Page MenuHomePhabricator

Open Tasks

Needs Triage (15)

Active Repositories

Recent Activity

Yesterday

qgarnier added a comment to T237: ssh_packet_disconnect_callback: Received SSH_MSG_DISCONNECT 3:invalid DH value.

Here the debug. It seems OpenSSH has the same issue.

Thu, Jul 9, 11:43 AM

Wed, Jul 8

Jakuje added a comment to T237: ssh_packet_disconnect_callback: Received SSH_MSG_DISCONNECT 3:invalid DH value.

Thanks for confirmation. Even though you can not change the server settings, there might be something useful in the logs pointing out what is the issue. It could be bug in srtSSHServer implementation or libssh implementation of the new diffie-hellman-group18-sha512 so it is worth investigating.

Wed, Jul 8, 8:01 AM

Tue, Jul 7

qgarnier added a comment to T237: ssh_packet_disconnect_callback: Received SSH_MSG_DISCONNECT 3:invalid DH value.

With following in ssh_config for my host, it's working:
Host 192.168.xxx.xxx

KexAlgorithms diffie-hellman-group1-sha1
Tue, Jul 7, 5:09 PM
qgarnier added a comment to T237: ssh_packet_disconnect_callback: Received SSH_MSG_DISCONNECT 3:invalid DH value.

Okay. So i cannot change the server (update or settings). I will try to force 'diffie-hellman-group14-sha1'. Thanks!

Tue, Jul 7, 5:05 PM
Jakuje added a comment to T237: ssh_packet_disconnect_callback: Received SSH_MSG_DISCONNECT 3:invalid DH value.

This is an issue of key exchange, not ciphres. The original trace is using probably diffie-hellman-group14-sha1 and the new one diffie-hellman-group18-sha512. The error invalid DH value comes from the server so I would suggest continuing some investigation there, figuring out what it does not like on the provided DH value.

Tue, Jul 7, 5:02 PM
qgarnier created T237: ssh_packet_disconnect_callback: Received SSH_MSG_DISCONNECT 3:invalid DH value.
Tue, Jul 7, 3:43 PM

Thu, Jul 2

seb128 added a comment to T235: Consider libsodium as an alternative to nacl.

@Jakuje thanks for your reply and the details, the build system doesn't really make clear than nacl is not needed when building with openssl. In regard of your explanation I don't think adding libsodium as yet another alternative is really needed so feel free to close the request. I've submitted a request to Debian now also to stop pulling nacl in their build

Thu, Jul 2, 12:43 PM
asn added a comment to T236: Disable *-cbc ciphers by default.

I agree.

Thu, Jul 2, 12:10 PM · Restricted Project

Wed, Jul 1

Jakuje created T236: Disable *-cbc ciphers by default.
Wed, Jul 1, 6:45 PM · Restricted Project

Tue, Jun 30

Jakuje added a comment to T235: Consider libsodium as an alternative to nacl.

I do not think nacl is used for anything at this moment when libssh is built against current openssl, which already supports X25519 curve for all we need. At least in Fedora, nacl is not listed as dependency of libssh at all.

Tue, Jun 30, 12:55 PM

Mon, Jun 29

seb128 created T235: Consider libsodium as an alternative to nacl.
Mon, Jun 29, 10:25 AM

Thu, Jun 25

zev333 added a comment to T231: ssh_channel_read() incorrectly returns -1 (SSH_ERROR).

Sorry for delay in response.
Mentioned commit fixes problem.

Thu, Jun 25, 10:50 AM

Wed, Jun 24

ansasaki committed rLIBSSHe0c7d78a39a2: tests: Do not parse configuration file in torture_knownhosts (authored by ansasaki).
tests: Do not parse configuration file in torture_knownhosts
Wed, Jun 24, 11:42 AM
ansasaki committed rLIBSSHf10d80047c66: tests: Do not parse configuration file in torture_knownhosts (authored by ansasaki).
tests: Do not parse configuration file in torture_knownhosts
Wed, Jun 24, 11:37 AM
msimyoni added a comment to T122: Running the sftp_read test for the second time fails.
Wed, Jun 24, 9:48 AM · Restricted Project

Tue, Jun 23

ansasaki committed rLIBSSH74e162c67fca: channel: Do not return error if the server closed the channel (authored by ansasaki).
channel: Do not return error if the server closed the channel
Tue, Jun 23, 8:02 PM
ansasaki committed rLIBSSH039054ea6e62: examples: Tolerate incomplete writes in exec example (authored by ansasaki).
examples: Tolerate incomplete writes in exec example
Tue, Jun 23, 8:01 PM
ansasaki committed rLIBSSH1da78553dce8: tests: Add test for CVE-2019-14889 (authored by ansasaki).
tests: Add test for CVE-2019-14889
Tue, Jun 23, 8:01 PM
ansasaki committed rLIBSSH750e4f3f9d3e: channel: Do not return error if the server closed the channel (authored by ansasaki).
channel: Do not return error if the server closed the channel
Tue, Jun 23, 4:19 PM
ansasaki closed T231: ssh_channel_read() incorrectly returns -1 (SSH_ERROR) as Resolved by committing rLIBSSH750e4f3f9d3e: channel: Do not return error if the server closed the channel.
Tue, Jun 23, 4:19 PM

Mon, Jun 22

asn committed rLIBSSHb0518552f19f: examples: Tolerate incomplete writes in exec example (authored by ansasaki).
examples: Tolerate incomplete writes in exec example
Mon, Jun 22, 2:58 PM
asn committed rLIBSSH1694606e12d8: tests: Add test for CVE-2019-14889 (authored by ansasaki).
tests: Add test for CVE-2019-14889
Mon, Jun 22, 2:58 PM
asn committed rLIBSSHa76badf77af9: Merge SubmittingPatches and README.CodingStyle to CONTRIBUTING.md (authored by asn).
Merge SubmittingPatches and README.CodingStyle to CONTRIBUTING.md
Mon, Jun 22, 2:58 PM

Fri, Jun 19

ansasaki closed T234: SCP pull wildcard returns No such file or directory as Wontfix.

We tried to keep those wildcards working when we introduced the fix for CVE-2019-14889, but we couldn't.

Fri, Jun 19, 5:42 PM

Thu, Jun 18

ansasaki added a comment to T231: ssh_channel_read() incorrectly returns -1 (SSH_ERROR).

Could you please check if the change I proposed in https://gitlab.com/libssh/libssh-mirror/-/merge_requests/122 fixes the issue for you?

Thu, Jun 18, 7:24 PM
Jakuje added a comment to T231: ssh_channel_read() incorrectly returns -1 (SSH_ERROR).

Thank you for checking. It looks like I was too fast guessing the fix.

Thu, Jun 18, 4:17 PM

Tue, Jun 16

zev333 added a comment to T231: ssh_channel_read() incorrectly returns -1 (SSH_ERROR).

I have tested the same code on master (245ad744b5ab0582fef7cf3905a717b791d7e08b commit). ssh_channel_read still return -1 sometimes.
I have enabled ssh debug and it looks like some timing problem. There is log part:

Tue, Jun 16, 6:46 PM

Sun, Jun 14

sansasmith9090 updated sansasmith9090.
Sun, Jun 14, 4:49 PM

Wed, Jun 10

Jakuje added a comment to T234: SCP pull wildcard returns No such file or directory.

Sounds like a mitigation to some of the security issues fixed in 0.9.3. See the announcement message for more details:

Wed, Jun 10, 7:40 PM
tbuerli created T234: SCP pull wildcard returns No such file or directory.
Wed, Jun 10, 2:58 PM

Jun 9 2020

Jakuje updated subscribers of T233: With libssh 0.9.4 the open session hangs when the maxAuthtries is reached.

Playing a bit more with that, it looks like a version 8.7.0 returns SSH_AUTH_AGAIN from ssh_userauth_none(), even though it is in blocking mode. It is certainly not correct, but better than not returning at all. But only after a timeout, which it spends in busy-loop wait.

Jun 9 2020, 4:33 PM

Jun 8 2020

Jakuje added a comment to T233: With libssh 0.9.4 the open session hangs when the maxAuthtries is reached.

I am able to reproduce this locally. The server sends SSH_MSG_DISCONNECT to the client, but in the ssh_userauth_get_response(), this message is not accepted to terminate waiting for answer from server in ssh_auth_response_termination() so it hangs forever in the poll -- I think this is a bug in poll implementation, which should stop waiting after receiving disconnect.

Jun 8 2020, 1:10 PM
asn committed rLIBSSH245ad744b5ab: buffer: Add NULL check for 'buffer' argument (authored by asn).
buffer: Add NULL check for 'buffer' argument
Jun 8 2020, 9:49 AM
asn committed rLIBSSH10b3ebbe61a7: buffer: Reformat ssh_buffer_add_data() (authored by asn).
buffer: Reformat ssh_buffer_add_data()
Jun 8 2020, 9:49 AM
asn committed rLIBSSH533d881b0f4b: sftpserver: Add missing NULL check for ssh_buffer_new() (authored by asn).
sftpserver: Add missing NULL check for ssh_buffer_new()
Jun 8 2020, 9:49 AM
asn committed rLIBSSHc5dfc2d5cec0: buffer: Add NULL check for 'buffer' argument (authored by asn).
buffer: Add NULL check for 'buffer' argument
Jun 8 2020, 9:49 AM
asn committed rLIBSSHf760781cb8fb: buffer: Reformat ssh_buffer_add_data() (authored by asn).
buffer: Reformat ssh_buffer_add_data()
Jun 8 2020, 9:49 AM
asn committed rLIBSSH2782cb0495b7: sftpserver: Add missing return check for ssh_buffer_add_data() (authored by asn).
sftpserver: Add missing return check for ssh_buffer_add_data()
Jun 8 2020, 9:49 AM
asn committed rLIBSSHe631ebb3e224: sftpserver: Add missing NULL check for ssh_buffer_new() (authored by asn).
sftpserver: Add missing NULL check for ssh_buffer_new()
Jun 8 2020, 9:48 AM
asn committed rLIBSSH8316bf1177c3: sftpserver: Add missing return check for ssh_buffer_add_data() (authored by asn).
sftpserver: Add missing return check for ssh_buffer_add_data()
Jun 8 2020, 9:48 AM