Attachment #1013 for bug #1014




/* helper */
static void port_open_helper(Channel *c, char *rtype);

static u_int32_t
tcp_window_size(void)
{
	u_int32_t tcpwinsz = 0;
	socklen_t optsz = sizeof(tcpwinsz);

	if (getsockopt(packet_get_connection_in(), SOL_SOCKET, SO_RCVBUF,
	    &tcpwinsz, &optsz) == 0)
		return tcpwinsz;
	else
		return 0;
}

/* -- channel core */

Channel *

	c->local_window_max = window;
	c->local_consumed = 0;
	c->local_maxpacket = maxpack;
	c->dynamic_window = 0;
	c->remote_id = -1;
	c->remote_name = xstrdup(remote_name);
	c->remote_window = 0;

static int
channel_check_window(Channel *c)
{
	u_int32_t winsz, addition = 0, adjust = 0;

	if (c->type == SSH_CHANNEL_OPEN &&
	    !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
	    c->local_window < c->local_window_max/2 &&
	    c->local_consumed > 0) {
		/*
		 * If the TCP window is larger than the channel window then
		 * make the adjust large enough for the sender to fill it.
		 */
		if (c->dynamic_window) {
			winsz = tcp_window_size();
			if (winsz > c->local_window_max) {
				addition = winsz - c->local_window_max;
				c->local_window_max += addition;
			}
		}
		adjust = c->local_consumed + addition;

		packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
		packet_put_int(c->remote_id);
		packet_put_int(adjust);
		packet_send();
		debug2("channel %d: window %d sent adjust %d",
		    c->self, c->local_window, adjust);
		c->local_window += adjust;
		c->local_window += c->local_consumed;
		c->local_consumed = 0;
	}
	return 1;

Lines 99-104 struct Channel { Link Here

(-)channels.h (+1 lines)
99	u_int local_window_max;	99	u_int local_window_max;
100	u_int local_consumed;	100	u_int local_consumed;
101	u_int local_maxpacket;	101	u_int local_maxpacket;
		102	int dynamic_window;
102	int extended_usage;	103	int extended_usage;
103	int single_connection;	104	int single_connection;
104		105




		  "OpenSSH_2.1*,"
		  "OpenSSH_2.2*",	SSH_OLD_SESSIONID|SSH_BUG_BANNER|
					SSH_OLD_DHGEX|SSH_BUG_NOREKEY|
					SSH_BUG_EXTEOF|SSH_OLD_FORWARD_ADDR|
					SSH_BUG_LARGEWINDOW},
		{ "OpenSSH_2.3.0*",	SSH_BUG_BANNER|SSH_BUG_BIGENDIANAES|
					SSH_OLD_DHGEX|SSH_BUG_NOREKEY|
					SSH_BUG_EXTEOF|SSH_OLD_FORWARD_ADDR|
					SSH_BUG_LARGEWINDOW},
		{ "OpenSSH_2.3.*",	SSH_BUG_BIGENDIANAES|SSH_OLD_DHGEX|
					SSH_BUG_NOREKEY|SSH_BUG_EXTEOF|
					SSH_OLD_FORWARD_ADDR|
					SSH_BUG_LARGEWINDOW},
		{ "OpenSSH_2.5.0p1*,"
		  "OpenSSH_2.5.1p1*",
					SSH_BUG_BIGENDIANAES|SSH_OLD_DHGEX|
					SSH_BUG_NOREKEY|SSH_BUG_EXTEOF|
					SSH_OLD_FORWARD_ADDR|
					SSH_BUG_LARGEWINDOW},
		{ "OpenSSH_2.5.0*,"
		  "OpenSSH_2.5.1*,"
		  "OpenSSH_2.5.2*",	SSH_OLD_DHGEX|SSH_BUG_NOREKEY|
					SSH_BUG_EXTEOF|SSH_OLD_FORWARD_ADDR},
		{ "OpenSSH_2.5.3*",	SSH_BUG_NOREKEY|SSH_BUG_EXTEOF|
					SSH_OLD_FORWARD_ADDR|
					SSH_BUG_LARGEWINDOW},
		{ "OpenSSH_2.*,"
		  "OpenSSH_3.0*,"
		  "OpenSSH_3.1*",	SSH_BUG_EXTEOF|SSH_OLD_FORWARD_ADDR|
					SSH_BUG_LARGEWINDOW},
		{ "OpenSSH_3.*",	SSH_OLD_FORWARD_ADDR|
					SSH_BUG_LARGEWINDOW},
		{ "OpenSSH_4.0.*", 	SSH_BUG_LARGEWINDOW},
		{ "OpenSSH*",		0 },
		{ "Sun_SSH_1.0*",	SSH_BUG_NOREKEY|SSH_BUG_EXTEOF|
					SSH_BUG_LARGEWINDOW},
		{ "*MindTerm*",		0 },
		{ "2.1.0*",		SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
					SSH_OLD_SESSIONID|SSH_BUG_DEBUG|

Lines 56-61 Link Here

(-)compat.h (+1 lines)
56	#define SSH_BUG_PROBE 0x00400000	56	#define SSH_BUG_PROBE 0x00400000
57	#define SSH_BUG_FIRSTKEX 0x00800000	57	#define SSH_BUG_FIRSTKEX 0x00800000
58	#define SSH_OLD_FORWARD_ADDR 0x01000000	58	#define SSH_OLD_FORWARD_ADDR 0x01000000
		59	#define SSH_BUG_LARGEWINDOW 0x02000000
59		60
60	void enable_compat13(void);	61	void enable_compat13(void);
61	void enable_compat20(void);	62	void enable_compat20(void);

Lines 895-900 server_request_session(void) Link Here

(-)serverloop.c (+2 lines)
895	c = channel_new("session", SSH_CHANNEL_LARVAL,	895	c = channel_new("session", SSH_CHANNEL_LARVAL,
896	-1, -1, -1, /window size/0, CHAN_SES_PACKET_DEFAULT,	896	-1, -1, -1, /window size/0, CHAN_SES_PACKET_DEFAULT,
897	0, "server-session", 1);	897	0, "server-session", 1);
		898	if (!(datafellows & SSH_BUG_LARGEWINDOW))
		899	c->dynamic_window = 1;
898	if (session_open(the_authctxt, c->self) != 1) {	900	if (session_open(the_authctxt, c->self) != 1) {
899	debug("session open failed, free channel %d", c->self);	901	debug("session open failed, free channel %d", c->self);
900	channel_free(c);	902	channel_free(c);

Return to bug 1014

Lines 139-144 static int IPv4or6 = AF_UNSPEC; Link Here

(-)channels.c (-4 / +32 lines)
139	/* helper */	139	/* helper */
140	static void port_open_helper(Channel c, char rtype);	140	static void port_open_helper(Channel c, char rtype);
141		141
		142	static u_int32_t
		143	tcp_window_size(void)
		144	{
		145	u_int32_t tcpwinsz = 0;
		146	socklen_t optsz = sizeof(tcpwinsz);
		147
		148	if (getsockopt(packet_get_connection_in(), SOL_SOCKET, SO_RCVBUF,
		149	&tcpwinsz, &optsz) == 0)
		150	return tcpwinsz;
		151	else
		152	return 0;
		153	}
		154
142	/* -- channel core */	155	/* -- channel core */
143		156
144	Channel *	157	Channel *
Lines 262-267 channel_new(char *ctype, int type, int r Link Here
262	c->local_window_max = window;	275	c->local_window_max = window;
263	c->local_consumed = 0;	276	c->local_consumed = 0;
264	c->local_maxpacket = maxpack;	277	c->local_maxpacket = maxpack;
		278	c->dynamic_window = 0;
265	c->remote_id = -1;	279	c->remote_id = -1;
266	c->remote_name = xstrdup(remote_name);	280	c->remote_name = xstrdup(remote_name);
267	c->remote_window = 0;	281	c->remote_window = 0;
Lines 1533-1550 channel_handle_ctl(Channel c, fd_set Link Here
1533	static int	1547	static int
1534	channel_check_window(Channel *c)	1548	channel_check_window(Channel *c)
1535	{	1549	{
		1550	u_int32_t winsz, addition = 0, adjust = 0;
		1551
1536	if (c->type == SSH_CHANNEL_OPEN &&	1552	if (c->type == SSH_CHANNEL_OPEN &&
1537	!(c->flags & (CHAN_CLOSE_SENT\|CHAN_CLOSE_RCVD)) &&	1553	!(c->flags & (CHAN_CLOSE_SENT\|CHAN_CLOSE_RCVD)) &&
1538	c->local_window < c->local_window_max/2 &&	1554	c->local_window < c->local_window_max/2 &&
1539	c->local_consumed > 0) {	1555	c->local_consumed > 0) {
		1556	/*
		1557	* If the TCP window is larger than the channel window then
		1558	* make the adjust large enough for the sender to fill it.
		1559	*/
		1560	if (c->dynamic_window) {
		1561	winsz = tcp_window_size();
		1562	if (winsz > c->local_window_max) {
		1563	addition = winsz - c->local_window_max;
		1564	c->local_window_max += addition;
		1565	}
		1566	}
		1567	adjust = c->local_consumed + addition;
		1568
1540	packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);	1569	packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
1541	packet_put_int(c->remote_id);	1570	packet_put_int(c->remote_id);
1542	packet_put_int(c->local_consumed);	1571	packet_put_int(adjust);
1543	packet_send();	1572	packet_send();
1544	debug2("channel %d: window %d sent adjust %d",	1573	debug2("channel %d: window %d sent adjust %d",
1545	c->self, c->local_window,	1574	c->self, c->local_window, adjust);
1546	c->local_consumed);	1575	c->local_window += adjust;
1547	c->local_window += c->local_consumed;
1548	c->local_consumed = 0;	1576	c->local_consumed = 0;
1549	}	1577	}
1550	return 1;	1578	return 1;

Lines 62-91 compat_datafellows(const char *version) Link Here

(-)compat.c (-8 / +17 lines)
62	"OpenSSH_2.1*,"	62	"OpenSSH_2.1*,"
63	"OpenSSH_2.2*", SSH_OLD_SESSIONID\|SSH_BUG_BANNER\|	63	"OpenSSH_2.2*", SSH_OLD_SESSIONID\|SSH_BUG_BANNER\|
64	SSH_OLD_DHGEX\|SSH_BUG_NOREKEY\|	64	SSH_OLD_DHGEX\|SSH_BUG_NOREKEY\|
65	SSH_BUG_EXTEOF\|SSH_OLD_FORWARD_ADDR},	65	SSH_BUG_EXTEOF\|SSH_OLD_FORWARD_ADDR\|
		66	SSH_BUG_LARGEWINDOW},
66	{ "OpenSSH_2.3.0*", SSH_BUG_BANNER\|SSH_BUG_BIGENDIANAES\|	67	{ "OpenSSH_2.3.0*", SSH_BUG_BANNER\|SSH_BUG_BIGENDIANAES\|
67	SSH_OLD_DHGEX\|SSH_BUG_NOREKEY\|	68	SSH_OLD_DHGEX\|SSH_BUG_NOREKEY\|
68	SSH_BUG_EXTEOF\|SSH_OLD_FORWARD_ADDR},	69	SSH_BUG_EXTEOF\|SSH_OLD_FORWARD_ADDR\|
		70	SSH_BUG_LARGEWINDOW},
69	{ "OpenSSH_2.3.*", SSH_BUG_BIGENDIANAES\|SSH_OLD_DHGEX\|	71	{ "OpenSSH_2.3.*", SSH_BUG_BIGENDIANAES\|SSH_OLD_DHGEX\|
70	SSH_BUG_NOREKEY\|SSH_BUG_EXTEOF\|	72	SSH_BUG_NOREKEY\|SSH_BUG_EXTEOF\|
71	SSH_OLD_FORWARD_ADDR},	73	SSH_OLD_FORWARD_ADDR\|
		74	SSH_BUG_LARGEWINDOW},
72	{ "OpenSSH_2.5.0p1*,"	75	{ "OpenSSH_2.5.0p1*,"
73	"OpenSSH_2.5.1p1*",	76	"OpenSSH_2.5.1p1*",
74	SSH_BUG_BIGENDIANAES\|SSH_OLD_DHGEX\|	77	SSH_BUG_BIGENDIANAES\|SSH_OLD_DHGEX\|
75	SSH_BUG_NOREKEY\|SSH_BUG_EXTEOF\|	78	SSH_BUG_NOREKEY\|SSH_BUG_EXTEOF\|
76	SSH_OLD_FORWARD_ADDR},	79	SSH_OLD_FORWARD_ADDR\|
		80	SSH_BUG_LARGEWINDOW},
77	{ "OpenSSH_2.5.0*,"	81	{ "OpenSSH_2.5.0*,"
78	"OpenSSH_2.5.1*,"	82	"OpenSSH_2.5.1*,"
79	"OpenSSH_2.5.2*", SSH_OLD_DHGEX\|SSH_BUG_NOREKEY\|	83	"OpenSSH_2.5.2*", SSH_OLD_DHGEX\|SSH_BUG_NOREKEY\|
80	SSH_BUG_EXTEOF\|SSH_OLD_FORWARD_ADDR},	84	SSH_BUG_EXTEOF\|SSH_OLD_FORWARD_ADDR},
81	{ "OpenSSH_2.5.3*", SSH_BUG_NOREKEY\|SSH_BUG_EXTEOF\|	85	{ "OpenSSH_2.5.3*", SSH_BUG_NOREKEY\|SSH_BUG_EXTEOF\|
82	SSH_OLD_FORWARD_ADDR},	86	SSH_OLD_FORWARD_ADDR\|
		87	SSH_BUG_LARGEWINDOW},
83	{ "OpenSSH_2.*,"	88	{ "OpenSSH_2.*,"
84	"OpenSSH_3.0*,"	89	"OpenSSH_3.0*,"
85	"OpenSSH_3.1*", SSH_BUG_EXTEOF\|SSH_OLD_FORWARD_ADDR},	90	"OpenSSH_3.1*", SSH_BUG_EXTEOF\|SSH_OLD_FORWARD_ADDR\|
86	{ "OpenSSH_3.*", SSH_OLD_FORWARD_ADDR },	91	SSH_BUG_LARGEWINDOW},
87	{ "Sun_SSH_1.0*", SSH_BUG_NOREKEY\|SSH_BUG_EXTEOF},	92	{ "OpenSSH_3.*", SSH_OLD_FORWARD_ADDR\|
		93	SSH_BUG_LARGEWINDOW},
		94	{ "OpenSSH_4.0.*", SSH_BUG_LARGEWINDOW},
88	{ "OpenSSH*", 0 },	95	{ "OpenSSH*", 0 },
		96	{ "Sun_SSH_1.0*", SSH_BUG_NOREKEY\|SSH_BUG_EXTEOF\|
		97	SSH_BUG_LARGEWINDOW},
89	{ "MindTerm", 0 },	98	{ "MindTerm", 0 },
90	{ "2.1.0*", SSH_BUG_SIGBLOB\|SSH_BUG_HMAC\|	99	{ "2.1.0*", SSH_BUG_SIGBLOB\|SSH_BUG_HMAC\|
91	SSH_OLD_SESSIONID\|SSH_BUG_DEBUG\|	100	SSH_OLD_SESSIONID\|SSH_BUG_DEBUG\|