diff options
| author | Matt Johnston <matt@ucc.asn.au> | 2018-02-26 22:42:53 +0800 |
|---|---|---|
| committer | Matt Johnston <matt@ucc.asn.au> | 2018-02-26 22:42:53 +0800 |
| commit | 3996e93a2045b68cbec6d645e7a166358dac95f7 (patch) | |
| tree | c887e754cbf23f7e7285f8c02a8d3d2e2885f8c2 | |
| parent | 246f24eda8bba15b04c7c7325af5092091c1751e (diff) | |
make group1 client-only
| -rw-r--r-- | default_options.h | 7 | ||||
| -rw-r--r-- | svr-session.c | 13 |
2 files changed, 19 insertions, 1 deletions
diff --git a/default_options.h b/default_options.h index 853aba6..3b75eb8 100644 --- a/default_options.h +++ b/default_options.h @@ -149,12 +149,17 @@ IMPORTANT: Some options will require "make clean" after changes */ * Small systems should generally include either curve25519 or ecdh for performance. * curve25519 is less widely supported but is faster */ -#define DROPBEAR_DH_GROUP1 0 #define DROPBEAR_DH_GROUP14_SHA1 1 #define DROPBEAR_DH_GROUP14_SHA256 1 #define DROPBEAR_DH_GROUP16 0 #define DROPBEAR_CURVE25519 1 #define DROPBEAR_ECDH 1 +#define DROPBEAR_DH_GROUP1 1 + +/* When group1 is enabled it will only be allowed by Dropbear client +not as a server, due to concerns over its strength. Set to 0 to allow +group1 in Dropbear server too */ +#define DROPBEAR_DH_GROUP1_CLIENTONLY 1 /* Control the memory/performance/compression tradeoff for zlib. * Set windowBits=8 for least memory usage, see your system's diff --git a/svr-session.c b/svr-session.c index 3ff7953..ae9cb24 100644 --- a/svr-session.c +++ b/svr-session.c @@ -42,6 +42,7 @@ #include "crypto_desc.h" static void svr_remoteclosed(void); +static void svr_algos_initialise(void); struct serversession svr_ses; /* GLOBAL */ @@ -102,6 +103,7 @@ void svr_session(int sock, int childpipe) { svr_authinitialise(); chaninitialise(svr_chantypes); svr_chansessinitialise(); + svr_algos_initialise(); /* for logging the remote address */ get_socket_address(ses.sock_in, NULL, NULL, &host, &port, 0); @@ -243,3 +245,14 @@ static void svr_remoteclosed() { } +static void svr_algos_initialise(void) { +#if DROPBEAR_DH_GROUP1 && DROPBEAR_DH_GROUP1_CLIENTONLY + algo_type *algo; + for (algo = sshkex; algo->name; algo++) { + if (strcmp(algo->name, "diffie-hellman-group1-sha1") == 0) { + algo->usable = 0; + } + } +#endif +} + |