[openssh-commits] [openssh] 04/04: upstream: Allow session-bind at openssh.com requests when the agent is

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 6a57081dc35acf3ee298108d4bc3580489608d5f
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Aug 7 05:18:05 2026 +0000

    upstream: Allow session-bind at openssh.com requests when the agent is
    
    locked, otherwise forwarding sessions established with an agent was locked
    will be treated as local, rather than remote.
    
    Reported by sn0x-sharma
    
    OpenBSD-Commit-ID: 524f210c6f2b3a06e0a2f6d0af5188a9a75fa2c7
---
 ssh-agent.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/ssh-agent.c b/ssh-agent.c
index 5fc73d697..1604f540a 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-agent.c,v 1.330 2026/07/05 02:46:44 dtucker Exp $ */
+/* $OpenBSD: ssh-agent.c,v 1.331 2026/08/07 05:18:05 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -1802,12 +1802,22 @@ process_extension(SocketEntry *e)
 		return;
 	}
 
-	if (strcmp(name, "query") == 0)
-		replied = success = process_ext_query(e);
-	else if (strcmp(name, "session-bind at openssh.com") == 0)
+	/*
+	 * This function can be called while the agent is locked to allow
+	 * session binds to be processed for new channels.
+	 * Other operations should be refused when locked.
+	 */
+
+	if (strcmp(name, "session-bind at openssh.com") == 0) {
 		success = process_ext_session_bind(e);
-	else {
+	} else if (locked) {
+		debug_f("attempt to use extension \"%s\" while locked", name);
+		goto generic_fail;
+	} else if (strcmp(name, "query") == 0) {
+		replied = success = process_ext_query(e);
+	} else {
 		debug_f("unsupported extension \"%s\"", name);
+ generic_fail:
 		free(name);
 		send_status(e, 0);
 		return;
@@ -1865,16 +1875,19 @@ process_message(u_int socknum)
 
 	/* check whether agent is locked */
 	if (locked && type != SSH_AGENTC_UNLOCK) {
-		sshbuf_reset(e->request);
 		switch (type) {
 		case SSH2_AGENTC_REQUEST_IDENTITIES:
 			/* send empty lists */
 			no_identities(e);
 			break;
+		case SSH_AGENTC_EXTENSION:
+			process_extension(e);
+			break;
 		default:
 			/* send a fail message for all other request types */
 			send_status(e, 0);
 		}
+		sshbuf_reset(e->request);
 		return 1;
 	}
 

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.