From nobody Sun May 5 07:01:10 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1624447916; cv=none; d=zohomail.com; s=zohoarc; b=NBc9oszCKzgtKQRPEKNUPieKSWwE/bWWE+jXapjBTeZDaJngH8atXD5zHAgx6MaS6wZ74wT0iXSaTT+LC9wWttFuwcaQtZ3mAvSnqEr5CFsRK0AXPQh31HBp8xLHBepw5qupoQuwypK+mKISGRD6F/S4FD5PS9TkIgK8btT2srI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1624447916; h=Content-Type:Content-Transfer-Encoding:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=4Yu7V/IfN03DrGDxcbEyrP62YVYkrt7Bml8JxedSob0=; b=Mr+aRU8lu7jjqYIcowMUxRuGk1HTPtmFfxoK2Pb2xsbyKMl4P9Ofu4p9YaVygI6cFoPbNb6qEHeteN255aTRR84A0jU0Kn2JM7uKZDqpV41vVVQ2PjX8X9aMWzMJrAv6bgVCGy+rdxYQJchXC9CiL4ty/bqGW7AIOogRZd115Zs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 162444791615364.14597116411392; Wed, 23 Jun 2021 04:31:56 -0700 (PDT) Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-486-VGps7UqjNX6D45YjabStpQ-1; Wed, 23 Jun 2021 07:31:52 -0400 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id A90061084F4C; Wed, 23 Jun 2021 11:31:47 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id CF032608BA; Wed, 23 Jun 2021 11:31:46 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 435084EA2A; Wed, 23 Jun 2021 11:31:45 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 15NBVhc8027612 for ; Wed, 23 Jun 2021 07:31:43 -0400 Received: by smtp.corp.redhat.com (Postfix) id C286E60CC9; Wed, 23 Jun 2021 11:31:43 +0000 (UTC) Received: from localhost.localdomain.com (ovpn-114-176.ams2.redhat.com [10.36.114.176]) by smtp.corp.redhat.com (Postfix) with ESMTP id C3E5660C13; Wed, 23 Jun 2021 11:31:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1624447915; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=4Yu7V/IfN03DrGDxcbEyrP62YVYkrt7Bml8JxedSob0=; b=cxu7g4YuA9c3wbg9ayaAXgFs7cVJXAheqIutJ4iIDj8Tr/Ofn+FHXkas07v+isB8cJ+MS3 wwftPeTwxxxTKkXXHkzP9XD6bfUNez+CPkcfx6FCK8LWj5TjGFZrq2OewGkiSf/KMuI5sR lEdOxdgyHLgII2qs3donpxogwJdmwBs= X-MC-Unique: VGps7UqjNX6D45YjabStpQ-1 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: libvir-list@redhat.com Subject: [PATCH] rpc: prefer SHA256 host key fingerprint with new libssh Date: Wed, 23 Jun 2021 12:31:37 +0100 Message-Id: <20210623113137.293615-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-loop: libvir-list@redhat.com X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) The host key fingerprint for SSH servers is used in a scenario where cryptographic strength is important. We should thus be defaulting to use of SHA256 where available. We only need SHA1 for Ubuntu 18.04 which does not have libssh >=3D 0.8.1 Signed-off-by: Daniel P. Berrang=C3=A9 Reviewed-by: Pavel Hrdina --- src/rpc/virnetlibsshsession.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/rpc/virnetlibsshsession.c b/src/rpc/virnetlibsshsession.c index 50ace5f41d..22d54c99be 100644 --- a/src/rpc/virnetlibsshsession.c +++ b/src/rpc/virnetlibsshsession.c @@ -39,6 +39,12 @@ VIR_LOG_INIT("rpc.netlibsshsession"); =20 #define VIR_NET_LIBSSH_BUFFER_SIZE 1024 =20 +#if LIBSSH_VERSION_INT < SSH_VERSION_INT(0, 8, 1) +# define VIR_SSH_HOSTKEY_HASH SSH_PUBLICKEY_HASH_SHA1 +#else +# define VIR_SSH_HOSTKEY_HASH SSH_PUBLICKEY_HASH_SHA256 +#endif + /* TRACE_LIBSSH=3D enables tracing in libssh itself. * The meaning of is described here: * https://api.libssh.org/master/group__libssh__log.html @@ -203,9 +209,10 @@ virLibsshServerKeyAsString(virNetLibsshSession *sess) return NULL; } =20 - /* calculate remote key hash, using SHA1 algorithm that is - * usual in OpenSSH. The returned value must be freed */ - ret =3D ssh_get_publickey_hash(key, SSH_PUBLICKEY_HASH_SHA1, + /* calculate remote key hash, using SHA256 algorithm that is + * the default in modern OpenSSH, fallback to SHA1 for older + * libssh. The returned value must be freed */ + ret =3D ssh_get_publickey_hash(key, VIR_SSH_HOSTKEY_HASH, &keyhash, &keyhashlen); ssh_key_free(key); if (ret < 0) { --=20 2.31.1