"
 
+# Removal of the entire default algorithm set is an error.
+verbose "remove all algorithms"
+cat > $OBJ/sshd_config.1 <<EOD
+${SSHD_KEYS}
+PubkeyAcceptedAlgorithms -*
+EOD
+$SUDO ${SSHD} -tq -f $OBJ/sshd_config.1 && \
+ fail "pubkeyacceptedalgorithms empty after removal accepted"
+
 # cleanup
 rm -f $OBJ/sshd_config.[012]
diff --git a/regress/sshcfgparse.sh b/regress/sshcfgparse.sh
index d82afcc5c..784e84134 100644
--- a/regress/sshcfgparse.sh
+++ b/regress/sshcfgparse.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: sshcfgparse.sh,v 1.11 2026/10/30 06:41:17 djm Exp $
+#	$OpenBSD: sshcfgparse.sh,v 1.12 2026/10/30 08:12:58 djm Exp $
 #	Placed in the Public Domain.
 
 tid="ssh config parse"
@@ -73,6 +73,9 @@ f=`${SSH} -GF none -opubkeyacceptedalgorithms=-ssh-ed25519 host | \
     awk '/^pubkeyacceptedalgorithms /{print $2}'`
 expect_result_present "$f" "ssh-ed25519-cert-v01.*"
 expect_result_absent "$f" "ssh-ed25519"
+# Removal of the entire default set is an error.
+${SSH} -GF none '-opubkeyacceptedalgorithms=-*' host >/dev/null 2>&1 && \
+	fail "pubkeyacceptedalgorithms empty after removal accepted"
 # Append to default set.
 # This is not tested when built !WITH_OPENSSL
 # XXX need a test for this

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.