pijul/thrussh - Change D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC

Fixing the terrapin attack mitigation

Created by pmeunier on December 19, 2023

D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC

Dependencies

In channels

main

Change contents

Replacement in thrussh/src/server/mod.rs at line 80 [4.203388]
B:BD[4.206137] → [4.206137:206180]
```
            preferred: Default::default(),
```
[4.206137]
[4.206180]
```
            preferred: Preferred::DEFAULT_SERVER,
```
Insertion in thrussh/src/server/mod.rs at line 644 [4.203388]
[4.223768]
[4.223768]
```
    debug!("buf {:?}", buf);
```
Insertion in thrussh/src/server/kex.rs at line 60 [4.225726]
[4.227526]
[4.227526]
```
        debug!("preferred {:?}", config.preferred);
```

Replacement in thrussh/src/negotiation.rs at line 56 [4.268386]

B:BD[5.15326] → [5.15326:15373]

B:BD[5.15373] → [3.1055:1101]

    pub const DEFAULT: Preferred = Preferred {
        kex: &[kex::CURVE25519, kex::STRICT],

[5.15326]

[5.15406]

    pub const DEFAULT_SERVER: Preferred = Preferred {
        kex: &[kex::CURVE25519, kex::STRICT_S],
        key: &[
            key::ED25519,
            key::ECDSA_SHA2_NISTP256,
            key::RSA_SHA2_256,
            key::RSA_SHA2_512,
        ],
        cipher: &[cipher::chacha20poly1305::NAME],
        mac: &["none"],
        compression: &["none", "zlib", "zlib@openssh.com"],
    };
    #[cfg(all(feature = "openssl", feature = "p256"))]
    pub const DEFAULT_CLIENT: Preferred = Preferred {
        kex: &[kex::CURVE25519, kex::STRICT_C],

Replacement in thrussh/src/negotiation.rs at line 83 [4.268386]

B:BD[5.15762] → [5.15762:15809]

B:BD[5.15809] → [3.1102:1148]

    pub const DEFAULT: Preferred = Preferred {
        kex: &[kex::CURVE25519, kex::STRICT],

[5.15762]

[5.15842]

    pub const DEFAULT_SERVER: Preferred = Preferred {
        kex: &[kex::CURVE25519, kex::STRICT_S],
        key: &[key::ED25519, key::ECDSA_SHA2_NISTP256],
        cipher: &[cipher::chacha20poly1305::NAME],
        mac: &["none"],
        compression: &["none", "zlib", "zlib@openssh.com"],
    };
    #[cfg(all(not(feature = "openssl"), feature = "p256"))]
    pub const DEFAULT_CLIENT: Preferred = Preferred {
        kex: &[kex::CURVE25519, kex::STRICT_C],

Replacement in thrussh/src/negotiation.rs at line 101 [4.268386]

∅:D[6.32] → [4.270075:270122]

∅:D[5.16101] → [4.270075:270122]

B:BD[4.270075] → [4.270075:270122]

B:BD[4.270122] → [3.1149:1195]

    pub const DEFAULT: Preferred = Preferred {
        kex: &[kex::CURVE25519, kex::STRICT],

[5.16101]

[4.270155]

    pub const DEFAULT_SERVER: Preferred = Preferred {
        kex: &[kex::CURVE25519, kex::STRICT_S],
        key: &[key::ED25519, key::RSA_SHA2_256, key::RSA_SHA2_512],
        cipher: &[cipher::chacha20poly1305::NAME],
        mac: &["none"],
        compression: &["none", "zlib", "zlib@openssh.com"],
    };
    #[cfg(all(feature = "openssl", not(feature = "p256")))]
    pub const DEFAULT_CLIENT: Preferred = Preferred {
        kex: &[kex::CURVE25519, kex::STRICT_C],

Replacement in thrussh/src/negotiation.rs at line 119 [4.268386]

∅:D[5.16167] → [6.213:260]

B:BD[6.213] → [6.213:260]

B:BD[6.260] → [3.1196:1242]

    pub const DEFAULT: Preferred = Preferred {
        kex: &[kex::CURVE25519, kex::STRICT],

[5.16167]

[6.293]

    pub const DEFAULT_SERVER: Preferred = Preferred {
        kex: &[kex::CURVE25519, kex::STRICT_S],

Replacement in thrussh/src/negotiation.rs at line 127 [4.268386]

B:BD[4.270366] → [4.270366:270416]

B:BD[4.270416] → [3.1243:1289]

∅:D[3.1289] → [5.16168:16321]

B:BD[4.270449] → [5.16168:16321]

    pub const COMPRESSED: Preferred = Preferred {
        kex: &[kex::CURVE25519, kex::STRICT],
        key: &[
            key::ED25519,
            key::ECDSA_SHA2_NISTP256,
            key::RSA_SHA2_256,
            key::RSA_SHA2_512,
        ],

[4.270366]

[4.270517]

    #[cfg(all(not(feature = "openssl"), not(feature = "p256")))]
    pub const DEFAULT_CLIENT: Preferred = Preferred {
        kex: &[kex::CURVE25519, kex::STRICT_C],
        key: &[key::ED25519],

Replacement in thrussh/src/negotiation.rs at line 133 [4.268386]

B:BD[4.270592] → [4.270592:270652]

        compression: &["zlib", "zlib@openssh.com", "none"],

[4.270592]

[4.270652]

        compression: &["none", "zlib", "zlib@openssh.com"],

Deletion in thrussh/src/negotiation.rs at line 135 [4.268386]

B:BD[4.270659] → [4.270659:270756]

}
impl Default for Preferred {
    fn default() -> Preferred {
        Preferred::DEFAULT
    }

Replacement in thrussh/src/negotiation.rs at line 199 [4.268386]

B:BD[7.1623] → [3.1290:1469]

        let client_supports_strict = Self::select(&[kex::STRICT], kex_string).is_some();
        let server_supports_strict = Self::select(&[kex::STRICT], kex_string).is_some();

[7.1623]

[4.272078]

        let client_supports_strict = Self::select(&[kex::STRICT_C], kex_string).is_some();
        let server_supports_strict = Self::select(&[kex::STRICT_S], kex_string).is_some();
        debug!("strict {:?} {:?}", client_supports_strict, server_supports_strict);

Replacement in thrussh/src/kex.rs at line 48 [4.306916]

B:BD[4.308346] → [3.1552:1615]

pub const STRICT: Name = Name("kex-strict-c-v00@openssh.com");

[4.308346]

[7.1791]

pub const STRICT_C: Name = Name("kex-strict-c-v00@openssh.com");
pub const STRICT_S: Name = Name("kex-strict-s-v00@openssh.com");

Replacement in thrussh/src/client/mod.rs at line 22 [4.334998]

B:BD[4.335739] → [4.335739:335820]

use crate::{ChannelId, ChannelMsg, ChannelOpenFailure, Disconnect, Limits, Sig};

[4.335739]

[4.335820]

use crate::{ChannelId, ChannelMsg, ChannelOpenFailure, Disconnect, Limits, Preferred, Sig};

Replacement in thrussh/src/client/mod.rs at line 1127 [4.334998]

B:BD[3.1866] → [3.1866:1920]

                    return Err(Error::KexInit.into())

[3.1866]

[3.1920]

                    return Err(Error::KexInit.into());

Replacement in thrussh/src/client/mod.rs at line 1209 [4.334998]
B:BD[4.373003] → [4.373003:373046]
```
            preferred: Default::default(),
```
[4.373003]
[4.373046]
```
            preferred: Preferred::DEFAULT_CLIENT,
```
Replacement in thrussh/Cargo.toml at line 5 [4.426118]
B:BD[4.426214] → [2.20:39]
```
version = "0.34.0"
```
[4.426214]
[4.426233]
```
version = "0.35.1"
```