From 6a57081dc35acf3ee298108d4bc3580489608d5f Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Fri, 7 Aug 2026 05:18:05 +0000 Subject: [PATCH] upstream: Allow session-bind@openssh.com requests when the agent is locked, otherwise forwarding sessions established with an agent was locked will be treated as local, rather than remote. Reported by sn0x-sharma OpenBSD-Commit-ID: 524f210c6f2b3a06e0a2f6d0af5188a9a75fa2c7 --- ssh-agent.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/ssh-agent.c b/ssh-agent.c index 5fc73d697..1604f540a 100644 --- a/ssh-agent.c +++ b/ssh-agent.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-agent.c,v 1.330 2026/07/05 02:46:44 dtucker Exp $ */ +/* $OpenBSD: ssh-agent.c,v 1.331 2026/08/07 05:18:05 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -1802,12 +1802,22 @@ process_extension(SocketEntry *e) return; } - if (strcmp(name, "query") == 0) - replied = success = process_ext_query(e); - else if (strcmp(name, "session-bind@openssh.com") == 0) + /* + * This function can be called while the agent is locked to allow + * session binds to be processed for new channels. + * Other operations should be refused when locked. + */ + + if (strcmp(name, "session-bind@openssh.com") == 0) { success = process_ext_session_bind(e); - else { + } else if (locked) { + debug_f("attempt to use extension \"%s\" while locked", name); + goto generic_fail; + } else if (strcmp(name, "query") == 0) { + replied = success = process_ext_query(e); + } else { debug_f("unsupported extension \"%s\"", name); + generic_fail: free(name); send_status(e, 0); return; @@ -1865,16 +1875,19 @@ process_message(u_int socknum) /* check whether agent is locked */ if (locked && type != SSH_AGENTC_UNLOCK) { - sshbuf_reset(e->request); switch (type) { case SSH2_AGENTC_REQUEST_IDENTITIES: /* send empty lists */ no_identities(e); break; + case SSH_AGENTC_EXTENSION: + process_extension(e); + break; default: /* send a fail message for all other request types */ send_status(e, 0); } + sshbuf_reset(e->request); return 1; } -- 2.47.3