upstream: Move check of public key type against allowed algorithms

to before parsing of the key sent by the peer.

This removes at least some key parsing and verification paths from
the pre-auth attack surface.

Suggested by Christopher Paul Rohlf of Anthropic, ok deraadt@

OpenBSD-Commit-ID: 4560b53b5cd2fe9b875436e48995a1829c2a9dea

diff --git a/auth2-hostbased.c b/auth2-hostbased.c
index 8a1acdec3f7ca3a9f020e2c852bcd3f7a5104123..564a8d3cc823177f6ce38ca8eb631d83fef8399d 100644 (file)
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-hostbased.c,v 1.57 2026/04/02 07:48:13 djm Exp $ */
+/* $OpenBSD: auth2-hostbased.c,v 1.58 2026/07/30 03:37:39 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -88,6 +88,12 @@ userauth_hostbased(struct ssh *ssh, const char *method)
                    pkalg);
                goto done;
        }
+       if (match_pattern_list(pkalg,
+           options.hostbased_accepted_algos, 0) != 1) {
+               logit_f("signature algorithm %s not in "
+                   "HostbasedAcceptedAlgorithms", pkalg);
+               goto done;
+       }
        if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
                error_fr(r, "key_from_blob");
                goto done;
@@ -102,11 +108,6 @@ userauth_hostbased(struct ssh *ssh, const char *method)
                    "(received %s, expected %s)", sshkey_ssh_name(key), pkalg);
                goto done;
        }
-       if (match_pattern_list(pkalg, options.hostbased_accepted_algos, 0) != 1) {
-               logit_f("signature algorithm %s not in "
-                   "HostbasedAcceptedAlgorithms", pkalg);
-               goto done;
-       }
        if ((r = sshkey_check_cert_sigtype(key,
            options.ca_sign_algorithms)) != 0) {
                logit_fr(r, "certificate signature algorithm %s",

diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index e446ef4122b263c6f30fffd8eaaf7f0929e0bfbd..c15b1ba713549176749a9eff9f0cdb0450f994c4 100644 (file)
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.126 2026/04/02 07:48:13 djm Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.127 2026/07/30 03:37:39 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2010 Damien Miller.  All rights reserved.
@@ -140,6 +140,11 @@ userauth_pubkey(struct ssh *ssh, const char *method)
                verbose_f("unsupported public key algorithm: %s", pkalg);
                goto done;
        }
+       if (match_pattern_list(pkalg, options.pubkey_accepted_algos, 0) != 1) {
+               logit_f("signature algorithm %s not in "
+                   "PubkeyAcceptedAlgorithms", pkalg);
+               goto done;
+       }
        if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
                error_fr(r, "parse key");
                goto done;
@@ -158,11 +163,6 @@ userauth_pubkey(struct ssh *ssh, const char *method)
                logit("refusing previously-used %s key", sshkey_type(key));
                goto done;
        }
-       if (match_pattern_list(pkalg, options.pubkey_accepted_algos, 0) != 1) {
-               logit_f("signature algorithm %s not in "
-                   "PubkeyAcceptedAlgorithms", pkalg);
-               goto done;
-       }
        if ((r = sshkey_check_cert_sigtype(key,
            options.ca_sign_algorithms)) != 0) {
                logit_fr(r, "certificate signature algorithm %s",