summaryrefslogtreecommitdiff
path: root/compat.c
diff options
context:
space:
mode:
Diffstat (limited to 'compat.c')
-rw-r--r--compat.c48
1 files changed, 13 insertions, 35 deletions
diff --git a/compat.c b/compat.c
index 69a104fbf..1e80cfa9a 100644
--- a/compat.c
+++ b/compat.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: compat.c,v 1.99 2016/05/24 02:31:57 dtucker Exp $ */ 1/* $OpenBSD: compat.c,v 1.100 2017/02/03 23:01:19 djm Exp $ */
2/* 2/*
3 * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. 3 * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved.
4 * 4 *
@@ -37,6 +37,7 @@
37#include "compat.h" 37#include "compat.h"
38#include "log.h" 38#include "log.h"
39#include "match.h" 39#include "match.h"
40#include "kex.h"
40 41
41int compat13 = 0; 42int compat13 = 0;
42int compat20 = 0; 43int compat20 = 0;
@@ -250,42 +251,14 @@ proto_spec(const char *spec)
250 return ret; 251 return ret;
251} 252}
252 253
253/*
254 * Filters a proposal string, excluding any algorithm matching the 'filter'
255 * pattern list.
256 */
257static char *
258filter_proposal(char *proposal, const char *filter)
259{
260 Buffer b;
261 char *orig_prop, *fix_prop;
262 char *cp, *tmp;
263
264 buffer_init(&b);
265 tmp = orig_prop = xstrdup(proposal);
266 while ((cp = strsep(&tmp, ",")) != NULL) {
267 if (match_pattern_list(cp, filter, 0) != 1) {
268 if (buffer_len(&b) > 0)
269 buffer_append(&b, ",", 1);
270 buffer_append(&b, cp, strlen(cp));
271 } else
272 debug2("Compat: skipping algorithm \"%s\"", cp);
273 }
274 buffer_append(&b, "\0", 1);
275 fix_prop = xstrdup((char *)buffer_ptr(&b));
276 buffer_free(&b);
277 free(orig_prop);
278
279 return fix_prop;
280}
281
282char * 254char *
283compat_cipher_proposal(char *cipher_prop) 255compat_cipher_proposal(char *cipher_prop)
284{ 256{
285 if (!(datafellows & SSH_BUG_BIGENDIANAES)) 257 if (!(datafellows & SSH_BUG_BIGENDIANAES))
286 return cipher_prop; 258 return cipher_prop;
287 debug2("%s: original cipher proposal: %s", __func__, cipher_prop); 259 debug2("%s: original cipher proposal: %s", __func__, cipher_prop);
288 cipher_prop = filter_proposal(cipher_prop, "aes*"); 260 if ((cipher_prop = match_filter_list(cipher_prop, "aes*")) == NULL)
261 fatal("match_filter_list failed");
289 debug2("%s: compat cipher proposal: %s", __func__, cipher_prop); 262 debug2("%s: compat cipher proposal: %s", __func__, cipher_prop);
290 if (*cipher_prop == '\0') 263 if (*cipher_prop == '\0')
291 fatal("No supported ciphers found"); 264 fatal("No supported ciphers found");
@@ -298,7 +271,8 @@ compat_pkalg_proposal(char *pkalg_prop)
298 if (!(datafellows & SSH_BUG_RSASIGMD5)) 271 if (!(datafellows & SSH_BUG_RSASIGMD5))
299 return pkalg_prop; 272 return pkalg_prop;
300 debug2("%s: original public key proposal: %s", __func__, pkalg_prop); 273 debug2("%s: original public key proposal: %s", __func__, pkalg_prop);
301 pkalg_prop = filter_proposal(pkalg_prop, "ssh-rsa"); 274 if ((pkalg_prop = match_filter_list(pkalg_prop, "ssh-rsa")) == NULL)
275 fatal("match_filter_list failed");
302 debug2("%s: compat public key proposal: %s", __func__, pkalg_prop); 276 debug2("%s: compat public key proposal: %s", __func__, pkalg_prop);
303 if (*pkalg_prop == '\0') 277 if (*pkalg_prop == '\0')
304 fatal("No supported PK algorithms found"); 278 fatal("No supported PK algorithms found");
@@ -312,10 +286,14 @@ compat_kex_proposal(char *p)
312 return p; 286 return p;
313 debug2("%s: original KEX proposal: %s", __func__, p); 287 debug2("%s: original KEX proposal: %s", __func__, p);
314 if ((datafellows & SSH_BUG_CURVE25519PAD) != 0) 288 if ((datafellows & SSH_BUG_CURVE25519PAD) != 0)
315 p = filter_proposal(p, "curve25519-sha256@libssh.org"); 289 if ((p = match_filter_list(p,
290 "curve25519-sha256@libssh.org")) == NULL)
291 fatal("match_filter_list failed");
316 if ((datafellows & SSH_OLD_DHGEX) != 0) { 292 if ((datafellows & SSH_OLD_DHGEX) != 0) {
317 p = filter_proposal(p, "diffie-hellman-group-exchange-sha256"); 293 if ((p = match_filter_list(p,
318 p = filter_proposal(p, "diffie-hellman-group-exchange-sha1"); 294 "diffie-hellman-group-exchange-sha256,"
295 "diffie-hellman-group-exchange-sha1")) == NULL)
296 fatal("match_filter_list failed");
319 } 297 }
320 debug2("%s: compat KEX proposal: %s", __func__, p); 298 debug2("%s: compat KEX proposal: %s", __func__, p);
321 if (*p == '\0') 299 if (*p == '\0')