Hi,
We embed libssh 0.12.2 (mbedtls backend, nonblocking sessions, driven by
ssh_event_dopoll) in an SSH client/server library for the Acton language.
In the field we have seen a channel stream arrive with its leading bytes
missing while the session and the channel stayed up and no error was
reported. In our case it was a NETCONF <hello> that started mid-element.
The only place we found where libssh loses channel data and still keeps the
session running is this check in channel_rcv_data (src/channels.c:670):
```
if (len > channel->local_window) {
SSH_LOG(SSH_LOG_RARE,
"Data packet too big for our window(%" PRIu32 " vs %"
PRIu32 ")",
len,
channel->local_window);
SSH_STRING_FREE(str);
ssh_set_error(session, SSH_FATAL, "Window exceeded");
return SSH_PACKET_USED;
}
```
When we patch this check to fire on one chosen packet, we reproduce the
exact symptom. We have not found out why the window would diverge in
practice and can no longer reproduce it...
We just want to like to understand why libssh behaves this way so that we
can handle it correctly on our side.
1. why is the whole payload dropped? RFC 4254 section 5.2 says:
"Both parties MAY ignore all extra data sent after the allowed window is
empty."
Read literally, that covers the bytes past the window, not the bytes that
still fit. Was dropping the whole packet a deliberate choice, for example
because a partial packet was considered worse than none or is there another
part of the RFC or a compatibility concern behind it?
2. why is the error SSH_FATAL when the session and channel keep running?
The error is recorded as fatal, but session_state is left as it is and the
channel stays open. By contrast, channel_rcv_change_window sets
SSH_SESSION_STATE_ERROR when a window adjust overflows (channels.c:575-581).
Is the difference intended and what does SSH_FATAL mean in this case?
3. is there an intended way for an application to notice the discard?
ssh_event_dopoll returns SSH_OK and ssh_get_status() does not report
SSH_CLOSED_ERROR. The error slot is per session, does not name the channel
and stays set until something overwrites it.
Thanks,
Antonio Prcela
Embedded Software Engineer
Sartura d.d.
Lendavska ulica 16a
10000 Zagreb, Croatia
Email: [email protected]
Web: www.sartura.hr
