|
 |
f7003b |
diff --git a/compat.c b/compat.c
|
|
|
f7003b |
index 46dfe3a9c2e..478a9403eea 100644
|
|
|
f7003b |
--- a/compat.c
|
|
|
f7003b |
+++ b/compat.c
|
|
|
f7003b |
@@ -190,26 +190,26 @@ compat_pkalg_proposal(struct ssh *ssh, char *pkalg_prop)
|
|
|
f7003b |
char *
|
|
|
f7003b |
compat_kex_proposal(struct ssh *ssh, char *p)
|
|
|
f7003b |
{
|
|
|
f7003b |
- char *cp = NULL;
|
|
|
f7003b |
+ char *cp = NULL, *cp2 = NULL;
|
|
|
f7003b |
|
|
|
f7003b |
if ((ssh->compat & (SSH_BUG_CURVE25519PAD|SSH_OLD_DHGEX)) == 0)
|
|
|
f7003b |
return xstrdup(p);
|
|
|
f7003b |
debug2_f("original KEX proposal: %s", p);
|
|
|
f7003b |
if ((ssh->compat & SSH_BUG_CURVE25519PAD) != 0)
|
|
|
f7003b |
- if ((p = match_filter_denylist(p,
|
|
|
f7003b |
+ if ((cp = match_filter_denylist(p,
|
|
|
f7003b |
"curve25519-sha256@libssh.org")) == NULL)
|
|
|
f7003b |
fatal("match_filter_denylist failed");
|
|
|
f7003b |
if ((ssh->compat & SSH_OLD_DHGEX) != 0) {
|
|
|
f7003b |
- cp = p;
|
|
|
f7003b |
- if ((p = match_filter_denylist(p,
|
|
|
f7003b |
+ if ((cp2 = match_filter_denylist(cp ? cp : p,
|
|
|
f7003b |
"diffie-hellman-group-exchange-sha256,"
|
|
|
f7003b |
"diffie-hellman-group-exchange-sha1")) == NULL)
|
|
|
f7003b |
fatal("match_filter_denylist failed");
|
|
|
f7003b |
free(cp);
|
|
|
f7003b |
+ cp = cp2;
|
|
|
f7003b |
}
|
|
|
f7003b |
- debug2_f("compat KEX proposal: %s", p);
|
|
|
f7003b |
- if (*p == '\0')
|
|
|
f7003b |
+ if (cp == NULL || *cp == '\0')
|
|
|
f7003b |
fatal("No supported key exchange algorithms found");
|
|
|
f7003b |
- return p;
|
|
|
f7003b |
+ debug2_f("compat KEX proposal: %s", cp);
|
|
|
f7003b |
+ return cp;
|
|
|
f7003b |
}
|
|
|
f7003b |
|