diff options
| author |   djm <djm@openbsd.org> | 2014-04-18 23:52:25 +0000 |
|---|---|---|
| committer | djm <djm@openbsd.org> | 2014-04-18 23:52:25 +0000 |
| commit | 9d7dda625ccad605b740f9246699242be0503da2 (patch) | |
| tree | 510f1b1eb3be6aa894ea36cc1cbed099cc992a1d /usr.bin/ssh/sshconnect2.c | |
| parent | OPENSSL_gmtime() is really just gmtime_r(); ok guenther (diff) | |
| download | wireguard-openbsd-9d7dda625ccad605b740f9246699242be0503da2.tar.xz wireguard-openbsd-9d7dda625ccad605b740f9246699242be0503da2.zip | |
OpenSSH 6.5 and 6.6 have a bug that causes ~0.2% of connections
using the curve25519-sha256@libssh.org KEX exchange method to fail
when connecting with something that implements the spec properly.
Disable this KEX method when speaking to one of the affected
versions.
reported by Aris Adamantiadis; ok markus@
Diffstat (limited to 'usr.bin/ssh/sshconnect2.c')
| -rw-r--r-- | usr.bin/ssh/sshconnect2.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/usr.bin/ssh/sshconnect2.c b/usr.bin/ssh/sshconnect2.c index 4848cd48af8..8e7e7ca75b7 100644 --- a/usr.bin/ssh/sshconnect2.c +++ b/usr.bin/ssh/sshconnect2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect2.c,v 1.205 2014/03/27 23:01:27 markus Exp $ */ +/* $OpenBSD: sshconnect2.c,v 1.206 2014/04/18 23:52:25 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved. @@ -190,6 +190,8 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port) } if (options.kex_algorithms != NULL) myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms; + myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal( + myproposal[PROPOSAL_KEX_ALGS]); if (options.rekey_limit || options.rekey_interval) packet_set_rekey_limits((u_int32_t)options.rekey_limit, |