| Summary: | Add IP address to error kex_exchange_identification error message | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | Ulrich Windl <Ulrich.Windl> | ||||||
| Component: | sshd | Assignee: | Assigned to nobody <unassigned-bugs> | ||||||
| Status: | CLOSED FIXED | ||||||||
| Severity: | enhancement | CC: | ahmedsayeed1982, djm, dtucker | ||||||
| Priority: | P5 | ||||||||
| Version: | 8.1p1 | ||||||||
| Hardware: | Other | ||||||||
| OS: | Linux | ||||||||
| Bug Depends on: | |||||||||
| Bug Blocks: | 3117 | ||||||||
| Attachments: |
|
||||||||
|
Description
Ulrich Windl
2020-03-03 22:48:25 AEDT
Created attachment 3359 [details]
Add peer info to kex_exchange_identification error messages
Please try this patch.
(In reply to Darren Tucker from comment #1) The patch looks OK for me, but I cannot really test it as the machine where I see it is some appliance where I can't replace code, and I'm not able to trigger this error on any machines where I could replace sshd. The only thing in the patch that makes me (as a no-"ssh developer") wonder is the size reserved for the identification: 512 It should be large enough, but maybe even it's too large. Isn't there a symbolic constant for that? Other things I'm thinking of is the consistency of messages containing the peer: "from server %s" (at end) "with peer %s" (at end) "remote host %s" (at end) "%s: peer %s" (at beginning) "from peer %s" (in middle) "with peer %s" (in middle) Maybe we should instead downgrade some of the error messages in kex_exchange_identification() to debug severity and have the caller call sshpkt_fatal() as that logs the connection details in a semi-standard format Created attachment 3365 [details]
use sshpkt_fatal() for kex_exchange_identification() errors
This uses sshpkt_fatal() to record errors from kex_exchange_identification(). This should make it consistent with most other exit messages.
Examples:
[djm@djm openssh]$ ./ssh -p 2222 127.0.0.1
Protocol major versions differ: 2 vs. 1
banner exchange: Connection to 127.0.0.1 port 2222: could not read protocol version
[djm@djm openssh]$ ./ssh -p 2222 127.0.0.1
kex_exchange_identification: Connection closed by remote host
Connection closed by 127.0.0.1 port 2222
There's arguably a little duplication between the error messages in some cases, but I think that's acceptable.
Note that this required some renovation of kex_exchange_identification() to preserve errno for SSH_ERR_SYSTEM_ERROR cases. That's the bulk of the diff.
Patch applied and will be in openssh-8.2 closing resolved bugs as of 8.6p1 release closing resolved bugs as of 8.6p1 release [spam removed] |