Skip to content

Commit

Permalink
SSH2: don't close channel on unexpected response to channel request
Browse files Browse the repository at this point in the history
  • Loading branch information
@terrafrost
terrafrost committed Mar 31, 2021
1 parent e209db7 commit 2d6705d
Showing 1 changed file with 15 additions and 30 deletions.
45 changes: 15 additions & 30 deletions phpseclib/Net/SSH2.php
View file
Expand Up @@ -2951,28 +2951,6 @@ function _initShell()
return false;
}

$response = $this->_get_binary_packet();
if ($response === false) {
$this->bitmap = 0;
user_error('Connection closed by server');
return false;
}

if (!strlen($response)) {
return false;
}
list(, $type) = unpack('C', $this->_string_shift($response, 1));

switch ($type) {
case NET_SSH2_MSG_CHANNEL_SUCCESS:
// if a pty can't be opened maybe commands can still be executed
case NET_SSH2_MSG_CHANNEL_FAILURE:
break;
default:
user_error('Unable to request pseudo-terminal');
return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION);
}

$packet = pack(
'CNNa*C',
NET_SSH2_MSG_CHANNEL_REQUEST,
Expand All @@ -2985,14 +2963,7 @@ function _initShell()
return false;
}

$this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_REQUEST;

$response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SHELL);
if ($response === false) {
return false;
}

$this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_DATA;
$this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_IGNORE;

$this->bitmap |= NET_SSH2_MASK_SHELL;

Expand Down Expand Up @@ -3923,6 +3894,16 @@ function _get_channel_packet($client_channel, $skip_extended = false)
return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION);
}
break;
case NET_SSH2_MSG_IGNORE:
switch ($type) {
case NET_SSH2_MSG_CHANNEL_SUCCESS:
//$this->channel_status[$channel] = NET_SSH2_MSG_CHANNEL_DATA;
continue 3;
case NET_SSH2_MSG_CHANNEL_FAILURE:
user_error('Error opening channel');
return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION);
}
break;
case NET_SSH2_MSG_CHANNEL_REQUEST:
switch ($type) {
case NET_SSH2_MSG_CHANNEL_SUCCESS:
Expand All @@ -3942,6 +3923,10 @@ function _get_channel_packet($client_channel, $skip_extended = false)

switch ($type) {
case NET_SSH2_MSG_CHANNEL_DATA:
//if ($this->channel_status[$channel] == NET_SSH2_MSG_IGNORE) {
// $this->channel_status[$channel] = NET_SSH2_MSG_CHANNEL_DATA;
//}

/*
if ($channel == NET_SSH2_CHANNEL_EXEC) {
// SCP requires null packets, such as this, be sent. further, in the case of the ssh.com SSH server
Expand Down

1 comment on commit 2d6705d

@terrafrost
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See #1631

Please sign in to comment.