diff --git a/openssh-7.2p1-fips.patch b/openssh-7.2p1-fips.patch index 69477f1..1baeba7 100644 --- a/openssh-7.2p1-fips.patch +++ b/openssh-7.2p1-fips.patch @@ -676,3 +676,31 @@ index f282907..51bbffb 100644 { NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL } }; +diff --git a/kex.c b/kex.c +index f07a636..4ce5843 100644 +--- a/kex.c ++++ b/kex.c +@@ -123,8 +123,6 @@ static const struct kexalg kexalgs[] = { + }; + + static const struct kexalg kexalgs_fips[] = { +- { KEX_DH14, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 }, +- { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1 }, + #ifdef HAVE_EVP_SHA256 + { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 }, + #endif +diff --git a/myproposal.h b/myproposal.h +index 7efe312..bcf2ae1 100644 +--- a/myproposal.h ++++ b/myproposal.h +@@ -131,9 +131,7 @@ + + #define KEX_DEFAULT_KEX_FIPS \ + KEX_ECDH_METHODS \ +- KEX_SHA256_METHODS \ +- "diffie-hellman-group-exchange-sha1," \ +- "diffie-hellman-group14-sha1" ++ KEX_SHA256_METHODS + #define KEX_FIPS_ENCRYPT \ + "aes128-ctr,aes192-ctr,aes256-ctr," \ + "aes128-cbc,3des-cbc," \