openssh bugs - May 2025 - [Bug 3820] New: Around 5 second delay when starting an X11 application

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

            Bug ID: 3820
           Summary: Around 5 second delay when starting an X11 application
           Product: Portable OpenSSH
           Version: 9.6p1
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: chsdik at gmail.com

As of OpenSSH 9.6p1, when starting a X11 (ssh -X) application,
it takes around 5 seconds before the window finally appears.

I have seen this on Solaris but I've seen quite a few reports for Linux
and others.

This can be worked around by setting ObscureKeyStrokeTiming to no;
it appears that the code does not distinguish between actual
keys typed in or other data to be send.


In the point where we try to obscure the timing, we no longer
now where the data comes from.

$ ssh -X <host>
...
$ time xterm -e true

real    0m4.89s
user    0m0.05s
sys     0m0.07s

With older version (9.4p1 tried here):
$ time xterm -e true

real    0m0.37s
user    0m0.05s
sys     0m0.05s

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

--- Comment #1 from Casper Dik <chsdik at gmail.com> ---
This also affects OpenSSH 10.0p2

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at dtucker.net

--- Comment #2 from Darren Tucker <dtucker at dtucker.net> ---
Additional data point: this only occurs when a pty is allocated.  (The
server here is OpenBSD current, but I don't think it's platform
specific).

$ ssh -o ObscureKeyStrokeTiming=yes server -X time xterm -e true
real    0m0.098s-p 2022 obsdsnap
user    0m0.010s
sys     0m0.040s


$ ssh -o ObscureKeyStrokeTiming=yes server -tt -X time xterm -e true
real    0m4.934s
user    0m0.000s
sys     0m0.040s

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org
   Attachment #3879|                            |ok?(djm at mindrot.org)
              Flags|                            |

--- Comment #3 from Darren Tucker <dtucker at dtucker.net> ---
Created attachment 3879
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3879&action=edit
Use most recent x11 channel for activity detection

While looking a this I found what I think is *a* bug, but not *this*
bug: x11_channel_used_recently uses the lastused value from the last
x11 channel it finds, which is not necessarily the most recently used
one if there's more than one.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3879|ok?(djm at mindrot.org)        |ok+
              Flags|                            |

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

--- Comment #4 from Damien Miller <djm at mindrot.org>
---
> this only occurs when a pty is allocated
That's because the timing obfuscation is only enabled when a TTY is
allocated; see the start of clientloop.c:obfuscate_keystroke_timing()

IMO we could move the x11_channel_used_recently() to that if test as
well, to make it more aggressively disable the obfuscation when X11 is
in use.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3880|                            |ok?(dtucker at dtucker.net)
              Flags|                            |

--- Comment #5 from Damien Miller <djm at mindrot.org> ---
Created attachment 3880
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3880&action=edit
Disable timing obfuscation more aggressively when X11 channels active

This is what I mean. It would benefit from some testing.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3879|0                           |1
        is obsolete|                            |

--- Comment #6 from Darren Tucker <dtucker at dtucker.net> ---
Comment on attachment 3879
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3879
Use most recent x11 channel for activity detection

This one (or rather a variation) has been committed upstream.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

--- Comment #7 from Darren Tucker <dtucker at dtucker.net> ---
(In reply to Damien Miller from comment #5)
> Created attachment 3880 [details]
> Disable timing obfuscation more aggressively when X11 channels active
> 
> This is what I mean. It would benefit from some testing.
This patch doesn't seem to make a noticeable difference for me.

Without patch:
$. /ssh -Y -p 2022 -i ~/.ssh/id_ed25519 -o identitiesonly=yes localhost
-tt time xterm -e true

real    0m4.818s
user    0m0.023s
sys     0m0.035s
Connection to localhost closed.

With patch:
$ ./ssh -Y -p 2022 -i ~/.ssh/id_ed25519 -o identitiesonly=yes localhost
-tt time xterm -e true

real    0m4.783s
user    0m0.021s
sys     0m0.046s
Connection to localhost closed.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3880|ok?(dtucker at dtucker.net)    |ok-
              Flags|                            |

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3882|                            |ok?(djm at mindrot.org)
              Flags|                            |

--- Comment #8 from Darren Tucker <dtucker at dtucker.net> ---
Created attachment 3882
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3882&action=edit
Fix x11_channel_used_recently()

(In reply to Darren Tucker from comment #7)
> This patch doesn't seem to make a noticeable difference for me.
This seems to be because x11_channel_used_recently() returns true when
the channel *hasn't* been used recently, ie the current time is more
than  a second past the time the time of last use:

       return lastused != 0 && monotime() > lastused + 1;

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

--- Comment #9 from Darren Tucker <dtucker at dtucker.net> ---
With just this patch, my test case seems better:

$ ./ssh -Y -p 2022 -i ~/.ssh/id_ed25519 -o identitiesonly=yes localhost
-tt time xterm -e true
real    0m0.038s
user    0m0.011s
sys     0m0.007s
Connection to localhost closed.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |3808


Referenced Bugs:

https://bugzilla.mindrot.org/show_bug.cgi?id=3808
[Bug 3808] Tracking bug for OpenSSH 10.1
-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3882|                            |ok+
              Flags|                            |

--- Comment #10 from Damien Miller <djm at mindrot.org> ---
Comment on attachment 3882
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3882
Fix x11_channel_used_recently()

sigh

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #11 from Darren Tucker <dtucker at dtucker.net> ---
This has been committed upstream and will be in the 10.1 release. 
Thanks for the report.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3820

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |openssh at vanderhave.org

--- Comment #12 from Darren Tucker <dtucker at dtucker.net> ---
*** Bug 3870 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.