Fixing the terrapin attack mitigation

pmeunier

Dec 19, 2023, 9:16 AM

D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC

Dependencies

[2] 2Q3SZY2C Version bump
[3] VJIXIN4T Fixing CVE-2023-48795
[4] KNLLUDOI Correct usage of `tokio::select!`
[5] 2WEO7OZL Version updates: getting rid of anyhow + moving to Tokio 1.0
[6] ASD7JVBE Do not read past the size of the buffer (after Tokio 0.3)
[7] 2VTUKRLJ Version
[8] ORSEEVB5 Version bump
[9] 7Y2ROIVZ Version bump
[10] E2SB74SV Version 0.30.3
[11] VYDCQWSF Version 0.30.6
[12] UHAEQPZU Support ecdsa-sha2-nistp256 keys for authentication
[13] FT67GGO4 Version bump (Pijul and Thrussh)
[14] BRDS7STA Adding method `send_channel_msg` to client::Session, to make it easier to write handlers
[15] OQZGSEWM Buffering non-kex packets received after issuing a KEXINIT
[16] TAOFQAII cargo fmt
[17] WXZWQLGL Correct negotiation without OpenSSL
[18] 7FRJYUI6 Reboot because of a bad change
[19] CQSPFH4H Version 0.30.4
[20] DJT33BQE Version bump
[21] PDTFLA4Y Version 0.30.7
[22] NHOSLQGG Thrussh: making OpenSSL optional
[23] EUHO3DAZ Send a SSH_MSG_EXT_INFO with server-sig-algs when the client indicates they support extensions by sending ext-info-c. This allows modern clients that don't do ssh-rsa anymore because of sha1 to still use RSA keys with sha2.
[24] 634OYCNM Tokio 0.3
[25] TFYJ3P2A Version 0.30.8/0.19.4, and solving conflicts
[26] G3FNNIIU Limiting the amount of messages that can be buffered while rekeying to two channel windows
[27] 662ZS5JF Version 0.33.2
[28] CWHVPLXN Version bump

Change contents

replacement in thrussh/src/server/mod.rs at line 80

[4.206137]→[4.206137:206180](∅→∅)

preferred: Default::default(),

[4.206137]

[4.206180]

preferred: Preferred::DEFAULT_SERVER,
edit in thrussh/src/server/mod.rs at line 644

[4.223768]

[4.223768]

debug!("buf {:?}", buf);
edit in thrussh/src/server/kex.rs at line 60

[4.227526]

[4.227526]

debug!("preferred {:?}", config.preferred);
replacement in thrussh/src/negotiation.rs at line 56

[4.15326]→[4.15326:15373](∅→∅),[4.15373]→[3.1055:1101](∅→∅)

pub const DEFAULT: Preferred = Preferred {
kex: &[kex::CURVE25519, kex::STRICT],

[4.15326]

[4.15406]

pub const DEFAULT_SERVER: Preferred = Preferred {
kex: &[kex::CURVE25519, kex::STRICT_S],
key: &[
key::ED25519,
key::ECDSA_SHA2_NISTP256,
key::RSA_SHA2_256,
key::RSA_SHA2_512,
],
cipher: &[cipher::chacha20poly1305::NAME],
mac: &["none"],
compression: &["none", "zlib", "zlib@openssh.com"],
};
#[cfg(all(feature = "openssl", feature = "p256"))]
pub const DEFAULT_CLIENT: Preferred = Preferred {
kex: &[kex::CURVE25519, kex::STRICT_C],
replacement in thrussh/src/negotiation.rs at line 83

[4.15762]→[4.15762:15809](∅→∅),[4.15809]→[3.1102:1148](∅→∅)

pub const DEFAULT: Preferred = Preferred {
kex: &[kex::CURVE25519, kex::STRICT],

[4.15762]

[4.15842]

pub const DEFAULT_SERVER: Preferred = Preferred {
kex: &[kex::CURVE25519, kex::STRICT_S],
key: &[key::ED25519, key::ECDSA_SHA2_NISTP256],
cipher: &[cipher::chacha20poly1305::NAME],
mac: &["none"],
compression: &["none", "zlib", "zlib@openssh.com"],
};

#[cfg(all(not(feature = "openssl"), feature = "p256"))]
pub const DEFAULT_CLIENT: Preferred = Preferred {
kex: &[kex::CURVE25519, kex::STRICT_C],
replacement in thrussh/src/negotiation.rs at line 101

[4.32]→[4.270075:270122](∅→∅),[4.16101]→[4.270075:270122](∅→∅),[4.270075]→[4.270075:270122](∅→∅),[4.270122]→[3.1149:1195](∅→∅)

pub const DEFAULT: Preferred = Preferred {
kex: &[kex::CURVE25519, kex::STRICT],

[4.16101]

[4.270155]

pub const DEFAULT_SERVER: Preferred = Preferred {
kex: &[kex::CURVE25519, kex::STRICT_S],
key: &[key::ED25519, key::RSA_SHA2_256, key::RSA_SHA2_512],
cipher: &[cipher::chacha20poly1305::NAME],
mac: &["none"],
compression: &["none", "zlib", "zlib@openssh.com"],
};

#[cfg(all(feature = "openssl", not(feature = "p256")))]
pub const DEFAULT_CLIENT: Preferred = Preferred {
kex: &[kex::CURVE25519, kex::STRICT_C],
replacement in thrussh/src/negotiation.rs at line 119

[4.16167]→[4.213:260](∅→∅),[4.213]→[4.213:260](∅→∅),[4.260]→[3.1196:1242](∅→∅)

pub const DEFAULT: Preferred = Preferred {
kex: &[kex::CURVE25519, kex::STRICT],

[4.16167]

[4.293]

pub const DEFAULT_SERVER: Preferred = Preferred {
kex: &[kex::CURVE25519, kex::STRICT_S],
replacement in thrussh/src/negotiation.rs at line 127

[4.270366]→[4.270366:270416](∅→∅),[4.270416]→[3.1243:1289](∅→∅),[3.1289]→[4.16168:16321](∅→∅),[4.270449]→[4.16168:16321](∅→∅)

pub const COMPRESSED: Preferred = Preferred {
kex: &[kex::CURVE25519, kex::STRICT],
key: &[
key::ED25519,
key::ECDSA_SHA2_NISTP256,
key::RSA_SHA2_256,
key::RSA_SHA2_512,
],

[4.270366]

[4.270517]

#[cfg(all(not(feature = "openssl"), not(feature = "p256")))]
pub const DEFAULT_CLIENT: Preferred = Preferred {
kex: &[kex::CURVE25519, kex::STRICT_C],
key: &[key::ED25519],
replacement in thrussh/src/negotiation.rs at line 133

[4.270592]→[4.270592:270652](∅→∅)

compression: &["zlib", "zlib@openssh.com", "none"],

[4.270592]

[4.270652]

compression: &["none", "zlib", "zlib@openssh.com"],
edit in thrussh/src/negotiation.rs at line 135

[4.270659]→[4.270659:270756](∅→∅)

}

impl Default for Preferred {
fn default() -> Preferred {
Preferred::DEFAULT
}
replacement in thrussh/src/negotiation.rs at line 199

[4.1623]→[3.1290:1469](∅→∅)

let client_supports_strict = Self::select(&[kex::STRICT], kex_string).is_some();
let server_supports_strict = Self::select(&[kex::STRICT], kex_string).is_some();

[4.1623]

[4.272078]

let client_supports_strict = Self::select(&[kex::STRICT_C], kex_string).is_some();
let server_supports_strict = Self::select(&[kex::STRICT_S], kex_string).is_some();
debug!("strict {:?} {:?}", client_supports_strict, server_supports_strict);
replacement in thrussh/src/kex.rs at line 48

[4.308346]→[3.1552:1615](∅→∅)

pub const STRICT: Name = Name("kex-strict-c-v00@openssh.com");

[4.308346]

[4.1791]

pub const STRICT_C: Name = Name("kex-strict-c-v00@openssh.com");
pub const STRICT_S: Name = Name("kex-strict-s-v00@openssh.com");
replacement in thrussh/src/client/mod.rs at line 22

[4.335739]→[4.335739:335820](∅→∅)

use crate::{ChannelId, ChannelMsg, ChannelOpenFailure, Disconnect, Limits, Sig};

[4.335739]

[4.335820]

use crate::{ChannelId, ChannelMsg, ChannelOpenFailure, Disconnect, Limits, Preferred, Sig};
replacement in thrussh/src/client/mod.rs at line 1127

[3.1866]→[3.1866:1920](∅→∅)

return Err(Error::KexInit.into())

[3.1866]

[3.1920]

return Err(Error::KexInit.into());
replacement in thrussh/src/client/mod.rs at line 1209

[4.373003]→[4.373003:373046](∅→∅)

preferred: Default::default(),

[4.373003]

[4.373046]

preferred: Preferred::DEFAULT_CLIENT,
replacement in thrussh/Cargo.toml at line 5

[4.426214]→[2.20:39](∅→∅)

version = "0.34.0"

[4.426214]

[4.426233]

version = "0.35.1"