dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: Move check of public key type against allowed algorithms

Browse Source 
to before parsing of the key sent by the peer.

This removes at least some key parsing and verification paths from
the pre-auth attack surface.

Suggested by Christopher Paul Rohlf of Anthropic, ok deraadt@

OpenBSD-Commit-ID: 4560b53b5cd2fe9b875436e48995a1829c2a9dea
This commit is contained in:
djm@openbsd.org authored and Damien Miller committed 2026-07-30 13:49:43 +10:00
1 parent 05000bc5ea
commit 52154c2d23
2 files changed
+13 -12
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

auth2-hostbased.c
+7 -6
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: auth2-hostbased.c,v 1.57 2026/04/02 07:48:13 djm Exp $ */
/* $OpenBSD: auth2-hostbased.c,v 1.58 2026/07/30 03:37:39 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -88,6 +88,12 @@ userauth_hostbased(struct ssh *ssh, const char *method)
pkalg);
goto done;
}
if (match_pattern_list(pkalg,
options.hostbased_accepted_algos, 0) != 1) {
logit_f("signature algorithm %s not in "
"HostbasedAcceptedAlgorithms", pkalg);
goto done;
}
if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
error_fr(r, "key_from_blob");
goto done;
@@ -102,11 +108,6 @@ userauth_hostbased(struct ssh *ssh, const char *method)
"(received %s, expected %s)", sshkey_ssh_name(key), pkalg);
goto done;
}
if (match_pattern_list(pkalg, options.hostbased_accepted_algos, 0) != 1) {
logit_f("signature algorithm %s not in "
"HostbasedAcceptedAlgorithms", pkalg);
goto done;
}
if ((r = sshkey_check_cert_sigtype(key,
options.ca_sign_algorithms)) != 0) {
logit_fr(r, "certificate signature algorithm %s",
auth2-pubkey.c
+6 -6
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: auth2-pubkey.c,v 1.126 2026/04/02 07:48:13 djm Exp $ */
/* $OpenBSD: auth2-pubkey.c,v 1.127 2026/07/30 03:37:39 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@@ -140,6 +140,11 @@ userauth_pubkey(struct ssh *ssh, const char *method)
verbose_f("unsupported public key algorithm: %s", pkalg);
goto done;
}
if (match_pattern_list(pkalg, options.pubkey_accepted_algos, 0) != 1) {
logit_f("signature algorithm %s not in "
"PubkeyAcceptedAlgorithms", pkalg);
goto done;
}
if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
error_fr(r, "parse key");
goto done;
@@ -158,11 +163,6 @@ userauth_pubkey(struct ssh *ssh, const char *method)
logit("refusing previously-used %s key", sshkey_type(key));
goto done;
}
if (match_pattern_list(pkalg, options.pubkey_accepted_algos, 0) != 1) {
logit_f("signature algorithm %s not in "
"PubkeyAcceptedAlgorithms", pkalg);
goto done;
}
if ((r = sshkey_check_cert_sigtype(key,
options.ca_sign_algorithms)) != 0) {
logit_fr(r, "certificate signature algorithm %s",