diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2019-02-23 08:20:43 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2019-02-24 10:51:46 +1100 |
| commit | 9b61130fbd95d196bce81ebeca94a4cb7c0d5ba0 (patch) | |
| tree | 3ad20b470660a2193096586ccbf8acf6f580da4a /myproposal.h | |
| parent | 37638c752041d591371900df820f070037878a2d (diff) | |
| download | openssh-git-9b61130fbd95d196bce81ebeca94a4cb7c0d5ba0.tar.gz | |
upstream: openssh-7.9 accidentally reused the server's algorithm lists
in the client for KEX, ciphers and MACs. The ciphers and MACs were identical
between the client and server, but the error accidentially disabled the
diffie-hellman-group-exchange-sha1 KEX method.
This fixes the client code to use the correct method list, but
because nobody complained, it also disables the
diffie-hellman-group-exchange-sha1 KEX method.
Reported by nuxi AT vault24.org via bz#2697; ok dtucker
OpenBSD-Commit-ID: e30c33a23c10fd536fefa120e86af1842e33fd57
Diffstat (limited to 'myproposal.h')
| -rw-r--r-- | myproposal.h | 15 |
1 files changed, 5 insertions, 10 deletions
diff --git a/myproposal.h b/myproposal.h index 27b4a15a..f1672987 100644 --- a/myproposal.h +++ b/myproposal.h @@ -1,4 +1,4 @@ -/* $OpenBSD: myproposal.h,v 1.57 2018/09/12 01:34:02 djm Exp $ */ +/* $OpenBSD: myproposal.h,v 1.58 2019/02/23 08:20:43 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. @@ -90,20 +90,15 @@ # else # define KEX_CURVE25519_METHODS "" # endif -#define KEX_COMMON_KEX \ +#define KEX_SERVER_KEX \ KEX_CURVE25519_METHODS \ KEX_ECDH_METHODS \ - KEX_SHA2_METHODS - -#define KEX_SERVER_KEX KEX_COMMON_KEX \ - KEX_SHA2_GROUP14 \ - "diffie-hellman-group14-sha1" \ - -#define KEX_CLIENT_KEX KEX_COMMON_KEX \ - "diffie-hellman-group-exchange-sha1," \ + KEX_SHA2_METHODS \ KEX_SHA2_GROUP14 \ "diffie-hellman-group14-sha1" +#define KEX_CLIENT_KEX KEX_SERVER_KEX + #define KEX_DEFAULT_PK_ALG \ HOSTKEY_ECDSA_CERT_METHODS \ "ssh-ed25519-cert-v01@openssh.com," \ |