EXT_INFO negotiation of hostbound pubkey auth

the EXT_INFO packet gets a new publickey-hostbound@openssh.com to
advertise the hostbound public key method.

Client side support to parse this feature flag and set the kex->flags
indicator if the expected version is offered (currently "0").

ok markus@

diff --git a/usr.bin/ssh/kex.c b/usr.bin/ssh/kex.c
index 3f9c185..d3fe4ad 100644 (file)
--- a/usr.bin/ssh/kex.c
+++ b/usr.bin/ssh/kex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.c,v 1.169 2021/12/19 22:08:06 djm Exp $ */
+/* $OpenBSD: kex.c,v 1.170 2021/12/19 22:13:12 djm Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  *
@@ -421,9 +421,12 @@ kex_send_ext_info(struct ssh *ssh)
                return SSH_ERR_ALLOC_FAIL;
        /* XXX filter algs list by allowed pubkey/hostbased types */
        if ((r = sshpkt_start(ssh, SSH2_MSG_EXT_INFO)) != 0 ||
-           (r = sshpkt_put_u32(ssh, 1)) != 0 ||
+           (r = sshpkt_put_u32(ssh, 2)) != 0 ||
            (r = sshpkt_put_cstring(ssh, "server-sig-algs")) != 0 ||
            (r = sshpkt_put_cstring(ssh, algs)) != 0 ||
+           (r = sshpkt_put_cstring(ssh,
+           "publickey-hostbound@openssh.com")) != 0 ||
+           (r = sshpkt_put_cstring(ssh, "0")) != 0 ||
            (r = sshpkt_send(ssh)) != 0) {
                error_fr(r, "compose");
                goto out;
@@ -483,6 +486,21 @@ kex_input_ext_info(int type, u_int32_t seq, struct ssh *ssh)
                        debug_f("%s=<%s>", name, val);
                        kex->server_sig_algs = val;
                        val = NULL;
+               } else if (strcmp(name,
+                   "publickey-hostbound@openssh.com") == 0) {
+                       /* XXX refactor */
+                       /* Ensure no \0 lurking in value */
+                       if (memchr(val, '\0', vlen) != NULL) {
+                               error_f("nul byte in %s", name);
+                               return SSH_ERR_INVALID_FORMAT;
+                       }
+                       debug_f("%s=<%s>", name, val);
+                       if (strcmp(val, "0") == 0)
+                               kex->flags |= KEX_HAS_PUBKEY_HOSTBOUND;
+                       else {
+                               debug_f("unsupported version of %s extension",
+                                   name);
+                       }
                } else
                        debug_f("%s (unrecognised)", name);
                free(name);