Check-in [7b589f12f9]

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Versions of OpenSSH before 2.5.4 kill the connection if the client attempts to rekey. Extend the description of SSH2_BUG_REKEY to cover this situation and apply it to the relevant OpenSSH versions.
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA1: 7b589f12f94d71c6fc42d532250cbbec2404bd1d
User & Date: ben 2005-01-11 10:33:08.000
Context
2005-01-11
13:33
Fix `disconnect': arrange that we keep track of when we're expecting to see the server slam the TCP connection shut (i.e. almost never, unless it's just sent us an SSH_MSG_DISCONNECT), and treat an unexpected closure as a non-clean session termination. Previously any server-initiated connection closure was being treated as a clean exit, which was a hangover from the good old Telnet-only days. check-in: cffc0c078a user: simon tags: trunk
10:33
Versions of OpenSSH before 2.5.4 kill the connection if the client attempts to rekey. Extend the description of SSH2_BUG_REKEY to cover this situation and apply it to the relevant OpenSSH versions. check-in: 7b589f12f9 user: ben tags: trunk
09:33
Bah, I left a rogue event log entry lying around. check-in: 885c74ec18 user: simon tags: trunk
Changes
Unified Diff Ignore Whitespace Patch
Changes to config.c.
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
			  sshbug_handler, I(offsetof(Config,sshbug_derivekey2)));
	    ctrl_droplist(s, "Requires padding on SSH2 RSA signatures", 'p', 20,
			  HELPCTX(ssh_bugs_rsapad2),
			  sshbug_handler, I(offsetof(Config,sshbug_rsapad2)));
	    ctrl_droplist(s, "Misuses the session ID in PK auth", 'n', 20,
			  HELPCTX(ssh_bugs_pksessid2),
			  sshbug_handler, I(offsetof(Config,sshbug_pksessid2)));
	    ctrl_droplist(s, "Ignores key re-exchange completely", 'k', 20,
			  HELPCTX(ssh_bugs_rekey2),
			  sshbug_handler, I(offsetof(Config,sshbug_rekey2)));
	}
    }
}







|





1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
			  sshbug_handler, I(offsetof(Config,sshbug_derivekey2)));
	    ctrl_droplist(s, "Requires padding on SSH2 RSA signatures", 'p', 20,
			  HELPCTX(ssh_bugs_rsapad2),
			  sshbug_handler, I(offsetof(Config,sshbug_rsapad2)));
	    ctrl_droplist(s, "Misuses the session ID in PK auth", 'n', 20,
			  HELPCTX(ssh_bugs_pksessid2),
			  sshbug_handler, I(offsetof(Config,sshbug_pksessid2)));
	    ctrl_droplist(s, "Handles key re-exchange badly", 'k', 20,
			  HELPCTX(ssh_bugs_rekey2),
			  sshbug_handler, I(offsetof(Config,sshbug_rekey2)));
	}
    }
}
Changes to doc/config.but.
1
2
3
4
5
6
7
8
\define{versionidconfig} \versionid $Id: config.but 5092 2005-01-11 10:37:55Z simon $

\C{config} Configuring PuTTY

This chapter describes all the configuration options in PuTTY.

PuTTY is configured using the control panel that comes up before you
start a session. Some options can also be changed in the middle of a
|







1
2
3
4
5
6
7
8
\define{versionidconfig} \versionid $Id: config.but 5097 2005-01-11 16:33:08Z ben $

\C{config} Configuring PuTTY

This chapter describes all the configuration options in PuTTY.

PuTTY is configured using the control panel that comes up before you
start a session. Some options can also be changed in the middle of a
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674


2675
2676
2677
2678
2679
2680
2681

If this bug is detected, PuTTY will sign data in the way OpenSSH
expects. If this bug is enabled when talking to a correct server,
SSH2 public-key authentication will fail.

This is an SSH2-specific bug.

\S{config-ssh-bug-rekey} \q{Ignores key re-exchange completely}

\cfg{winhelp-topic}{ssh.bugs.rekey2}

Some very old SSH servers cannot cope with repeat key exchange at
all, and will ignore attempts by the client to start one. Since
PuTTY pauses the session while performing a repeat key exchange, the
effect of this would be to cause the session to hang after an hour
(unless you have your rekey timeout set differently; see
\k{config-ssh-kex-rekey} for more about rekeys).



If this bug is detected, PuTTY will never initiate a repeat key
exchange. If this bug is enabled when talking to a correct server,
the session should still function, but may be less secure than you
would expect.

This is an SSH2-specific bug.







|



|





>
>







2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683

If this bug is detected, PuTTY will sign data in the way OpenSSH
expects. If this bug is enabled when talking to a correct server,
SSH2 public-key authentication will fail.

This is an SSH2-specific bug.

\S{config-ssh-bug-rekey} \q{Handles key re-exchange badly}

\cfg{winhelp-topic}{ssh.bugs.rekey2}

Some SSH servers cannot cope with repeat key exchange at
all, and will ignore attempts by the client to start one. Since
PuTTY pauses the session while performing a repeat key exchange, the
effect of this would be to cause the session to hang after an hour
(unless you have your rekey timeout set differently; see
\k{config-ssh-kex-rekey} for more about rekeys).
Other, very old, SSH servers handle repeat key exchange even more
badly, and disconnect upon receiving a repeat key exchange request.

If this bug is detected, PuTTY will never initiate a repeat key
exchange. If this bug is enabled when talking to a correct server,
the session should still function, but may be less secure than you
would expect.

This is an SSH2-specific bug.
Changes to ssh.c.
2135
2136
2137
2138
2139
2140
2141


2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
	 */
	ssh->remote_bugs |= BUG_SSH2_PK_SESSIONID;
	logevent("We believe remote version has SSH2 public-key-session-ID bug");
    }

    if (ssh->cfg.sshbug_rekey2 == FORCE_ON ||
	(ssh->cfg.sshbug_rekey2 == AUTO &&


	 (wc_match("Sun_SSH_1.0", imp) ||
	  wc_match("Sun_SSH_1.0.1", imp)))) {
	/*
	 * These versions have the SSH2 ignore-rekey bug.
	 */
	ssh->remote_bugs |= BUG_SSH2_REKEY;
	logevent("We believe remote version has SSH2 ignore-rekey bug");
    }
}

/*
 * The `software version' part of an SSH version string is required
 * to contain no spaces or minus signs.
 */







>
>
|


|


|







2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
	 */
	ssh->remote_bugs |= BUG_SSH2_PK_SESSIONID;
	logevent("We believe remote version has SSH2 public-key-session-ID bug");
    }

    if (ssh->cfg.sshbug_rekey2 == FORCE_ON ||
	(ssh->cfg.sshbug_rekey2 == AUTO &&
	 (wc_match("OpenSSH_2.[0-4]*", imp) ||
	  wc_match("OpenSSH_2.5.[0-3]*", imp) ||
	  wc_match("Sun_SSH_1.0", imp) ||
	  wc_match("Sun_SSH_1.0.1", imp)))) {
	/*
	 * These versions have the SSH2 rekey bug.
	 */
	ssh->remote_bugs |= BUG_SSH2_REKEY;
	logevent("We believe remote version has SSH2 rekey bug");
    }
}

/*
 * The `software version' part of an SSH version string is required
 * to contain no spaces or minus signs.
 */