Re: [Curdle] I-D Action: draft-ietf-curdle-ssh-ext-info-09.txt

Hello everyone,

it has come to my attention that a widely used SSH implementation that
supports EXT_INFO contains an oversight (uses an incorrect string decoding
function) which imposes undesirable restrictions on the content of
"extension-value".

Regretfully, this oversight makes it so that the "delay-compression"
extension cannot be sent to current versions of this application. The
application does not understand the extension, but will choke on the null
bytes contained in the extension-value.

I trust that this was unintentional, and that the implementers will fix the
oversight.

This behavior was previously already against the spec, but the language
that dictated this was subtle and in a different section than the
definition of "extension-value". I have made the language much more overt
to help implementers avoid this problem in the future.

denis

On Mon, Jun 12, 2017 at 10:25 PM, <internet-drafts@ietf.org> wrote:

>
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> This draft is a work item of the CURves, Deprecating and a Little more
> Encryption of the IETF.
>
>         Title           : Extension Negotiation in Secure Shell (SSH)
>         Author          : Denis Bider
>         Filename        : draft-ietf-curdle-ssh-ext-info-09.txt
>         Pages           : 11
>         Date            : 2017-06-12
>
> Abstract:
>   This memo updates RFC 4252, RFC 4253, and RFC 4254 to define a
>   mechanism for SSH clients and servers to exchange information about
>   supported protocol extensions confidentially after SSH key exchange.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-curdle-ssh-ext-info/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-curdle-ssh-ext-info-09
> https://datatracker.ietf.org/doc/html/draft-ietf-curdle-ssh-ext-info-09
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-curdle-ssh-ext-info-09
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> Curdle mailing list
> Curdle@ietf.org
> https://www.ietf.org/mailman/listinfo/curdle
>