Bug 1624344

Summary: Rekeying on long sessions fails when using gss
Product: [Fedora] Fedora Reporter: Daniel Ahlin <dah>
Component: opensshAssignee: Jakub Jelen <jjelen>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 28CC: dwalsh, jfch, jjelen, lkundrak, mattias.ellert, plautrba, tmraz
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: openssh-7.8p1-2.fc28 openssh-7.8p1-2.fc29 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1624370 (view as bug list) Environment:
Last Closed: 2018-09-11 16:52:13 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1624370    
Attachments:
Description Flags
Fixes rekey proposal none

Description Daniel Ahlin 2018-08-31 09:26:10 UTC 
Created attachment 1480064 [details]
Fixes rekey proposal

Description of problem:

(This is a slight adaption of our Debian report of this issue available at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819361)

We get failures during rekey when using ssh with kerberos authentication
and GSSAPI key-exchange. This can be noticed in long-running ssh
sessions or when doing large scp transfers (or triggered manually in the
ssh client, using the ~R escape sequence).

As far as we can tell the ssh client offers a different set of
key-exchange algorithms on initial connection and when doing the
rekeying.


Version-Release number of selected component (if applicable):
7.8p1-1 and very probably earlier versions as well


How reproducible:
Always and easily done with ~R

Steps to Reproduce:
1.Start ssh session with gsskex
2.Trigger rekey with ~R or a large data transfer

Actual results:
Rekey fails

Expected results:
Rekey succeeds

Additional info:
Patch is attached (albeit against an older version)
Please see a longer discussion on:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819361
Comment 1 Jakub Jelen 2018-08-31 11:37:43 UTC 
Thank you for the report. This is something that should be indeed fixed. I am wondering why nobody hit this before.
Comment 2 Fedora Update System 2018-08-31 12:20:07 UTC 
openssh-7.8p1-2.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-50a6d79d8e
Comment 3 Fedora Update System 2018-08-31 12:36:48 UTC 
openssh-7.8p1-2.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-9effcf1f69
Comment 4 Fedora Update System 2018-08-31 16:23:13 UTC 
openssh-7.8p1-2.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-50a6d79d8e
Comment 5 Fedora Update System 2018-08-31 22:27:46 UTC 
openssh-7.8p1-2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-9effcf1f69
Comment 6 Fedora Update System 2018-09-11 16:52:13 UTC 
openssh-7.8p1-2.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2018-09-21 05:25:16 UTC 
openssh-7.8p1-2.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.