libssh2_session_method_pref() to throw error for bad method names

[Will Cosgrove]

Hi Amy,
I would propose an alternate solution would be to add the key extension string onto the method kex prefs string _after_ it’s been filtered, instead of before, so the rest of the preferences wouldn’t be subject to this test which would be a bit confusing. I’ll work up an MR with this change.

Cheers,
Will 

> On Feb 27, 2025, at 11:10 AM, Amy Lin via libssh2-devel <libssh2-devel at lists.haxx.se> wrote:
> 
> Hello Team,
>  
> We are upgrading from Libssh2 1.10 to 1.11.1. We found that calling kex.c: libssh2_session_method_pref() with bad method names did not throw an error.
>  
> It looks like key extension indicators were added with the new update, but the error handling for LIBSSH2_ERROR_METHOD_NOT_SUPPORTED continues to check for empty string.  https://github.com/libssh2/libssh2/commit/00e2a07e824db8798d94809156e9fb4e70a42f89
>  
> What do folks think about this update in error handling?
>  
> In https://github.com/libssh2/libssh2/blob/master/src/kex.c: 4310
> -    if(!*newprefs) {
> +    // ignore trailing comma in kex_extensions when comparing
> +    if((strlen(newprefs) == (kex_extensions_len-1)) &&
> +            (strncmp(newprefs, kex_extensions, (kex_extensions_len-1)) == 0)) {
>          LIBSSH2_FREE(session, newprefs);
>          return _libssh2_error(session, LIBSSH2_ERROR_METHOD_NOT_SUPPORTED,
>                                "The requested method(s) are not currently "
>                                "supported");
>      }
>  
> Thanks,
> Amy
> -- 
> libssh2-devel mailing list
> libssh2-devel at lists.haxx.se <mailto:libssh2-devel at lists.haxx.se>
> https://lists.haxx.se/mailman/listinfo/libssh2-devel

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.haxx.se/pipermail/libssh2-devel/attachments/20250227/b6f091ae/attachment.htm>