Re: libssh-4.0.2 client code problem

[Aris Adamantiadis <aris@xxxxxxxxxxxx>]

Hi Eugene,

I was not able to reproduce the problem on a CentOS 4.8 with
openssh-server-3.9p1-11.el4_7.x86-64.rpm, at least not when libssh is
running on my ubuntu workstation.
What's the configuration of the client in your test ? Are you able to
connect to rhel using libssh 0.4.2 from something else than Rhel/centos ?
I'm trying now to compile libssh on Centos.

Regards,

Aris

Eugene Starozhilov a écrit :
> Aris,
> 
> Just checked:
> 
> samplessh -l oracle -p 1778 -c aes128-ctr alpha-dev30.edf.gxs.com
> result: sshd[22710]: Disconnecting: Corrupted MAC on input.
> 
> samplessh -l oracle -p 1778  alpha-dev30.edf.gxs.com
> result: sshd[22778]: Disconnecting: Corrupted MAC on input.
> 
> samplessh -l oracle -p 1778 -c aes256-cbc  alpha-dev30.edf.gxs.com
> result: OK
> 
> samplessh -l oracle -p 1778 -c blowfish-cbc alpha-dev30.edf.gxs.com
> result: OK
> 
> The box has openssh-server-3.9p1-11.el4_7.x86_64.rpm. It is RedHat
> Enterprise Server 4 distribution.
> 
> Thanks,
> Eugene
> 
> --- On *Mon, 4/12/10, Aris Adamantiadis /<aris@xxxxxxxxxxxx>/* wrote:
> 
> 
>     From: Aris Adamantiadis <aris@xxxxxxxxxxxx>
>     Subject: Re: libssh-4.0.2 client code problem
>     To: libssh@xxxxxxxxxx
>     Date: Monday, April 12, 2010, 12:14 PM
> 
>     Hi Eugene,
> 
>     That's very strange. I will check out what has happened.
> 
>     Have you got any information on the distribution/ssh server installed
>     on the server ? I suspect it's a problem with aes256-ctr.
> 
>     In order to verify:
>     samplessh -l oracle -p 1778 -c aes256-cbc alpha-dev30.edf.gxs.com
>     samplessh -l oracle -p 1778 -c blowfish-cbc alpha-dev30.edf.gxs.com
> 
>     It would also help if you tried aes128-ctr.
> 
>     Thanks,
> 
>     Aris
> 
>     Eugene Starozhilov a écrit :
>     >
>     > Hi Aris,
>     >
>     > Thanks for fixing server api bug. But I ran into another problem with
>     > client api.
>     > These are traces from sshd and  libssh client code:
>     >
>     > ---------------------------  sshd
>     > --------------------------------------------------
>     > sshd[22309]: Connection from ::ffff:10.160.123.184 port 44351
>     > sshd[22309]: debug1: Client protocol version 2.0; client software
>     > version libssh-0.4.2
>     > sshd[22309]: debug1: no match: libssh-0.4.2
>     > sshd[22309]: debug1: Enabling compatibility mode for protocol 2.0
>     > sshd[22309]: debug1: Local version string SSH-1.99-OpenSSH_3.9p1
>     > sshd[22341]: debug1: permanently_set_uid: 74/74
>     > sshd[22341]: debug1: list_hostkey_types: ssh-rsa,ssh-dss
>     > sshd[22341]: debug1: SSH2_MSG_KEXINIT sent
>     > sshd[22341]: debug1: SSH2_MSG_KEXINIT received
>     > sshd[22341]: debug1: kex: client->server aes256-ctr hmac-sha1 none
>     > sshd[22341]: debug1: kex: server->client aes256-ctr hmac-sha1 none
>     > sshd[22341]: debug1: expecting SSH2_MSG_KEXDH_INIT
>     > sshd[22341]: debug1: SSH2_MSG_NEWKEYS sent
>     > sshd[22341]: debug1: expecting SSH2_MSG_NEWKEYS
>     > sshd[22341]: debug1: SSH2_MSG_NEWKEYS received
>     > sshd[22341]: debug1: KEX done
>     > sshd[22341]: Disconnecting: Corrupted MAC on input.
>     >
>     ------------------------------------------------------------------------------
>     >
>     > -------------------- libssh client code -----------------------------
>     > [3] host 10.160.31.50 matches an IP address
>     > [1] Trying to connect to host: 10.160.31.50:1778 with timeout 1800.0
>     > [3] Socket connected with timeout
>     >
>     > [1] SSH server banner: SSH-1.99-OpenSSH_3.9p1
>     > [1] Analyzing banner: SSH-1.99-OpenSSH_3.9p1
>     > [1] We are talking to an OpenSSH server version: 3.9 (30900)
>     > [3] Packet size decrypted: 636 (0x27c)
>     > [3] Read a 636 bytes packet
>     > [3] 11 bytes padding, 635 bytes left in buffer
>     > [3] After padding, 624 bytes left in buffer
>     > [3] Final size 624
>     > [3] Type 20
>     > [3] Writing on the wire a packet having 141 bytes before
>     > [3] 141 bytes after comp + 6 padding bytes = 148 bytes packet
>     > [3] Writing on the wire a packet having 133 bytes before
>     > [3] 133 bytes after comp + 6 padding bytes = 140 bytes packet
>     > [3] Packet size decrypted: 444 (0x1bc)
>     > [3] Read a 444 bytes packet
>     > [3] 10 bytes padding, 443 bytes left in buffer
>     > [3] After padding, 433 bytes left in buffer
>     > [3] Final size 433
>     > [3] Type 31
>     > [3] Writing on the wire a packet having 1 bytes before
>     > [3] 1 bytes after comp + 10 padding bytes = 12 bytes packet
>     > [1] SSH_MSG_NEWKEYS sent
>     >
>     > [3] Packet size decrypted: 12 (0xc)
>     > [3] Read a 12 bytes packet
>     > [3] 10 bytes padding, 11 bytes left in buffer
>     > [3] After padding, 1 bytes left in buffer
>     > [3] Final size 1
>     > [3] Type 21
>     > [1] Got SSH_MSG_NEWKEYS
>     >
>     > [3] Set output algorithm to aes256-ctr
>     > [3] Set input algorithm to aes256-ctr
>     >
>     > [3] Writing on the wire a packet having 17 bytes before
>     > [3] 17 bytes after comp + 10 padding bytes = 28 bytes packet
>     > [3] Encrypting packet with seq num: 3, len: 32
>     > [3] Sent SSH_MSG_SERVICE_REQUEST (service ssh-userauth)
>     > [3] Decrypting 16 bytes
>     > [3] Packet size decrypted: 44 (0x2c)
>     > [3] Read a 44 bytes packet
>     > [3] Decrypting 32 bytes
>     > 2010-04-12 13:14:54,211557; 1126189408 procSrvAuth;  Did not receive
>     > SERVICE_ACCEPT
>     >
>     --------------------------------------------------------------------------------------------
>     >
>     > sshd receives corrupted MAC and drops connection. It happens when
>     client
>     > calls ssh_service_request(session, "ssh-userauth");
>     >
>     > I built libssh-4.0.2 from git repository:
>     >
>     > git clone git://git.libssh.org/projects/libssh/libssh.git libssh
>     > git checkout -b v0-4 origin/v0-4
>     >
>     > with libcrypto library (openssl 0.9.7a).
>     >
>     >
>     > The same error can be reproduced using samplessh example with sshd.
>     >
>     > /usr/sbin/sshd -d  -p 1778
>     > samplessh -l oracle -p 1778 alpha-dev30.edf.gxs.com
>     >
>     >
>     > Thank you,
>     > Eugene
>     >
>     >
>     > --- On *Sun, 3/28/10, Aris Adamantiadis /<aris@xxxxxxxxxxxx
>     </mc/compose?to=aris@xxxxxxxxxxxx>>/* wrote:
>     >
>     >
>     >     From: Aris Adamantiadis <aris@xxxxxxxxxxxx
>     </mc/compose?to=aris@xxxxxxxxxxxx>>
>     >     Subject: Re: libssh-0.4.2 server api bug
>     >     To: libssh@xxxxxxxxxx </mc/compose?to=libssh@xxxxxxxxxx>
>     >     Date: Sunday, March 28, 2010, 3:51 PM
>     >
>     >     Hi,
>     >
>     >     This was resolved in d2bb97c1c6f32c167e1a6093201e01a52bfe0e0d.
>     Thanks
>     >     for your feedback on this bug.
>     >
>     >     Regards,
>     >
>     >     Aris
>     >
>     >     Aris Adamantiadis a écrit :
>     >     > Hi
>     >     > Oops, we missed that bug for the release. I will find a
>     solution.
>     >     >
>     >     > Aris
>     >     >
>     >     > Eugene Starozhilov a écrit :
>     >     >> Hi Aris,
>     >     >>
>     >     >> The new release libssh-0.4.2 has the same problem as
>     libssh-0.4.1
>     >     >> (described below). samplesshd doesn't work with standard
>     LINUX ssh
>     >     >> client. Is any chance to get it fixed soon?
>     >     >>
>     >     >>
>     >     >> Thank you,
>     >     >> Eugene
>     >     >>
>     >
>     >
> 
>