From fa2d843403874cf30f4892f26b15e33178d80daa Mon Sep 17 00:00:00 2001
From: Matt Johnston <matt@ucc.asn.au>
Date: Sat, 15 Feb 2014 21:23:41 +0800
Subject: [PATCH] Disable immediate auth for delayed-zlib mode
---
cli-auth.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/cli-auth.c b/cli-auth.c
index 1b6dac71..c21f6946 100644
--- a/cli-auth.c
+++ b/cli-auth.c
@@ -52,14 +52,22 @@ void cli_auth_getmethods() {
encrypt_packet();
#ifdef DROPBEAR_CLI_IMMEDIATE_AUTH
- ses.authstate.authtypes = AUTH_TYPE_PUBKEY;
- if (getenv(DROPBEAR_PASSWORD_ENV)) {
- ses.authstate.authtypes |= AUTH_TYPE_PASSWORD | AUTH_TYPE_INTERACT;
- }
- if (cli_auth_try() == DROPBEAR_SUCCESS) {
- TRACE(("skipped initial none auth query"))
- /* Note that there will be two auth responses in-flight */
- cli_ses.ignore_next_auth_response = 1;
+ /* We can't haven't two auth requests in-flight with delayed zlib mode
+ since if the first one succeeds then the remote side will
+ expect the second one to be compressed.
+ Race described at
+ http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/zlib-openssh.html
+ */
+ if (ses.keys->trans.algo_comp != DROPBEAR_COMP_ZLIB_DELAY) {
+ ses.authstate.authtypes = AUTH_TYPE_PUBKEY;
+ if (getenv(DROPBEAR_PASSWORD_ENV)) {
+ ses.authstate.authtypes |= AUTH_TYPE_PASSWORD | AUTH_TYPE_INTERACT;
+ }
+ if (cli_auth_try() == DROPBEAR_SUCCESS) {
+ TRACE(("skipped initial none auth query"))
+ /* Note that there will be two auth responses in-flight */
+ cli_ses.ignore_next_auth_response = 1;
+ }
}
#endif
TRACE(("leave cli_auth_getmethods"))
--
GitLab