Skip to content

Commit

Permalink
Apply less restrictive signature key algorithm check
Browse files Browse the repository at this point in the history
Addresses same issue as golang/go#56342
  • Loading branch information
tobischo committed Jun 15, 2023
1 parent 8e447d8 commit a878079
Showing 1 changed file with 6 additions and 1 deletion.
7 changes: 6 additions & 1 deletion ssh/client_auth.go
Original file line number Diff line number Diff line change
Expand Up @@ -371,7 +371,12 @@ func confirmKeyAck(key PublicKey, algo string, c packetConn) (bool, error) {
if err := Unmarshal(packet, &msg); err != nil {
return false, err
}
if msg.Algo != algo || !bytes.Equal(msg.PubKey, pubKey) {
// if msg.Algo != algo || !bytes.Equal(msg.PubKey, pubKey) {
// Some SSH servers do not respond with the approviate given algorithm that
// was selected based on the server-sig-algs.
// We therefore want to accept any algorithm that is acceptable to us.
keyAlgos := algorithmsForKeyFormat(key.Type())
if !contains(keyAlgos, msg.Algo) || !bytes.Equal(msg.PubKey, pubKey) {
return false, nil
}
return true, nil
Expand Down

0 comments on commit a878079

Please sign in to comment.