diff options
| author |   djm <djm@openbsd.org> | 2020-05-13 09:52:41 +0000 |
|---|---|---|
| committer | djm <djm@openbsd.org> | 2020-05-13 09:52:41 +0000 |
| commit | 4a96427138e53b7e9b022aeacebc338f7a5571d8 (patch) | |
| tree | b5b5225787c7fb2c12ffdebe911385561cade274 /usr.bin/ssh/sshconnect2.c | |
| parent | Kill biospoll/pctrpoll defines and use `seltrue' directly in cdev_*_init(). (diff) | |
| download | wireguard-openbsd-4a96427138e53b7e9b022aeacebc338f7a5571d8.tar.xz wireguard-openbsd-4a96427138e53b7e9b022aeacebc338f7a5571d8.zip | |
when ordering the hostkey algorithms to request from a server,
prefer certificate types if the known_hosts files contain a key
marked as a @cert-authority; bz#3157 ok markus@
Diffstat (limited to 'usr.bin/ssh/sshconnect2.c')
| -rw-r--r-- | usr.bin/ssh/sshconnect2.c | 20 |
1 files changed, 16 insertions, 4 deletions
diff --git a/usr.bin/ssh/sshconnect2.c b/usr.bin/ssh/sshconnect2.c index ad45598d620..1f3d2364fc2 100644 --- a/usr.bin/ssh/sshconnect2.c +++ b/usr.bin/ssh/sshconnect2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect2.c,v 1.321 2020/04/17 03:38:47 djm Exp $ */ +/* $OpenBSD: sshconnect2.c,v 1.322 2020/05/13 09:52:41 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved. @@ -130,11 +130,23 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port) while ((alg = strsep(&avail, ",")) && *alg != '\0') { if ((ktype = sshkey_type_from_name(alg)) == KEY_UNSPEC) fatal("%s: unknown alg %s", __func__, alg); + /* + * If we have a @cert-authority marker in known_hosts then + * prefer all certificate algorithms. + */ + if (sshkey_type_is_cert(ktype) && + lookup_marker_in_hostkeys(hostkeys, MRK_CA)) { + ALG_APPEND(first, alg); + continue; + } + /* If the key appears in known_hosts then prefer it */ if (lookup_key_in_hostkeys_by_type(hostkeys, - sshkey_type_plain(ktype), NULL)) + sshkey_type_plain(ktype), NULL)) { ALG_APPEND(first, alg); - else - ALG_APPEND(last, alg); + continue; + } + /* Otherwise, put it last */ + ALG_APPEND(last, alg); } #undef ALG_APPEND xasprintf(&ret, "%s%s%s", first, |