Function pickSignatureAlgorithm

ssh/client_auth.go:260–332

(signer Signer, extensions map[string][]byte)

}

func pickSignatureAlgorithm(signer Signer, extensions map[string][]byte) (MultiAlgorithmSigner, string, error) {
	var as MultiAlgorithmSigner
	keyFormat := signer.PublicKey().Type()

	// If the signer implements MultiAlgorithmSigner we use the algorithms it
	// support, if it implements AlgorithmSigner we assume it supports all
	// algorithms, otherwise only the key format one.
	switch s := signer.(type) {
	case MultiAlgorithmSigner:
		as = s
	case AlgorithmSigner:
		as = &multiAlgorithmSigner{
			AlgorithmSigner:     s,
			supportedAlgorithms: algorithmsForKeyFormat(underlyingAlgo(keyFormat)),
		}
	default:
		as = &multiAlgorithmSigner{
			AlgorithmSigner:     algorithmSignerWrapper{signer},
			supportedAlgorithms: []string{underlyingAlgo(keyFormat)},
		}
	}

	getFallbackAlgo := func() (string, error) {
		// Fallback to use if there is no "server-sig-algs" extension or a
		// common algorithm cannot be found. We use the public key format if the
		// MultiAlgorithmSigner supports it, otherwise we return an error.
		if !slices.Contains(as.Algorithms(), underlyingAlgo(keyFormat)) {
			return "", fmt.Errorf("ssh: no common public key signature algorithm, server only supports %q for key type %q, signer only supports %v",
				underlyingAlgo(keyFormat), keyFormat, as.Algorithms())
		}
		return keyFormat, nil
	}

	extPayload, ok := extensions["server-sig-algs"]
	if !ok {
		// If there is no "server-sig-algs" extension use the fallback
		// algorithm.
		algo, err := getFallbackAlgo()
		return as, algo, err
	}

	// The server-sig-algs extension only carries underlying signature
	// algorithm, but we are trying to select a protocol-level public key
	// algorithm, which might be a certificate type. Extend the list of server
	// supported algorithms to include the corresponding certificate algorithms.
	serverAlgos := strings.Split(string(extPayload), ",")
	for _, algo := range serverAlgos {
		if certAlgo, ok := certificateAlgo(algo); ok {
			serverAlgos = append(serverAlgos, certAlgo)
		}
	}

	// Filter algorithms based on those supported by MultiAlgorithmSigner.
	// Iterate over the signer's algorithms first to preserve its preference order.
	supportedKeyAlgos := algorithmsForKeyFormat(keyFormat)
	var keyAlgos []string
	for _, signerAlgo := range as.Algorithms() {
		if idx := slices.IndexFunc(supportedKeyAlgos, func(algo string) bool {