[openssh-commits] [openssh] 49/87: upstream: don't let SSH_MSG_PONG replies pile up if the peer

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 2c34666e084654943319a687227caca35536daa2
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 05:21:48 2026 +0000

    upstream: don't let SSH_MSG_PONG replies pile up if the peer
    
    isn't sending ACKs and there is a significant amount of data in data in out
    transport obuf. Avoids an obscure post-auth soft memory DoS
    
    Anthropic ANT-2026-Z4SZFUYY
    
    OpenBSD-Commit-ID: 55eb6b4d171008321f5c16cf1b1fdfeeadc7cff8
---
 PROTOCOL | 8 +++++---
 packet.c | 7 ++++++-
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/PROTOCOL b/PROTOCOL
index 06081f82a..1ca2dfd83 100644
--- a/PROTOCOL
+++ b/PROTOCOL
@@ -110,8 +110,10 @@ ping:
 	byte		SSH_MSG_PONG
 	string		data
 
-Replies are sent in order. They are sent immediately except when rekeying
-is in progress, in which case they are queued until rekeying completes.
+Replies are sent in order. No reply is sent to a ping that is received
+before authentication has completed, while rekeying is in progress or
+while the peer has not yet read a significant amount of previously sent
+data.
 
 The server advertises support for these messages using the
 SSH2_MSG_EXT_INFO mechanism (RFC8308), with the following message:
@@ -718,4 +720,4 @@ master instance and later clients.
 OpenSSH extends the usual agent protocol. These changes are documented
 in the PROTOCOL.agent file.
 
-$OpenBSD: PROTOCOL,v 1.60 2026/02/09 22:09:48 dtucker Exp $
+$OpenBSD: PROTOCOL,v 1.61 2026/10/30 05:21:48 djm Exp $
diff --git a/packet.c b/packet.c
index 462df2847..bf556c680 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.347 2026/10/30 04:36:21 djm Exp $ */
+/* $OpenBSD: packet.c,v 1.348 2026/10/30 05:21:48 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -1947,6 +1947,11 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, uint32_t *seqnr_p)
 				DBG(debug("Won't reply to PING during KEX"));
 				break;
 			}
+			/* Don't let replies pile up if the peer isn't reading */
+			if (!ssh_packet_not_very_much_data_to_write(ssh)) {
+				DBG(debug("Won't reply to PING with backlog"));
+				break;
+			}
 			if ((r = sshpkt_start(ssh, SSH2_MSG_PONG)) != 0 ||
 			    (r = sshpkt_put_string(ssh, d, len)) != 0 ||
 			    (r = sshpkt_send(ssh)) != 0)

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.