openssh unix dev - Sep 2011 - Interop problem with old dropbear and new openssh

Hi,

I have a router running an old version of OpenWRT with an old version of 
dropbear (Dropbear sshd v0.44test3).  It has been working for many years and I 
ssh in from my desktop systems (running Debian Testing) with no problem.

However, recently I upgraded one of my desktops and I can no longer connect to 
the router.  Dropbear on the router is exiting with:

exit before auth: bad buf_getwriteptr

Looking at the output from ssh -vv, the problem occurs right after

debug1: sending SSH2_MSG_KEXDH_INIT
debug1: expecting SSH2_MSG_KEXDH_REPLY

The desktop is running "SSH-2.0-OpenSSH_5.9p1 Debian-1" (it failed
with 5.8 as
well).  However, another desktop still running "SSH-2.0-OpenSSH_5.5p1 
Debian-6" still works fine.  The config files are identical and I can't
find
anything in the changelog between those versions which looks like it would 
affect the content of that message.

Has anyone seen this, or does anyone have any suggestions for possible 
workrounds?

Graham

please include a full debug trace from the client and, if possible, from
the server.

On Fri, 30 Sep 2011, Graham Cobb wrote:
> Hi,
> 
> I have a router running an old version of OpenWRT with an old version of 
> dropbear (Dropbear sshd v0.44test3).  It has been working for many years
and I
> ssh in from my desktop systems (running Debian Testing) with no problem.
> 
> However, recently I upgraded one of my desktops and I can no longer connect
to
> the router.  Dropbear on the router is exiting with:
> 
> exit before auth: bad buf_getwriteptr
> 
> Looking at the output from ssh -vv, the problem occurs right after
> 
> debug1: sending SSH2_MSG_KEXDH_INIT
> debug1: expecting SSH2_MSG_KEXDH_REPLY
> 
> The desktop is running "SSH-2.0-OpenSSH_5.9p1 Debian-1" (it
failed with 5.8 as
> well).  However, another desktop still running "SSH-2.0-OpenSSH_5.5p1 
> Debian-6" still works fine.  The config files are identical and I
can't find
> anything in the changelog between those versions which looks like it would 
> affect the content of that message.
> 
> Has anyone seen this, or does anyone have any suggestions for possible 
> workrounds?
> 
> Graham
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>

On Friday 30 September 2011 22:45:03 Graham Cobb wrote:
> However, recently I upgraded one of my desktops and I can no longer connect
> to the router.  Dropbear on the router is exiting with:
> 
> exit before auth: bad buf_getwriteptr
> 
> Looking at the output from ssh -vv, the problem occurs right after
> 
> debug1: sending SSH2_MSG_KEXDH_INIT
> debug1: expecting SSH2_MSG_KEXDH_REPLY
> 
> The desktop is running "SSH-2.0-OpenSSH_5.9p1 Debian-1" (it
failed with 5.8
> as well).  However, another desktop still running
"SSH-2.0-OpenSSH_5.5p1
> Debian-6" still works fine.  The config files are identical and I
can't
> find anything in the changelog between those versions which looks like it
> would affect the content of that message.
Just to close off this thread, in case anyone finds it in the future.  The 
problem is definitely a dropbear bug.  It is broken in dropbear 0.44 but works 
with dropbear 0.53.1.  I found the OpenSSH code changes which trigger the bug 
and there are no option settings which can workround the dropbear problem.

Thanks to Damien for his help.

Graham