xref: /titanic_41/usr/src/cmd/ssh/include/myproposal.h (revision 6023a540d24df8406f1bd221f66d71e19332fafd)
1 /*
2  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23  */
24 
25 /*
26  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
27  * Use is subject to license terms.
28  */
29 
30 /*	$OpenBSD: myproposal.h,v 1.14 2002/04/03 09:26:11 markus Exp $	*/
31 
32 #ifndef	_MYPROPOSAL_H
33 #define	_MYPROPOSAL_H
34 
35 #ifdef __cplusplus
36 extern "C" {
37 #endif
38 
39 
40 #define	KEX_DEFAULT_KEX			"diffie-hellman-group-exchange-sha1," \
41 					"diffie-hellman-group1-sha1"
42 
43 #define	KEX_DEFAULT_PK_ALG		"ssh-rsa,ssh-dss"
44 
45 /*
46  * Keep CBC modes in the back of the client default cipher list for backward
47  * compatibility but remove them from the server side because there are some
48  * potential security issues with those modes regarding SSH protocol version 2.
49  * Since the client is the one who picks the cipher from the list offered by the
50  * server the only way to force the client not to use CBC modes is not to
51  * advertise those at all. Note that we still support all such CBC modes in the
52  * server code, this is about the default server cipher list only. The list can
53  * be changed in the Ciphers option in the sshd_config(4) file.
54  *
55  * Note that the ordering of ciphers on the server side is not relevant but we
56  * must do it properly even here so that we can use the macro for the client
57  * list as well.
58  */
59 #define	KEX_DEFAULT_SERVER_ENCRYPT	"aes128-ctr,aes192-ctr,aes256-ctr," \
60 					"arcfour128,arcfour256,arcfour"
61 
62 #define	KEX_DEFAULT_CLIENT_ENCRYPT	KEX_DEFAULT_SERVER_ENCRYPT \
63 					",aes128-cbc,aes192-cbc,aes256-cbc," \
64 					"blowfish-cbc,3des-cbc"
65 
66 #define	KEX_DEFAULT_MAC			"hmac-md5,hmac-sha1,hmac-sha1-96," \
67 					"hmac-md5-96"
68 
69 #define	KEX_DEFAULT_COMP		"none,zlib"
70 #define	KEX_DEFAULT_LANG		""
71 
72 
73 static char *my_srv_proposal[PROPOSAL_MAX] = {
74 	KEX_DEFAULT_KEX,
75 	KEX_DEFAULT_PK_ALG,
76 	KEX_DEFAULT_SERVER_ENCRYPT,
77 	KEX_DEFAULT_SERVER_ENCRYPT,
78 	KEX_DEFAULT_MAC,
79 	KEX_DEFAULT_MAC,
80 	KEX_DEFAULT_COMP,
81 	KEX_DEFAULT_COMP,
82 	KEX_DEFAULT_LANG,
83 	KEX_DEFAULT_LANG
84 };
85 
86 static char *my_clnt_proposal[PROPOSAL_MAX] = {
87 	KEX_DEFAULT_KEX,
88 	KEX_DEFAULT_PK_ALG,
89 	KEX_DEFAULT_CLIENT_ENCRYPT,
90 	KEX_DEFAULT_CLIENT_ENCRYPT,
91 	KEX_DEFAULT_MAC,
92 	KEX_DEFAULT_MAC,
93 	KEX_DEFAULT_COMP,
94 	KEX_DEFAULT_COMP,
95 	KEX_DEFAULT_LANG,
96 	KEX_DEFAULT_LANG
97 };
98 
99 #ifdef __cplusplus
100 }
101 #endif
102 
103 #endif /* _MYPROPOSAL_H */
104