go.crypto/ssh: never negotiate unsupported ciphers
Fixes golang/go#4285.
Adding a new cipher that is supported by the remote end, but not supported by our client causes that cipher to be considered a valid candidate. This fails later in setupKeys when there is no cipherModes configuration.
In summary, unsupported ciphers cannot be willed into existence by adding them to the client config. This change enforces this.
R=golang-dev, agl
CC=golang-dev
https://golang.org/cl/6780047
diff --git a/ssh/cipher.go b/ssh/cipher.go
index 0646e1e..97e5d9b 100644
--- a/ssh/cipher.go
+++ b/ssh/cipher.go
@@ -74,6 +74,9 @@
"arcfour256", "arcfour128",
}
+// cipherModes documents properties of supported ciphers. Ciphers not included
+// are not supported and will not be negotiated, even if explicitly requested in
+// ClientConfig.Crypto.Ciphers.
var cipherModes = map[string]*cipherMode{
// Ciphers from RFC4344, which introduced many CTR-based ciphers. Algorithms
// are defined in the order specified in the RFC.
