IPV6 SSH Callhome connection failing to establish due to host host

[Krisscut]

Hi,

Trying to perform an IPV6 callhome connection, it fails when trying to connect on the remote ip to fetch the host from the initial "accept_callhome" that was previously displayed just fine.

The code uses first use

libnetconf2/src/session_client_ch.h

Line 147 in d44d328

int nc_client_ssh_ch_add_bind_listen(const char *address, uint16_t port);

then

libnetconf2/src/session_client.c

Line 1819 in d44d328

nc_accept_callhome(int timeout, struct ly_ctx *ctx, struct nc_session **session)

) to accept the connection

At this point everything seems fine because the ipv6 is properly displayed here

libnetconf2/src/session_server.c

Line 629 in d44d328

VRB(NULL, "Accepted a connection on %s:%u from %s:%u.", binds[i].address, binds[i].port, client_address, client_port);

But then later on it seems between the ssh_options_set and the get the host is lost:

libnetconf2/src/session_client_ssh.c

Line 1801 in d44d328

ssh_options_set(sess, SSH_OPTIONS_HOST, host);

And we go through that code which default the host to localhost:

libnetconf2/src/session_client_ssh.c

Line 1506 in d44d328

host = strdup("localhost");

Log:

configureSSHSessionAuthentication(): Set netconf model path: /ram/yangmodel
configureSSHSessionAuthentication(): Set auth type: PASSWORD enable
configureSSHSessionAuthentication(): Set auth type: PUBLICKEY disable
configureSSHSessionAuthentication(): Set auth type: INTERACTIVE disable
configureSSHSessionAuthentication(): waitCallHome bind to ip: 0:0:0:0:0:0:0:0, port: 4334
configureTLSSessionAuthentication(): waitCallHome bind to ip: 0:0:0:0:0:0:0:0, port: 4335
lnc2_print_clb(): [] nc VBS: Accepted a connection on 0:0:0:0:0:0:0:0:4334 from fd5f:4268:2387:87c1::2:35648.
lnc2_print_clb(): [] nc VBS: set encryption_c_s: aes128-ctr,chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr
lnc2_print_clb(): [] nc VBS: set encryption_s_c: aes128-ctr,chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr
lnc2_print_clb(): [] nc VBS: set macAlgo_c_s: hmac-sha2-256,hmac-sha2-512-etm@openssh.com,hmac-sha2-512,hmac-sha2-256-etm@openssh.com
lnc2_print_clb(): [] nc VBS: set macAlgo_s_c: hmac-sha2-256,hmac-sha2-512-etm@openssh.com,hmac-sha2-512,hmac-sha2-256-etm@openssh.com
lnc2_print_clb(): [] nc VBS: set compression_c_s NULL
lnc2_print_clb(): [] nc VBS: set compression_s_c NULL
lnc2_print_clb(): [] nc VBS: set key_exchange: ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org
lnc2_print_clb(): [] nc VBS: set hostkeys: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256
lnc2_print_clb(): [] nc DBG: nc_sock_connect(localhost, 35648, -1, -1)
lnc2_print_clb(): [] nc VBS: Trying to connect via IPv4 to 127.0.0.1:35648.
lnc2_print_clb(): [] nc VBS: getsockopt() error (Connection refused).
lnc2_print_clb(): [] nc ERR: Unable to connect to localhost:35648 (Connection refused).

[michalvasko]

I am not sure why you think localhost is being set and I went through the process with gdb and the host was set on

libnetconf2/src/session_client_ssh.c

Line 1801 in e1d80bd

ssh_options_set(sess, SSH_OPTIONS_HOST, host);

and then

libnetconf2/src/session_client_ssh.c

Line 1499 in e1d80bd

if (ssh_options_get(ssh_session, SSH_OPTIONS_HOST, &host) != SSH_OK) {

return SR_ERR_OK so the previously set host was kept.

[Krisscut]

yes I agree that the code seems fine, but as you can see with the log Accepted a connection on 0:0:0:0:0:0:0:0:4334 from fd5f:4268:2387:87c1::2:35648. , the addr at this point is fine but then later on it becomes localhost.

Maybe we should patch the code to add further traces around these lines to understand why exactly it becomes localhost.

I'm pretty sure we go through that code which default the host to localhost if the ssh_options_get fails:

libnetconf2/src/session_client_ssh.c

Line 1499 in d44d328

if (ssh_options_get(ssh_session, SSH_OPTIONS_HOST, &host) != SSH_OK) {

[michalvasko]

Like I said, I used gdb to manually go through the whole code and it worked as expected so nothing more for me to examine, I am not able to reproduce it. But you definitely have something wrong because the socket is already connected and then tries to connect again. I have used the current devel, what version of libnetconf2 and libssh are you using?

[Krisscut]

Hum, looks like the soft having the issue is running on libnetconf2 2.1.20 and libssh 0.9.8
Even without migrating to the major version which could take more work, I think it should attempt to upgrade to libnetconf2 2.1.34 because it seems quite a lot of changes were done in the meantime.

[michalvasko]

That is not even an official release and really old so yes, I suggest you update it.

[danielstancioi01]

Hello, I had a look over the libraries that we are using ( libnetconf2 2.1.20 and libssh 0.9.8) and it seems that the problem appears in ssh_options_set (apparently the host was not set correctly from the beginning). In the 0.9.8 version of libssh ssh_options_set is using ssh_config_parse_uri to parse the user, host and port. And it seems that ssh_config_parse_uri is expecting that for ipv6, host address will be enclosed with square brackets

Now my questions are:

1. What version of libssh did you use when tried to reproduce this issue?
2. Was this idea of enclosing ip address between [] in latest versions of libnetconf2? Can this be a solution for the problem? Also do you have any idea if there is some documentation that requires ipv6 to be enclosed like this?

[michalvasko]

I have added checks to make sure the hostname is set successfully so you can make sure this is the problem, I do not think so. I have used libssh 0.10.6 but this code is the same as in 0.9.8.

[danielstancioi01]

Hello again
We checked locally by adding logs in libnetconf2 and it seems that ssh_options_set() failed for fd5f:4268:2387:87c1::6 in nc_accept_callhome_ssh_sock(). Than also ssh_options_get() failed as host was not set correctly.

Now I am still thinking that the problem is somewhere in the parsing of this address, in libssh maybe.
I also checked and the host pointer that is used in nc_accept_callhome_ssh_sock() for set method in initialized in nc_sock_accept_binds()

And it looks like this from the start

Maybe it will help if you can check for this addr. I also tried to compile that ssh_config_parse_uri() from libssh and for fd5f:4268:2387:87c1::6 it returns me fd5f:4268:2387:87c1: and this for sure will not pass this validation from ssh_config_parse_uri()

[michalvasko]

I have tried to connect to this IP and ssh_options_set() succeeded, there is a check in the current version and no error was printed. But if you are certain that you have a non-working use-case then create an issue in libssh.

[danielstancioi01]

Hello, as an update this issue was solved with this: https://gitlab.com/libssh/libssh-mirror/-/issues/227