ports/libssh
ports/libssh
1
1
Форкнуть 0
Код Релизы 1 Активность

Disable *-cbc ciphers by default

Просмотр исходного кода 
OpenSSH disabled them in 2014 and 2017 for servers and clients so its our
turn to follow the suit.

Fixes T236

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
Этот коммит содержится в:
Jakub Jelen 2020-07-15 21:09:40 +02:00 коммит произвёл Andreas Schneider
родитель 906cc7e7e9
Коммит 90e56df74e
1 изменённых файлов: 13 добавлений и 10 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

23
src/kex.c
Просмотреть файл

@ -57,8 +57,8 @@
#ifdef HAVE_LIBGCRYPT
# define AES "aes256-gcm@openssh.com,aes128-gcm@openssh.com," \
"aes256-ctr,aes192-ctr,aes128-ctr," \
"aes256-cbc,aes192-cbc,aes128-cbc,"
"aes256-ctr,aes192-ctr,aes128-ctr,"
# define AES_CBC "aes256-cbc,aes192-cbc,aes128-cbc,"
# define DES "3des-cbc"
# define DES_SUPPORTED "3des-cbc"
@ -68,8 +68,8 @@
# else
# define GCM ""
# endif /* MBEDTLS_GCM_C */
# define AES GCM "aes256-ctr,aes192-ctr,aes128-ctr," \
"aes256-cbc,aes192-cbc,aes128-cbc,"
# define AES GCM "aes256-ctr,aes192-ctr,aes128-ctr,"
# define AES_CBC "aes256-cbc,aes192-cbc,aes128-cbc,"
# define DES "3des-cbc"
# define DES_SUPPORTED "3des-cbc"
@ -81,12 +81,15 @@
# define GCM ""
# endif /* HAVE_OPENSSL_EVP_AES_GCM */
# ifdef BROKEN_AES_CTR
# define AES GCM "aes256-cbc,aes192-cbc,aes128-cbc,"
# define AES GCM
# define AES_CBC "aes256-cbc,aes192-cbc,aes128-cbc,"
# else /* BROKEN_AES_CTR */
# define AES GCM "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,"
# define AES GCM "aes256-ctr,aes192-ctr,aes128-ctr,"
# define AES_CBC "aes256-cbc,aes192-cbc,aes128-cbc,"
# endif /* BROKEN_AES_CTR */
# else /* HAVE_OPENSSL_AES_H */
# define AES ""
# define AES_CBC ""
# endif /* HAVE_OPENSSL_AES_H */
# define DES "3des-cbc"
@ -230,8 +233,8 @@ static const char *fips_methods[] = {
static const char *default_methods[] = {
KEY_EXCHANGE,
DEFAULT_PUBLIC_KEY_ALGORITHMS,
CHACHA20 AES BLOWFISH DES,
CHACHA20 AES BLOWFISH DES,
CHACHA20 AES DES,
CHACHA20 AES DES,
"hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1",
"hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1",
"none",
@ -245,8 +248,8 @@ static const char *default_methods[] = {
static const char *supported_methods[] = {
KEY_EXCHANGE_SUPPORTED,
PUBLIC_KEY_ALGORITHMS,
CHACHA20 AES BLOWFISH DES_SUPPORTED NONE,
CHACHA20 AES BLOWFISH DES_SUPPORTED NONE,
CHACHA20 AES AES_CBC BLOWFISH DES_SUPPORTED NONE,
CHACHA20 AES AES_CBC BLOWFISH DES_SUPPORTED NONE,
"hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1" NONE,
"hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1" NONE,
ZLIB,