>From c679470e3d49929ba57445e56389d937479f2178 Mon Sep 17 00:00:00 2001
From: Roumen Petrov <openssh@roumenpetrov.info>
Date: Sun, 5 Feb 2017 16:30:38 +0200
Subject: [PATCH 8/9] force public key algorithms for rfc6187 keys

---
 ssh-xkalg.c                  | 15 +++++++++++++++
 tests/CA/test-hostalg.sh.inc |  2 +-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/ssh-xkalg.c b/ssh-xkalg.c
index 8b39feb..a676f04 100644
--- a/ssh-xkalg.c
+++ b/ssh-xkalg.c
@@ -45,6 +45,10 @@
 #  error "OPENSSL_NO_SHA"
 #endif
 
+#if 1
+# define FORCE_RFC6187_ALGO	1 /* prefer RFC6187 RSA&DSA */
+#endif
+
 
 static int
 DSS1RAW_SignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, unsigned int *siglen, EVP_PKEY *pkey) {
@@ -369,6 +373,13 @@ logit("TRACE_XKALG add_default_xkalg:");
 		fatal("ssh_init_xkalg: oops");
 # endif
 
+#ifdef FORCE_RFC6187_ALGO
+	if (ssh_add_x509key_alg("x509v3-ssh-rsa,rsa-sha1,ssh-rsa") < 0)
+		fatal("ssh_init_xkalg: oops");
+	if (ssh_add_x509key_alg("x509v3-ssh-dss,dss-raw,ssh-dss") < 0)
+		fatal("ssh_init_xkalg: oops");
+#endif /*def FORCE_RFC6187_ALGO*/
+
 	/* RSA public key algorithm: */
 	/* - draft-ietf-secsh-transport-NN.txt where NN <= 12
 	 * does not define explicitly signature format.
@@ -381,9 +392,11 @@ logit("TRACE_XKALG add_default_xkalg:");
 #endif
 	if (ssh_add_x509key_alg("x509v3-sign-rsa,rsa-md5") < 0)
 		fatal("ssh_init_xkalg: oops");
+#ifndef FORCE_RFC6187_ALGO
 	/* - RFC6187 */
 	if (ssh_add_x509key_alg("x509v3-ssh-rsa,rsa-sha1,ssh-rsa") < 0)
 		fatal("ssh_init_xkalg: oops");
+#endif
 
 	/* DSA public key algorithm: */
 	/* - default is compatible with draft-ietf-secsh-transport-NN.txt
@@ -396,9 +409,11 @@ logit("TRACE_XKALG add_default_xkalg:");
 	 */
 	if (ssh_add_x509key_alg("x509v3-sign-dss,dss-raw") < 0)
 		fatal("ssh_init_xkalg: oops");
+#ifndef FORCE_RFC6187_ALGO
 	/* - RFC6187 */
 	if (ssh_add_x509key_alg("x509v3-ssh-dss,dss-raw,ssh-dss") < 0)
 		fatal("ssh_init_xkalg: oops");
+#endif
 }
 
 
diff --git a/tests/CA/test-hostalg.sh.inc b/tests/CA/test-hostalg.sh.inc
index 1bed43f..0097856 100644
--- a/tests/CA/test-hostalg.sh.inc
+++ b/tests/CA/test-hostalg.sh.inc
@@ -105,7 +105,7 @@ EOF
     ; do
 
 case $alg in
-x509v3-ssh-*) continue;; #TODO (not yet)
+x509v3-sign-*) continue;; #TODO
 esac
 
       case $alg in
-- 
2.9.0