diff options
| author | deraadt@openbsd.org <deraadt@openbsd.org> | 2024-08-23 06:51:00 +0200 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2024-08-27 01:05:43 +0200 |
| commit | 10ccf611ab8ecba9ce6b0548c5ccd8c1220baf92 (patch) | |
| tree | ce6dc0c5c4f0f624323c54a2b5b260e1c078a673 /packet.c | |
| parent | upstream: sntrup761x25519-sha512 now has an IANA codepoint assigned, so (diff) | |
| download | openssh-10ccf611ab8ecba9ce6b0548c5ccd8c1220baf92.tar.xz openssh-10ccf611ab8ecba9ce6b0548c5ccd8c1220baf92.zip | |
upstream: As defined in the RFC, the SSH protocol has negotiable
compression support (which is requested as the name "zlib"). Compression
starts very early in the session. Relative early in OpenSSH lifetime, privsep
was added to sshd, and this required a shared-memory hack so the two
processes could see what was going on in the dataflow. This shared-memory
hack was soon recognized as a tremendous complexity risk, because it put libz
(which very much trusts it's memory) in a dangerous place, and a new option
("zlib@openssh.com") was added begins compression after authentication (aka
delayed-compression). That change also permitted removal of the
shared-memory hack. Despite removal from the server, the old "zlib" support
remained in the client, to allow negotiation with non-OpenSSH daemons which
lack the delayed-compression option. This commit deletes support for the
older "zlib" option in the client. It reduces our featureset in a small way,
and encourages other servers to move to a better design. The SSH protocol is
different enough that compressed-key-material attacks like BEAST are
unlikely, but who wants to take the chance? We encourage other ssh servers
who care about optional compression support to add delayed-zlib support.
(Some already do "zlib@openssh.com") ok djm markus
OpenBSD-Commit-ID: 6df986f38e4ab389f795a6e39e7c6857a763ba72
Diffstat (limited to 'packet.c')
| -rw-r--r-- | packet.c | 7 |
1 files changed, 3 insertions, 4 deletions
@@ -1,4 +1,4 @@ -/* $OpenBSD: packet.c,v 1.316 2024/08/15 00:51:51 djm Exp $ */ +/* $OpenBSD: packet.c,v 1.317 2024/08/23 04:51:00 deraadt Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -1015,9 +1015,8 @@ ssh_set_newkeys(struct ssh *ssh, int mode) /* explicit_bzero(enc->iv, enc->block_size); explicit_bzero(enc->key, enc->key_len); explicit_bzero(mac->key, mac->key_len); */ - if ((comp->type == COMP_ZLIB || - (comp->type == COMP_DELAYED && - state->after_authentication)) && comp->enabled == 0) { + if (((comp->type == COMP_DELAYED && state->after_authentication)) && + comp->enabled == 0) { if ((r = ssh_packet_init_compression(ssh)) < 0) return r; if (mode == MODE_OUT) { |