Re: session establishment struck

[Vasuki Gubbi <gkvasuki@xxxxxxxxx>]

Aris,

I am having this problem even for single session establishment using single
thread. Problem seems to be memory corruption during hmac_init. Is it some
issue with crypto library?  I am enclosing verbose output of libssh.

uname -a : Linux axer.nms.fnc.fujitsu.com 2.6.32-131.0.15.el6.x86_64 #1 SMP
Tue May 10 15:42:40 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux
cat /etc/redhat-release : Red Hat Enterprise Linux Server release 6.1
(Santiago)

Regards,
Vasuki


[func]     entering function ssh_socket_wait_for_data line 390 in
/scratch/libssh-0.4.5/libssh/socket.c
[func]     leaving function ssh_socket_wait_for_data line 427 in
/scratch/libssh-0.4.5/libssh/socket.c
[func]     entering function ssh_socket_read line 331 in
/scratch/libssh-0.4.5/libssh/socket.c
[func]      entering function ssh_socket_wait_for_data line 390 in
/scratch/libssh-0.4.5/libssh/socket.c
[func]      leaving function ssh_socket_wait_for_data line 395 in
/scratch/libssh-0.4.5/libssh/socket.c
[func]     leaving function ssh_socket_read line 342 in
/scratch/libssh-0.4.5/libssh/socket.c
[3] Packet size decrypted: 12 (0xc)
[func]     entering function ssh_socket_wait_for_data line 390 in
/scratch/libssh-0.4.5/libssh/socket.c
[func]     leaving function ssh_socket_wait_for_data line 427 in
/scratch/libssh-0.4.5/libssh/socket.c
[func]     entering function ssh_socket_read line 331 in
/scratch/libssh-0.4.5/libssh/socket.c
[func]      entering function ssh_socket_wait_for_data line 390 in
/scratch/libssh-0.4.5/libssh/socket.c
[func]      leaving function ssh_socket_wait_for_data line 395 in
/scratch/libssh-0.4.5/libssh/socket.c
[func]     leaving function ssh_socket_read line 342 in
/scratch/libssh-0.4.5/libssh/socket.c
[3] Read a 12 bytes packet
[3] 10 bytes padding, 11 bytes left in buffer
[3] After padding, 1 bytes left in buffer
[func]    leaving function packet_read2 line 230 in
/scratch/libssh-0.4.5/libssh/packet.c
[func]    entering function packet_translate line 405 in
/scratch/libssh-0.4.5/libssh/packet.c
[3] Final size 1
[3] Type 21
[func]    leaving function packet_translate line 425 in
/scratch/libssh-0.4.5/libssh/packet.c
[func]   leaving function packet_wait2 line 808 in
/scratch/libssh-0.4.5/libssh/packet.c
[1] Got SSH_MSG_NEWKEYS

[func]   entering function make_sessionid line 494 in
/scratch/libssh-0.4.5/libssh/dh.c
[func]   leaving function make_sessionid line 625 in
/scratch/libssh-0.4.5/libssh/dh.c
[3] Set output algorithm to aes256-cbc
[3] Set input algorithm to aes256-cbc
[func]   entering function generate_session_keys line 701 in
/scratch/libssh-0.4.5/libssh/dh.c
[func]   leaving function generate_session_keys line 802 in
/scratch/libssh-0.4.5/libssh/dh.c
[func]   entering function signature_verify line 1000 in
/scratch/libssh-0.4.5/libssh/dh.c
[func]    Going to verify a ssh-dss type signature
[func]   leaving function signature_verify line 1036 in
/scratch/libssh-0.4.5/libssh/dh.c
[func]  leaving function dh_handshake line 384 in
/scratch/libssh-0.4.5/libssh/client.c
[func] leaving function ssh_connect line 626 in
/scratch/libssh-0.4.5/libssh/client.c
[func] entering function ssh_is_server_known line 1567 in
/scratch/libssh-0.4.5/libssh/keyfiles.c
[func]  entering function ssh_get_knownhost_line line 1265 in
/scratch/libssh-0.4.5/libssh/keyfiles.c
[func]  leaving function ssh_get_knownhost_line line 1321 in
/scratch/libssh-0.4.5/libssh/keyfiles.c
[func]  entering function match_hashed_host line 1457 in
/scratch/libssh-0.4.5/libssh/keyfiles.c
[func]  leaving function ssh_is_server_known line 1649 in
/scratch/libssh-0.4.5/libssh/keyfiles.c
SSH_SERVER_KNOWN_OK while connecting to Host : 168.127.196.174
[func]  entering function ssh_userauth_autopubkey line 789 in
/scratch/libssh-0.4.5/libssh/auth.c
[func]   entering function ssh_userauth_none line 216 in
/scratch/libssh-0.4.5/libssh/auth.c
[func]    entering function ask_userauth line 52 in
/scratch/libssh-0.4.5/libssh/auth.c
[func]     entering function ssh_service_request line 428 in
/scratch/libssh-0.4.5/libssh/client.c
[func]      entering function packet_send2 line 472 in
/scratch/libssh-0.4.5/libssh/packet.c
[3] Writing on the wire a packet having 17 bytes before
[3] 17 bytes after comp + 10 padding bytes = 28 bytes packet
[3] Encrypting packet with seq num: 3, len: 32
*** glibc detected *** /opt/nsjava/jre/bin/java: malloc(): memory
corruption: 0x00007fcc240082c0 ***


On Sun, Aug 26, 2012 at 7:17 PM, Vasuki Gubbi <gkvasuki@xxxxxxxxx> wrote:

> Aris,
>
> Thank you for your reply. But in the current case, session has not been
> established as it is struck at user authentication, so problem might not be
> multithreaded corruption of the data structures. Read and write threads are
> created after establishing the session.
>
> But you raise a very important issue. In our case, we have a third party
> library that parses the reads from the network and also writes data to the
> network. Library expects read and write function handler to be registered,
> with the expectation that user implemented read blocks till the data is
> available from the network to parse the data. Write method is called by the
> library once a data is formatted to write to the network. Third party
> library is the one that creates separate threads for reading and writing
> once we create a network connection.
> In such a case, can you please let me know how I can use libssh?
>
> Regards,
> Vasuki
>
>
> On Sun, Aug 26, 2012 at 2:08 PM, Andreas Schneider <asn@xxxxxxxxxxxxxx>wrote:
>
>> On Saturday 25 August 2012 11:15:15 you wrote:
>> > Aris,
>> >
>> > Thank you for your response.
>> >
>> > We create multiple ssh sessions simultaneously to multiple hosts. For
>> each
>> > host we connect, I have a read thread to read from ssh session and write
>> > thread that writes to session.
>>
>> That's the problem. You can only work on one session in one thread or the
>> internal states will be wrong and strange things can happen.
>>
>>
>>         -- andreas
>>
>> --
>> Andreas Schneider                   GPG-ID: F33E3FC6
>> www.cryptomilk.org                asn@xxxxxxxxxxxxxx
>>
>>
>>
>