Merge branch 'hans/ssh/ext-info_bug_fixes'

5 files changed, 57 insertions, 31 deletions

diff --git a/lib/ssh/doc/src/ssh.xml b/lib/ssh/doc/src/ssh.xml
index c659e093b9..5c9ce3d5fb 100644
--- a/lib/ssh/doc/src/ssh.xml
+++ b/lib/ssh/doc/src/ssh.xml
@@ -246,10 +246,12 @@
 	  <tag><c><![CDATA[{pref_public_key_algs, list()}]]></c></tag>
 	  <item>
             <p>List of user (client) public key algorithms to try to use.</p>
-	    <p>The default value is 
-	    <c><![CDATA[['ssh-rsa','ssh-dss','ecdsa-sha2-nistp256','ecdsa-sha2-nistp384','ecdsa-sha2-nistp521'] ]]></c>
+	    <p>The default value is the <c>public_key</c> entry in 
+	    <seealso marker="#default_algorithms/0">ssh:default_algorithms/0</seealso>.
+	    </p>
+	    <p>If there is no public key of a specified type available, the corresponding entry is ignored.
+	    Note that the available set is dependent on the underlying cryptolib and current user's public keys.
 	    </p>
-	    <p>If there is no public key of a specified type available, the corresponding entry is ignored.</p>
 	  </item>
 
 	  <tag><c><![CDATA[{preferred_algorithms, algs_list()}]]></c></tag>
diff --git a/lib/ssh/src/ssh_connection_handler.erl b/lib/ssh/src/ssh_connection_handler.erl
index 39bd54869f..6a6b9896cb 100644
--- a/lib/ssh/src/ssh_connection_handler.erl
+++ b/lib/ssh/src/ssh_connection_handler.erl
@@ -1701,15 +1701,18 @@ handle_ssh_msg_ext_info(#ssh_msg_ext_info{data=Data}, D0) ->
     lists:foldl(fun ext_info/2, D0, Data).
 
 
-ext_info({"server-sig-algs",SigAlgs}, D0 = #data{ssh_params=#ssh{role=client}=Ssh0}) ->
+ext_info({"server-sig-algs",SigAlgs}, D0 = #data{ssh_params=#ssh{role=client,
+                                                                 userauth_pubkeys=ClientSigAlgs}=Ssh0}) ->
     %% Make strings to eliminate risk of beeing bombed with odd strings that fills the atom table:
     SupportedAlgs = lists:map(fun erlang:atom_to_list/1, ssh_transport:supported_algorithms(public_key)),
-    Ssh = Ssh0#ssh{userauth_pubkeys = 
-                       [list_to_atom(SigAlg) || SigAlg <- string:tokens(SigAlgs,","),
-                                                %% length of SigAlg is implicitly checked by member:
-                                                lists:member(SigAlg, SupportedAlgs)
-                       ]},
-    D0#data{ssh_params = Ssh};
+    ServerSigAlgs = [list_to_atom(SigAlg) || SigAlg <- string:tokens(SigAlgs,","),
+                                             %% length of SigAlg is implicitly checked by the comparison
+                                             %% in member/2:
+                                             lists:member(SigAlg, SupportedAlgs)
+                    ],
+    CommonAlgs = [Alg || Alg <- ServerSigAlgs,
+                         lists:member(Alg, ClientSigAlgs)],
+    D0#data{ssh_params = Ssh0#ssh{userauth_pubkeys = CommonAlgs} };
 
 ext_info(_, D0) ->
     %% Not implemented
diff --git a/lib/ssh/src/ssh_options.erl b/lib/ssh/src/ssh_options.erl
index 78f68dbcb1..12c0190082 100644
--- a/lib/ssh/src/ssh_options.erl
+++ b/lib/ssh/src/ssh_options.erl
@@ -392,6 +392,12 @@ default(server) ->
             class => user_options
            },
 
+      {preferred_algorithms, def} =>
+          #{default => ssh:default_algorithms(),
+            chk => fun check_preferred_algorithms/1,
+            class => user_options
+           },
+
 %%%%% Undocumented
       {infofun, def} =>
           #{default => fun(_,_,_) -> void end,
@@ -430,12 +436,24 @@ default(client) ->
            },
 
       {pref_public_key_algs, def} =>
-          #{default => 
-                ssh_transport:supported_algorithms(public_key),
-            chk => 
-                fun check_pref_public_key_algs/1,
-            class =>
-                ssh
+          #{default => ssh_transport:default_algorithms(public_key) -- ['rsa-sha2-256',
+                                                                        'rsa-sha2-512'],
+            chk => fun check_pref_public_key_algs/1,
+            class => user_options
+           },
+
+      {preferred_algorithms, def} =>
+          #{default => [{K,Vs} || {K,Vs0} <- ssh:default_algorithms(),
+                                  Vs <- [case K of
+                                             public_key -> 
+                                                 Vs0 -- ['rsa-sha2-256',
+                                                         'rsa-sha2-512'];
+                                             _ ->
+                                                 Vs0
+                                         end]
+                       ],
+            chk => fun check_preferred_algorithms/1,
+            class => user_options
            },
 
       {dh_gex_limits, def} =>
@@ -503,12 +521,6 @@ default(common) ->
              class => user_options
             },
 
-       {preferred_algorithms, def} =>
-           #{default => ssh:default_algorithms(),
-             chk => fun check_preferred_algorithms/1,
-             class => user_options
-            },
-
        {id_string, def} => 
            #{default => undefined, % FIXME: see ssh_transport:ssh_vsn/0
              chk => fun(random) -> 
@@ -817,16 +829,23 @@ valid_hash(X,  _) -> error_in_check(X, "Expect atom or list in fingerprint spec"
 
 %%%----------------------------------------------------------------
 check_preferred_algorithms(Algs) ->
+    [error_in_check(K,"Bad preferred_algorithms key")
+     || {K,_} <- Algs,
+        not lists:keymember(K,1,ssh:default_algorithms())],
+
     try alg_duplicates(Algs, [], [])
     of
 	[] ->
 	    {true,
-	     [try ssh_transport:supported_algorithms(Key)
-	      of
-		  DefAlgs -> handle_pref_alg(Key,Vals,DefAlgs)
-	      catch
-		  _:_ -> error_in_check(Key,"Bad preferred_algorithms key")
-	      end  || {Key,Vals} <- Algs]
+	     [case proplists:get_value(Key, Algs) of
+                  undefined ->
+                      {Key,DefAlgs};
+                  Vals ->
+                      handle_pref_alg(Key,Vals,SupAlgs)
+              end
+	      || {{Key,DefAlgs}, {Key,SupAlgs}} <- lists:zip(ssh:default_algorithms(),
+                                                             ssh_transport:supported_algorithms())
+             ]
 	    };
 
 	Dups ->
diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index aaec733f3c..1a15798080 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -737,9 +737,11 @@ ext_info_message(#ssh{role=client,
     end;
 
 ext_info_message(#ssh{role=server,
-                      send_ext_info=true} = Ssh0) ->
+                      send_ext_info=true,
+                      opts = Opts} = Ssh0) ->
     AlgsList = lists:map(fun erlang:atom_to_list/1,
-                         ssh_transport:default_algorithms(public_key)),
+                         proplists:get_value(public_key,
+                                             ?GET_OPT(preferred_algorithms, Opts))),
     Msg = #ssh_msg_ext_info{nr_extensions = 1,
                             data = [{"server-sig-algs", string:join(AlgsList,",")}]
                            },
diff --git a/lib/ssh/test/ssh_basic_SUITE.erl b/lib/ssh/test/ssh_basic_SUITE.erl
index 1e591bc295..62e2a585e4 100644
--- a/lib/ssh/test/ssh_basic_SUITE.erl
+++ b/lib/ssh/test/ssh_basic_SUITE.erl
@@ -612,7 +612,7 @@ exec_key_differs(Config, UserPKAlgs) ->
 	    {_Pid, _Host, Port} = ssh_test_lib:daemon([{system_dir, SystemDir},
 						       {user_dir, SystemUserDir},
 						       {preferred_algorithms,
-							[{public_key,['ssh-rsa']}]}]),
+							[{public_key,['ssh-rsa'|UserPKAlgs]}]}]),
 	    ct:sleep(500),
 
 	    IO = ssh_test_lib:start_io_server(),