diff options
| author | Jeff Forcier <jeff@bitprophet.org> | 2023-12-15 22:14:48 -0500 |
|---|---|---|
| committer | Jeff Forcier <jeff@bitprophet.org> | 2023-12-15 22:14:48 -0500 |
| commit | be3ffc18cc466e0b0a877d716721353c12561bcc (patch) | |
| tree | d24bc9387a7ddea5c8d88c4882212b09a8fd667e | |
| parent | 352531f803e55e8a5186cd928543279ad1585893 (diff) | |
Make ext-info faux-KexAlgorithm detection more robust
| -rw-r--r-- | paramiko/transport.py | 5 | ||||
| -rw-r--r-- | sites/www/changelog.rst | 3 | ||||
| -rw-r--r-- | tests/test_transport.py | 8 |
3 files changed, 12 insertions, 4 deletions
diff --git a/paramiko/transport.py b/paramiko/transport.py index 8785d6bb..14a26333 100644 --- a/paramiko/transport.py +++ b/paramiko/transport.py @@ -2450,8 +2450,9 @@ class Transport(threading.Thread, ClosingContextManager): # Strip out ext-info "kex algo" self._remote_ext_info = None - if kex_algo_list[-1].startswith("ext-info-"): - self._remote_ext_info = kex_algo_list.pop() + for i, algo in enumerate(kex_algo_list): + if algo.startswith("ext-info-"): + self._remote_ext_info = kex_algo_list.pop(i) # as a server, we pick the first item in the client's list that we # support. diff --git a/sites/www/changelog.rst b/sites/www/changelog.rst index c18890eb..2deb6998 100644 --- a/sites/www/changelog.rst +++ b/sites/www/changelog.rst @@ -2,6 +2,9 @@ Changelog ========= +- :bug:`-` Tweak ``ext-info-(c|s)`` detection during KEXINIT protocol phase; + the original implementation made assumptions based on an OpenSSH + implementation detail. - :release:`3.2.0 <2023-05-25>` - :bug:`- major` Fixed a very sneaky bug found at the apparently rarely-traveled intersection of ``RSA-SHA2`` keys, certificates, SSH agents, diff --git a/tests/test_transport.py b/tests/test_transport.py index b2efd637..421c078b 100644 --- a/tests/test_transport.py +++ b/tests/test_transport.py @@ -1213,10 +1213,14 @@ class TestSHA2SignatureKeyExchange(unittest.TestCase): class TestExtInfo(unittest.TestCase): - def test_ext_info_handshake(self): + def test_ext_info_handshake_exposed_in_client_kexinit(self): with server() as (tc, _): + # NOTE: this is latest KEXINIT /sent by us/ (Transport retains it) kex = tc._get_latest_kex_init() - assert kex["kex_algo_list"][-1] == "ext-info-c" + # flag in KexAlgorithms list + assert "ext-info-c" in kex["kex_algo_list"] + # data stored on Transport after hearing back from a compatible + # server (such as ourselves in server mode) assert tc.server_extensions == { "server-sig-algs": b"ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss" # noqa } |