search

rapier1 / hpn-ssh

HPN-SSH based on OpenSSH
https://psc.edu/hpn-ssh-home
Other
319 stars 43 forks source link

Patch against OpenSSH 9.6 or greater #62

Closed elluisian closed 8 months ago

elluisian commented 8 months ago

Hi, asking for an enhancement, or better, to fix an important vulnerability. As you may know, some time ago a new vulnerability named Terrapin has been discovered on SSH implementations (https://terrapin-attack.com/), but the newest hpn-ssh is still based upon OpenSSH 9.5p1 which, as far as I know, is still affected by the problem.

Please, whenever possible, update the patches so that hpn-ssh is safe from that vulnerability.

Thanks for the hard work anyway.

dave-re-imprivata commented 8 months ago

https://github.com/rapier1/hpn-ssh/discussions/59

elluisian commented 8 months ago

Thank you @dave-re-imprivata, I noticed that it is still work in progress only after creating the issue. My bad for wasting your time. It can be closed if you think so. Again my bad.

rapier1 commented 8 months ago

Hey there. We are working on it but we've come across a regression in our code. It seems that a chance exists for the connection to enter in to a pathological state when transferring data to an HPN server from an SSH client more recent than 8.8p1. I have a fix in place but it involves limiting the advertised receive window in SSH->HPN connections. I'm not happy about doing that so I'm looking for other ways of mitigating this issue. I hope to have an effective fix out soon but please be assured that I am working on it.

Buffer management is hard. :|

elluisian commented 8 months ago

Thank you for your answer @rapier1, not a problem at all, as already stated, I'm sorry I didn't check the discussions BEFORE posting this issue, had I known, I wouldn't have opened it. Since I'm still a beginner developer I can only imagine that it is indeed something difficult you're dealing with, so do not worry, take your time and keep up the good work!