SSHClient: adjust Transport preferred host key types if known host

If we have a host keys that will be checked, we need to
negotiate for the type we have. Commonly, openssh could
have saved an ecdsa key in known_hosts, but SSHClient will
let the Transport negotiate for an rsa key.

Then it would consider a key of a non-corresponding type to be "missing".
That situation is also now a BadHostKeyException.

Before this change, a man-in-the-middle attack on the paramiko ssh
client was possible by having only a host key type which differs from
what the client has in known_hosts (and then giving any key of that type).

0 files changed, 0 insertions, 0 deletions