Add bug openssh-bug3967-workaround
Marco Ricci commited on 2026-07-06 19:31:57
Zeige 2 geänderte Dateien mit 23 Einfügungen und 0 Löschungen.
- index.md 1ff5c9c..f35b17c
- openssh-bug3967-workaround.md 0000000..54572c0
| ... | ... |
@@ -27,6 +27,7 @@ |
| 27 | 27 |
- [falsy-vault-config-values][]{: .fixed }
|
| 28 | 28 |
- [no-stdlib-module-names][]{: .fixed }
|
| 29 | 29 |
- [one-time-key-override-fails][]{: .fixed }
|
| 30 |
+ - [openssh-bug3967-workaround][]{: .fixed }
|
|
| 30 | 31 |
- [print-service-notes][]{: .fixed }
|
| 31 | 32 |
- [remove-pageant-build-info-check][]{: .fixed }
|
| 32 | 33 |
- [single-toplevel-module][]{: .fixed }
|
| ... | ... |
@@ -75,6 +76,7 @@ |
| 75 | 76 |
[no-stdlib-module-names]: no-stdlib-module-names.md |
| 76 | 77 |
[no-strict-compatibility-mode]: no-strict-compatibility-mode.md |
| 77 | 78 |
[one-time-key-override-fails]: one-time-key-override-fails.md |
| 79 |
+ [openssh-bug3967-workaround]: openssh-bug3967-workaround.md |
|
| 78 | 80 |
[other-derivation-schemes]: other-derivation-schemes.md |
| 79 | 81 |
[pretty-print-json]: pretty-print-json.md |
| 80 | 82 |
[print-service-notes]: print-service-notes.md |
| ... | ... |
@@ -0,0 +1,21 @@ |
| 1 |
+# `derivepassphrase` bug openssh-bug3967-workaround |
|
| 2 |
+ |
|
| 3 |
+???+ bug-success "Bug details: Work around faulty `query` response in OpenSSH 10.3" |
|
| 4 |
+ <table id="bug-summary" markdown> |
|
| 5 |
+ <tr><th scope=col>Class<td><i>bug</i><td>This is clearly an actual problem we want fixed. |
|
| 6 |
+ <tr><th scope=col>Present-in<td colspan=2><b>0.6</b> |
|
| 7 |
+ <tr><th scope=col>Fixed-in<td colspan=2><a href="https://git.schokokeks.org/derivepassphrase.git/commit/20bcd8f960b0655700905e9f20f807de15809188">20bcd8f960b0655700905e9f20f807de15809188</a> |
|
| 8 |
+ </table> |
|
| 9 |
+ |
|
| 10 |
+OpenSSH 10.3 is the first version to support the `query` extension request in its `ssh-agent`. |
|
| 11 |
+However, `ssh-agent` responds to each `query` extension request with *two* responses: once with the "normal" response, and once with a spurious empty `SUCCESS` response. |
|
| 12 |
+This causes all following requests to be misaligned, interpreting the wrong message as the intended response. |
|
| 13 |
+ |
|
| 14 |
+[The OpenSSH project acknowledges the bug][OPENSSH_BZ3967], and has a fix in preparation for 10.4. |
|
| 15 |
+ |
|
| 16 |
+We can detect and work around this situation by immediately issuing a subsequent `REQUEST_IDENTITIES` request, because it cannot legally have an empty `SUCCESS` response. |
|
| 17 |
+We then read the spurious empty `SUCCESS` response, if any, and the expected `IDENTITIES_ANSWER` or `FAILURE` response, and are then once again re-aligned. |
|
| 18 |
+ |
|
| 19 |
+<b>Therefore</b>, implement the above workaround to work seamlessly with OpenSSH 10.3. |
|
| 20 |
+ |
|
| 21 |
+[OPENSSH_BZ3967]: https://bugzilla.mindrot.org/show_bug.cgi?id=3967 |
|
| 0 | 22 |