summaryrefslogtreecommitdiff
path: root/PROTOCOL
diff options
context:
space:
mode:
Diffstat (limited to 'PROTOCOL')
-rw-r--r--PROTOCOL33
1 files changed, 28 insertions, 5 deletions
diff --git a/PROTOCOL b/PROTOCOL
index 4d7a447b0..76e6adb4b 100644
--- a/PROTOCOL
+++ b/PROTOCOL
@@ -61,7 +61,30 @@ remain open after a "eow@openssh.com" has been sent and more data may
61still be sent in the other direction. This message does not consume 61still be sent in the other direction. This message does not consume
62window space and may be sent even if no window space is available. 62window space and may be sent even if no window space is available.
63 63
644. sftp: Reversal of arguments to SSH_FXP_SYMLINK 644. connection: disallow additional sessions extension
65 "no-more-sessions@openssh.com"
66
67Most SSH connections will only ever request a single session, but a
68attacker may abuse a running ssh client to surreptitiously open
69additional sessions under their control. OpenSSH provides a global
70request "no-more-sessions@openssh.com" to mitigate this attack.
71
72When an OpenSSH client expects that it will never open another session
73(i.e. it has been started with connection multiplexing disabled), it
74will send the following global request:
75
76 byte SSH_MSG_GLOBAL_REQUEST
77 string "no-more-sessions@openssh.com"
78 char want-reply
79
80On receipt of such a message, an OpenSSH server will refuse to open
81future channels of type "session" and instead immediately abort the
82connection.
83
84Note that this is not a general defence against compromised clients
85(that is impossible), but it thwarts a simple attack.
86
875. sftp: Reversal of arguments to SSH_FXP_SYMLINK
65 88
66When OpenSSH's sftp-server was implemented, the order of the arguments 89When OpenSSH's sftp-server was implemented, the order of the arguments
67to the SSH_FXP_SYMLINK method was inadvertendly reversed. Unfortunately, 90to the SSH_FXP_SYMLINK method was inadvertendly reversed. Unfortunately,
@@ -74,7 +97,7 @@ SSH_FXP_SYMLINK as follows:
74 string targetpath 97 string targetpath
75 string linkpath 98 string linkpath
76 99
775. sftp: Server extension announcement in SSH_FXP_VERSION 1006. sftp: Server extension announcement in SSH_FXP_VERSION
78 101
79OpenSSH's sftp-server lists the extensions it supports using the 102OpenSSH's sftp-server lists the extensions it supports using the
80standard extension announcement mechanism in the SSH_FXP_VERSION server 103standard extension announcement mechanism in the SSH_FXP_VERSION server
@@ -95,7 +118,7 @@ ever changed in an incompatible way. The server MAY advertise the same
95extension with multiple versions (though this is unlikely). Clients MUST 118extension with multiple versions (though this is unlikely). Clients MUST
96check the version number before attemping to use the extension. 119check the version number before attemping to use the extension.
97 120
986. sftp: Extension request "posix-rename@openssh.com" 1217. sftp: Extension request "posix-rename@openssh.com"
99 122
100This operation provides a rename operation with POSIX semantics, which 123This operation provides a rename operation with POSIX semantics, which
101are different to those provided by the standard SSH_FXP_RENAME in 124are different to those provided by the standard SSH_FXP_RENAME in
@@ -112,7 +135,7 @@ rename(oldpath, newpath) and will respond with a SSH_FXP_STATUS message.
112This extension is advertised in the SSH_FXP_VERSION hello with version 135This extension is advertised in the SSH_FXP_VERSION hello with version
113"1". 136"1".
114 137
1157. sftp: Extension requests "statvfs@openssh.com" and 1388. sftp: Extension requests "statvfs@openssh.com" and
116 "fstatvfs@openssh.com" 139 "fstatvfs@openssh.com"
117 140
118These requests correspond to the statvfs and fstatvfs POSIX system 141These requests correspond to the statvfs and fstatvfs POSIX system
@@ -153,5 +176,5 @@ The values of the f_flag bitmask are as follows:
153This extension is advertised in the SSH_FXP_VERSION hello with version 176This extension is advertised in the SSH_FXP_VERSION hello with version
154"2". 177"2".
155 178
156$OpenBSD: PROTOCOL,v 1.5 2008/06/09 13:38:46 dtucker Exp $ 179$OpenBSD: PROTOCOL,v 1.6 2008/06/10 22:15:23 djm Exp $
157 180