Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | Versions of OpenSSH before 2.5.4 kill the connection if the client attempts to rekey. Extend the description of SSH2_BUG_REKEY to cover this situation and apply it to the relevant OpenSSH versions. |
|---|---|
| Timelines: | family | ancestors | descendants | both | trunk |
| Files: | files | file ages | folders |
| SHA1: |
7b589f12f94d71c6fc42d532250cbbec |
| User & Date: | ben 2005-01-11 10:33:08.000 |
Context
|
2005-01-11
| ||
| 13:33 | Fix `disconnect': arrange that we keep track of when we're expecting to see the server slam the TCP connection shut (i.e. almost never, unless it's just sent us an SSH_MSG_DISCONNECT), and treat an unexpected closure as a non-clean session termination. Previously any server-initiated connection closure was being treated as a clean exit, which was a hangover from the good old Telnet-only days. check-in: cffc0c078a user: simon tags: trunk | |
| 10:33 | Versions of OpenSSH before 2.5.4 kill the connection if the client attempts to rekey. Extend the description of SSH2_BUG_REKEY to cover this situation and apply it to the relevant OpenSSH versions. check-in: 7b589f12f9 user: ben tags: trunk | |
| 09:33 | Bah, I left a rogue event log entry lying around. check-in: 885c74ec18 user: simon tags: trunk | |
Changes
Changes to config.c.
| ︙ | ︙ | |||
1835 1836 1837 1838 1839 1840 1841 | sshbug_handler, I(offsetof(Config,sshbug_derivekey2))); ctrl_droplist(s, "Requires padding on SSH2 RSA signatures", 'p', 20, HELPCTX(ssh_bugs_rsapad2), sshbug_handler, I(offsetof(Config,sshbug_rsapad2))); ctrl_droplist(s, "Misuses the session ID in PK auth", 'n', 20, HELPCTX(ssh_bugs_pksessid2), sshbug_handler, I(offsetof(Config,sshbug_pksessid2))); | | | 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 |
sshbug_handler, I(offsetof(Config,sshbug_derivekey2)));
ctrl_droplist(s, "Requires padding on SSH2 RSA signatures", 'p', 20,
HELPCTX(ssh_bugs_rsapad2),
sshbug_handler, I(offsetof(Config,sshbug_rsapad2)));
ctrl_droplist(s, "Misuses the session ID in PK auth", 'n', 20,
HELPCTX(ssh_bugs_pksessid2),
sshbug_handler, I(offsetof(Config,sshbug_pksessid2)));
ctrl_droplist(s, "Handles key re-exchange badly", 'k', 20,
HELPCTX(ssh_bugs_rekey2),
sshbug_handler, I(offsetof(Config,sshbug_rekey2)));
}
}
}
|
Changes to doc/config.but.
|
| | | 1 2 3 4 5 6 7 8 |
\define{versionidconfig} \versionid $Id: config.but 5097 2005-01-11 16:33:08Z ben $
\C{config} Configuring PuTTY
This chapter describes all the configuration options in PuTTY.
PuTTY is configured using the control panel that comes up before you
start a session. Some options can also be changed in the middle of a
|
| ︙ | ︙ | |||
2658 2659 2660 2661 2662 2663 2664 | If this bug is detected, PuTTY will sign data in the way OpenSSH expects. If this bug is enabled when talking to a correct server, SSH2 public-key authentication will fail. This is an SSH2-specific bug. | | | > > | 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 |
If this bug is detected, PuTTY will sign data in the way OpenSSH
expects. If this bug is enabled when talking to a correct server,
SSH2 public-key authentication will fail.
This is an SSH2-specific bug.
\S{config-ssh-bug-rekey} \q{Handles key re-exchange badly}
\cfg{winhelp-topic}{ssh.bugs.rekey2}
Some SSH servers cannot cope with repeat key exchange at
all, and will ignore attempts by the client to start one. Since
PuTTY pauses the session while performing a repeat key exchange, the
effect of this would be to cause the session to hang after an hour
(unless you have your rekey timeout set differently; see
\k{config-ssh-kex-rekey} for more about rekeys).
Other, very old, SSH servers handle repeat key exchange even more
badly, and disconnect upon receiving a repeat key exchange request.
If this bug is detected, PuTTY will never initiate a repeat key
exchange. If this bug is enabled when talking to a correct server,
the session should still function, but may be less secure than you
would expect.
This is an SSH2-specific bug.
|
| ︙ | ︙ |
Changes to ssh.c.
| ︙ | ︙ | |||
2135 2136 2137 2138 2139 2140 2141 |
*/
ssh->remote_bugs |= BUG_SSH2_PK_SESSIONID;
logevent("We believe remote version has SSH2 public-key-session-ID bug");
}
if (ssh->cfg.sshbug_rekey2 == FORCE_ON ||
(ssh->cfg.sshbug_rekey2 == AUTO &&
| > > | | | | 2135 2136 2137 2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149 2150 2151 2152 2153 2154 2155 2156 2157 |
*/
ssh->remote_bugs |= BUG_SSH2_PK_SESSIONID;
logevent("We believe remote version has SSH2 public-key-session-ID bug");
}
if (ssh->cfg.sshbug_rekey2 == FORCE_ON ||
(ssh->cfg.sshbug_rekey2 == AUTO &&
(wc_match("OpenSSH_2.[0-4]*", imp) ||
wc_match("OpenSSH_2.5.[0-3]*", imp) ||
wc_match("Sun_SSH_1.0", imp) ||
wc_match("Sun_SSH_1.0.1", imp)))) {
/*
* These versions have the SSH2 rekey bug.
*/
ssh->remote_bugs |= BUG_SSH2_REKEY;
logevent("We believe remote version has SSH2 rekey bug");
}
}
/*
* The `software version' part of an SSH version string is required
* to contain no spaces or minus signs.
*/
|
| ︙ | ︙ |