Bug 2203241

Summary: The rekey with different KEX algorithm fails with the recent patches moving to OpenSSL 3.0 API
Product: [Fedora] Fedora Reporter: Jakub Jelen <jjelen>
Component: opensshAssignee: Dmitry Belyavskiy <dbelyavs>
Status: CLOSED WORKSFORME QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: rawhideCC: crypto-team, dbelyavs, dwalsh, jjelen, lkundrak, mattias.ellert, npocs, tm
Target Milestone: ---Keywords: Regression, Triaged
Target Release: ---Flags: fedora-admin-xmlrpc: mirror+
Hardware: i686   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-05-16 12:58:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
reproducer using libssh none

Description Jakub Jelen 2023-05-11 15:54:13 UTC 
The rebase of libssh to 0.10.5 was stuck for last week because two tests failed during the build on i686 arch:

[  FAILED  ] tests: 2 test(s), listed below:
[  FAILED  ] torture_rekey_different_kex
[  FAILED  ] torture_rekey_server_different_kex

https://koji.fedoraproject.org/koji/taskinfo?taskID=100917069

This was pinpointed to the patch openssh-9.0p1-evp-fips-dh.patch in OpenSSH, which if reverted, makes the tests work as expected.

Note, that the above tests do two things:
 * connect to the server
 * change the preferred key exchange algorithm
 * initiate (or let the server to initiate) rekey

This does not happen during the initial key exchange nor in case the key exchange algorithms are same for the second time (covered with other tests).

Given that this is very corner case, I will probably skip these tests for now in libssh, but it needs to be fixed anyway.

Reproducible: Always

Steps to Reproduce:
1. Run libssh testsuite (with client tests enabled)
2. See the failure
Actual Results:  
[  FAILED  ] tests: 2 test(s), listed below:
[  FAILED  ] torture_rekey_different_kex
[  FAILED  ] torture_rekey_server_different_kex

Expected Results:  
all tests pass
Comment 3 Jakub Jelen 2023-05-15 09:00:15 UTC 
Created attachment 1964608 [details]
reproducer using libssh
Comment 4 Dmitry Belyavskiy 2023-05-16 12:58:19 UTC 
Looks like a timing issue. Closing.
Comment 5 Jakub Jelen 2023-05-16 21:00:33 UTC 
For the record, I filled the upstream merge request to address this:

https://gitlab.com/libssh/libssh-mirror/-/merge_requests/370

Running the builds in koji to verify the fix:

https://koji.fedoraproject.org/koji/taskinfo?taskID=101218310