upstream commit

unbreak hostkey rotation; attempting to sign with a
desired signature algorithm of kex->hostkey_alg is incorrect when the key
type isn't capable of making those signatures. ok markus@

OpenBSD-Commit-ID: 35ae46864e1f5859831ec0d115ee5ea50953a906

1 files changed, 12 insertions, 3 deletions

diff --git a/clientloop.c b/clientloop.c
index 3ce5d930e..c187ae570 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.308 2017/12/18 02:25:15 djm Exp $ */
+/* $OpenBSD: clientloop.c,v 1.309 2017/12/18 23:16:23 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1893,7 +1893,7 @@ client_global_hostkeys_private_confirm(struct ssh *ssh, int type,
         struct hostkeys_update_ctx *ctx = (struct hostkeys_update_ctx *)_ctx;
         size_t i, ndone;
         struct sshbuf *signdata;
-        int r;
+        int r, kexsigtype, use_kexsigtype;
         const u_char *sig;
         size_t siglen;
 
@@ -1905,6 +1905,9 @@ client_global_hostkeys_private_confirm(struct ssh *ssh, int type,
                 hostkeys_update_ctx_free(ctx);
                 return;
         }
+        kexsigtype = sshkey_type_plain(
+            sshkey_type_from_name(ssh->kex->hostkey_alg));
+
         if ((signdata = sshbuf_new()) == NULL)
                 fatal("%s: sshbuf_new failed", __func__);
         /* Don't want to accidentally accept an unbound signature */
@@ -1933,9 +1936,15 @@ client_global_hostkeys_private_confirm(struct ssh *ssh, int type,
                             __func__, ssh_err(r));
                         goto out;
                 }
+                /*
+                 * For RSA keys, prefer to use the signature type negotiated
+                 * during KEX to the default (SHA1).
+                 */
+                use_kexsigtype = kexsigtype == KEY_RSA &&
+                    sshkey_type_plain(ctx->keys[i]->type) == KEY_RSA;
                 if ((r = sshkey_verify(ctx->keys[i], sig, siglen,
                     sshbuf_ptr(signdata), sshbuf_len(signdata),
-                    ssh->kex->hostkey_alg, 0)) != 0) {
+                    use_kexsigtype ? ssh->kex->hostkey_alg : NULL, 0)) != 0) {
                         error("%s: server gave bad signature for %s key %zu",
                             __func__, sshkey_type(ctx->keys[i]), i);
                         goto out;