Darren Tucker <dtucker@xxxxxxxxxx> writes:
>Assuming that's the whole packet, I think that's a zero-prompt
>USERAUTH_INFO_REQUEST packet containing empty name, instructions and language
>strings. What do you mean by "fails a data-validity check"?
My code checks for sane values in the fields in the packet, so it rejects it
as malformed before it gets to the interesting philosophical issue of how to
send a response to a request for zero responses.
>If it was just the prompt part of the packet, what's in the name and
>instruction fields?
Nothing. All fields are empty, so if you take this (RFC 4256):
byte SSH_MSG_USERAUTH_INFO_REQUEST
[0] string name (ISO-10646 UTF-8)
[0] string instruction (ISO-10646 UTF-8)
[0] string language tag (as defined in [RFC-3066])
[0] int num-prompts
string prompt[1] (ISO-10646 UTF-8)
boolean echo[1]
...
string prompt[num-prompts] (ISO-10646 UTF-8)
boolean echo[num-prompts]
and set all fields to empty, you get 16 bytes of zeros (marked up above).
>Zero prompts is specifically allowed by RFC4256 section 3.2:
>
>" The num-prompts field may be `0', in which case there will be no
> prompt/echo fields in the message, but the client SHOULD still
> display the name and instruction fields (as described below)."
Sure, but since they're also empty there's nothing to display. So it's really
a case of "what do you do in response to a request for zero responses?". I'm
not sure if promulgating koans was a goal of OpenSSH.
Peter.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
