NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

bin/45049: The HPN patch for OpenSSH breaks on SOCKS proxies

>Number:         45049
>Category:       bin
>Synopsis:       The HPN patch for OpenSSH breaks on SOCKS proxies
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jun 10 21:10:00 +0000 2011
>Originator:     Pierre Pronchery <>
>Release:        NetBSD 5.1_STABLE
System: NetBSD rst.defora.lan 5.1_STABLE NetBSD 5.1_STABLE (GENERIC) #0: Sun 
Apr 24 04:27:02 UTC 2011 
Architecture: i386
Machine: i386
I am currently using OpenSSH over SOCKS proxies, as provided by existing
OpenSSH connections (using the "DynamicForward" mechanism). When using
the default SSH binaries from NetBSD base (on both client and server
side) I am observing difficulties after a few minutes of use with
interactive sessions:
- data is sent properly from the client to the server
- data is received from the server to the client, but never displayed on
  the terminal
- when this occurs, the ssh client forwarding the connection outputs the
  following error: "rcvd too much data"

This behavior has already been reported publicly, like found here in the
Gentoo bug reporting system:

During the ensueing debugging process, the HPN patch was found to be the
culprit. This patch seems to be applied by default on NetBSD; see
src/crypto/dist/ssh/HPN-README, and the output of "ssh -v" for instance:

Remote protocol version 2.0, remote software version OpenSSH_5.0
debug1: match: OpenSSH_5.0 NetBSD_Secure_Shell-20080403-hpn13v1 pat

Replacing the SSH client used to forward connections over SOCKS with one
built from pkgsrc/security/openssh (without the "hpn-patch" option set)
seems to work-around the problem.

Alternatively, using the SSH client from base with the (undocumented
except in HPN-README) "HPNDisabled=yes" option seems to do the trick

$ ssh -D 9050

then, with pkgsrc's net/tsocks configured:
$ cat /usr/pkg/etc/tsocks.conf
local =
server =
server_type = 5
server_port = 9050
$ tsocks ssh

after a while, the connection seems to break, and error messages appear
on the first client (providing the SOCKS proxy).

As mentioned above, the "HPNDisabled" option can be enabled to
workaround the problem.

Unfortunately, the HPN project doesn't seem to have enough resources to
maintain its patch properly:

Home | Main Index | Thread Index | Old Index