x/crypto/ssh: Client chokes after first key exchange against OpenSSH 7.4p1 server

[peterverraedt]

What version of Go are you using (go version)?

$ go version
go version go1.16.14 linux/amd64

Does this issue reproduce with the latest release?

Tested with latest commits regarding RFC8308 support for client.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GOARCH="amd64"
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOVERSION="go1.16.14"

What did you do?

I'm running a ssh client (similar to https://github.com/helloyi/go-sshclient) against an OpenSSH 7.4p1 server, with client authentication using certificates, and running a command for a while (longer than 30 seconds) remotely, piping stdin/stdout through ssh.

What did you expect to see?

The command being completed successfully.

What did you see instead?

After RFC8308 was implemented client-side in the x/crypto/ssh package, the ssh client closes its connection suddenly after the first key reexchange, returning the error "remote command exited without exit status or exit signal".

The reason, at it seems, is that an OpenSSH 7.4p1 server receiving ext-info-c, sends msgExtInfo after every key exchange rather than only the first one, breaking RFC8308. The first one is correctly handled in https://github.com/golang/crypto/blob/master/ssh/client_auth.go#L33-L59, but the key reexchange happens when the mux is already set up and results in the connection being closed client-side.

The following patch works to circumvent the issue:

diff --git a/ssh/mux.go b/ssh/mux.go
index 9654c01869..7d3fd28dd4 100644
--- a/ssh/mux.go
+++ b/ssh/mux.go
@@ -227,6 +227,9 @@ func (m *mux) onePacket() error {
 	}
 
 	switch packet[0] {
+	case msgExtInfo:
+		// OpenSSH 7.4p1 sends msgExtInfo at the wrong time, breaking RFC8308. We simply ignore the packet.
+		return nil
 	case msgChannelOpen:
 		return m.handleChannelOpen(packet)
 	case msgGlobalRequest, msgRequestSuccess, msgRequestFailure:

The issue is not present against OpenSSH 8.

[peterverraedt]

See also https://bugzilla.mindrot.org/show_bug.cgi?id=2929.

[gopherbot]

Change https://go.dev/cl/394134 mentions this issue: ssh: send ext-info-c only once