derivepassphrase bug openssh-bug3967-workaround¶
Bug details: Work around faulty query response in OpenSSH 10.3
| Class | bug | This is clearly an actual problem we want fixed. |
|---|---|---|
| Present-in | 0.6 | |
| Fixed-in | 20bcd8f960b0655700905e9f20f807de15809188 (0.6.1) | |
OpenSSH 10.3 is the first version to support the query extension request in its ssh-agent.
However, ssh-agent responds to each query extension request with two responses: once with the “normal” response, and once with a spurious empty SUCCESS response.
This causes all following requests to be misaligned, interpreting the wrong message as the intended response.
The OpenSSH project acknowledges the bug, and has a fix in preparation for 10.4.
We can detect and work around this situation by immediately issuing a subsequent REQUEST_IDENTITIES request, because it cannot legally have an empty SUCCESS response.
We then read the spurious empty SUCCESS response, if any, and the expected IDENTITIES_ANSWER or FAILURE response, and are then once again re-aligned.
Therefore, implement the above workaround to work seamlessly with OpenSSH 10.3.