upstream: Request RSA-SHA2 signatures for

rsa-sha2-{256|512}[email protected] cert algorithms; ok markus@

OpenBSD-Commit-ID: afc6f7ca216ccd821656d1c911d2a3deed685033

authfd.c

@@ -327,10 +327,12 @@ ssh_free_identitylist(struct ssh_identitylist *idl)
 static u_int
 agent_encode_alg(const struct sshkey *key, const char *alg)
 {
-	if (alg != NULL && key->type == KEY_RSA) {
-		if (strcmp(alg, "rsa-sha2-256") == 0)
+	if (alg != NULL && sshkey_type_plain(key->type) == KEY_RSA) {
+		if (strcmp(alg, "rsa-sha2-256") == 0 ||
+		    strcmp(alg, "[email protected]") == 0)
 			return SSH_AGENT_RSA_SHA2_256;
-		else if (strcmp(alg, "rsa-sha2-512") == 0)
+		if (strcmp(alg, "rsa-sha2-512") == 0 ||
+		    strcmp(alg, "[email protected]") == 0)
 			return SSH_AGENT_RSA_SHA2_512;
 	}
 	return 0;

configure.ac

@@ -2616,7 +2616,7 @@ if test "x$openssl" = "xyes" ; then
 				AC_MSG_ERROR([OpenSSL >= 1.0.1 required (have "$ssl_library_ver")])
 		                ;;
 			100*)   ;; # 1.0.x
-			101000[0123456]*)
+			101000[[0123456]]*)
 				# https://github.com/openssl/openssl/pull/4613
 				AC_MSG_ERROR([OpenSSL 1.1.x versions prior to 1.1.0g have a bug that breaks their use with OpenSSH (have "$ssl_library_ver")])
 				;;
@@ -2850,7 +2850,7 @@ if test "x$openssl" = "xyes" ; then
 		[AC_DEFINE([HAVE_EVP_CIPHER_CTX_GET_IV], [1],
 		    [Define if libcrypto has EVP_CIPHER_CTX_get_iv])])
 	AC_SEARCH_LIBS([EVP_CIPHER_CTX_set_iv], [crypto],
-		[AC_DEFINE([HAVE_EVP_CIPHER_CTX_GET_IV], [1],
+		[AC_DEFINE([HAVE_EVP_CIPHER_CTX_SET_IV], [1],
 		    [Define if libcrypto has EVP_CIPHER_CTX_set_iv])])
 
 	AC_SEARCH_LIBS([RSA_get0_crt_params], [crypto],

contrib/cygwin/ssh-host-config

@@ -307,7 +307,7 @@ check_service_files_ownership() {
 
   if [ -z "${run_service_as}" ]
   then
-    accnt_name=$(/usr/bin/cygrunsrv -VQ sshd |
+    accnt_name=$(/usr/bin/cygrunsrv -VQ "${service_name}" |
     		 /usr/bin/sed -ne 's/^Account *: *//gp')
     if [ "${accnt_name}" = "LocalSystem" ]
     then

monitor.c

@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.186 2018/07/20 03:46:34 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.188 2018/11/16 02:43:56 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -846,6 +846,35 @@ mm_answer_authserv(int sock, struct sshbuf *m)
 	return (0);
 }
 
+/*
+ * Check that the key type appears in the supplied pattern list, ignoring
+ * mismatches in the signature algorithm. (Signature algorithm checks are
+ * performed in the unprivileged authentication code).
+ * Returns 1 on success, 0 otherwise.
+ */
+static int
+key_base_type_match(const char *method, const struct sshkey *key,
+    const char *list)
+{
+	char *s, *l, *ol = xstrdup(list);
+	int found = 0;
+
+	l = ol;
+	for ((s = strsep(&l, ",")); s && *s != '\0'; (s = strsep(&l, ","))) {
+		if (sshkey_type_from_name(s) == key->type) {
+			found = 1;
+			break;
+		}
+	}
+	if (!found) {
+		error("%s key type %s is not in permitted list %s", method,
+		    sshkey_ssh_name(key), list);
+	}
+
+	free(ol);
+	return found;
+}
+
 int
 mm_answer_authpassword(int sock, struct sshbuf *m)
 {
@@ -1151,8 +1180,8 @@ mm_answer_keyallowed(int sock, struct sshbuf *m)
 				break;
 			if (auth2_key_already_used(authctxt, key))
 				break;
-			if (match_pattern_list(sshkey_ssh_name(key),
-			    options.pubkey_key_types, 0) != 1)
+			if (!key_base_type_match(auth_method, key,
+			    options.pubkey_key_types))
 				break;
 			allowed = user_key_allowed(ssh, authctxt->pw, key,
 			    pubkey_auth_attempt, &opts);
@@ -1163,8 +1192,8 @@ mm_answer_keyallowed(int sock, struct sshbuf *m)
 				break;
 			if (auth2_key_already_used(authctxt, key))
 				break;
-			if (match_pattern_list(sshkey_ssh_name(key),
-			    options.hostbased_key_types, 0) != 1)
+			if (!key_base_type_match(auth_method, key,
+			    options.hostbased_key_types))
 				break;
 			allowed = hostbased_key_allowed(authctxt->pw,
 			    cuser, chost, key);

openbsd-compat/openssl-compat.c

@@ -76,7 +76,7 @@ ssh_OpenSSL_add_all_algorithms(void)
 	ENGINE_load_builtin_engines();
 	ENGINE_register_all_complete();
 
-#if OPENSSL_VERSION_NUMBER < 0x10001000L
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	OPENSSL_config(NULL);
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS |

ssh-keysign.c

@@ -40,6 +40,7 @@
 #include <openssl/evp.h>
 #include <openssl/rand.h>
 #include <openssl/rsa.h>
+#include "openbsd-compat/openssl-compat.h"
 #endif
 
 #include "xmalloc.h"

ssh_api.c

@@ -29,6 +29,8 @@
 #include "ssherr.h"
 #include "sshbuf.h"
 
+#include "openbsd-compat/openssl-compat.h"
+
 #include <string.h>
 
 int	_ssh_exchange_banner(struct ssh *);