[openssh-commits] [openssh] 31/87: upstream: make ConnectTimeout apply to the initial KEX as ssh.1

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 81e0e4348e250222e7177ce1f53b11271511022e
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 03:20:00 2026 +0000

    upstream: make ConnectTimeout apply to the initial KEX as ssh.1
    
    promises. This isn't perfect: the timeout is applied per-packet read() rather
    than as a total time bound, but it at least allows a connection that stalls
    post-banner and pre-KEX to be automatically terminated
    
    Anthropic NT-2026-LZZ8V5RF
    
    OpenBSD-Commit-ID: 0bdf349f0e5380d21d3692eeb81407ddd34923b5
---
 sshconnect.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/sshconnect.c b/sshconnect.c
index 3349d8e39..a317c4432 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect.c,v 1.386 2026/09/16 00:29:44 djm Exp $ */
+/* $OpenBSD: sshconnect.c,v 1.387 2026/10/30 03:20:00 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -1653,10 +1653,21 @@ ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost,
 	/* Put the connection into non-blocking mode. */
 	ssh_packet_set_nonblocking(ssh);
 
+	/*
+	 * ConnectTimeout also covers the initial key exchange: bound each
+	 * packet read/write during KEX by the time remaining, rounded up to
+	 * whole seconds. Time spent at the host key prompt is not counted.
+	 */
+	if (timeout_ms > 0)
+		ssh_packet_set_timeout(ssh, timeout_ms / 1000 + 1, 1);
+
 	/* key exchange */
 	/* authenticate user */
 	debug("Authenticating to %s:%d as '%s'", host, port, server_user);
 	ssh_kex2(ssh, host, hostaddr, port, cinfo);
+	/* KEX done; use the keepalive timeout for the rest of the session. */
+	ssh_packet_set_timeout(ssh, options.server_alive_interval,
+	    options.server_alive_count_max);
 	kex_set_warn_weak_crypto(ssh, options.warn_weak_crypto &&
 	    !options.kex_algorithms_set);
 	if (!options.kex_algorithms_set && ssh->kex != NULL &&

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.