6 files changed, 38 insertions, 7 deletions

diff --git a/ChangeLog b/ChangeLog
index 3e8592118..5b53c216c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -98,6 +98,16 @@
      remove the identity files from this manpage - ssh-agent doesn't deal
      with them at all and the same information is duplicated in ssh-add.1
      (which does deal with them); prodded by deraadt@
+   - djm@cvs.openbsd.org 2014/04/18 23:52:25
+     [compat.c compat.h sshconnect2.c sshd.c version.h]
+     OpenSSH 6.5 and 6.6 have a bug that causes ~0.2% of connections
+     using the curve25519-sha256@libssh.org KEX exchange method to fail
+     when connecting with something that implements the spec properly.
+     
+     Disable this KEX method when speaking to one of the affected
+     versions.
+     
+     reported by Aris Adamantiadis; ok markus@
 
 20140401
  - (djm) On platforms that support it, use prctl() to prevent sftp-server
diff --git a/compat.c b/compat.c
index 9d9fabef3..64f9790a8 100644
--- a/compat.c
+++ b/compat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: compat.c,v 1.82 2013/12/30 23:52:27 djm Exp $ */
+/* $OpenBSD: compat.c,v 1.83 2014/04/18 23:52:25 djm Exp $ */
 /*
  * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
  *
@@ -95,6 +95,8 @@ compat_datafellows(const char *version)
                 { "Sun_SSH_1.0*",       SSH_BUG_NOREKEY|SSH_BUG_EXTEOF},
                 { "OpenSSH_4*",         0 },
                 { "OpenSSH_5*",         SSH_NEW_OPENSSH|SSH_BUG_DYNAMIC_RPORT},
+                { "OpenSSH_6.5*,"
+                  "OpenSSH_6.6",        SSH_NEW_OPENSSH|SSH_BUG_CURVE25519PAD},
                 { "OpenSSH*",           SSH_NEW_OPENSSH },
                 { "*MindTerm*",         0 },
                 { "2.1.0*",             SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
@@ -251,7 +253,6 @@ compat_cipher_proposal(char *cipher_prop)
         return cipher_prop;
 }
 
-
 char *
 compat_pkalg_proposal(char *pkalg_prop)
 {
@@ -265,3 +266,16 @@ compat_pkalg_proposal(char *pkalg_prop)
         return pkalg_prop;
 }
 
+char *
+compat_kex_proposal(char *kex_prop)
+{
+        if (!(datafellows & SSH_BUG_CURVE25519PAD))
+                return kex_prop;
+        debug2("%s: original KEX proposal: %s", __func__, kex_prop);
+        kex_prop = filter_proposal(kex_prop, "curve25519-sha256@libssh.org");
+        debug2("%s: compat KEX proposal: %s", __func__, kex_prop);
+        if (*kex_prop == '\0')
+                fatal("No supported key exchange algorithms found");
+        return kex_prop;
+}
+
diff --git a/compat.h b/compat.h
index b174fa171..2e25d5ba9 100644
--- a/compat.h
+++ b/compat.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: compat.h,v 1.44 2013/12/30 23:52:27 djm Exp $ */
+/* $OpenBSD: compat.h,v 1.45 2014/04/18 23:52:25 djm Exp $ */
 
 /*
  * Copyright (c) 1999, 2000, 2001 Markus Friedl.  All rights reserved.
@@ -59,6 +59,7 @@
 #define SSH_BUG_RFWD_ADDR       0x02000000
 #define SSH_NEW_OPENSSH         0x04000000
 #define SSH_BUG_DYNAMIC_RPORT   0x08000000
+#define SSH_BUG_CURVE25519PAD   0x10000000
 
 void     enable_compat13(void);
 void     enable_compat20(void);
@@ -66,6 +67,7 @@ void     compat_datafellows(const char *);
 int      proto_spec(const char *);
 char    *compat_cipher_proposal(char *);
 char    *compat_pkalg_proposal(char *);
+char    *compat_kex_proposal(char *);
 
 extern int compat13;
 extern int compat20;
diff --git a/sshconnect2.c b/sshconnect2.c
index f123194b0..b1aa69c24 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.205 2014/03/27 23:01:27 markus Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.206 2014/04/18 23:52:25 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -196,6 +196,8 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
         }
         if (options.kex_algorithms != NULL)
                 myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
+        myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
+            myproposal[PROPOSAL_KEX_ALGS]);
 
         if (options.rekey_limit || options.rekey_interval)
                 packet_set_rekey_limits((u_int32_t)options.rekey_limit,
diff --git a/sshd.c b/sshd.c
index f0fc07896..3ca722c5c 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.423 2014/04/12 04:55:53 djm Exp $ */
+/* $OpenBSD: sshd.c,v 1.424 2014/04/18 23:52:25 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -2438,6 +2438,9 @@ do_ssh2_kex(void)
         if (options.kex_algorithms != NULL)
                 myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
 
+        myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
+            myproposal[PROPOSAL_KEX_ALGS]);
+
         if (options.rekey_limit || options.rekey_interval)
                 packet_set_rekey_limits((u_int32_t)options.rekey_limit,
                     (time_t)options.rekey_interval);
diff --git a/version.h b/version.h
index a1579ace1..cc8a079a9 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
-/* $OpenBSD: version.h,v 1.70 2014/02/27 22:57:40 djm Exp $ */
+/* $OpenBSD: version.h,v 1.71 2014/04/18 23:52:25 djm Exp $ */
 
-#define SSH_VERSION     "OpenSSH_6.6"
+#define SSH_VERSION     "OpenSSH_6.7"
 
 #define SSH_PORTABLE    "p1"
 #define SSH_RELEASE     SSH_VERSION SSH_PORTABLE