[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: ssh_options_set not working?


On 5/26/23 17:17, Kerrison, Adam wrote:
Hello

I am trying to enable all supported key exchange methods, ciphers and HMACs to handle connecting to some truly ancient servers. The setup code is:

   ssh_session session = ssh_new();

   fprintf(stderr, "SETTING KEYEX %s\n", ALL_KEYEX_METHODS);

 if(ssh_options_set(session, SSH_OPTIONS_KEY_EXCHANGE, ALL_KEYEX_METHODS) < 0) {

    fprintf(stderr, "FAILED TO SET KEYEX\n");

    }

    fprintf(stderr, "SETTING CIPHERS %s\n", ALL_CIPHERS);

    if(ssh_options_set(session, SSH_OPTIONS_CIPHERS_C_S, ALL_CIPHERS) < 0) {

       fprintf(stderr, "FAILED TO SET CIPHERS\n");

   }

   fprintf(stderr, "SETTING HMACS %s\n", ALL_HMACS);

   if(ssh_options_set(session, SSH_OPTIONS_HMAC_C_S, ALL_HMACS) < 0) {

     fprintf(stderr, "FAILED TO SET HMACS\n");

   }

Where the ALL_* values are constants defining all the supports things (see below)

When I run the code my connection fails. The output is:

SETTING KEYEX curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1

SETTING CIPHERS chacha20-poly1305,aes256-gcm@xxxxxxxxxxx,aes128-gcm@xxxxxxxxxxx,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc

SETTING HMACS hmac-sha2-256-etm@xxxxxxxxxxx,hmac-sha2-512-etm@xxxxxxxxxxx,hmac-sha1-etm@xxxxxxxxxxx,hmac-sha2-512,hmac-sha2-256,hmac-sha1

ERROR: failed to connect: kex error : no match for method kex algos: server [diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1], client [curve25519-sha256,curve25519-sha256@xxxxxxxxxx,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512] (code 2)

So the ssh_options_set() calls aren’t failing but the values don’t seem to have been applied as the client keyex list doesn’t include the diffie-helman SHA1 methods that I set?

This API ignores any unknown algorithms, for example to avoid failing hard when parsing openssh configuration files. I do not think there is an API to retrieve the enabled algorithms, but the ssh_options_get() could be very simply extended to return the list of enabled algorithms for double-checking this. Feel free to propose the merge request!

The two algorithms supported by the server [diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1] are supported by libssh master, but they are not enabled by default in current versions. But using the ssh_options_set() should enable them.

The list of the algorithms you list in the outputs also differ both in content and order which sounds like the setting of the algorithms was not effective for some reason.

What am I doing wrong here?

What libssh version are you using? Can you bump the log verbosity and check the logs for some more information?

Regards,
--
Jakub Jelen
Crypto Team, Security Engineering
Red Hat, Inc.


Follow-Ups:
RE: [EXTERNAL] Re: ssh_options_set not working?"Kerrison, Adam" <Adam_Kerrison@xxxxxxx>
References:
ssh_options_set not working?"Kerrison, Adam" <Adam_Kerrison@xxxxxxx>
Archive administrator: postmaster@lists.cynapses.org