#38041: openssl-1.0.1e broken with key_from_blob error messages ----------------------+-------------------------------- Reporter: david@… | Owner: macports-tickets@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.1.3 Resolution: | Keywords: Port: openssl | ----------------------+-------------------------------- Comment (by david@…): Odd... now this is showing up in openssl-1.0.1c too. Trying to get a version of openssl installed that works. Will update this ticket if I make progress. -- Ticket URL: <https://trac.macports.org/ticket/38041#comment:1> MacPorts <http://www.macports.org/> Ports system for Mac OS

#38041: openssl-1.0.1e broken with key_from_blob error messages ----------------------+-------------------------------- Reporter: david@… | Owner: macports-tickets@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.1.3 Resolution: | Keywords: Port: openssl | ----------------------+-------------------------------- Comment (by david@…): Debugging the session shows... Client end... {{{ scp -l 5000 -v -P 9999 -i /Users/david/.ssh/dfavor.dsa xhtml11.conf.patch root@68.233.248.187:. Executing: program /opt/local/bin/ssh host 68.233.248.187, user root, command scp -v -t . OpenSSH_6.1p1, OpenSSL 1.0.1e 11 Feb 2013 debug1: Reading configuration data /opt/local/etc/ssh/ssh_config debug1: Connecting to 68.233.248.187 [68.233.248.187] port 9999. debug1: Connection established. debug1: identity file /Users/david/.ssh/dfavor.dsa type 2 debug1: identity file /Users/david/.ssh/dfavor.dsa-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0p1 Debian-3ubuntu1 debug1: match: OpenSSH_6.0p1 Debian-3ubuntu1 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.1 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5 none debug1: kex: client->server aes128-ctr hmac-md5 none debug1: sending SSH2_MSG_KEX_ECDH_INIT debug1: expecting SSH2_MSG_KEX_ECDH_REPLY Connection closed by 68.233.248.187 lost connection }}} Server end... {{{ /usr/sbin/sshd -p 9999 -d debug1: sshd version OpenSSH_6.0p1 Debian-3ubuntu1 debug1: read PEM private key done: type RSA debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048 debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048 debug1: private host key: #0 type 1 RSA debug1: read PEM private key done: type DSA debug1: Checking blacklist file /usr/share/ssh/blacklist.DSA-1024 debug1: Checking blacklist file /etc/ssh/blacklist.DSA-1024 debug1: private host key: #1 type 2 DSA debug1: read PEM private key done: type ECDSA debug1: Checking blacklist file /usr/share/ssh/blacklist.ECDSA-256 debug1: Checking blacklist file /etc/ssh/blacklist.ECDSA-256 debug1: private host key: #2 type 3 ECDSA debug1: rexec_argv[0]='/usr/sbin/sshd' debug1: rexec_argv[1]='-p' debug1: rexec_argv[2]='9999' debug1: rexec_argv[3]='-d' Set /proc/self/oom_score_adj from 0 to -1000 debug1: Bind to port 9999 on 0.0.0.0. Server listening on 0.0.0.0 port 9999. debug1: Bind to port 9999 on ::. Server listening on :: port 9999. debug1: Server will not fork when running in debugging mode. debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8 debug1: inetd sockets after dupping: 3, 3 Connection from 173.174.85.112 port 48690 debug1: Client protocol version 2.0; client software version OpenSSH_6.1 debug1: match: OpenSSH_6.1 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-3ubuntu1 debug1: permanently_set_uid: 105/65534 [preauth] debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256 [preauth] debug1: SSH2_MSG_KEXINIT sent [preauth] debug1: SSH2_MSG_KEXINIT received [preauth] debug1: kex: client->server aes128-ctr hmac-md5 none [preauth] debug1: kex: server->client aes128-ctr hmac-md5 none [preauth] debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth] buffer_get_bignum2_ret: BN_bin2bn failed [preauth] buffer_get_ecpoint: buffer error [preauth] debug1: do_cleanup [preauth] debug1: monitor_read_log: child log fd closed debug1: do_cleanup debug1: Killing privsep child 29221 }}} -- Ticket URL: <https://trac.macports.org/ticket/38041#comment:3> MacPorts <http://www.macports.org/> Ports system for Mac OS

#38041: openssl-1.0.1e broken with key_from_blob error messages ------------------------------+-------------------------------- Reporter: david@… | Owner: macports-tickets@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.1.3 Resolution: | Keywords: Port: openssl openssh | ------------------------------+-------------------------------- Changes (by jmr@…): * port: openssl => openssl openssh Comment: So given that you're seeing the problem with every version of openssl you tried, couldn't the problem just as easily be in the openssh port? -- Ticket URL: <https://trac.macports.org/ticket/38041#comment:5> MacPorts <http://www.macports.org/> Ports system for Mac OS

#38041: openssl-1.0.1e broken with key_from_blob error messages ------------------------------+-------------------------------- Reporter: david@… | Owner: macports-tickets@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.1.3 Resolution: | Keywords: Port: openssl openssh | ------------------------------+-------------------------------- Comment (by david@…): Replying to [comment:5 jmr@…]:

So given that you're seeing the problem with every version of openssl you tried, couldn't the problem just as easily be in the openssh port?

Unfortunately this is correct. I should have stated this above. The only way I can fix this right now is to use the Apple shipped ssh + scp, as the Macports versions fail. I also tried building an openssh variant (+ldns) which forces a true configure + make, rather than downloading a binary. This failed too. It's a bit odd no one has reported this because looking at a random openssh mirror (http://mirror.esc7.net/pub/OpenBSD/OpenSSH/portable/) shows that OpenSSH-6.1p1 released on 29-Aug-2012 so there should have been bug reports generated against Macports ssh + scp long before now. Only thing I can determine is something has changed which is escaping me. I'm running openssl-1.0.1c which still gives the same problem, so neither the 1.0.1d or 1.0.1e openssl releases appear to be the culprit. Now that I think about it, maybe it's some other openssh library... {{{ David-Favor-iMac> /opt/local/bin/ssh -V OpenSSH_6.1p1, OpenSSL 1.0.1c 10 May 2012 David-Favor-iMac> otool -L /opt/local/bin/ssh /opt/local/bin/ssh: /opt/local/lib/libcrypto.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0) /opt/local/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.7) /usr/lib/libresolv.9.dylib (compatibility version 1.0.0, current version 1.0.0) /opt/local/lib/libgssapi_krb5.2.2.dylib (compatibility version 2.0.0, current version 2.2.0) /opt/local/lib/libkrb5.3.3.dylib (compatibility version 3.0.0, current version 3.3.0) /opt/local/lib/libk5crypto.3.1.dylib (compatibility version 3.0.0, current version 3.1.0) /opt/local/lib/libcom_err.1.1.dylib (compatibility version 1.0.0, current version 1.1.0) /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 169.3.0) }}} Maybe one of the other libraries change underneath openssh. I'll hack on /opt/local/etc/ssh/ssh_config and see if I can come up with some config that fixes the problem. No great hope for this though, as this code is completely new to me. -- Ticket URL: <https://trac.macports.org/ticket/38041#comment:7> MacPorts <http://www.macports.org/> Ports system for Mac OS

#38041: openssl-1.0.1e broken with key_from_blob error messages ------------------------------+-------------------------------- Reporter: david@… | Owner: macports-tickets@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.1.3 Resolution: | Keywords: Port: openssl openssh | ------------------------------+-------------------------------- Comment (by david@…): Per ticket #38015, rebuilding openssl-1.0.1e with no-asm creates a working Macports ssh + scp. This ticket can be closed. -- Ticket URL: <https://trac.macports.org/ticket/38041#comment:9> MacPorts <http://www.macports.org/> Ports system for Mac OS