Attachment #3476 for bug #3213

Lines 63-73 compat_banner(struct ssh ssh, const char version) Link Here

(-)a/compat.c (-1 / +2 lines)
63	{ "OpenSSH_6.5*,"	63	{ "OpenSSH_6.5*,"
64	"OpenSSH_6.6*", SSH_NEW_OPENSSH\|SSH_BUG_CURVE25519PAD\|	64	"OpenSSH_6.6*", SSH_NEW_OPENSSH\|SSH_BUG_CURVE25519PAD\|
65	SSH_BUG_SIGTYPE},	65	SSH_BUG_SIGTYPE},
		66	{ "OpenSSH_7.4*", SSH_NEW_OPENSSH\|SSH_BUG_SIGTYPE\|
		67	SSH_BUG_SIGTYPE74},
66	{ "OpenSSH_7.0*,"	68	{ "OpenSSH_7.0*,"
67	"OpenSSH_7.1*,"	69	"OpenSSH_7.1*,"
68	"OpenSSH_7.2*,"	70	"OpenSSH_7.2*,"
69	"OpenSSH_7.3*,"	71	"OpenSSH_7.3*,"
70	"OpenSSH_7.4*,"
71	"OpenSSH_7.5*,"	72	"OpenSSH_7.5*,"
72	"OpenSSH_7.6*,"	73	"OpenSSH_7.6*,"
73	"OpenSSH_7.7*", SSH_NEW_OPENSSH\|SSH_BUG_SIGTYPE},	74	"OpenSSH_7.7*", SSH_NEW_OPENSSH\|SSH_BUG_SIGTYPE},

Lines 29-35 Link Here

(-)a/compat.h (-1 / +1 lines)
29		29
30	#define SSH_BUG_UTF8TTYMODE 0x00000001	30	#define SSH_BUG_UTF8TTYMODE 0x00000001
31	#define SSH_BUG_SIGTYPE 0x00000002	31	#define SSH_BUG_SIGTYPE 0x00000002
32	/* #define unused 0x00000004 */	32	#define SSH_BUG_SIGTYPE74 0x00000004
33	/* #define unused 0x00000008 */	33	/* #define unused 0x00000008 */
34	#define SSH_OLD_SESSIONID 0x00000010	34	#define SSH_OLD_SESSIONID 0x00000010
35	/* #define unused 0x00000020 */	35	/* #define unused 0x00000020 */




	return r;
}

/*
 * OpenSSH 7.4 supports SHA2 sig types, but fails to indicate its
 * support.  For that release, check the local policy against the
 * SHA2 signature types.
 */
static char *
key_sig_algorithm_compat(struct ssh *ssh, const struct sshkey *key)
{
	char *allowed, *oallowed, *cp, *tmp, *alg = NULL;
	if ((key->type == KEY_RSA && (ssh->compat & SSH_BUG_SIGTYPE74))) {
		oallowed = allowed = xstrdup(options.pubkey_accepted_algos);
		while ((cp = strsep(&allowed, ",")) != NULL) {
			if (sshkey_type_from_name(cp) != key->type)
				continue;
			tmp = match_list(sshkey_sigalg_by_name(cp),
			    "rsa-sha2-256,rsa-sha2-512", NULL);
			if (tmp != NULL)
				alg = xstrdup(cp);
			free(tmp);
			if (alg != NULL)
				break;
		}
		free(oallowed);
	}
	return alg;
}

/*
 * Select an algorithm for publickey signatures.
 * Returns algorithm (caller must free) or NULL if no mutual algorithm found.

			break;
	}
	free(oallowed);
	if (alg == NULL)
		alg = key_sig_algorithm_compat(ssh, key);
	return alg;
}


Return to bug 3213

Lines 1164-1169 input_userauth_passwd_changereq(int type, u_int32_t seqnr, struct ssh *ssh) Link Here

(-)a/sshconnect2.c (+29 lines)
1164	return r;	1164	return r;
1165	}	1165	}
1166		1166
		1167	/*
		1168	* OpenSSH 7.4 supports SHA2 sig types, but fails to indicate its
		1169	* support. For that release, check the local policy against the
		1170	* SHA2 signature types.
		1171	*/
		1172	static char *
		1173	key_sig_algorithm_compat(struct ssh ssh, const struct sshkey key)
		1174	{
		1175	char allowed, oallowed, cp, tmp, *alg = NULL;
		1176	if ((key->type == KEY_RSA && (ssh->compat & SSH_BUG_SIGTYPE74))) {
		1177	oallowed = allowed = xstrdup(options.pubkey_accepted_algos);
		1178	while ((cp = strsep(&allowed, ",")) != NULL) {
		1179	if (sshkey_type_from_name(cp) != key->type)
		1180	continue;
		1181	tmp = match_list(sshkey_sigalg_by_name(cp),
		1182	"rsa-sha2-256,rsa-sha2-512", NULL);
		1183	if (tmp != NULL)
		1184	alg = xstrdup(cp);
		1185	free(tmp);
		1186	if (alg != NULL)
		1187	break;
		1188	}
		1189	free(oallowed);
		1190	}
		1191	return alg;
		1192	}
		1193
1167	/*	1194	/*
1168	* Select an algorithm for publickey signatures.	1195	* Select an algorithm for publickey signatures.
1169	* Returns algorithm (caller must free) or NULL if no mutual algorithm found.	1196	* Returns algorithm (caller must free) or NULL if no mutual algorithm found.
Lines 1208-1213 key_sig_algorithm(struct ssh ssh, const struct sshkey key) Link Here
1208	break;	1235	break;
1209	}	1236	}
1210	free(oallowed);	1237	free(oallowed);
		1238	if (alg == NULL)
		1239	alg = key_sig_algorithm_compat(ssh, key);
1211	return alg;	1240	return alg;
1212	}	1241	}
1213		1242