diff options
| author | Darren Tucker <dtucker@zip.com.au> | 2013-06-11 11:47:40 +1000 |
|---|---|---|
| committer | Darren Tucker <dtucker@zip.com.au> | 2013-06-11 11:47:40 +1000 |
| commit | 37885e4b5e0dc937ffaff234c48460e6aa31b34a (patch) | |
| tree | bae1ed773f867219780b19b96f489e7f10d54e03 | |
| parent | b396fa313014ca06e7e694ab01b7c36cba660b0a (diff) | |
- (dtucker) [myproposal.h] Do not advertise AES GSM ciphers if we don't haveV_6_2
the required OpenSSL support. Patch from naddy at freebsd.
| -rw-r--r-- | ChangeLog | 4 | ||||
| -rw-r--r-- | myproposal.h | 9 |
2 files changed, 12 insertions, 1 deletions
@@ -1,3 +1,7 @@ +20130610 + - (dtucker) [myproposal.h] Do not advertise AES GSM ciphers if we don't have + the required OpenSSL support. Patch from naddy at freebsd. + 20130516 - (djm) [contrib/ssh-copy-id] Fix bug that could cause "rm *" to be executed if mktemp failed; bz#2105 ok dtucker@ diff --git a/myproposal.h b/myproposal.h index 99d09346..05b17dbb 100644 --- a/myproposal.h +++ b/myproposal.h @@ -45,6 +45,13 @@ # define HOSTKEY_ECDSA_METHODS #endif +#ifdef OPENSSL_HAVE_EVPGCM +# define AESGCM_CIPHER_MODES \ + "aes128-gcm@openssh.com,aes256-gcm@openssh.com," +#else +# define AESGCM_CIPHER_MODES +#endif + /* Old OpenSSL doesn't support what we need for DHGEX-sha256 */ #if OPENSSL_VERSION_NUMBER >= 0x00907000L # define KEX_SHA256_METHODS \ @@ -73,7 +80,7 @@ #define KEX_DEFAULT_ENCRYPT \ "aes128-ctr,aes192-ctr,aes256-ctr," \ "arcfour256,arcfour128," \ - "aes128-gcm@openssh.com,aes256-gcm@openssh.com," \ + AESGCM_CIPHER_MODES \ "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc," \ "aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se" #ifdef HAVE_EVP_SHA256 |