PuTTY semi-bug kexinit-unimplemented

Home | Licence | FAQ | Docs | Download | Keys | Links
Mirrors | Updates | Feedback | Changes | Wishlist | Team

---------------------------------------------------[Tue Jan 11 15:08:58 2005]--
From: Not ordinarily borrowable.  (bjh:1)
To: anakin:8

Curious:  If I use PuTTY to connect to wraith.csi.cam.ac.uk, and request key
re-exchange before typing the user name, the packet log shows PuTTY getting an
SSH2_MSG_UNIMPLEMENTED, but PuTTY doesn't bombout(("expected key exchange
packet from server")) as I'd expect.  Of course, it also doesn't give up on the
key exchange, which it perhaps should.

---------------------------------------------------[Tue Jan 11 15:13:37 2005]--
From: `Wombling *freely*', dammit!  (anakin:8)
To: bjh:1

> Curious:  If I use PuTTY to connect to wraith.csi.cam.ac.uk, and request key
> re-exchange before typing the user name, the packet log shows PuTTY getting a
> SSH2_MSG_UNIMPLEMENTED, but PuTTY doesn't bombout(("expected key exchange
> packet from server")) as I'd expect.

Well, UNIMPLEMENTED won't be going to do_ssh2_transport(), because it's not in
the transport layer range of message numbers [20,50). So I suppose it'd go to
do_ssh2_authconn().

My guess is that it's being swallowed in the crWaitUntilV(!pktin) at line 6076,
which I suppose ought to be fixed somehow.

Responding to the UNIMPLEMENTED by abandoning that particular key exchange
sounds above the call of duty to me, I have to say, when the fault is obviously
OpenSSH's.

---------------------------------------------------[Tue Jan 11 15:25:54 2005]--
From: Not ordinarily borrowable.  (bjh:1)
To: anakin:8

> Well, UNIMPLEMENTED won't be going to do_ssh2_transport(), because it's not i
> the transport layer range of message numbers [20,50). So I suppose it'd go to
> do_ssh2_authconn().

Ah.  That would explain my confusion.

> Responding to the UNIMPLEMENTED by abandoning that particular key exchange
> sounds above the call of duty to me, I have to say, when the fault is obvious
> OpenSSH's.

I suppose so.  It's not as if we're likely to do an automatic re-exchange
before authentication is complete, so exiting with an error at that stage would
be reasonable.  I'll add a wishlist item, since that code scares me.

Audit trail for this semi-bug.