ClearML/dropbear
1
0
Fork 0
mirror of https://github.com/clearml/dropbear synced 2025-03-03 10:41:39 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Disable non-delayed zlib for server

Browse Source
This commit is contained in:
Matt Johnston 2015-01-28 21:38:27 +08:00
parent 6165f53fcd
commit a7a79d569a
7 changed files with 42 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
algo.h
View File

@ -51,6 +51,7 @@ extern algo_type sshhostkey[];
extern algo_type sshciphers[];
extern algo_type sshhashes[];
extern algo_type ssh_compress[];
extern algo_type ssh_delaycompress[];
extern algo_type ssh_nocompress[];
extern const struct dropbear_cipher dropbear_nocipher;

4
cli-runopts.c
View File

@ -156,7 +156,7 @@ void cli_getopts(int argc, char ** argv) {
cli_opts.proxycmd = NULL;
#endif
#ifndef DISABLE_ZLIB
opts.enable_compress = 1;
opts.compress_mode = DROPBEAR_COMPRESS_ON;
#endif
#ifdef ENABLE_USER_ALGO_LIST
opts.cipher_list = NULL;
@ -609,7 +609,7 @@ static void parse_multihop_hostname(const char* orighostarg, const char* argv0)
passthrough_args, remainder);
#ifndef DISABLE_ZLIB
/* The stream will be incompressible since it's encrypted. */
opts.enable_compress = 0;
opts.compress_mode = DROPBEAR_COMPRESS_OFF;
#endif
m_free(passthrough_args);
}

6
common-algo.c
View File

@ -205,6 +205,12 @@ algo_type ssh_compress[] = {
{"none", DROPBEAR_COMP_NONE, NULL, 1, NULL},
{NULL, 0, NULL, 0, NULL}
};
algo_type ssh_delaycompress[] = {
{"zlib@openssh.com", DROPBEAR_COMP_ZLIB_DELAY, NULL, 1, NULL},
{"none", DROPBEAR_COMP_NONE, NULL, 1, NULL},
{NULL, 0, NULL, 0, NULL}
};
#endif
algo_type ssh_nocompress[] = {

22
common-kex.c
View File

@ -238,14 +238,24 @@ void recv_msg_newkeys() {
void kexfirstinitialise() {
ses.kexstate.donefirstkex = 0;
#ifndef DISABLE_ZLIB
if (opts.enable_compress) {
ses.compress_algos = ssh_compress;
} else
#endif
{
#ifdef DISABLE_ZLIB
ses.compress_algos = ssh_nocompress;
#else
switch (opts.compress_mode)
{
case DROPBEAR_COMPRESS_DELAYED:
ses.compress_algos = ssh_delaycompress;
break;
case DROPBEAR_COMPRESS_ON:
ses.compress_algos = ssh_compress;
break;
case DROPBEAR_COMPRESS_OFF:
ses.compress_algos = ssh_nocompress;
break;
}
#endif
kexinitialise();
}

5
options.h
View File

@ -174,6 +174,11 @@ much traffic. */
#define DROPBEAR_ZLIB_WINDOW_BITS 15
#endif
/* Server won't allow zlib compression until after authentication. Prevents
flaws in the zlib library being unauthenticated exploitable flaws.
Some old ssh clients may not support the alternative zlib@openssh.com method */
#define DROPBEAR_SERVER_DELAY_ZLIB 1
/* Whether to do reverse DNS lookups. */
/*#define DO_HOST_LOOKUP */

6
runopts.h
View File

@ -44,7 +44,11 @@ typedef struct runopts {
/* TODO: add a commandline flag. Currently this is on by default if compression
* is compiled in, but disabled for a client's non-final multihop stages. (The
* intermediate stages are compressed streams, so are uncompressible. */
int enable_compress;
enum {
DROPBEAR_COMPRESS_DELAYED, /* Server only */
DROPBEAR_COMPRESS_ON,
DROPBEAR_COMPRESS_OFF,
} compress_mode;
#endif
#ifdef ENABLE_USER_ALGO_LIST

8
svr-runopts.c
View File

@ -140,9 +140,15 @@ void svr_getopts(int argc, char ** argv) {
#ifdef ENABLE_SVR_REMOTETCPFWD
svr_opts.noremotetcp = 0;
#endif
#ifndef DISABLE_ZLIB
opts.enable_compress = 1;
#if DROPBEAR_SERVER_DELAY_ZLIB
opts.compress_mode = DROPBEAR_COMPRESS_DELAYED;
#else
opts.compress_mode = DROPBEAR_COMPRESS_ON;
#endif
#endif
/* not yet
opts.ipv4 = 1;
opts.ipv6 = 1;