Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SSH2: send KEXINIT packet and identification string first or last (for 1.0 branch) #1162

Closed

Conversation

terrafrost
Copy link
Member

@terrafrost terrafrost commented Aug 7, 2017

This branch adds four new methods:

  • sendIdentificationStringFirst()
  • sendIdentificationStringLast()
  • sendKEXINITFirst()
  • sendKEXINITLast()

RFC4253 § 4.2 says "when the connection has been established, both sides MUST send an identification string" but it does not say which side should send it first.

RFC4253 § 7.1 says "key exchange begins by each side sending the [SSH_MSG_KEXINIT] packet" but again it does not say which side should send it first.

In theory, it shouldn't matter which side sends it first but in practice it sometimes does.

#1046 demonstrates that phpseclib sending the SSH_MSG_KEXINIT packet last can sometimes result in errors so, in lieu of any evidence that sending it first can result in errors, I've changed it so that it sends it first by default now. BUT if that does cause errors then phpseclib can be easily made to send it last.

https://stackoverflow.com/q/40430024/569976 demonstrates that phpseclib sending the identification packet last can result in errors but 535104c#commitcomment-23493058 demonstrates that sending it first can result in errors as well. This commit preserves the current behavior but makes it so that the current behavior can be overwritten.

@dvaeversted
Copy link

This solved an issue with connection errors against Cisco devices that we started experiencing after upgrading from a 0.X release of phpseclib, to 2.0.6

@terrafrost
Copy link
Member Author

This has been merged.

@terrafrost terrafrost closed this Aug 8, 2017
@terrafrost terrafrost mentioned this pull request Aug 25, 2017
@terrafrost
Copy link
Member Author

It's interesting SSH_MSG_NEWKEYS hasn't caused anyone an issue.

Quoting RFC4253 § 7.3, "Key exchange ends by each side sending an SSH_MSG_NEWKEYS message".

phpseclib sends SSH_MSG_NEWKEYS first.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants