Make sure the extensions are processed before making decissions on the signature algorithm

Jakub Jelenrequested to merge
jjelen/libssh-mirror:process-extensions into master

Originally reported by Till on mailing list here:

https://archive.libssh.org/libssh/2025-05/0000000.html

After some debugging, it turns out the client code does not guarantee the extensions are processed before making decisions on the signature algorithm that is being used for authentication, causing false-positive failures.

This does not happen in the tests, where we initially call ssh_userauth_none, which enumerates authentications methods and as a side effect processes outstanding packets such as SSH_EXT_INFO message with the server-sig-algs extension.

When the first function called after ssh_connect() is ssh_userauth_publickey(), the ssh_userauth_request_service() was wrongly called only after the signature algorithm compatibility was checked.

Checklist

  • Commits have Signed-off-by: with name/author being identical to the commit author
  • Code modified for feature
  • Test suite updated with functionality tests
  • Test suite updated with negative tests
  • Documentation updated

Reviewer's checklist:

  • Any issues marked for closing are addressed
  • There is a test suite reasonably covering new functionality or modifications
  • Function naming, parameters, return values, types, etc., are consistent and according to CONTRIBUTING.md
  • This feature/change has adequate documentation added
  • No obvious mistakes in the code

Merge request reports