upstream commit

unbreak hostkey rotation; attempting to sign with a
desired signature algorithm of kex->hostkey_alg is incorrect when the key
type isn't capable of making those signatures. ok markus@

OpenBSD-Commit-ID: 35ae46864e1f5859831ec0d115ee5ea50953a906

1 files changed, 11 insertions, 3 deletions

diff --git a/serverloop.c b/serverloop.c
index fb2980568..615921c38 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: serverloop.c,v 1.201 2017/12/18 02:25:15 djm Exp $ */
+/* $OpenBSD: serverloop.c,v 1.202 2017/12/18 23:16:24 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -671,7 +671,7 @@ server_input_hostkeys_prove(struct ssh *ssh, struct sshbuf **respp)
         struct sshbuf *resp = NULL;
         struct sshbuf *sigbuf = NULL;
         struct sshkey *key = NULL, *key_pub = NULL, *key_prv = NULL;
-        int r, ndx, success = 0;
+        int r, ndx, kexsigtype, use_kexsigtype, success = 0;
         const u_char *blob;
         u_char *sig = 0;
         size_t blen, slen;
@@ -679,6 +679,8 @@ server_input_hostkeys_prove(struct ssh *ssh, struct sshbuf **respp)
         if ((resp = sshbuf_new()) == NULL || (sigbuf = sshbuf_new()) == NULL)
                 fatal("%s: sshbuf_new", __func__);
 
+        kexsigtype = sshkey_type_plain(
+            sshkey_type_from_name(ssh->kex->hostkey_alg));
         while (ssh_packet_remaining(ssh) > 0) {
                 sshkey_free(key);
                 key = NULL;
@@ -709,6 +711,12 @@ server_input_hostkeys_prove(struct ssh *ssh, struct sshbuf **respp)
                 sshbuf_reset(sigbuf);
                 free(sig);
                 sig = NULL;
+                /*
+                 * For RSA keys, prefer to use the signature type negotiated
+                 * during KEX to the default (SHA1).
+                 */
+                use_kexsigtype = kexsigtype == KEY_RSA &&
+                    sshkey_type_plain(key->type) == KEY_RSA;
                 if ((r = sshbuf_put_cstring(sigbuf,
                     "hostkeys-prove-00@openssh.com")) != 0 ||
                     (r = sshbuf_put_string(sigbuf,
@@ -716,7 +724,7 @@ server_input_hostkeys_prove(struct ssh *ssh, struct sshbuf **respp)
                     (r = sshkey_puts(key, sigbuf)) != 0 ||
                     (r = ssh->kex->sign(key_prv, key_pub, &sig, &slen,
                     sshbuf_ptr(sigbuf), sshbuf_len(sigbuf),
-                    ssh->kex->hostkey_alg, 0)) != 0 ||
+                    use_kexsigtype ? ssh->kex->hostkey_alg : NULL, 0)) != 0 ||
                     (r = sshbuf_put_string(resp, sig, slen)) != 0) {
                         error("%s: couldn't prepare signature: %s",
                             __func__, ssh_err(r));