[JENKINS-75919] AuthenticationManager does not wait for service request message response

[jenkins-infra-bot]

PR link for fix: jenkinsci/trilead-ssh2#250

Originally detected by a libssh user here: https://gitlab.com/libssh/libssh-mirror/-/issues/311 (trilead ssh2 client used against a libssh server)

The authentication code sent 'ssh-userauth' SSH_MSG_SERVICE_REQUEST followed by 'ssh-connection' SSH_MSG_USERAUTH_REQUEST before waiting for responses of both of these requests (https://github.com/jenkinsci/trilead-ssh2/blob/34c8e6535725e81b20045fec14ccc1cc065cc3a7/src/com/trilead/ssh2/auth/AuthenticationManager.java#L141).

PacketServiceRequest sr = new PacketServiceRequest("ssh-userauth");			tm.sendMessage(sr.getPayload());

PacketUserauthRequestNone urn = new PacketUserauthRequestNone("ssh-connection", user);
tm.sendMessage(urn.getPayload());

byte[] msg = getNextMessage();
new PacketServiceAccept(msg, 0, msg.length);

msg = getNextMessage();
 

This seems to be a violation of the protocol which mentions (quoting the protocol RFC 4253 Section 8 "Service Request"):

"Note that after a key exchange with implicit server authentication, the client MUST wait for response to its service request message before sending any further data."

---

Originally reported by galorithm, imported from: AuthenticationManager does not wait for service request message response

• assignee: ifernandezcalvo
• status: Open
• priority: Minor
• component(s): trilead-api-plugin
• resolution: Unresolved
• votes: 0
• watchers: 1
• imported: 20251216-225446

Raw content of original issue

PR link for fix: jenkinsci/trilead-ssh2#250

Originally detected by a libssh user here: https://gitlab.com/libssh/libssh-mirror/-/issues/311 (trilead ssh2 client used against a libssh server)

The authentication code sent 'ssh-userauth' SSH_MSG_SERVICE_REQUEST followed by 'ssh-connection' SSH_MSG_USERAUTH_REQUEST before waiting for responses of both of these requests (https://github.com/jenkinsci/trilead-ssh2/blob/34c8e6535725e81b20045fec14ccc1cc065cc3a7/src/com/trilead/ssh2/auth/AuthenticationManager.java#L141).

PacketServiceRequest sr = new PacketServiceRequest("ssh-userauth");			tm.sendMessage(sr.getPayload());

PacketUserauthRequestNone urn = new PacketUserauthRequestNone("ssh-connection", user);
tm.sendMessage(urn.getPayload());

byte[] msg = getNextMessage();
new PacketServiceAccept(msg, 0, msg.length);

msg = getNextMessage();
 

This seems to be a violation of the protocol which mentions (quoting the protocol RFC 4253 Section 8 "Service Request"):
"Note that after a key exchange with implicit server authentication, the client MUST wait for response to its service request message before sending any further data."