Merge pull request #761 from net-ssh/revert-757-opt-in-etm-hmac

Revert "Make hmac-sha2-{256,512}-etm opt-in"

CHANGES.txt

@@ -1,14 +1,5 @@
-=== 6.0.1
-
-  * Make sha2-{256,512}[email protected] MAC opt-in as they seems to have issues [#757]
-
-=== 6.0.0
-
-  * Support empty lines and comments in known_hosts [donoghuc, #742]
-  * Add sha2-{256,512}[email protected] MAC algorithms [graaff, #714]
-
 === 6.0.0 beta2
-
+  
   * Support :certkeys and CertificateFile configuration option  [Anders Carling, #722]
 
 === 6.0.0 beta1

lib/net/ssh/transport/algorithms.rb

@@ -43,7 +43,8 @@ class Algorithms
 
           encryption: %w[aes256-ctr aes192-ctr aes128-ctr],
 
-          hmac: %w[hmac-sha2-512 hmac-sha2-256
+          hmac: %w[[email protected] [email protected]
+                   hmac-sha2-512 hmac-sha2-256
                    hmac-sha1]
         }.freeze
 
@@ -83,9 +84,7 @@ class Algorithms
                    hmac-sha1-96
                    hmac-ripemd160 [email protected]
                    hmac-md5 hmac-md5-96
-                   none] +
-                %w[[email protected]
-                   [email protected]],
+                   none],
 
           compression: %w[none [email protected] zlib],
           language: %w[]

test/transport/test_algorithms.rb

@@ -21,7 +21,7 @@ def test_constructor_should_build_default_list_of_preferred_algorithms
       assert_equal ed_ec_host_keys + %w[[email protected] [email protected] ssh-rsa], algorithms[:host_key]
       assert_equal x25519_kex + ec_kex + %w[diffie-hellman-group-exchange-sha256 diffie-hellman-group14-sha1], algorithms[:kex]
       assert_equal %w[aes256-ctr aes192-ctr aes128-ctr], algorithms[:encryption]
-      assert_equal %w[hmac-sha2-512 hmac-sha2-256 hmac-sha1], algorithms[:hmac]
+      assert_equal %w[hmac-sha2-512[email protected] [email protected] hmac-sha2-512 hmac-sha2-256 hmac-sha1], algorithms[:hmac]
       assert_equal %w[none [email protected] zlib], algorithms[:compression]
       assert_equal %w[], algorithms[:language]
     end
@@ -30,7 +30,7 @@ def test_constructor_should_build_complete_list_of_algorithms_with_append_all_su
       assert_equal ed_ec_host_keys + %w[[email protected] [email protected] ssh-rsa ssh-dss], algorithms(append_all_supported_algorithms: true)[:host_key]
       assert_equal x25519_kex + ec_kex + %w[diffie-hellman-group-exchange-sha256 diffie-hellman-group14-sha1 diffie-hellman-group-exchange-sha1 diffie-hellman-group1-sha1], algorithms(append_all_supported_algorithms: true)[:kex]
       assert_equal %w[aes256-ctr aes192-ctr aes128-ctr aes256-cbc aes192-cbc aes128-cbc [email protected] blowfish-ctr blowfish-cbc cast128-ctr cast128-cbc 3des-ctr 3des-cbc idea-cbc none], algorithms(append_all_supported_algorithms: true)[:encryption]
-      assert_equal %w[hmac-sha2-512 hmac-sha2-256 hmac-sha1 hmac-sha2-512-96 hmac-sha2-256-96 hmac-sha1-96 hmac-ripemd160 [email protected] hmac-md5 hmac-md5-96 none [email protected] [email protected]], algorithms(append_all_supported_algorithms: true)[:hmac]
+      assert_equal %w[hmac-sha2-512[email protected] hmac-sha2-256[email protected] hmac-sha2-512 hmac-sha2-256 hmac-sha1 hmac-sha2-512-96 hmac-sha2-256-96 hmac-sha1-96 hmac-ripemd160 [email protected] hmac-md5 hmac-md5-96 none], algorithms(append_all_supported_algorithms: true)[:hmac]
       assert_equal %w[none [email protected] zlib], algorithms(append_all_supported_algorithms: true)[:compression]
       assert_equal %w[], algorithms[:language]
     end
@@ -135,25 +135,25 @@ def test_constructor_with_preferred_encryption_supports_removals_with_wildcard
     end
 
     def test_constructor_with_preferred_hmac_should_put_preferred_hmac_first
-      assert_equal %w[hmac-md5-96 hmac-sha2-512 hmac-sha2-256 hmac-sha1 hmac-sha2-512-96 hmac-sha2-256-96 hmac-sha1-96 hmac-ripemd160 [email protected] hmac-md5 none [email protected] [email protected]], algorithms(hmac: "hmac-md5-96", append_all_supported_algorithms: true)[:hmac]
+      assert_equal %w[hmac-md5-96 hmac-sha2-512[email protected] hmac-sha2-256[email protected] hmac-sha2-512 hmac-sha2-256 hmac-sha1 hmac-sha2-512-96 hmac-sha2-256-96 hmac-sha1-96 hmac-ripemd160 [email protected] hmac-md5 none], algorithms(hmac: "hmac-md5-96", append_all_supported_algorithms: true)[:hmac]
     end
 
     def test_constructor_with_multiple_preferred_hmac_should_put_all_preferred_hmac_first
-      assert_equal %w[hmac-md5-96 hmac-sha1-96 hmac-sha2-512 hmac-sha2-256 hmac-sha1 hmac-sha2-512-96 hmac-sha2-256-96 hmac-ripemd160 [email protected] hmac-md5 none [email protected] [email protected]], algorithms(hmac: %w[hmac-md5-96 hmac-sha1-96], append_all_supported_algorithms: true)[:hmac]
+      assert_equal %w[hmac-md5-96 hmac-sha1-96 hmac-sha2-512[email protected] hmac-sha2-256[email protected] hmac-sha2-512 hmac-sha2-256 hmac-sha1 hmac-sha2-512-96 hmac-sha2-256-96 hmac-ripemd160 [email protected] hmac-md5 none], algorithms(hmac: %w[hmac-md5-96 hmac-sha1-96], append_all_supported_algorithms: true)[:hmac]
     end
 
     def test_constructor_with_unrecognized_hmac_should_ignore_those
-      assert_equal %w[hmac-sha2-512 hmac-sha2-256 hmac-sha1 hmac-sha2-512-96 hmac-sha2-256-96 hmac-sha1-96 hmac-ripemd160 [email protected] hmac-md5 hmac-md5-96 none [email protected] [email protected]],
+      assert_equal %w[hmac-sha2-512[email protected] hmac-sha2-256[email protected] hmac-sha2-512 hmac-sha2-256 hmac-sha1 hmac-sha2-512-96 hmac-sha2-256-96 hmac-sha1-96 hmac-ripemd160 [email protected] hmac-md5 hmac-md5-96 none],
         algorithms(hmac: "unknown hmac-md5-96", append_all_supported_algorithms: true)[:hmac]
     end
 
     def test_constructor_with_preferred_hmac_supports_additions
-      assert_equal %w[hmac-sha2-512 hmac-sha2-256 hmac-sha1 hmac-sha2-512-96 hmac-sha2-256-96 hmac-sha1-96 hmac-ripemd160 [email protected] hmac-md5 hmac-md5-96 [email protected] [email protected]],
+      assert_equal %w[hmac-sha2-512[email protected] hmac-sha2-256[email protected] hmac-sha2-512 hmac-sha2-256 hmac-sha1 hmac-sha2-512-96 hmac-sha2-256-96 hmac-sha1-96 hmac-ripemd160 [email protected] hmac-md5 hmac-md5-96],
                    algorithms(hmac: %w[+hmac-md5-96 -none])[:hmac]
     end
 
     def test_constructor_with_preferred_hmac_supports_removals_with_wildcard
-      assert_equal %w[hmac-sha2-512 hmac-sha2-256 hmac-sha2-512-96 hmac-sha2-256-96 hmac-ripemd160 [email protected] hmac-sha2-256-[email protected] hmac-sha2-512-etm@openssh.com],
+      assert_equal %w[hmac-sha2-512[email protected] hmac-sha2-256[email protected] hmac-sha2-512 hmac-sha2-256 hmac-sha2-512-96 hmac-sha2-256-96 hmac-ripemd160 hmac-ripemd160@openssh.com],
                    algorithms(hmac: %w[-hmac-sha1* -hmac-md5* -none])[:hmac]
     end
 
@@ -410,8 +410,8 @@ def assert_kexinit(buffer, options={})
       assert_equal options[:host_key] || (ed_ec_host_keys + %w[[email protected] [email protected] ssh-rsa]).join(','), buffer.read_string
       assert_equal options[:encryption_client] || 'aes256-ctr,aes192-ctr,aes128-ctr', buffer.read_string
       assert_equal options[:encryption_server] || 'aes256-ctr,aes192-ctr,aes128-ctr', buffer.read_string
-      assert_equal options[:hmac_client] || 'hmac-sha2-512,hmac-sha2-256,hmac-sha1', buffer.read_string
-      assert_equal options[:hmac_server] || 'hmac-sha2-512,hmac-sha2-256,hmac-sha1', buffer.read_string
+      assert_equal options[:hmac_client] || 'hmac-sha2-512[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-sha1', buffer.read_string
+      assert_equal options[:hmac_server] || 'hmac-sha2-512[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-sha1', buffer.read_string
       assert_equal options[:compression_client] || 'none,[email protected],zlib', buffer.read_string
       assert_equal options[:compression_server] || 'none,[email protected],zlib', buffer.read_string
       assert_equal options[:language_client] || '', buffer.read_string