RepoMirrors
/
openssh
mirror of git://anongit.mindrot.org/openssh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream: stricter handling of channel window limits 

This makes ssh/sshd more strict in handling non-compliant peers that
send more data than the advertised channel window allows. Previously
the additional data would be silently discarded. This change will
cause ssh/sshd to terminate the connection if the channel window is
exceeded by more than a small grace allowance.

ok markus@

OpenBSD-Commit-ID: 811e21b41831eba3dd7f67b3d409a438f20d3037
This commit is contained in:
djm@openbsd.org 2023-12-18 14:47:20 +00:00 committed by Damien Miller
parent 4448a2938a
commit 0cb50eefdd
No known key found for this signature in database
2 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
channels.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: channels.c,v 1.434 2023/11/15 22:51:49 djm Exp $ */ /* $OpenBSD: channels.c,v 1.435 2023/12/18 14:47:20 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -3407,11 +3407,20 @@ channel_input_data(int type, u_int32_t seq, struct ssh *ssh)
return 0; return 0;
} }
if (win_len > c->local_window) { if (win_len > c->local_window) {
logit("channel %d: rcvd too much data %zu, win %u", c->local_window_exceeded += win_len - c->local_window;
c->self, win_len, c->local_window); logit("channel %d: rcvd too much data %zu, win %u/%u "
return 0; "(excess %u)", c->self, win_len, c->local_window,
c->local_window_max, c->local_window_exceeded);
c->local_window = 0;
/* Allow 10% grace before bringing the hammer down */
if (c->local_window_exceeded > (c->local_window_max / 10)) {
ssh_packet_disconnect(ssh, "channel %d: peer ignored "
"channel window", c->self);
} }
} else {
c->local_window -= win_len; c->local_window -= win_len;
c->local_window_exceeded = 0;
}
if (c->datagram) { if (c->datagram) {
if ((r = sshbuf_put_string(c->output, data, data_len)) != 0) if ((r = sshbuf_put_string(c->output, data, data_len)) != 0)

3
channels.h
View File

@ -1,4 +1,4 @@
/* $OpenBSD: channels.h,v 1.153 2023/11/15 22:51:49 djm Exp $ */ /* $OpenBSD: channels.h,v 1.154 2023/12/18 14:47:20 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
@ -170,6 +170,7 @@ struct Channel {
u_int remote_window; u_int remote_window;
u_int remote_maxpacket; u_int remote_maxpacket;
u_int local_window; u_int local_window;
u_int local_window_exceeded;
u_int local_window_max; u_int local_window_max;
u_int local_consumed; u_int local_consumed;
u_int local_maxpacket; u_int local_maxpacket;