security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-06-02 22:38:02 +02:00
Code Activity

ssh: Returned faked response for the new session-bind extension.

Browse Source 
* agent/command-ssh.c (SSH_OPT_CONSTRAIN_MAXSIGN): New.
(SSH_OPT_CONSTRAIN_EXTENSION): New.
(ssh_handler_add_identity): Ignore them.
(ssh_handler_extension): Take success for session-bind.
--

OpenSSH 8.9 does not gracefully allow communication with older agent
implementations.  Until this new OpenSSH feature has been settled we
return a faked response.

Code has not yet been tested.

GnuPG-bug-id: 5931
This commit is contained in:
Werner Koch 2022-04-14 12:30:55 +02:00
parent dd727ec968
commit 46d62d80a2
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
agent/command-ssh.c
View File

@ -75,6 +75,8 @@
/* Options. */ /* Options. */
#define SSH_OPT_CONSTRAIN_LIFETIME 1 #define SSH_OPT_CONSTRAIN_LIFETIME 1
#define SSH_OPT_CONSTRAIN_CONFIRM 2 #define SSH_OPT_CONSTRAIN_CONFIRM 2
#define SSH_OPT_CONSTRAIN_MAXSIGN 3
#define SSH_OPT_CONSTRAIN_EXTENSION 255
/* Response types. */ /* Response types. */
#define SSH_RESPONSE_SUCCESS 6 #define SSH_RESPONSE_SUCCESS 6
@ -3165,6 +3167,11 @@ ssh_handler_add_identity (ctrl_t ctrl, estream_t request, estream_t response)
break; break;
} }
case SSH_OPT_CONSTRAIN_MAXSIGN:
case SSH_OPT_CONSTRAIN_EXTENSION:
/* Not yet implemented. */
break;
default: default:
/* FIXME: log/bad? */ /* FIXME: log/bad? */
break; break;
@ -3387,6 +3394,13 @@ ssh_handler_extension (ctrl_t ctrl, estream_t request, estream_t response)
(response, session_env_list_stdenvnames (NULL, NULL)); (response, session_env_list_stdenvnames (NULL, NULL));
goto finalleave; goto finalleave;
} }
else if (!strcmp (exttype, "session-bind@openssh.org"))
{
ret_err = stream_write_byte (response, SSH_RESPONSE_SUCCESS);
log_info ("ssh-agent extension '%s' ignored - returning success anyway\n",
exttype);
goto finalleave;
}
else else
{ {
if (opt.verbose) if (opt.verbose)