Expose new libssh option to set key exchange methods

changelogs/fragments/key_exchange_algorithms.yml

@@ -0,0 +1,3 @@
+---
+minor_changes:
+  - "Exposes new libssh option to configure key_exchange_algorithms. This requires ansible-pylibssh v1.3.0 or higher."

docs/ansible.netcommon.libssh_connection.rst

@@ -131,6 +131,29 @@ Parameters
                         <div>Set the preferred server host key types as a comma-separated list (e.g., ssh-rsa,ssh-dss,ecdh-sha2-nistp256).</div>
                 </td>
             </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>key_exchange_algorithms</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">string</span>
+                    </div>
+                </td>
+                <td>
+                </td>
+                    <td>
+                            <div> ini entries:
+                                    <p>[libssh_connection]<br>key_exchange_algorithms = VALUE</p>
+                            </div>
+                                <div>env:ANSIBLE_LIBSSH_KEY_EXCHANGE_ALGORITHMS</div>
+                                <div>var: ansible_libssh_key_exchange_algorithms</div>
+                    </td>
+                <td>
+                        <div>Set the key exchange method as a comma-separated list (e.g., &quot;ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1&quot;).</div>
+                        <div>The list can be prepended by +,-,^ which will append, remove or move to the beginning (prioritizing) of the default list respectively. Giving an empty list after + and ^ will cause error.</div>
+                </td>
+            </tr>
             <tr>
                 <td colspan="1">
                     <div class="ansibleOptionAnchor" id="parameter-"></div>

plugins/connection/libssh.py

@@ -104,7 +104,7 @@
         default: ''
         description:
             - List of algorithms to forward to SSH_OPTIONS_PUBLICKEY_ACCEPTED_TYPES.
-        type: string
+        type: str
         env:
           - name: ANSIBLE_LIBSSH_PUBLICKEY_ALGORITHMS
         ini:
@@ -114,13 +114,25 @@
       hostkeys:
         default: ''
         description: Set the preferred server host key types as a comma-separated list (e.g., ssh-rsa,ssh-dss,ecdh-sha2-nistp256).
-        type: string
+        type: str
         env:
           - name: ANSIBLE_LIBSSH_HOSTKEYS
         ini:
           - {key: hostkeys, section: libssh_connection}
         vars:
           - name: ansible_libssh_hostkeys
+      key_exchange_algorithms:
+        description:
+          - Set the key exchange method as a comma-separated list (e.g., "ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1").
+          - The list can be prepended by +,-,^ which will append, remove or move to the beginning (prioritizing) of the default list respectively.
+            Giving an empty list after + and ^ will cause error.
+        type: str
+        env:
+          - name: ANSIBLE_LIBSSH_KEY_EXCHANGE_ALGORITHMS
+        ini:
+          - {key: key_exchange_algorithms, section: libssh_connection}
+        vars:
+          - name: ansible_libssh_key_exchange_algorithms
       host_key_checking:
         description: 'Set this to "False" if you want to avoid host key checking by the underlying tools Ansible uses to connect to the host'
         type: boolean
@@ -422,6 +434,11 @@ def _connect_uncached(self):
             if self.get_option("hostkeys"):
                 ssh_connect_kwargs["hostkeys"] = self.get_option("hostkeys")
 
+            if self.get_option("key_exchange_algorithms"):
+                ssh_connect_kwargs["key_exchange_algorithms"] = self.get_option(
+                    "key_exchange_algorithms"
+                )
+
             self.ssh.set_missing_host_key_policy(MyAddPolicy(self))
 
             self.ssh.connect(