Large SendEnv variables prevent connection about dropbear HOT 5 CLOSED

Ah, I could see how that would happen. What is the need for such large environment variables?

from dropbear.

What is the need for such large environment variables?

I'm sure there's several use cases. For me, it's convenience. I like to take a few things "with me" when connecting to other machines, such as $LS_COLORS or the contents of my .bashrc. While there's no hard need for these, having to explicitely exclude Dropbear hosts from the SendEnv directive in my SSH config is bothersome.

Cheers!

from dropbear.

Fixing this would be tricky. Dropbear allows 35000 bytes per packet (from rfc4253). Increasing that value gives more scope of running out of memory on small devices. A whole packet needs to be kept in memory at once, at least to validate the hmac/aead.

I'll close this, though if someone has ideas how to work around it feel free to reopen.
Note that Dropbear doesn't currently support "env" setting at all, it could be added.

from dropbear.

35000 bytes per packet (from rfc4253).

Interesting. I wonder if OpenSSH simply allows larger packets, or somehow tells the client to fragment them. Is there a way to truncate the payload of larger packets during the initial connection without breaking everything? Or warn the user? Crashing with a Broken Pipe makes it hard to diagnose this issue from the user perspective.

Cheers!

from dropbear.

Dropbear probably should send a SSH_MSG_DISCONNECT message. It would need a bit of a rework to flush that message out without reading any further incoming traffic.

from dropbear.