[prev in list] [next in list] [prev in thread] [next in thread] 

List:       openssh-bugs
Subject:    [Bug 1360] Connection aborted on large data -R transfer
From:       bugzilla-daemon () bugzilla ! mindrot ! org
Date:       2007-09-17 19:43:00
Message-ID: 20070917194300.C2AA469BA2 () natsu ! mindrot ! org
[Download RAW message or body]

http://bugzilla.mindrot.org/show_bug.cgi?id=1360





--- Comment #2 from Jan Kratochvil <jan.kratochvil@redhat.com>  2007-09-18 05:42:54 ---
Created an attachment (id=1349)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1349)
Fix - undo one patch.

IMO the problem is due to the patch:
   - markus@cvs.openbsd.org 2007/06/11 09:14:00
     [channels.h]
     increase default channel windows; ok djm

The attached patch workarounds it (tested only briefly and only the
client side).

The problem is reported from packet.c:
                if (packet_length < 1 + 4 || packet_length > 256 *
1024) {
#ifdef PACKET_DEBUG
                        buffer_dump(&incoming_packet);
#endif
                        packet_disconnect("Bad packet length %u.",
packet_length);
                }
and the code is right - the size like 557056 is definitely > 256KB.

Removing only this check does not help, the server then crashes on:
Sep 17 21:25:45 host1 sshd[4072]: fatal: buffer_append_space: len
1326080 not supported

The tested server (different than in my original bugreport) is:
openssh-4.3p2-19.fc6.i386

I hope there is now enough info for understanding the problem.
I expect you are aware of the window sizes negotiations across SSH
versions and their maximum allowed values permitted by the protocol.

Reproducer is:
$ nc -l 5000 >/dev/null & ssh -vvvv -R 5000:localhost:5000 REMOTE_HOST
'nc </dev/urandom localhost 5000'
(with local x86_64 openssh-4.7 under the test and remote
openssh-4.3p2-19.fc6.i386, running over 11Mbit connection)


-- 
Configure bugmail: http://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
[prev in list] [next in list] [prev in thread] [next in thread]