[openssh-commits] [openssh] 29/87: upstream: better accounting when the peer exceeds it channel

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 76e0390ef678c8152f8101bd976cc139221769a1
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 02:59:36 2026 +0000

    upstream: better accounting when the peer exceeds it channel
    
    window. We allow a 10% grace before the connection is terminated but
    previously would reset the excess if the peer sent an empty packet after
    going into excess, allowing them to buffer more data than intended.
    
    This now requires the peer to fully pay down the excess before giving
    them back window.
    
    Anthropic ANT-2026-KM8MV6JI
    
    OpenBSD-Commit-ID: d8f18cff4cf2038d3419683c126c1a7958b88244
---
 channels.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/channels.c b/channels.c
index dc008efc3..b0770290f 100644
--- a/channels.c
+++ b/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.473 2026/10/27 22:51:00 djm Exp $ */
+/* $OpenBSD: channels.c,v 1.474 2026/10/30 02:59:36 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -2496,8 +2496,20 @@ channel_handle_efd(struct ssh *ssh, Channel *c)
 static int
 channel_check_window(struct ssh *ssh, Channel *c)
 {
+	u_int excess;
 	int r;
 
+	/*
+	 * Data that the peer sent beyond the advertised window was never
+	 * charged against it, so don't hand back window for consuming it.
+	 * The excess is forgiven as it drains from the buffer instead.
+	 */
+	if (c->local_window_exceeded != 0) {
+		excess = MINIMUM(c->local_consumed, c->local_window_exceeded);
+		c->local_consumed -= excess;
+		c->local_window_exceeded -= excess;
+	}
+
 	if (c->type == SSH_CHANNEL_OPEN &&
 	    !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
 	    ((c->local_window_max - c->local_window >
@@ -3603,10 +3615,8 @@ channel_input_data(int type, uint32_t seq, struct ssh *ssh)
 			ssh_packet_disconnect(ssh, "channel %d: peer ignored "
 			    "channel window", c->self);
 		}
-	} else {
+	} else
 		c->local_window -= win_len;
-		c->local_window_exceeded = 0;
-	}
 
 	if (c->datagram) {
 		if ((r = sshbuf_put_string(c->output, data, data_len)) != 0)

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.