shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-09 18:04:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

Disable *-cbc ciphers by default

Browse Source 
OpenSSH disabled them in 2014 and 2017 for servers and clients so its our
turn to follow the suit.

Fixes T236

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
This commit is contained in:
Jakub Jelen
2020-07-15 21:09:40 +02:00
committed by Andreas Schneider
parent 906cc7e7e9
commit 90e56df74e
1 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/kex.c
View File

@@ -57,8 +57,8 @@
#ifdef HAVE_LIBGCRYPT #ifdef HAVE_LIBGCRYPT
# define AES "aes256-gcm@openssh.com,aes128-gcm@openssh.com," \ # define AES "aes256-gcm@openssh.com,aes128-gcm@openssh.com," \
"aes256-ctr,aes192-ctr,aes128-ctr," \ "aes256-ctr,aes192-ctr,aes128-ctr,"
"aes256-cbc,aes192-cbc,aes128-cbc," # define AES_CBC "aes256-cbc,aes192-cbc,aes128-cbc,"
# define DES "3des-cbc" # define DES "3des-cbc"
# define DES_SUPPORTED "3des-cbc" # define DES_SUPPORTED "3des-cbc"
@@ -68,8 +68,8 @@
# else # else
# define GCM "" # define GCM ""
# endif /* MBEDTLS_GCM_C */ # endif /* MBEDTLS_GCM_C */
# define AES GCM "aes256-ctr,aes192-ctr,aes128-ctr," \ # define AES GCM "aes256-ctr,aes192-ctr,aes128-ctr,"
"aes256-cbc,aes192-cbc,aes128-cbc," # define AES_CBC "aes256-cbc,aes192-cbc,aes128-cbc,"
# define DES "3des-cbc" # define DES "3des-cbc"
# define DES_SUPPORTED "3des-cbc" # define DES_SUPPORTED "3des-cbc"
@@ -81,12 +81,15 @@
# define GCM "" # define GCM ""
# endif /* HAVE_OPENSSL_EVP_AES_GCM */ # endif /* HAVE_OPENSSL_EVP_AES_GCM */
# ifdef BROKEN_AES_CTR # ifdef BROKEN_AES_CTR
# define AES GCM "aes256-cbc,aes192-cbc,aes128-cbc," # define AES GCM
# define AES_CBC "aes256-cbc,aes192-cbc,aes128-cbc,"
# else /* BROKEN_AES_CTR */ # else /* BROKEN_AES_CTR */
# define AES GCM "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc," # define AES GCM "aes256-ctr,aes192-ctr,aes128-ctr,"
# define AES_CBC "aes256-cbc,aes192-cbc,aes128-cbc,"
# endif /* BROKEN_AES_CTR */ # endif /* BROKEN_AES_CTR */
# else /* HAVE_OPENSSL_AES_H */ # else /* HAVE_OPENSSL_AES_H */
# define AES "" # define AES ""
# define AES_CBC ""
# endif /* HAVE_OPENSSL_AES_H */ # endif /* HAVE_OPENSSL_AES_H */
# define DES "3des-cbc" # define DES "3des-cbc"
@@ -230,8 +233,8 @@ static const char *fips_methods[] = {
static const char *default_methods[] = { static const char *default_methods[] = {
KEY_EXCHANGE, KEY_EXCHANGE,
DEFAULT_PUBLIC_KEY_ALGORITHMS, DEFAULT_PUBLIC_KEY_ALGORITHMS,
CHACHA20 AES BLOWFISH DES, CHACHA20 AES DES,
CHACHA20 AES BLOWFISH DES, CHACHA20 AES DES,
"hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1",
"hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1",
"none", "none",
@@ -245,8 +248,8 @@ static const char *default_methods[] = {
static const char *supported_methods[] = { static const char *supported_methods[] = {
KEY_EXCHANGE_SUPPORTED, KEY_EXCHANGE_SUPPORTED,
PUBLIC_KEY_ALGORITHMS, PUBLIC_KEY_ALGORITHMS,
CHACHA20 AES BLOWFISH DES_SUPPORTED NONE, CHACHA20 AES AES_CBC BLOWFISH DES_SUPPORTED NONE,
CHACHA20 AES BLOWFISH DES_SUPPORTED NONE, CHACHA20 AES AES_CBC BLOWFISH DES_SUPPORTED NONE,
"hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1" NONE, "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1" NONE,
"hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1" NONE, "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1" NONE,
ZLIB, ZLIB,