openssh bugs - Oct 2008 - [Bug 1528] New: sshd hangs when pasting more than 2k of text

https://bugzilla.mindrot.org/show_bug.cgi?id=1528

           Summary: sshd hangs when pasting more than 2k of text
           Product: Portable OpenSSH
           Version: 5.1p1
          Platform: Sparc
        OS/Version: Solaris
            Status: NEW
          Severity: normal
          Priority: P2
         Component: sshd
        AssignedTo: unassigned-bugs at mindrot.org
        ReportedBy: doke at udel.edu


Created an attachment (id=1570)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1570)
patch for channels.c

On Solaris 9 and 10, on both sparc and i86pc, sshd hangs on an ioctl
TCGETS call after a large write to the pty.  Where large is anything
over about 2k.  So pasting 100 or so lines of text into vi will hang
the session.  

The cause is the tcgetattr call on line 1606 of channels.c provoking a
solaris bug.  It hangs forever after a large write to the pty.  The
workaround is to not make the call, assume the terminal is 
not echoing, and always send the random data packet.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528





--- Comment #1 from Doke Scott <doke at udel.edu>  2008-10-02 08:02:30 ---
Created an attachment (id=1571)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1571)
alternate patch for channels.c

The ioctl is failing partially because the wfd file descriptor isn't
actually a pty.  It's being incorrectly flagged as one in
channel_register_fds() which simply trusts it's caller.  Also the test
on line 1605 is checking to see if rfd is a pty, before applying the
ioctl to wfd.  

So this will also fix the problem, but might not be as secure because
it doesn't send the ignored random data packets.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528





--- Comment #2 from Darren Tucker <dtucker at zip.com.au>  2008-10-02
11:15:13 ---
Created an attachment (id=1572)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1572)
Only generate fake echo packets for tty writes < 1k

I suspect patch #1570 would make the echo/noecho difference observable
on the wire.  An alternative is to only do this check for small writes.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528





--- Comment #3 from Doke Scott <doke at udel.edu>  2008-10-11 07:35:12 ---
I'm not sure 1572 will avoid the problem.  Large writes get broken up
into multiple writes.  The last one can be small, yet enough to fill
the pipe, and make the ioctl hang.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528





--- Comment #4 from Doke Scott <doke at udel.edu>  2008-10-11 07:39:24 ---
1571 avoids the problem, but makes it more vulnerable to analysis. 
Maybe it could randomly decide to send random size fake packets?

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528


Carol Kassel <ckassel at columbia.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ckassel at columbia.edu




--- Comment #5 from Carol Kassel <ckassel at columbia.edu>  2009-02-10
05:52:40 ---
Hi, new and not-so-tech-savvy user here. I'm interested in this ticket
because we have a real-live user at Columbia who is tearing his hair
out over this issue. I see that the conversation stopped last October.
Does that mean no one is working on this problem? Do you happen to know
if and when someone will? Thanks; we're eager to know!

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528





--- Comment #6 from Doke Scott <doke at udel.edu>  2009-02-10 06:31:17 ---
I've been using the alternate patch (#1571, 920 bytes) I attached to
this bug report.  It's been running since october on about 200
production unix servers, used daily by hundreds of people and thousands
of automated jobs.  We havn't seen any problems.  

Technically, it probably does make the session a little more subject to
certain kinds of cryptographic analysis.  It could probably be improved
by adding something to randomly send the filler packets.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528


Jeff Wieland <wieland at purdue.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |major
                 CC|                            |wieland at purdue.edu




--- Comment #7 from Jeff Wieland <wieland at purdue.edu>  2009-02-26
03:06:34 ---
I'm seeing th

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528


radmin <listmail at triad.rr.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |listmail at triad.rr.com




--- Comment #8 from radmin <listmail at triad.rr.com>  2009-02-26 03:32:22
---
I tested openssh-5.0p1 and confirm that this issue does not exist
there, but unfortunately that version doesn't contain the following
solaris fix (in OpenSSH_5.2p1):
* Avoid a sshd(8) hang-on-exit on Solaris caused by depending on the
success of isatty() on a PTY master (undefined behaviour). Probably
affected other platforms too. (bz#1463)
The above fix works wonders for service administration in an oracle
environment.
--
Anyway, in short, this is confirmation that we are also affect by this
issue and would like to see an official fix make it into the main code
some day.
--
I will test and implement the alternate patch #1571 for the time being.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528





--- Comment #9 from Carol Kassel <ckassel at columbia.edu>  2009-02-26
06:59:18 ---
Just an update on my situation: we installed the patch and it was
successful here. We have not encountered any problems. We, too, would
like to see this make it into the main code. Thanks!

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528





--- Comment #10 from Jeff Wieland <wieland at purdue.edu>  2009-02-26
07:06:48 ---
Patch #1571 seems to be working well for us as well under Solaris 8 and
10.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528





--- Comment #11 from radmin <listmail at triad.rr.com>  2009-07-08
23:43:57 ---
Anyone rechecked for this in 5.2p1 ?  I will end up checking if I don't
hear back from anyone, however I don't see this bug ID listed in the
latest change log.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528


radmin <listmail at triad.rr.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|5.1p1                       |5.2p1




--- Comment #12 from radmin <listmail at triad.rr.com>  2009-07-09
01:09:40 ---
Nevermind, I found previous emails where 5.2p1 was confirmed to still
exhibit the issue and also that the alternate patch worked for version
5.2p1 as well.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528


Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at zip.com.au
             Blocks|                            |1560




--- Comment #13 from Darren Tucker <dtucker at zip.com.au>  2009-07-31
10:18:22 ---
We'll do something with this for 5.3

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528


Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #1570|0                           |1
        is obsolete|                            |
   Attachment #1571|0                           |1
        is obsolete|                            |
   Attachment #1572|0                           |1
        is obsolete|                            |


--- Comment #14 from Darren Tucker <dtucker at zip.com.au> 2009-08-28
10:38:14 EST ---
Created an attachment (id=1677)
Skip tcgetattr on solaris

I think this is the simplest thing to do.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528


Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


--- Comment #15 from Darren Tucker <dtucker at zip.com.au> 2009-08-28
11:03:31 EST ---
This has been committed and will be in the 5.3 release.  Thanks.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1528

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #16 from Damien Miller <djm at mindrot.org> 2009-10-06
15:02:50 EST ---
Mass move of RESOLVED bugs to CLOSED now that 5.3 is out.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.