Bug 2203241 - The rekey with different KEX algorithm fails with the recent patches moving to OpenSSL 3.0 API
Summary: The rekey with different KEX algorithm fails with the recent patches moving t...
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: Fedora
Classification: Fedora
Component: openssh
Version: rawhide
Hardware: i686
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Dmitry Belyavskiy
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-05-11 15:54 UTC by Jakub Jelen
Modified: 2023-05-16 21:00 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2023-05-16 12:58:19 UTC
Type: ---
Embargoed:
fedora-admin-xmlrpc: mirror+


Attachments (Terms of Use)
reproducer using libssh (2.11 KB, text/plain)
2023-05-15 09:00 UTC, Jakub Jelen
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FC-835 0 None None None 2023-05-11 15:56:39 UTC

Description Jakub Jelen 2023-05-11 15:54:13 UTC
The rebase of libssh to 0.10.5 was stuck for last week because two tests failed during the build on i686 arch:

[  FAILED  ] tests: 2 test(s), listed below:
[  FAILED  ] torture_rekey_different_kex
[  FAILED  ] torture_rekey_server_different_kex

https://koji.fedoraproject.org/koji/taskinfo?taskID=100917069

This was pinpointed to the patch openssh-9.0p1-evp-fips-dh.patch in OpenSSH, which if reverted, makes the tests work as expected.

Note, that the above tests do two things:
 * connect to the server
 * change the preferred key exchange algorithm
 * initiate (or let the server to initiate) rekey

This does not happen during the initial key exchange nor in case the key exchange algorithms are same for the second time (covered with other tests).

Given that this is very corner case, I will probably skip these tests for now in libssh, but it needs to be fixed anyway.

Reproducible: Always

Steps to Reproduce:
1. Run libssh testsuite (with client tests enabled)
2. See the failure
Actual Results:  
[  FAILED  ] tests: 2 test(s), listed below:
[  FAILED  ] torture_rekey_different_kex
[  FAILED  ] torture_rekey_server_different_kex

Expected Results:  
all tests pass

Comment 3 Jakub Jelen 2023-05-15 09:00:15 UTC
Created attachment 1964608 [details]
reproducer using libssh

Comment 4 Dmitry Belyavskiy 2023-05-16 12:58:19 UTC
Looks like a timing issue. Closing.

Comment 5 Jakub Jelen 2023-05-16 21:00:33 UTC
For the record, I filled the upstream merge request to address this:

https://gitlab.com/libssh/libssh-mirror/-/merge_requests/370

Running the builds in koji to verify the fix:

https://koji.fedoraproject.org/koji/taskinfo?taskID=101218310


Note You need to log in before you can comment on or make changes to this bug.