hostkeyalgos.go

package transport

import (

	"errors"

	"net"

	xssh "golang.org/x/crypto/ssh"

	"golang.org/x/crypto/ssh/knownhosts"

)

// Why this file exists

//

// x/crypto/ssh negotiates the host key algorithm from ClientConfig.

// HostKeyAlgorithms; left empty, the client advertises its own default

// preference and the server picks from that. knownhosts then checks whatever

// key came back against known_hosts — and if the file holds a key for the host

// but not in the negotiated algorithm, the result is a *mismatch*, not a

// fallback to an algorithm we do have.

//

// That is the difference between OpenSSH and a naive Go client. OpenSSH orders

// HostKeyAlgorithms by what known_hosts already has for the host, so it asks for

// the key it can verify. A Go client that skips this connects fine to a host

// whose known_hosts entry happens to match the negotiated algorithm and reports

// a bogus "key mismatch" for one that does not — the same file, the same server,

// verdict decided by which key type was recorded first.

//

// Seen on a fresh Arch host offering ssh-rsa + ecdsa + ed25519 whose known_hosts

// entry was ed25519-only: Go negotiated ecdsa and the dial failed with

// "knownhosts: key mismatch" even though the recorded key was correct and

// unchanged. Other hosts in the same file worked purely because all three of

// their key types had been recorded.

//

// x/crypto/ssh/knownhosts exposes no helper for this (github.com/skeema/knownhosts

// exists precisely to fill the gap), but KeyError.Want carries the known keys for

// the host — so probing the callback with a key the file cannot contain hands

// back exactly the list we need, with no new dependency and no second parser to

// keep in sync with OpenSSH's hashed-hostname format.

// probeKey is a non-certificate public key of a type no known_hosts file can

// contain, so the knownhosts callback always reports a mismatch and populates

// KeyError.Want with the host's recorded keys. It is never sent to a server.

type probeKey struct{}

func (probeKey) Type() string                         { return "legatus-probe" }

func (probeKey) Marshal() []byte                      { return []byte("legatus-probe") }

func (probeKey) Verify([]byte, *xssh.Signature) error { return errors.New("probe key cannot verify") }

// hostKeyAlgosFor returns the host key algorithms recorded in known_hosts for

// addr ("host:port"), in the order they appear, or nil when the host is unknown

// (nil leaves ClientConfig.HostKeyAlgorithms empty, i.e. the library default —

// an unknown host must still fail the callback, not fail to negotiate).

func hostKeyAlgosFor(cb xssh.HostKeyCallback, addr string) []string {

	if cb == nil {

		return nil

	}

	// A dummy remote: the knownhosts callback prefers the address argument and

	// only falls back to remote when it is empty, so this is never consulted.

	remote := &net.TCPAddr{IP: net.IPv4zero, Port: 0}

	err := cb(addr, remote, probeKey{})

	var ke *knownhosts.KeyError

	if !errors.As(err, &ke) || len(ke.Want) == 0 {

		// Unknown host, or a non-knownhosts callback (InsecureIgnoreHostKey, a

		// test double). Either way we have nothing to prefer.

		return nil

	}

	var algos []string

	seen := map[string]bool{}

	add := func(a string) {

		if !seen[a] {

			seen[a] = true

			algos = append(algos, a)

		}

	}

	for _, k := range ke.Want {

		switch t := k.Key.Type(); t {

		case xssh.KeyAlgoRSA:

			// known_hosts records an RSA key as "ssh-rsa" — that is the key

			// format, not the signature algorithm. Modern servers sign with

			// rsa-sha2-*, and SHA-1 ssh-rsa is disabled by default on current

			// OpenSSH, so advertising only "ssh-rsa" would fail to negotiate

			// against exactly the hosts that matter. Offer the SHA-2 variants

			// first and keep ssh-rsa last for ancient servers.

			add(xssh.KeyAlgoRSASHA512)

			add(xssh.KeyAlgoRSASHA256)

			add(xssh.KeyAlgoRSA)

		default:

			add(t)

		}

	}

	return algos

}