From 4d7ff0a8169141d18335638cf7c6e48d4c18cdf2 Mon Sep 17 00:00:00 2001
From: Hans Nilsson <hans@erlang.org>
Date: Tue, 16 May 2017 11:52:45 +0200
Subject: ssh: disable rsa-sha2-* for clients because there is a bug in the
 client verification code for those algorithms

---
 lib/ssh/src/ssh_options.erl | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/lib/ssh/src/ssh_options.erl b/lib/ssh/src/ssh_options.erl
index aebb5a7062..12c0190082 100644
--- a/lib/ssh/src/ssh_options.erl
+++ b/lib/ssh/src/ssh_options.erl
@@ -392,6 +392,12 @@ default(server) ->
             class => user_options
            },
 
+      {preferred_algorithms, def} =>
+          #{default => ssh:default_algorithms(),
+            chk => fun check_preferred_algorithms/1,
+            class => user_options
+           },
+
 %%%%% Undocumented
       {infofun, def} =>
           #{default => fun(_,_,_) -> void end,
@@ -430,11 +436,26 @@ default(client) ->
            },
 
       {pref_public_key_algs, def} =>
-          #{default => ssh_transport:default_algorithms(public_key),
+          #{default => ssh_transport:default_algorithms(public_key) -- ['rsa-sha2-256',
+                                                                        'rsa-sha2-512'],
             chk => fun check_pref_public_key_algs/1,
             class => user_options
            },
 
+      {preferred_algorithms, def} =>
+          #{default => [{K,Vs} || {K,Vs0} <- ssh:default_algorithms(),
+                                  Vs <- [case K of
+                                             public_key -> 
+                                                 Vs0 -- ['rsa-sha2-256',
+                                                         'rsa-sha2-512'];
+                                             _ ->
+                                                 Vs0
+                                         end]
+                       ],
+            chk => fun check_preferred_algorithms/1,
+            class => user_options
+           },
+
       {dh_gex_limits, def} =>
           #{default => {1024, 6144, 8192},      % FIXME: Is this true nowadays?
             chk => fun({Min,I,Max}) ->
@@ -500,12 +521,6 @@ default(common) ->
              class => user_options
             },
 
-       {preferred_algorithms, def} =>
-           #{default => ssh:default_algorithms(),
-             chk => fun check_preferred_algorithms/1,
-             class => user_options
-            },
-
        {id_string, def} => 
            #{default => undefined, % FIXME: see ssh_transport:ssh_vsn/0
              chk => fun(random) -> 
-- 
cgit v1.2.3