Openssl-version dont have X25519 #903

kennedyshead · 2019-01-24T20:06:11Z

Home Assistant release with the issue:

0.86.0b3

Operating environment (HassOS/Generic):

Docker raspberrypi3-homeassistant

Supervisor logs:

2019-01-23 16:07:24 ERROR (MainThread) [homeassistant.setup] Error during setup of component asuswrt
Traceback (most recent call last):
  File "/usr/local/lib/python3.6/site-packages/homeassistant/setup.py", line 145, in _async_setup_component
    hass, processed_config)
  File "/usr/local/lib/python3.6/site-packages/homeassistant/components/asuswrt.py", line 61, in async_setup
    await api.connection.async_connect()
  File "/usr/local/lib/python3.6/site-packages/aioasuswrt/connection.py", line 66, in async_connect
    self._client = await asyncssh.connect(self._host, **kwargs)
  File "/usr/local/lib/python3.6/site-packages/asyncssh/misc.py", line 182, in __await__
    return (yield from self._coro)
  File "/usr/local/lib/python3.6/site-packages/asyncssh/connection.py", line 5454, in connect
    conn, _ = yield from create_connection(None, host, port, **kwargs)
  File "/usr/local/lib/python3.6/site-packages/asyncssh/connection.py", line 5110, in create_connection
    yield from auth_waiter
  File "/usr/local/lib/python3.6/site-packages/asyncssh/connection.py", line 627, in data_received
    while self._inpbuf and self._recv_handler():
  File "/usr/local/lib/python3.6/site-packages/asyncssh/connection.py", line 847, in _recv_packet
    processed = handler.process_packet(pkttype, seq, packet)
  File "/usr/local/lib/python3.6/site-packages/asyncssh/packet.py", line 215, in process_packet
    self._packet_handlers[pkttype](self, pkttype, pktid, packet)
  File "/usr/local/lib/python3.6/site-packages/asyncssh/connection.py", line 1414, in _process_kexinit
    self._kex = get_kex(self, kex_alg)
  File "/usr/local/lib/python3.6/site-packages/asyncssh/kex.py", line 122, in get_kex
    return handler(alg, conn, hash_alg, *args)
  File "/usr/local/lib/python3.6/site-packages/asyncssh/kex_ecdh.py", line 47, in __init__
    self._priv = ecdh_class(*args)
  File "/usr/local/lib/python3.6/site-packages/asyncssh/crypto/curve25519.py", line 31, in __init__
    self._priv_key = x25519.X25519PrivateKey.generate()
  File "/usr/local/lib/python3.6/site-packages/cryptography/hazmat/primitives/asymmetric/x25519.py", line 39, in generate
    _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM
cryptography.exceptions.UnsupportedAlgorithm: X25519 is not supported by this version of OpenSSL.

Description of problem:
There seems to be a problem with the openssl version.
home-assistant/core#20361

The text was updated successfully, but these errors were encountered:

bereska · 2019-01-25T05:16:50Z

0.86.1 does not support it X25519, either

Jc2k · 2019-01-26T14:26:44Z

Hi - this is happening for homekit_controller as well. I've dug into it a bit there. I didn't catch the problem because i use the home-assistant/home-assistant Docker image, not the HASS.io ones.

Ultimately cryptography==2.3.1 installed correctly as preferred by upstream SHOULD have X25519 support. It works on Mac, it works on Raspbian (on an original raspberry pi), it works on Debian, it works on Ubuntu). And, all versions after 2.0.0 (released 2017-07-17) support it, if installed from wheels (which is obviously the problem).

Full run through - sorry if its teaching anyone to suck eggs.

On Debian, Ubuntu and Raspbian, it would by default install a manylinux1 wheel version of cryptography that has a modern version of openssl baked in. This will be a version that the cryptography team has tested with that particular release. All the features are available in that case. Obviously this does not work on Alpine because of musl.
On Ubuntu 18.04 and Debian Stretch or similiar, if for some reason an sdist of cryptography was used it would also still work. This is because both of those releases have a modern version of OpenSSL.
Alpine 3.8 has an old version of openssl and no support for the wheels provided by the python community. So we are unlucky on 2 different fronts. This means features get turned off. So even though the right version of cryptography is installed, it still doesn't work. Note that this version of OpenSSL actaully goes out of support later this year, as it happens.

Unfortunately even if this code was exercised in CI, CI is Ubuntu based so we can't catch errors like this before they bite an actual release.

Cryptography recommend that you use the wheel wherever possible as it means they are able to ship a secure (and functional) implementation to you in a timely fashion, but this is obviously not possible on Alpine (musl libc versus glibc means no upstream provided wheels).

This particular example of the issue will go away by itself when HASS.io starts to use Alpine 3.9 (which is about to be released 'soon'). At that point cryptography will be compiled against openssl 1.1.1. However the underlying disconnect between cryptography on Ubuntu/Debian/Raspbian vs cryptography on Alpine will remain and will likely bite in the future in other ways.

I will happily put together a PR to build cryptography as documented by upstream in the Docker images if this is usefu/desiredl and someone can point me at the right Dockerfiles.

craigcarps · 2019-01-28T02:55:55Z

Hass.IO 86.3 with ASUSWRT doesnt work with SSH or Telnet, hopefully gets resolved in 86.4

Telnet Error Logging:
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/homeassistant/setup.py", line 145, in _async_setup_component
hass, processed_config)
File "/usr/local/lib/python3.6/site-packages/homeassistant/components/asuswrt.py", line 61, in async_setup
await api.connection.async_connect()
File "/usr/local/lib/python3.6/site-packages/aioasuswrt/connection.py", line 113, in async_connect
await self._reader.readuntil(b'login: ')
File "/usr/local/lib/python3.6/asyncio/streams.py", line 578, in readuntil
raise IncompleteReadError(chunk, None)
asyncio.streams.IncompleteReadError: 458 bytes read on a total of None expected bytes

liquid667 · 2019-01-31T20:42:30Z

Still not solved with hassio 86.4

2019-01-31 21:27:26 ERROR (MainThread) [homeassistant.setup] Error during setup of component asuswrt
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/homeassistant/setup.py", line 145, in _async_setup_component
hass, processed_config)
File "/usr/local/lib/python3.6/site-packages/homeassistant/components/asuswrt.py", line 61, in async_setup
await api.connection.async_connect()
File "/usr/local/lib/python3.6/site-packages/aioasuswrt/connection.py", line 66, in async_connect
self._client = await asyncssh.connect(self._host, **kwargs)
File "/usr/local/lib/python3.6/site-packages/asyncssh/misc.py", line 182, in await
return (yield from self._coro)
File "/usr/local/lib/python3.6/site-packages/asyncssh/connection.py", line 5454, in connect
conn, _ = yield from create_connection(None, host, port, **kwargs)
File "/usr/local/lib/python3.6/site-packages/asyncssh/connection.py", line 5110, in create_connection
yield from auth_waiter
File "/usr/local/lib/python3.6/site-packages/asyncssh/connection.py", line 627, in data_received
while self._inpbuf and self._recv_handler():
File "/usr/local/lib/python3.6/site-packages/asyncssh/connection.py", line 847, in _recv_packet
processed = handler.process_packet(pkttype, seq, packet)
File "/usr/local/lib/python3.6/site-packages/asyncssh/packet.py", line 215, in process_packet
self._packet_handlers[pkttype](self, pkttype, pktid, packet)
File "/usr/local/lib/python3.6/site-packages/asyncssh/connection.py", line 1414, in _process_kexinit
self._kex = get_kex(self, kex_alg)
File "/usr/local/lib/python3.6/site-packages/asyncssh/kex.py", line 122, in get_kex
return handler(alg, conn, hash_alg, *args)
File "/usr/local/lib/python3.6/site-packages/asyncssh/kex_ecdh.py", line 47, in init
self._priv = ecdh_class(*args)
File "/usr/local/lib/python3.6/site-packages/asyncssh/crypto/curve25519.py", line 31, in init
self._priv_key = x25519.X25519PrivateKey.generate()
File "/usr/local/lib/python3.6/site-packages/cryptography/hazmat/primitives/asymmetric/x25519.py", line 39, in gener
ate
_Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM
cryptography.exceptions.UnsupportedAlgorithm: X25519 is not supported by this version of OpenSSL.

arsaboo · 2019-01-31T20:44:41Z

Should be fixed in next release

lamboid · 2019-02-01T10:27:46Z

go go go please

mxwlsavard · 2019-02-03T01:09:57Z

Will this be fixed for HomeKit Controller as well? Sorry for asking, I just sat down at my PC to report this issue with the HomeKit controller when I found this issue. Thanks! 😄

furiaceka87 · 2019-02-05T07:34:56Z

any news about this issue?

kennedyshead · 2019-02-05T07:52:18Z

Will this be fixed for HomeKit Controller as well? Sorry for asking, I just sat down at my PC to report this issue with the HomeKit controller when I found this issue. Thanks! 😄

Yes, it will get solved for both platforms with this.

Gunth · 2019-02-07T14:38:35Z

I still have this issue for HomeKit Controller with the new release 87.0

quarcko · 2019-02-07T20:30:48Z

For me it is strange, homekit_controller is working fine up to 0.86.4
but after installing 0.87 - boom, OpenSSL version is bad..
reverted back to 0.86.4 - working again.

bereska · 2019-02-07T20:48:26Z

I'm happy to confirm that asuswrt now works in 0.87.0

Jc2k · 2019-02-07T21:03:53Z

The version of OpenSSL in hass.io has always been "bad", its just that more and more python code in the wild is starting to expect OpenSSL to be up to date.

For the asuswrt people there was a workaround to avoid using HASS.io OpenSSL at all for X25519. This means that one of the libraries is pinned at an old version - so currently blocked from security updates. The underlying problem is still there, just hidden. Hopefully HASS.io will use Alpine 3.9 before we have to choose between fixing a security bug and letting asuswrt work for HASS.io users 😱

There's no easy workaround for homekit_controller other than to not use HASS.io or to wait for it to upgrade to Alpine 3.9. (The non-hass.io Docker instructions should work, as should the venv instructions).

niemyjski · 2019-02-08T00:17:29Z

I'm also seeing this with the homekit_controller in hassio 0.87.0

2019-02-07 18:11:38 ERROR (MainThread) [homeassistant.core] Error doing job: Future exception was never retrieved
Traceback (most recent call last):
  File "/usr/local/lib/python3.6/concurrent/futures/thread.py", line 56, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/usr/local/lib/python3.6/site-packages/homeassistant/components/homekit_controller/__init__.py", line 362, in discovery_dispatch
    device = HKDevice(hass, host, port, model, hkid, config_num, config)
  File "/usr/local/lib/python3.6/site-packages/homeassistant/components/homekit_controller/__init__.py", line 98, in __init__
    self.accessory_setup()
  File "/usr/local/lib/python3.6/site-packages/homeassistant/components/homekit_controller/__init__.py", line 112, in accessory_setup
    data = self.pairing.list_accessories_and_characteristics()
  File "/usr/local/lib/python3.6/site-packages/homekit/controller.py", line 272, in list_accessories_and_characteristics
    self.session = Session(self.pairing_data)
  File "/usr/local/lib/python3.6/site-packages/homekit/controller.py", line 604, in __init__
    c2a_key, a2c_key = get_session_keys(conn, pairing_data)
  File "/usr/local/lib/python3.6/site-packages/homekit/protocol/__init__.py", line 247, in get_session_keys
    ios_key = x25519.X25519PrivateKey.generate()
  File "/usr/local/lib/python3.6/site-packages/cryptography/hazmat/primitives/asymmetric/x25519.py", line 39, in generate
    _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM
cryptography.exceptions.UnsupportedAlgorithm: X25519 is not supported by this version of OpenSSL.

Snoemannen · 2019-02-09T07:34:33Z

This just happened to me as well for homekit_controller when I upgraded hassio (running in docker on an ubuntu server) from 0.86.4 to 0.87.0 last night.

Would it be possible to just roll back to 0.86.4 until this has been fixed?

quarcko · 2019-02-09T08:23:35Z

I just did wipe and restore last snapshot. Worker a treat. ⁣Sent from BlueMail

…

On Feb 9, 2019, 09:34, at 09:34, Jens Westerlund ***@***.***> wrote: This just happened to me as well for homekit_controller when I upgraded hassio (running in docker on an ubuntu server) from 0.86.4 to 0.87.0 last night. Would it be possible to just roll back to 0.86.4 until this has been fixed? -- You are receiving this because you commented. Reply to this email directly or view it on GitHub: #903 (comment)

niemyjski · 2019-02-12T15:45:04Z

Are there any updates for this? I'd love to get this working.

Jc2k · 2019-02-21T10:17:58Z

I think this issue can be closed now - see #914.

@kennedyshead interest.

This was referenced Jan 26, 2019

Homekit Controller Koogeek home-assistant/core#18949

Closed

asuswrt still not working ssh using user/pass login 0.86.3 home-assistant/core#20513

Closed

Jc2k mentioned this issue Feb 8, 2019

HomeKit update to 0.12.2 in 0.87 causes UnsupportedAlgorithm error home-assistant/core#20840

Closed

rudgr mentioned this issue Feb 11, 2019

Homekit_controller: Update for cover.garage_door fails: TypeError: can't concat bool to bytearray home-assistant/core#20763

Closed

This was referenced Feb 11, 2019

Despite #20432, ASUSWRT ssh is still broken in HASSIO. #914

Closed

Homekit Controller: Future exception was never retrieved home-assistant/core#20960

Closed

Jc2k mentioned this issue Feb 12, 2019

HomeKit Controller – Koogeek Light Strip - no entities added even if accessory was found home-assistant/core#18241

Closed

pvizeli closed this as completed Feb 21, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Openssl-version dont have X25519 #903

Openssl-version dont have X25519 #903

kennedyshead commented Jan 24, 2019 •

edited

bereska commented Jan 25, 2019

Jc2k commented Jan 26, 2019

craigcarps commented Jan 28, 2019 •

edited

liquid667 commented Jan 31, 2019

arsaboo commented Jan 31, 2019

lamboid commented Feb 1, 2019

mxwlsavard commented Feb 3, 2019

furiaceka87 commented Feb 5, 2019

kennedyshead commented Feb 5, 2019

Gunth commented Feb 7, 2019 •

edited

quarcko commented Feb 7, 2019

bereska commented Feb 7, 2019

Jc2k commented Feb 7, 2019 •

edited

niemyjski commented Feb 8, 2019 •

edited

Snoemannen commented Feb 9, 2019

quarcko commented Feb 9, 2019 via email

niemyjski commented Feb 12, 2019

Jc2k commented Feb 21, 2019

Openssl-version dont have X25519 #903

Openssl-version dont have X25519 #903

Comments

kennedyshead commented Jan 24, 2019 • edited

bereska commented Jan 25, 2019

Jc2k commented Jan 26, 2019

craigcarps commented Jan 28, 2019 • edited

liquid667 commented Jan 31, 2019

arsaboo commented Jan 31, 2019

lamboid commented Feb 1, 2019

mxwlsavard commented Feb 3, 2019

furiaceka87 commented Feb 5, 2019

kennedyshead commented Feb 5, 2019

Gunth commented Feb 7, 2019 • edited

quarcko commented Feb 7, 2019

bereska commented Feb 7, 2019

Jc2k commented Feb 7, 2019 • edited

niemyjski commented Feb 8, 2019 • edited

Snoemannen commented Feb 9, 2019

quarcko commented Feb 9, 2019 via email

niemyjski commented Feb 12, 2019

Jc2k commented Feb 21, 2019

kennedyshead commented Jan 24, 2019 •

edited

craigcarps commented Jan 28, 2019 •

edited

Gunth commented Feb 7, 2019 •

edited

Jc2k commented Feb 7, 2019 •

edited

niemyjski commented Feb 8, 2019 •

edited