1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
From f9f8970756a601f30c97d079d6ff99751b0c9334 Mon Sep 17 00:00:00 2001
From: "dtucker@openbsd.org" <dtucker@openbsd.org>
Date: Tue, 11 Mar 2025 07:42:08 +0000
Subject: upstream: Check if dbclient supports SHA1 before trying SHA1-based
KEX.
Dropbear 2025.87 removed SHA1 support by default, which means
diffie-hellman-group14-sha1 is not available. Unfortunately there isn't a
flag to query supported KEX, so instead check MACs and if it doesn't have
SHA1 methods, assuming SHA1 based KEXes are likewise not available. Spotted
by anton@.
OpenBSD-Regress-ID: acfa8e26c001cb18b9fb81a27271c3b51288d304
Bug-Debian: https://bugs.debian.org/1100948
Last-Update: 2025-03-20
Patch-Name: dropbear-check-sha1.patch
regress/dropbear-kex.sh | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/regress/dropbear-kex.sh b/regress/dropbear-kex.sh
index d9f1b32c0..72717fbb7 100644
@@ -1,4 +1,4 @@
-# $OpenBSD: dropbear-kex.sh,v 1.3 2024/06/19 10:10:46 dtucker Exp $
+# $OpenBSD: dropbear-kex.sh,v 1.4 2025/03/11 07:42:08 dtucker Exp $
# Placed in the Public Domain.
tid="dropbear kex"
@@ -10,8 +10,14 @@ fi
cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak
kex="curve25519-sha256 curve25519-sha256@libssh.org"
-if $SSH -Q kex | grep 'diffie-hellman-group14-sha1'; then
- kex="$kex diffie-hellman-group14-sha256 diffie-hellman-group14-sha1"
+if $SSH -Q kex | grep 'diffie-hellman-group14-sha256' >/dev/null; then
+ kex="$kex diffie-hellman-group14-sha256"
+fi
+# There's no flag to query KEX, so if MACs does not contain SHA1, assume
+# there's also SHA1-based KEX methods either.
+if $SSH -Q kex | grep 'diffie-hellman-group14-sha1' >/dev/null && \
+ $DBCLIENT -m help hst 2>&1 | grep -- '-sha1' >/dev/null ; then
+ kex="$kex diffie-hellman-group14-sha1"
fi
for k in $kex; do
@@ -19,8 +25,9 @@ for k in $kex; do
rm -f ${COPY}
# dbclient doesn't have switch for kex, so force in server
(cat $OBJ/sshd_proxy.bak; echo "KexAlgorithms $k") >$OBJ/sshd_proxy
- env HOME=$OBJ dbclient -y -i $OBJ/.dropbear/id_ed25519 2>$OBJ/dbclient.log \
- -J "$OBJ/ssh_proxy.sh" somehost cat ${DATA} > ${COPY}
+ env HOME=$OBJ \
+ ${DBCLIENT} -y -i $OBJ/.dropbear/id_ed25519 2>$OBJ/dbclient.log \
+ -J "$OBJ/ssh_proxy.sh" somehost cat ${DATA} > ${COPY}
if [ $? -ne 0 ]; then
fail "ssh cat $DATA failed"
fi
|
