[
https://issues.apache.org/jira/browse/SSHD-771?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16162701#comment-16162701
]
Andreas Bergander commented on SSHD-771:
----------------------------------------
It seems like the problem only occurs in combination with certain Key Exchange
Algorithms. More specifically these: diffie-hellman-group-exchange-sha1,
diffie-hellman-group14-sha1, diffie-hellman-group1-sha1.
So to reproduce:
I start an SFTP server using: {{SshServer -p 2222}}
And then connect using OpenSSH (v7.5p1): {{sftp -vvv -P 2222
-oKexAlgorithms=diffie-hellman-group14-sha1 -oMACs=hmac-sha2-512 localhost}}
If I switch to hmac-sha-256 it will work with any Kex algorithm. If I change
Kex algorithm to something else, like diffie-hellman-group-exchange-sha256 or
ecdh-sha2-nistp521, it works.
The error I get from OpenSSH is:
{code}
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 4294967296 blocks
debug2: key: /home/andber/.ssh/id_rsa (0x0)
debug2: key: /home/andber/.ssh/id_dsa (0x0)
debug2: key: /home/andber/.ssh/id_ecdsa (0x0)
debug2: key: /home/andber/.ssh/id_ed25519 (0x0)
debug3: send packet: type 5
Corrupted MAC on input.
debug3: send packet: type 1
Authentication failed.
Connection closed
{code}
> SFTP server closes the connection when hmac-sha2-512 is used
> ------------------------------------------------------------
>
> Key: SSHD-771
> URL: https://issues.apache.org/jira/browse/SSHD-771
> Project: MINA SSHD
> Issue Type: Bug
> Affects Versions: 1.6.0
> Reporter: Andreas Bergander
> Assignee: Goldstein Lyor
> Fix For: 1.7.0
>
> Attachments: SshdTest.java
>
>
> It seems like the SFTP server in sshd does not handle HMAC SHA-2-512 very
> well. If I set up a server which only accepts that HMAC, the server closes
> the connection as soon as I connect with a client.
> The server throws an exception in AbstractSession (row 1380) before closing
> the connection:
> {code}
> // Check the computed result with the received mac (just after the packet
> data)
> if (!BufferUtils.equals(inMacResult, 0, data, decoderLength + 4, macSize)) {
> throw new SshException(SshConstants.SSH2_DISCONNECT_MAC_ERROR, "MAC Error");
> }
> {code}
> If I switch the HMAC to SHA-2-256 everything works ok.
> I've attached a sample program which sets up a server. I've tested with a
> couple of different clients and all of them exposes the error in the server.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
