diff options
| -rw-r--r-- | interface-definitions/include/version/ssh-version.xml.i | 2 | ||||
| -rw-r--r-- | interface-definitions/service_ssh.xml.in | 4 | ||||
| -rw-r--r-- | smoketest/configs/assert/basic-vyos | 1 | ||||
| -rw-r--r-- | src/migration-scripts/ssh/2-to-3 | 31 |
4 files changed, 34 insertions, 4 deletions
diff --git a/interface-definitions/include/version/ssh-version.xml.i b/interface-definitions/include/version/ssh-version.xml.i index 0f25caf98..05cf431a7 100644 --- a/interface-definitions/include/version/ssh-version.xml.i +++ b/interface-definitions/include/version/ssh-version.xml.i @@ -1,3 +1,3 @@ <!-- include start from include/version/ssh-version.xml.i --> -<syntaxVersion component='ssh' version='2'></syntaxVersion> +<syntaxVersion component='ssh' version='3'></syntaxVersion> <!-- include end --> diff --git a/interface-definitions/service_ssh.xml.in b/interface-definitions/service_ssh.xml.in index c659a7db7..4d10de646 100644 --- a/interface-definitions/service_ssh.xml.in +++ b/interface-definitions/service_ssh.xml.in @@ -41,10 +41,10 @@ <help>Allowed ciphers</help> <completionHelp> <!-- generated by ssh -Q cipher | tr '\n' ' ' as this will not change dynamically --> - <list>3des-cbc aes128-cbc aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se aes128-ctr aes192-ctr aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com chacha20-poly1305@openssh.com</list> + <list>3des-cbc aes128-cbc aes192-cbc aes256-cbc aes128-ctr aes192-ctr aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com chacha20-poly1305@openssh.com</list> </completionHelp> <constraint> - <regex>(3des-cbc|aes128-cbc|aes192-cbc|aes256-cbc|rijndael-cbc@lysator.liu.se|aes128-ctr|aes192-ctr|aes256-ctr|aes128-gcm@openssh.com|aes256-gcm@openssh.com|chacha20-poly1305@openssh.com)</regex> + <regex>(3des-cbc|aes128-cbc|aes192-cbc|aes256-cbc|aes128-ctr|aes192-ctr|aes256-ctr|aes128-gcm@openssh.com|aes256-gcm@openssh.com|chacha20-poly1305@openssh.com)</regex> </constraint> <multi/> </properties> diff --git a/smoketest/configs/assert/basic-vyos b/smoketest/configs/assert/basic-vyos index 601051d8f..20363b77f 100644 --- a/smoketest/configs/assert/basic-vyos +++ b/smoketest/configs/assert/basic-vyos @@ -85,7 +85,6 @@ set service ssh ciphers 'aes128-ctr' set service ssh ciphers 'aes192-ctr' set service ssh ciphers 'aes256-ctr' set service ssh ciphers 'chacha20-poly1305@openssh.com' -set service ssh ciphers 'rijndael-cbc@lysator.liu.se' set service ssh key-exchange 'curve25519-sha256@libssh.org' set service ssh key-exchange 'diffie-hellman-group1-sha1' set service ssh key-exchange 'diffie-hellman-group-exchange-sha1' diff --git a/src/migration-scripts/ssh/2-to-3 b/src/migration-scripts/ssh/2-to-3 new file mode 100644 index 000000000..e18a6aa05 --- /dev/null +++ b/src/migration-scripts/ssh/2-to-3 @@ -0,0 +1,31 @@ +# Copyright VyOS maintainers and contributors <maintainers@vyos.io> +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this library. If not, see <http://www.gnu.org/licenses/>. + +# T8098: rijndael-cbc@lysator.liu.se was removed in OpenSSH 6.7 which is used +# starting with VyOS 1.4 + +from vyos.configtree import ConfigTree + +base = ['service', 'ssh'] + +def migrate(config: ConfigTree) -> None: + if not config.exists(base + ['ciphers']): + # Nothing to do + return + + deprecated_cipher = 'rijndael-cbc@lysator.liu.se' + for cipher in config.return_values(base + ['ciphers']): + if cipher == deprecated_cipher: + config.delete_value(base + ['ciphers'], value=deprecated_cipher) |