enable GCM and Chacha20 ciphers

[drizzd]

These are offered by ssh by default, but they are not included in the
default list of Ciphers in ssh_config.

Instead of setting the entire list of ciphers, selectively re-enable the
CBC ciphers using the "Cipher +somecipher" notation.

Closes git-for-windows/git#1723.

[dscho]

Thank you!

I do have two requests, still, before merging time:

1. could you Sign-off on that patch?
2. existing Git for Windows SDKs will already have an /etc/ssh_config that was patched by the current git-extra (or an earlier one). Could you make it so that this case is handled, too, by reverting the previous edit (something like ! grep '^Cipher .*,aes256-cbc,aes192-cbc' /etc/ssh/ssh_config || sed -i -e 's|^\(Cipher .*\),aes256-cbc,aes192-cbc|# \1|' /etc/ssh/ssh_config)?

[drizzd]

Good point. I can do this, but if a user modifies /etc/ssh/ssh_config, then we may overwrite their modifications too. I think the right way is to patch the openssh package instead. Since we already have some patches there, that's no extra maintenance overhead. I created a pull request there:
git-for-windows/MSYS2-packages#24

The only downside is that due to the modification by git-extra, the new ssh_config will be installed as /etc/ssh/ssh_config.new with a warning.

[dscho]

The only downside is that due to the modification by git-extra, the new ssh_config will be installed as /etc/ssh/ssh_config.new with a warning.

That's not the only downside. It would make it quite a bit harder to revert the supposedly temporary workaround of re-enabling weak ciphers to accommodate a few hosters (all of which have updated their SSH to handle strong ciphers in the meantime AFAICT).

[dscho]

Thank you, @drizzd!