ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs

The documentation of ClientConfig.HostKeyAlgorithms says:

  If empty, a reasonable default is used.

However, if HostKeyAlgorithms is empty but non-nil, the reasonable
default won't be applied, and the SSH handshake will fail. Fix this by
changing the nil check to a length check.

While here, do the same for KeyExchanges, Ciphers, MACs in Config.

Change-Id: I1b3d2d2159f3c7d57a9a690ad04f1f6818b39a5c
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/800080
Reviewed-by: Nicola Murino <nicola.murino@gmail.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Carlos Amedee <carlos@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>
Auto-Submit: Nicola Murino <nicola.murino@gmail.com>
This commit is contained in:
database64128
2026-07-22 10:37:01 -07:00
committed by Gopher Robot
parent 626e40fc98
commit b53964a1ca
2 changed files with 4 additions and 4 deletions
+1 -1
View File
@@ -162,7 +162,7 @@ func newClientTransport(conn keyingTransport, clientVersion, serverVersion []byt
t.remoteAddr = addr
t.hostKeyCallback = config.HostKeyCallback
t.bannerCallback = config.BannerCallback
if config.HostKeyAlgorithms != nil {
if len(config.HostKeyAlgorithms) > 0 {
t.hostKeyAlgorithms = config.HostKeyAlgorithms
} else {
t.hostKeyAlgorithms = defaultHostKeyAlgos