Re: [9front] [patch] /sys/src/cmd/ssh.c notify user of unavailable cipher

[Romano <unobe@cpan.org>]

On April 21, 2020 6:46:13 PM UTC, cinap_lenrek@felloff.net wrote:
>> +		if(unpack(p, recv.w-p, "s.", &s, &n, &p) < 0)
>> +			break;
>> +		if(debug)
>>  			fprint(2, "%s: %.*s\n", *t, utfnlen(s, n), s);
>> +		if(!strcmp(*t,"clicipher") && !strstr(s,cipheralgs)) {
>> +			fprint(2, "%s not found in %.*s\n", cipheralgs, utfnlen(s, n),
>s);
>> +			sysfatal("server does not support cipher");
>>  		}
>
>hm... this is wrong as "s" is not NUL terminated here.

Cinap,

Thanks for the feedback! I am new to this and I appreciate the pointers.

By wrong, you mean that utfnlen() shouldn't be used with 's'? That usage already existed in the chunk I modified, so would that mean the implementation @ tip is also wrong in that way? Or  is there something else I'm missing?

> also not correct as you'd need to check if the overlap is properly
>delimited.

Even if there's only one supported cipher by the client at this point?

>also, this is not good enougth as to predict if the handshake
>would fail you'd need to also check kex and zip algorithms.

Agreed: I was scratching the itch I had, admittedly, abd thought less was more. I pondered doing more but as this is my first foray into this system and code base, I was trying to limit the effects of my changes. The generalized case would be nice to implement, but I fear there'd be so much of my crappy code for veterans like you to comment on, it would stall improvement. Do you think that adding the patch actually makes anything operate worse than it currently does on tip? Do you think it's a step backwards?

>overall, i'd prefer to implement the handshake proper and maybe
>add support for some common older ciphersuits instead adding
>code that does alot of clever things working around these
>limitations.

Yes, I'd prefer that too. I can review the RFC to see how far off-base the current implemenation is. Also, I am not a crypto expert and my beginning perusal of the 9front code didn't yield info for me on where to begin with adding new ciphers. So I guess this would be a good time to ask: do you (or does anyone else) have some pointers on where I would begin with adding other ciphers?