Re: [Curdle] Client-side SSH_MSG_EXT_INFO: Use it or lose it principle!

denis bider <denisbider.ietf@gmail.com> Mon, 27 April 2020 09:00 UTC

MIME-Version: 1.0
References: <CADPMZDBcOtUaUBJKn20yEpLi=pmse2SgiXpZXArAKLyKTeS-GQ@mail.gmail.com> <1587965828521.34734@cs.auckland.ac.nz>
In-Reply-To: <1587965828521.34734@cs.auckland.ac.nz>
From: denis bider <denisbider.ietf@gmail.com>
Date: Mon, 27 Apr 2020 04:00:12 -0500
Message-ID: <CADPMZDA33QGM15jq94sDWCyg60pjdT2VWR2-_iRbfBnYBYs4MA@mail.gmail.com>
To: Peter Gutmann <pgut001@cs.auckland.ac.nz>
Cc: curdle <curdle@ietf.org>, "ietf-ssh@netbsd.org" <ietf-ssh@netbsd.org>, Damien Miller <djm@mindrot.org>
Content-Type: multipart/alternative; boundary="000000000000fdb2a605a441f1ba"
Archived-At: <https://mailarchive.ietf.org/arch/msg/curdle/-I2TXq1TNkYxLn1AOW_0n3ykQLc>
Subject: Re: [Curdle] Client-side SSH_MSG_EXT_INFO: Use it or lose it principle!
Precedence: list

About this:

> TLS dealt with this to some extent by adding a mechanism
> bacronym'd as GREASE for sending random information in
> extensions to detect implementations that broke on them,
> perhaps something similar could be done for SSH.

The challenge with this is that some widely used implementation -
*cough*OpenSSH*cough* - would need to exercise all functions of the
protocol that are legal, but not necessarily in widespread use. If they
want to prevent rusting at the joints, OpenSSH would have to do so for most
features, including those they do not CURRENTLY find useful.

For example, if a common problem is that clients fail to correctly handle
global requests if they receive them while waiting for channel open
confirmation - this is a bug that both OpenSSH and PuTTY had, at some point
long ago - then the way to exercise that would be to include a trivial
global request, in say 10% of cases, before a channel open confirmation.

I would welcome that, personally, and hence that's why I originally
included Damien in this thread. :)

denis

On Mon, Apr 27, 2020 at 12:37 AM Peter Gutmann <pgut001@cs.auckland.ac.nz>
wrote:

> denis bider <denisbider.ietf@gmail.com> writes:
>
> >it has come to my attention that at least one SSH server implementation
> (a)
> >advertises support for SSH_MSG_EXT_INFO as defined in RFC 8308, and (b)
> >disconnects on actual receipt of an EXT_INFO message from the client.
>
> Not wanting to do a public name-and-shame on this, but could you share the
> ID
> string needed to fingerprint this server?  Looks like a lot of
> implementations
> will need to be able to deal with this...
>
> >This happens when we define a general mechanism, but then the most widely
> >used implementations only use certain aspects of it.
>
> That's a more specific version of "an implementation is fully SSH
> standards-
> compliant when it can connect to OpenSSH (client) or Putty can connect to
> it
> (server)".  Those two are the universal benchmark for SSH implementations,
> for
> better or for worse.  TLS dealt with this to some extent by adding a
> mechanism
> bacronym'd as GREASE for sending random information in extensions to detect
> implementations that broke on them, perhaps something similar could be done
> for SSH.
>
> Peer.

[Curdle] Client-side SSH_MSG_EXT_INFO: Use it or … denis bider
Re: [Curdle] Client-side SSH_MSG_EXT_INFO: Use it… Ron Frederick
Re: [Curdle] Client-side SSH_MSG_EXT_INFO: Use it… denis bider
Re: [Curdle] Client-side SSH_MSG_EXT_INFO: Use it… Peter Gutmann
Re: [Curdle] Client-side SSH_MSG_EXT_INFO: Use it… denis bider
Re: [Curdle] Client-side SSH_MSG_EXT_INFO: Use it… denis bider
[Curdle] Fwd: Client-side SSH_MSG_EXT_INFO: Use i… denis bider
Re: [Curdle] Client-side SSH_MSG_EXT_INFO: Use it… Ron Frederick
Re: [Curdle] Client-side SSH_MSG_EXT_INFO: Use it… denis bider