[Bug 1863930] Re: SSH 1.99 clients fail to connect to openssh-server 1:7.6p1-4ubuntu0.3

[Christian Ehrhardt ]

Autopkgtests are complete on the PPA at 
https://bileto.ubuntu.com/#/ticket/3962
https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3962/+packages

Tests all passed or are known force-badtest cases already.

Waiting for Kyle's response to properly handle the severity of this ...

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1863930

Title:
  SSH 1.99 clients fail to connect to openssh-server 1:7.6p1-4ubuntu0.3

Status in openssh package in Ubuntu:
  Fix Released
Status in openssh source package in Bionic:
  Triaged

Bug description:
  [Impact]

   * The version check in ssh was broken no more following RFC 4253 and
     thereby denying some clients that it shouldn't

   * Upstream fixed that and this is backporting the changes to bionic.

  [Test Case]

   # Prep
   * configure the ssh server to generally work
   # Testcase
   $ wget https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1863930/+attachment/5332797/+files/test_bug_1863930.py
   $ apt install python3-paramiko
   $ python3 test_bug_1863930.py localhost (or whatever your host is)

   Will report "Server is not patched." or "Server is patched.

   * for an extra regression check it might be worth to do some "normal" ssh 
     connections as well

  [Regression Potential]

   * The change is very small and reviewable as well as being upstream and 
     in all Ubuntu releases >=Cosmic for a while now so it seems safe.
     If anything the kind of regression to expect is that some former 
     (wrong) connection denials will then succeed. I can only think of
     that being an issue in test suites but not in the real world.

  [Other Info]

   * n/a

  --

  SSHD closes the connection and logs the error message below when a
  client presents a protoversion of "1.99":

      Protocol major versions differ for X.X.X.X port X:
  SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3 vs. SSH-1.99-XXX

  RFC 4253 only states that clients should treat a server's protoversion
  of "1.99" as equivalent to "2.0"; however, some backward-compatible
  clients send a protoversion of "1.99" and expect the server to treat
  it as "2.0".

  This regression was introduced in openssh-portable 7.6p1 from commit
  97f4d3083; fixes were implemented in commits 9e9c4a7e5 and c9c1bba06.
  I've attached a patch with both of those fixes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1863930/+subscriptions