# HG changeset patch
# User Matt Johnston <matt@ucc.asn.au>
# Date 1519656173 -28800
# Node ID d1a8a05216ff6778b74b184bc8015e0a7a3b2d06
# Parent  016b86f03e21be804c1e802da9867197038d8b01
make group1 client-only

diff -r 016b86f03e21 -r d1a8a05216ff default_options.h
--- a/default_options.h	Mon Feb 26 22:19:01 2018 +0800
+++ b/default_options.h	Mon Feb 26 22:42:53 2018 +0800
@@ -149,12 +149,17 @@
  * Small systems should generally include either curve25519 or ecdh for performance.
  * curve25519 is less widely supported but is faster
  */ 
-#define DROPBEAR_DH_GROUP1 0
 #define DROPBEAR_DH_GROUP14_SHA1 1
 #define DROPBEAR_DH_GROUP14_SHA256 1
 #define DROPBEAR_DH_GROUP16 0
 #define DROPBEAR_CURVE25519 1
 #define DROPBEAR_ECDH 1
+#define DROPBEAR_DH_GROUP1 1
+
+/* When group1 is enabled it will only be allowed by Dropbear client
+not as a server, due to concerns over its strength. Set to 0 to allow
+group1 in Dropbear server too */
+#define DROPBEAR_DH_GROUP1_CLIENTONLY 1
 
 /* Control the memory/performance/compression tradeoff for zlib.
  * Set windowBits=8 for least memory usage, see your system's
diff -r 016b86f03e21 -r d1a8a05216ff svr-session.c
--- a/svr-session.c	Mon Feb 26 22:19:01 2018 +0800
+++ b/svr-session.c	Mon Feb 26 22:42:53 2018 +0800
@@ -42,6 +42,7 @@
 #include "crypto_desc.h"
 
 static void svr_remoteclosed(void);
+static void svr_algos_initialise(void);
 
 struct serversession svr_ses; /* GLOBAL */
 
@@ -102,6 +103,7 @@
 	svr_authinitialise();
 	chaninitialise(svr_chantypes);
 	svr_chansessinitialise();
+	svr_algos_initialise();
 
 	/* for logging the remote address */
 	get_socket_address(ses.sock_in, NULL, NULL, &host, &port, 0);
@@ -243,3 +245,14 @@
 
 }
 
+static void svr_algos_initialise(void) {
+#if DROPBEAR_DH_GROUP1 && DROPBEAR_DH_GROUP1_CLIENTONLY
+	algo_type *algo;
+	for (algo = sshkex; algo->name; algo++) {
+		if (strcmp(algo->name, "diffie-hellman-group1-sha1") == 0) {
+			algo->usable = 0;
+		}
+	}
+#endif
+}
+