pyrox.dev
ssh: Fix support for ssh-dss host keys
+1
nixos/modules/programs/ssh.nix
+1
nixos/modules/programs/ssh.nix
+3
-1
pkgs/tools/networking/openssh/default.nix
+3
-1
pkgs/tools/networking/openssh/default.nix
+52
pkgs/tools/networking/openssh/fix-host-key-algorithms-plus.patch
+52
pkgs/tools/networking/openssh/fix-host-key-algorithms-plus.patch
···
1
+
Specifying "HostKeyAlgorithms +ssh-dds" does not work properly because
2
+
setting any value for HostKeyAlgorithms causes the known host keys to
3
+
be ignored for the purpose of determining the priority of algorithms.
4
+
This was fixed upstream for HostKeyAlgorithms in sshd_config, but not
5
+
in ssh_config. The fix is to apply order_hostkeyalgs() if the user
6
+
specifies a HostKeyAlgorithms starting with "+".
7
+
8
+
diff -ru -x '*~' openssh-7.2p2-orig/sshconnect2.c openssh-7.2p2/sshconnect2.c
9
+
--- openssh-7.2p2-orig/sshconnect2.c 2016-03-09 19:04:48.000000000 +0100
10
+
+++ openssh-7.2p2/sshconnect2.c 2016-04-01 15:39:45.140945902 +0200
11
+
@@ -100,7 +100,7 @@
12
+
}
13
+
14
+
static char *
15
+
-order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port)
16
+
+order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port, char *algs)
17
+
{
18
+
char *oavail, *avail, *first, *last, *alg, *hostname, *ret;
19
+
size_t maxlen;
20
+
@@ -116,7 +116,7 @@
21
+
for (i = 0; i < options.num_system_hostfiles; i++)
22
+
load_hostkeys(hostkeys, hostname, options.system_hostfiles[i]);
23
+
24
+
- oavail = avail = xstrdup(KEX_DEFAULT_PK_ALG);
25
+
+ oavail = avail = xstrdup(algs);
26
+
maxlen = strlen(avail) + 1;
27
+
first = xmalloc(maxlen);
28
+
last = xmalloc(maxlen);
29
+
@@ -181,18 +181,21 @@
30
+
myproposal[PROPOSAL_MAC_ALGS_CTOS] =
31
+
myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
32
+
if (options.hostkeyalgorithms != NULL) {
33
+
+ int append = options.hostkeyalgorithms[0] == '+';
34
+
if (kex_assemble_names(KEX_DEFAULT_PK_ALG,
35
+
&options.hostkeyalgorithms) != 0)
36
+
fatal("%s: kex_assemble_namelist", __func__);
37
+
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
38
+
- compat_pkalg_proposal(options.hostkeyalgorithms);
39
+
+ compat_pkalg_proposal(append
40
+
+ ? order_hostkeyalgs(host, hostaddr, port, options.hostkeyalgorithms)
41
+
+ : options.hostkeyalgorithms);
42
+
} else {
43
+
/* Enforce default */
44
+
options.hostkeyalgorithms = xstrdup(KEX_DEFAULT_PK_ALG);
45
+
/* Prefer algorithms that we already have keys for */
46
+
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
47
+
compat_pkalg_proposal(
48
+
- order_hostkeyalgs(host, hostaddr, port));
49
+
+ order_hostkeyalgs(host, hostaddr, port, KEX_DEFAULT_PK_ALG));
50
+
}
51
+
52
+
if (options.rekey_limit || options.rekey_interval)