From f4cf6605e8ddf4accb553c155a77878031850128 Mon Sep 17 00:00:00 2001
From: Hans Nilsson <hans@erlang.org>
Date: Fri, 5 May 2017 16:18:00 +0200
Subject: ssh: fix broken preferred_algorithms and pref_public_key_algs options

---
 lib/ssh/doc/src/ssh.xml     |  8 +++++---
 lib/ssh/src/ssh_options.erl | 28 ++++++++++++++++------------
 2 files changed, 21 insertions(+), 15 deletions(-)

diff --git a/lib/ssh/doc/src/ssh.xml b/lib/ssh/doc/src/ssh.xml
index c659e093b9..5c9ce3d5fb 100644
--- a/lib/ssh/doc/src/ssh.xml
+++ b/lib/ssh/doc/src/ssh.xml
@@ -246,10 +246,12 @@
 	  <tag><c><![CDATA[{pref_public_key_algs, list()}]]></c></tag>
 	  <item>
             <p>List of user (client) public key algorithms to try to use.</p>
-	    <p>The default value is 
-	    <c><![CDATA[['ssh-rsa','ssh-dss','ecdsa-sha2-nistp256','ecdsa-sha2-nistp384','ecdsa-sha2-nistp521'] ]]></c>
+	    <p>The default value is the <c>public_key</c> entry in 
+	    <seealso marker="#default_algorithms/0">ssh:default_algorithms/0</seealso>.
+	    </p>
+	    <p>If there is no public key of a specified type available, the corresponding entry is ignored.
+	    Note that the available set is dependent on the underlying cryptolib and current user's public keys.
 	    </p>
-	    <p>If there is no public key of a specified type available, the corresponding entry is ignored.</p>
 	  </item>
 
 	  <tag><c><![CDATA[{preferred_algorithms, algs_list()}]]></c></tag>
diff --git a/lib/ssh/src/ssh_options.erl b/lib/ssh/src/ssh_options.erl
index 78f68dbcb1..aebb5a7062 100644
--- a/lib/ssh/src/ssh_options.erl
+++ b/lib/ssh/src/ssh_options.erl
@@ -430,12 +430,9 @@ default(client) ->
            },
 
       {pref_public_key_algs, def} =>
-          #{default => 
-                ssh_transport:supported_algorithms(public_key),
-            chk => 
-                fun check_pref_public_key_algs/1,
-            class =>
-                ssh
+          #{default => ssh_transport:default_algorithms(public_key),
+            chk => fun check_pref_public_key_algs/1,
+            class => user_options
            },
 
       {dh_gex_limits, def} =>
@@ -817,16 +814,23 @@ valid_hash(X,  _) -> error_in_check(X, "Expect atom or list in fingerprint spec"
 
 %%%----------------------------------------------------------------
 check_preferred_algorithms(Algs) ->
+    [error_in_check(K,"Bad preferred_algorithms key")
+     || {K,_} <- Algs,
+        not lists:keymember(K,1,ssh:default_algorithms())],
+
     try alg_duplicates(Algs, [], [])
     of
 	[] ->
 	    {true,
-	     [try ssh_transport:supported_algorithms(Key)
-	      of
-		  DefAlgs -> handle_pref_alg(Key,Vals,DefAlgs)
-	      catch
-		  _:_ -> error_in_check(Key,"Bad preferred_algorithms key")
-	      end  || {Key,Vals} <- Algs]
+	     [case proplists:get_value(Key, Algs) of
+                  undefined ->
+                      {Key,DefAlgs};
+                  Vals ->
+                      handle_pref_alg(Key,Vals,SupAlgs)
+              end
+	      || {{Key,DefAlgs}, {Key,SupAlgs}} <- lists:zip(ssh:default_algorithms(),
+                                                             ssh_transport:supported_algorithms())
+             ]
 	    };
 
 	Dups ->
-- 
cgit v1.2.3