Re: making it so SSH server sends ext-info-s
Ron Frederick <[email protected]> Sat, 25 May 2024 10:38:06 -0700
| Newsgroups | gmane.ietf.secsh |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_A1685357-E209-4EC3-829A-91779ACC327A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On May 24, 2024, at 5:16=E2=80=AFPM, Terra Frost <[email protected]> = wrote: > I'm trying to test some changes to an SSH client relating to RFC8308 = but am having some difficulty doing so. >=20 > I can make the SSH client send ext-info-c to SSH servers but none of = them are sending ext-info-s back. >=20 > Does anyone know of any SSH server that implements ext-info-s and what = one must do to configure it? >=20 > According to the bottom of https://terrapin-attack.com/patches.html = the people who discovered the terrapin attack contacted the maintainers = of all SSH implementations that, among other things, implemented = RFC8308. As OpenSSH was among those contacted I assume that that means = that OpenSSH implements it but it's unclear to me how to get OpenSSH (or = any other SSH server for that matter) to send ext-info-s. The Terrapin changes don=E2=80=99t require ext-info-s. They actually add = other independent items to the kex algorithm list = ([email protected] and [email protected]), similar = to the ext-info-c and ext-info-s values described in RFC 8308. The reason you don=E2=80=99t see many implementations sending ext-info-s = is that a server is only supposed to send this if it plans on actually = parsing something out of the client=E2=80=99s SSH_MSG_EXT_INFO message. = The same goes in reverse for the client. However, there are popular = extensions generated by the server and parsed by the client (such as = "server-sig-algs") but not as many widely implemented in the opposite = direction. If you=E2=80=99re looking for an implementation that sends ext-info-s, = AsyncSSH (https://asyncssh.readthedocs.io/en/latest/) is one example. = For now, the only thing AsyncSSH sends in the client SSH_MSG_EXT_INFO is = =E2=80=9Cglobal-requests-ok=E2=80=9D (see = https://datatracker.ietf.org/doc/html/draft-ssh-global-requests-ok-00 = for details). --=20 Ron Frederick [email protected] --Apple-Mail=_A1685357-E209-4EC3-829A-91779ACC327A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"content-type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"overflow-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;">On May 24, = 2024, at 5:16=E2=80=AFPM, Terra Frost <[email protected]> = wrote:<div><blockquote type=3D"cite"><div><div dir=3D"ltr"><div>I'm = trying to test some changes to an SSH client relating to RFC8308 but am = having some difficulty doing so.</div><div><br></div><div>I can make the = SSH client send ext-info-c to SSH servers but none of them are sending = ext-info-s back.</div><div><br></div><div>Does anyone know of any SSH = server that implements ext-info-s and what one must do to configure = it?</div><div><br></div><div>According to the bottom of <a = href=3D"https://terrapin-attack.com/patches.html">https://terrapin-attack.= com/patches.html</a> the people who discovered the terrapin attack = contacted the maintainers of all SSH implementations that, among other = things, implemented RFC8308. As OpenSSH was among those contacted I = assume that that means that OpenSSH implements it but it's unclear to me = how to get OpenSSH (or any other SSH server for that matter) to send = ext-info-s.</div></div> </div></blockquote></div><div><br></div>The Terrapin changes don=E2=80=99t= require ext-info-s. They actually add other independent items to the = kex algorithm list ([email protected] and = [email protected]), similar to the ext-info-c and ext-info-s = values described in RFC 8308.<div><br></div><div>The reason you don=E2=80=99= t see many implementations sending ext-info-s is that a server is only = supposed to send this if it plans on actually parsing something out of = the client=E2=80=99s SSH_MSG_EXT_INFO message. The same goes in reverse = for the client. However, there are popular extensions generated by the = server and parsed by the client (such as "server-sig-algs") but not as = many widely implemented in the opposite = direction.</div><div><br></div><div>If you=E2=80=99re looking for an = implementation that sends ext-info-s, AsyncSSH (<a = href=3D"https://asyncssh.readthedocs.io/en/latest/">https://asyncssh.readt= hedocs.io/en/latest/</a>) is one example. For now, the only thing = AsyncSSH sends in the client SSH_MSG_EXT_INFO is = =E2=80=9Cglobal-requests-ok=E2=80=9D (see <a = href=3D"https://datatracker.ietf.org/doc/html/draft-ssh-global-requests-ok= -00">https://datatracker.ietf.org/doc/html/draft-ssh-global-requests-ok-00= </a> for details).<br><div> -- <br>Ron Frederick<br>[email protected]<br><br><br> </div> <br></div></body></html>= --Apple-Mail=_A1685357-E209-4EC3-829A-91779ACC327A--