Subject: should "want reply" responses be checked or ignored?

From: Jim Wigginton <[email-masked]>
Date: Thu, 13 Aug 2009 10:33:12 -0500

>From <http://tools.ietf.org/html/rfc4254#section-6.5>:

>   It is RECOMMENDED that the reply to these messages be requested and
>   checked.  The client SHOULD ignore these messages.

Recommending SSH_MSG_CHANNEL_REQUEST responses be checked and then
saying, later, that they should be ignored, seems a little
contradictory.  If you ignore them, you're not checking them, and if
you check them, you're not ignoring them.

---

From: Simon Tatham <[email-masked]>
Date: Thu, 13 Aug 2009 17:08:26 +0100

> you check them, you're not ignoring them.

I think you've misparsed. In both those sentences, "these messages"
denote the SSH_MSG_CHANNEL_REQUESTs themselves, not the responses.

Thus, the first sentence says that when the client sends the
SSH_MSG_CHANNEL_REQUEST that starts a shell or command or subsystem,
it is RECOMMENDED that they set the want_reply flag and check the
reply (since the alternative is to fail to notice when the server
was unable to start the requested process).

The second sentence says that if the _server_ should ever send the
_client_ an SSH_MSG_CHANNEL_REQUEST that asks to start a shell or
command or subsystem, the client should ignore it! (Probably most
relevant to people who are writing both a client and server
implementation which share code, in which one might accidentally
leave in the code that responds to requests and end up with the
client able to respond to all sorts of inappropriate requests if a
malicious server should take it into its head to send them.)
-- 
Simon Tatham         "A cynic is a person who smells flowers and
<[email-masked]>    immediately looks around for a coffin."

---

From: Jim Wigginton <[email-masked]>
Date: Fri, 14 Aug 2009 16:44:53 -0500

> denote the SSH_MSG_CHANNEL_REQUESTs themselves, not the responses.

Rereading it, I think you're right.

> malicious server should take it into its head to send them.)

Seems kinda redundant given this:

6.1.  Opening a Session

  A session is started by sending the following message.

     byte      SSH_MSG_CHANNEL_OPEN
     string    "session"
     uint32    sender channel
     uint32    initial window size
     uint32    maximum packet size

  Client implementations SHOULD reject any session channel open
  requests to make it more difficult for a corrupt server to attack the
  client.

Of course, redundancy isn't necessarily a bad thing.

Anyway, thanks!