Commits on Feb 24, 2025

1. ssh: limit the size of the internal packet queue while waiting for KEX …

   In the SSH protocol, clients and servers execute the key exchange to
   generate one-time session keys used for encryption and authentication.
   The key exchange is performed initially after the connection is
   established and then periodically after a configurable amount of data.
   While a key exchange is in progress, we add the received packets to an
   internal queue until we receive SSH_MSG_KEXINIT from the other side.
   This can result in high memory usage if the other party is slow to
   respond to the SSH_MSG_KEXINIT packet, or memory exhaustion if a
   malicious client never responds to an SSH_MSG_KEXINIT packet during a
   large file transfer.
   We now limit the internal queue to 64 packets: this means 2MB with the
   typical 32KB packet size.
   When the internal queue is full we block further writes until the
   pending key exchange is completed or there is a read or write error.
   
   Thanks to Yuichi Watanabe for reporting this issue.
   
   Change-Id: I1ce2214cc16e08b838d4bc346c74c72addafaeec
   Reviewed-on: https://go-review.googlesource.com/c/crypto/+/652135
   Reviewed-by: Neal Patel <nealpatel@google.com>
   Auto-Submit: Gopher Robot <gobot@golang.org>
   Reviewed-by: Roland Shoemaker <roland@golang.org>
   LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

   

   drakkan authored and gopherbot committed Feb 24, 2025
   Configuration menu

   • View commit details
   • Copy full SHA for 7292932
   • Browse repository at this point

   Copy the full SHA

   7292932 View commit details

   Browse the repository at this point in the history