From 737109b2b8ab62e6392584e83ea4c61f4d8b00d5 Mon Sep 17 00:00:00 2001 From: Nicola Murino Date: Fri, 6 May 2022 09:21:57 +0200 Subject: [PATCH] sftpfs: add more ciphers, KEXs and MACs they are negotiated according to the order. Restrictions are generally configured server side. I want to avoid to expose other settings for now. Fixes #817 Signed-off-by: Nicola Murino --- go.mod | 2 +- go.sum | 4 ++-- vfs/sftpfs.go | 11 +++++++++++ 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 4fe81dcb..250e4779 100644 --- a/go.mod +++ b/go.mod @@ -152,7 +152,7 @@ require ( golang.org/x/tools v0.1.10 // indirect golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f // indirect google.golang.org/appengine v1.6.7 // indirect - google.golang.org/genproto v0.0.0-20220504150022-98cd25cafc72 // indirect + google.golang.org/genproto v0.0.0-20220505152158-f39f71e6c8f3 // indirect google.golang.org/grpc v1.46.0 // indirect google.golang.org/protobuf v1.28.0 // indirect gopkg.in/ini.v1 v1.66.4 // indirect diff --git a/go.sum b/go.sum index 4be132b8..df885b29 100644 --- a/go.sum +++ b/go.sum @@ -1200,8 +1200,8 @@ google.golang.org/genproto v0.0.0-20220414192740-2d67ff6cf2b4/go.mod h1:8w6bsBMX google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo= google.golang.org/genproto v0.0.0-20220429170224-98d788798c3e/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo= google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4= -google.golang.org/genproto v0.0.0-20220504150022-98cd25cafc72 h1:iif0mpUetMBqcQPUoq+JnCcmzvfpp8wRx515va8wP1c= -google.golang.org/genproto v0.0.0-20220504150022-98cd25cafc72/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4= +google.golang.org/genproto v0.0.0-20220505152158-f39f71e6c8f3 h1:q1kiSVscqoDeqTF27eQ2NnLLDmqF0I373qQNXYMy0fo= +google.golang.org/genproto v0.0.0-20220505152158-f39f71e6c8f3/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= diff --git a/vfs/sftpfs.go b/vfs/sftpfs.go index 970b2266..3b90b971 100644 --- a/vfs/sftpfs.go +++ b/vfs/sftpfs.go @@ -787,6 +787,17 @@ func (fs *SFTPFs) createConnection() error { if fs.config.Password.GetPayload() != "" { clientConfig.Auth = append(clientConfig.Auth, ssh.Password(fs.config.Password.GetPayload())) } + // add more ciphers, KEXs and MACs, they are negotiated according to the order + clientConfig.Ciphers = []string{"aes128-gcm@openssh.com", "aes256-gcm@openssh.com", "chacha20-poly1305@openssh.com", + "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "aes192-cbc", "aes256-cbc"} + clientConfig.KeyExchanges = []string{"curve25519-sha256", "curve25519-sha256@libssh.org", + "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", + "diffie-hellman-group14-sha256", "diffie-hellman-group16-sha512", "diffie-hellman-group18-sha512", + "diffie-hellman-group-exchange-sha256", "diffie-hellman-group-exchange-sha1", + "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"} + clientConfig.MACs = []string{"hmac-sha2-256-etm@openssh.com", "hmac-sha2-256", + "hmac-sha2-512-etm@openssh.com", "hmac-sha2-512", + "hmac-sha1", "hmac-sha1-96"} fs.sshClient, err = ssh.Dial("tcp", fs.config.Endpoint, clientConfig) if err != nil { fsLog(fs, logger.LevelError, "unable to connect: %v", err)