Fixing strict mode

pmeunier

Jun 14, 2024, 9:05 AM

32GIIFWR6CUE24WCZJHM2D76QVXV4SNPOUNXJB62LGALJJSWCZUQC

Dependencies

• [2] EZTTZ6OW Fixing terrapin, again
• [3] EUHO3DAZ Send a SSH_MSG_EXT_INFO with server-sig-algs when the client indicates they support extensions by sending ext-info-c. This allows modern clients that don't do ssh-rsa anymore because of sha1 to still use RSA keys with sha2.
• [4] 2Q3SZY2C Version bump
• [5] D6H7OWTT Fixing the terrapin attack mitigation
• [6] VJIXIN4T Fixing CVE-2023-48795
• [7] CWHVPLXN Version bump
• [8] ASD7JVBE Do not read past the size of the buffer (after Tokio 0.3)
• [9] 2VTUKRLJ Version
• [10] VYDCQWSF Version 0.30.6
• [11] BRDS7STA Adding method `send_channel_msg` to client::Session, to make it easier to write handlers
• [12] TFYJ3P2A Version 0.30.8/0.19.4, and solving conflicts
• [13] DJT33BQE Version bump
• [14] 7FRJYUI6 Reboot because of a bad change
• [15] OQZGSEWM Buffering non-kex packets received after issuing a KEXINIT
• [16] E2SB74SV Version 0.30.3
• [17] PDTFLA4Y Version 0.30.7
• [18] 7Y2ROIVZ Version bump
• [19] ORSEEVB5 Version bump
• [20] CQSPFH4H Version 0.30.4
• [21] 634OYCNM Tokio 0.3
• [22] WXZWQLGL Correct negotiation without OpenSSL
• [23] 662ZS5JF Version 0.33.2
• [24] 2WEO7OZL Version updates: getting rid of anyhow + moving to Tokio 1.0
• [25] FT67GGO4 Version bump (Pijul and Thrussh)
• [26] G3FNNIIU Limiting the amount of messages that can be buffered while rekeying to two channel windows
• [*] 2SFWWZ2R Rearm reading future on empty packet, and respond to server-initiated key re-exchange

Change contents

• edit in thrussh/src/server/mod.rs at line 525
  [28.210]

  [2.61]
  + buffer.strict = session.common.write_buffer.strict;

  + debug!("buffer strict {:?} {:?}", buffer.strict, buf[0]);
• edit in thrussh/src/negotiation.rs at line 42
  [3.269663]

  [3.269663]
  + /// Which side we're on.

  + pub is_server: bool,
• edit in thrussh/src/negotiation.rs at line 59
  [3.190]

  [3.190]
  + is_server: true,
• edit in thrussh/src/negotiation.rs at line 73
  [3.642]

  [3.642]
  + is_server: false,
• edit in thrussh/src/negotiation.rs at line 88
  [3.745]

  [3.745]
  + is_server: true,
• edit in thrussh/src/negotiation.rs at line 98
  [3.1106]

  [3.1106]
  + is_server: false,
• edit in thrussh/src/negotiation.rs at line 108
  [3.1209]

  [3.1209]
  + is_server: true,
• edit in thrussh/src/negotiation.rs at line 118
  [3.1582]

  [3.1582]
  + is_server: false,
• edit in thrussh/src/negotiation.rs at line 128
  [3.1685]

  [3.1685]
  + is_server: true,
• edit in thrussh/src/negotiation.rs at line 138
  [3.1853]

  [3.1853]
  + is_server: false,
• replacement in thrussh/src/negotiation.rs at line 206
  [3.272078]→[3.1424:1622](∅→∅)
  − let client_supports_ext = Self::select(&[kex::CLIENT_SUPPORTS_EXT], kex_string).is_some();

  − let server_supports_ext = Self::select(&[kex::SERVER_SUPPORTS_EXT], kex_string).is_some();
  [3.272078]

  [3.1622]
  + let client_supports_ext = if pref.is_server {

  + Self::select(&[kex::CLIENT_SUPPORTS_EXT], kex_string).is_some()

  + } else {

  + pref.kex.iter().any(|x| x == &kex::CLIENT_SUPPORTS_EXT)

  + };

  + let server_supports_ext = if pref.is_server {

  + pref.kex.iter().any(|x| x == &kex::SERVER_SUPPORTS_EXT)

  + } else {

  + Self::select(&[kex::SERVER_SUPPORTS_EXT], kex_string).is_some()

  + };
• replacement in thrussh/src/negotiation.rs at line 217
  [3.1623]→[3.1993:2175](∅→∅)
  − let client_supports_strict = Self::select(&[kex::STRICT_C], kex_string).is_some();

  − let server_supports_strict = Self::select(&[kex::STRICT_S], kex_string).is_some();
  [3.1623]

  [3.2175]
  + let client_supports_strict = if pref.is_server {

  + Self::select(&[kex::STRICT_C], kex_string).is_some()

  + } else {

  + pref.kex.iter().any(|x| x == &kex::STRICT_C)

  + };

  + let server_supports_strict = if pref.is_server {

  + pref.kex.iter().any(|x| x == &kex::STRICT_S)

  + } else {

  + Self::select(&[kex::STRICT_S], kex_string).is_some()

  + };
• edit in thrussh/src/client/mod.rs at line 886
  [28.716]

  [2.560]
  + buffer.strict = self.common.write_buffer.strict;
• replacement in thrussh/Cargo.toml at line 5
  [3.426214]→[2.917:936](∅→∅)
  − version = "0.35.3"
  [3.426214]

  [3.426233]
  + version = "0.35.4"