dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: don't let SSH_MSG_PONG replies pile up if the peer

Browse Source 
isn't sending ACKs and there is a significant amount of data in data in out
transport obuf. Avoids an obscure post-auth soft memory DoS

Anthropic ANT-2026-Z4SZFUYY

OpenBSD-Commit-ID: 55eb6b4d171008321f5c16cf1b1fdfeeadc7cff8
This commit is contained in:
djm@openbsd.org authored and Damien Miller committed 2026-10-30 20:14:15 +11:00
1 parent 097af23b8c
commit 2c34666e08
2 files changed
+11 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

PROTOCOL
+5 -3
View File
@@ -110,8 +110,10 @@ ping:
byte SSH_MSG_PONG
string data
Replies are sent in order. They are sent immediately except when rekeying
is in progress, in which case they are queued until rekeying completes.
Replies are sent in order. No reply is sent to a ping that is received
before authentication has completed, while rekeying is in progress or
while the peer has not yet read a significant amount of previously sent
data.
The server advertises support for these messages using the
SSH2_MSG_EXT_INFO mechanism (RFC8308), with the following message:
@@ -718,4 +720,4 @@ master instance and later clients.
OpenSSH extends the usual agent protocol. These changes are documented
in the PROTOCOL.agent file.
$OpenBSD: PROTOCOL,v 1.60 2026/02/09 22:09:48 dtucker Exp $
$OpenBSD: PROTOCOL,v 1.61 2026/10/30 05:21:48 djm Exp $
packet.c
+6 -1
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: packet.c,v 1.347 2026/10/30 04:36:21 djm Exp $ */
/* $OpenBSD: packet.c,v 1.348 2026/10/30 05:21:48 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1947,6 +1947,11 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, uint32_t *seqnr_p)
DBG(debug("Won't reply to PING during KEX"));
break;
}
/* Don't let replies pile up if the peer isn't reading */
if (!ssh_packet_not_very_much_data_to_write(ssh)) {
DBG(debug("Won't reply to PING with backlog"));
break;
}
if ((r = sshpkt_start(ssh, SSH2_MSG_PONG)) != 0 ||
(r = sshpkt_put_string(ssh, d, len)) != 0 ||
(r = sshpkt_send(ssh)) != 0)