ssh ProxyCommand in ipa-client causes crash of x2goclient

[Kees Bakker]

Hey,

With x2go [1] you can start a remote desktop. Going from UNIX (client) to UNIX (server)
it will use SSH behinds the scenes.

However, on a IPA client the x2goclient command fails with a segfault (somewhere in a ssh library).
This is caused by the modified /etc/ssh/ssh_config. More specifically this

ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h

When you disable this line the x2go connection succeeds.

[1] https://wiki.x2go.org/doku.php

[Alexander Bokovoy]

On to, 24 loka 2019, Kees Bakker via FreeIPA-users wrote:
> Hey,
>
> With x2go [1] you can start a remote desktop. Going from UNIX (client) to UNIX (server)
> it will use SSH behinds the scenes.
>
> However, on a IPA client the x2goclient command fails with a segfault (somewhere in a ssh library).
> This is caused by the modified /etc/ssh/ssh_config. More specifically this
>
> ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h
>
> When you disable this line the x2go connection succeeds.
>
> [1] https://wiki.x2go.org/doku.php

If you could install debug packages and generate a backtrace, that would
be great as it would help to understand where it happens. Thanks in
advance!

[Kees Bakker]

On 24-10-19 16:12, Alexander Bokovoy wrote:
> On to, 24 loka 2019, Kees Bakker via FreeIPA-users wrote:
> > Hey,
> >
> > With x2go [1] you can start a remote desktop. Going from UNIX (client) to UNIX (server)
> > it will use SSH behinds the scenes.
> >
> > However, on a IPA client the x2goclient command fails with a segfault (somewhere in a ssh library).
> > This is caused by the modified /etc/ssh/ssh_config. More specifically this
> >
> > ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h
> >
> > When you disable this line the x2go connection succeeds.
> >
> > [1] https://wiki.x2go.org/doku.php
>
> If you could install debug packages and generate a backtrace, that would
> be great as it would help to understand where it happens. Thanks in
> advance!

Hey Alexander,

The segfault is in a library of the libssh-4 package. I don't know if that is something
you wanted to be involved with. Anyway, here is the stack strace of the segfault.

segfault at 4 ip 00007f6e7e0d5eeb sp 00007f6e64e6ea88 error 6 in libssh.so.4.5.0

After installing the dgbsym package and running from gdb I could get a stack trace

Thread 6 "SshMasterConnec" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffdf1a0700 (LWP 14736)]
0x00007ffff7b89eeb in ssh_poll_set_events (p=0x7fffd40076b0, events=4) at ./src/poll.c:349
349    ./src/poll.c: No such file or directory.
(gdb) where
#0  0x00007ffff7b89eeb in ssh_poll_set_events (p=0x7fffd40076b0, events=4) at ./src/poll.c:349
#1  0x00007ffff7b8d3c8 in ssh_socket_unbuffered_write (len=<optimized out>, buffer=<optimized out>, s=0x7fffd4003850)
     at ./src/socket.c:574
#2  ssh_socket_nonblocking_flush (s=s@entry=0x7fffd4003850) at ./src/socket.c:667
#3  0x00007ffff7b8d4c4 in ssh_socket_write (s=0x7fffd4003850, buffer=<optimized out>, len=len@entry=64)
     at ./src/socket.c:628
#4  0x00007ffff7b846c3 in ssh_packet_write (session=0x7fffd4004bc0, session=0x7fffd4004bc0) at ./src/packet.c:1316
#5  packet_send2 (session=session@entry=0x7fffd4004bc0) at ./src/packet.c:1386
#6  0x00007ffff7b85315 in ssh_packet_send (session=session@entry=0x7fffd4004bc0) at ./src/packet.c:1411
#7  0x00007ffff7b72d69 in channel_write_common (channel=0x7fffd40112e0, data=0x7fffdf11fce0, len=6, is_stderr=0)
     at ./src/channels.c:1357
#8  0x0000555555640cc3 in ?? ()
#9  0x0000555555644745 in ?? ()
#10 0x00007ffff581de3c in ?? () from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#11 0x00007ffff558b6db in start_thread (arg=0x7fffdf1a0700) at pthread_create.c:463
#12 0x00007ffff4d1388f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

[Alexander Bokovoy]

On pe, 25 loka 2019, Kees Bakker wrote:
> On 24-10-19 16:12, Alexander Bokovoy wrote:
> > On to, 24 loka 2019, Kees Bakker via FreeIPA-users wrote:
> > > Hey,
> > >
> > > With x2go [1] you can start a remote desktop. Going from UNIX (client) to UNIX (server)
> > > it will use SSH behinds the scenes.
> > >
> > > However, on a IPA client the x2goclient command fails with a segfault (somewhere in a ssh library).
> > > This is caused by the modified /etc/ssh/ssh_config. More specifically this
> > >
> > > ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h
> > >
> > > When you disable this line the x2go connection succeeds.
> > >
> > > [1] https://wiki.x2go.org/doku.php
> >
> > If you could install debug packages and generate a backtrace, that would
> > be great as it would help to understand where it happens. Thanks in
> > advance!
>
> Hey Alexander,
>
> The segfault is in a library of the libssh-4 package. I don't know if that is something
> you wanted to be involved with. Anyway, here is the stack strace of the segfault.

Thanks. So the crash is in ssh_poll_set_events(). Andreas, do you have
any ideas?
> segfault at 4 ip 00007f6e7e0d5eeb sp 00007f6e64e6ea88 error 6 in libssh.so.4.5.0
>
> After installing the dgbsym package and running from gdb I could get a stack trace
>
> Thread 6 "SshMasterConnec" received signal SIGSEGV, Segmentation fault.
> [Switching to Thread 0x7fffdf1a0700 (LWP 14736)]
> 0x00007ffff7b89eeb in ssh_poll_set_events (p=0x7fffd40076b0, events=4) at ./src/poll.c:349
> 349    ./src/poll.c: No such file or directory.
> (gdb) where
> #0  0x00007ffff7b89eeb in ssh_poll_set_events (p=0x7fffd40076b0, events=4) at ./src/poll.c:349
> #1  0x00007ffff7b8d3c8 in ssh_socket_unbuffered_write (len=<optimized out>, buffer=<optimized out>, s=0x7fffd4003850)
>     at ./src/socket.c:574
> #2  ssh_socket_nonblocking_flush (s=s@entry=0x7fffd4003850) at ./src/socket.c:667
> #3  0x00007ffff7b8d4c4 in ssh_socket_write (s=0x7fffd4003850, buffer=<optimized out>, len=len@entry=64)
>     at ./src/socket.c:628
> #4  0x00007ffff7b846c3 in ssh_packet_write (session=0x7fffd4004bc0, session=0x7fffd4004bc0) at ./src/packet.c:1316
> #5  packet_send2 (session=session@entry=0x7fffd4004bc0) at ./src/packet.c:1386
> #6  0x00007ffff7b85315 in ssh_packet_send (session=session@entry=0x7fffd4004bc0) at ./src/packet.c:1411
> #7  0x00007ffff7b72d69 in channel_write_common (channel=0x7fffd40112e0, data=0x7fffdf11fce0, len=6, is_stderr=0)
>     at ./src/channels.c:1357
> #8  0x0000555555640cc3 in ?? ()
> #9  0x0000555555644745 in ?? ()
> #10 0x00007ffff581de3c in ?? () from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
> #11 0x00007ffff558b6db in start_thread (arg=0x7fffdf1a0700) at pthread_create.c:463
> #12 0x00007ffff4d1388f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
>
> -- 
> Kees Bakker

[Andreas Schneider]

On Friday, 25 October 2019 11:11:32 CEST Alexander Bokovoy wrote:
> On pe, 25 loka 2019, Kees Bakker wrote:
> > On 24-10-19 16:12, Alexander Bokovoy wrote:
> > > On to, 24 loka 2019, Kees Bakker via FreeIPA-users wrote:
> > > > Hey,
> > > >
> > > > With x2go [1] you can start a remote desktop. Going from UNIX (client) to
> > > > UNIX (server) it will use SSH behinds the scenes.
> > > >
> > > > However, on a IPA client the x2goclient command fails with a segfault
> > > > (somewhere in a ssh library). This is caused by the modified
> > > > /etc/ssh/ssh_config. More specifically this
> > > >
> > > > ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h
> > > >
> > > > When you disable this line the x2go connection succeeds.
> > > >
> > > > [1] https://wiki.x2go.org/doku.php
> > >
> > > If you could install debug packages and generate a backtrace, that would
> > > be great as it would help to understand where it happens. Thanks in
> > > advance!
> >
> > Hey Alexander,
> >
> > The segfault is in a library of the libssh-4 package. I don't know if that
> > is something you wanted to be involved with. Anyway, here is the stack
> > strace of the segfault.
>
> Thanks. So the crash is in ssh_poll_set_events(). Andreas, do you have
> any ideas?

Where is libssh installed from? It looks like this is libssh 0.8.0.
> > segfault at 4 ip 00007f6e7e0d5eeb sp 00007f6e64e6ea88 error 6 in
> > libssh.so.4.5.0
> >
> > After installing the dgbsym package and running from gdb I could get a
> > stack trace
> >
> > Thread 6 "SshMasterConnec" received signal SIGSEGV, Segmentation fault.
> > [Switching to Thread 0x7fffdf1a0700 (LWP 14736)]
> > 0x00007ffff7b89eeb in ssh_poll_set_events (p=0x7fffd40076b0, events=4) at
> > ./src/poll.c:349 349    ./src/poll.c: No such file or directory.
> > (gdb) where
> > #0  0x00007ffff7b89eeb in ssh_poll_set_events (p=0x7fffd40076b0, events=4)
> > at ./src/poll.c:349 #1  0x00007ffff7b8d3c8 in ssh_socket_unbuffered_write
> > (len=<optimized out>, buffer=<optimized out>, s=0x7fffd4003850) at
> > ./src/socket.c:574
> > #2  ssh_socket_nonblocking_flush (s=s@entry=0x7fffd4003850) at
> > ./src/socket.c:667 #3  0x00007ffff7b8d4c4 in ssh_socket_write
> > (s=0x7fffd4003850, buffer=<optimized out>, len=len@entry=64) at
> > ./src/socket.c:628
> > #4  0x00007ffff7b846c3 in ssh_packet_write (session=0x7fffd4004bc0,
> > session=0x7fffd4004bc0) at ./src/packet.c:1316 #5  packet_send2
> > (session=session@entry=0x7fffd4004bc0) at ./src/packet.c:1386 #6 
> > 0x00007ffff7b85315 in ssh_packet_send
> > (session=session@entry=0x7fffd4004bc0) at ./src/packet.c:1411 #7 
> > 0x00007ffff7b72d69 in channel_write_common (channel=0x7fffd40112e0,
> > data=0x7fffdf11fce0, len=6, is_stderr=0) at ./src/channels.c:1357
> > #8  0x0000555555640cc3 in ?? ()
> > #9  0x0000555555644745 in ?? ()
> > #10 0x00007ffff581de3c in ?? () from
> > /usr/lib/x86_64-linux-gnu/libQtCore.so.4 #11 0x00007ffff558b6db in
> > start_thread (arg=0x7fffdf1a0700) at pthread_create.c:463 #12
> > 0x00007ffff4d1388f in clone () at
> > ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

[Kees Bakker]

On 25-10-19 13:09, Andreas Schneider wrote:
> On Friday, 25 October 2019 11:11:32 CEST Alexander Bokovoy wrote:
> > On pe, 25 loka 2019, Kees Bakker wrote:
> > > On 24-10-19 16:12, Alexander Bokovoy wrote:
> > > > On to, 24 loka 2019, Kees Bakker via FreeIPA-users wrote:
> > > > > Hey,
> > > > >
> > > > > With x2go [1] you can start a remote desktop. Going from UNIX (client) to
> > > > > UNIX (server) it will use SSH behinds the scenes.
> > > > >
> > > > > However, on a IPA client the x2goclient command fails with a segfault
> > > > > (somewhere in a ssh library). This is caused by the modified
> > > > > /etc/ssh/ssh_config. More specifically this
> > > > > ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h
> > > > >
> > > > > When you disable this line the x2go connection succeeds.
> > > > >
> > > > > [1] https://wiki.x2go.org/doku.php
> > > >
> > > > If you could install debug packages and generate a backtrace, that would
> > > > be great as it would help to understand where it happens. Thanks in
> > > > advance!
> > >
> > > Hey Alexander,
> > >
> > > The segfault is in a library of the libssh-4 package. I don't know if that
> > > is something you wanted to be involved with. Anyway, here is the stack
> > > strace of the segfault.
> >
> > Thanks. So the crash is in ssh_poll_set_events(). Andreas, do you have
> > any ideas?
>
> Where is libssh installed from? It looks like this is libssh 0.8.0.

It's Ubuntu 18.04.3 and the libraries are from the normal
distribution source.
     https://packages.ubuntu.com/search?keywords=libssh

# dpkg -l libssh*|cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version                            Architecture Description
+++-=====================-==================================-============-===================================
ii  libssh-4:amd64 0.8.0~20170825.94fa1e38-1ubuntu0.2 amd64        tiny C SSH library (OpenSSL flavor)
ii  libssh-4-dbgsym:amd64 0.8.0~20170825.94fa1e38-1ubuntu0.2 amd64        debug symbols for libssh-4
un  libssh-dbg <none>                             <none>       (no description available)
ii  libssh-gcrypt-4:amd64 0.8.0~20170825.94fa1e38-1ubuntu0.2 amd64        tiny C SSH library (gcrypt flavor)
ii  libssh2-1:amd64 1.8.0-1                            amd64        SSH2 client-side library
# apt policy libssh-4
libssh-4:
   Installed: 0.8.0~20170825.94fa1e38-1ubuntu0.2
   Candidate: 0.8.0~20170825.94fa1e38-1ubuntu0.2
   Version table:
  *** 0.8.0~20170825.94fa1e38-1ubuntu0.2 500
         500 http://nl.archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages
         500 http://security.ubuntu.com/ubuntu bionic-security/main amd64 Packages
         100 /var/lib/dpkg/status
      0.8.0~20170825.94fa1e38-1build1 500
         500 http://nl.archive.ubuntu.com/ubuntu bionic/main amd64 Packages
> > > segfault at 4 ip 00007f6e7e0d5eeb sp 00007f6e64e6ea88 error 6 in
> > > libssh.so.4.5.0
> > >
> > > After installing the dgbsym package and running from gdb I could get a
> > > stack trace
> > >
> > > Thread 6 "SshMasterConnec" received signal SIGSEGV, Segmentation fault.
> > > [Switching to Thread 0x7fffdf1a0700 (LWP 14736)]
> > > 0x00007ffff7b89eeb in ssh_poll_set_events (p=0x7fffd40076b0, events=4) at
> > > ./src/poll.c:349 349    ./src/poll.c: No such file or directory.
> > > (gdb) where
> > > #0  0x00007ffff7b89eeb in ssh_poll_set_events (p=0x7fffd40076b0, events=4)
> > > at ./src/poll.c:349 #1  0x00007ffff7b8d3c8 in ssh_socket_unbuffered_write
> > > (len=<optimized out>, buffer=<optimized out>, s=0x7fffd4003850) at
> > > ./src/socket.c:574
> > > #2  ssh_socket_nonblocking_flush (s=s@entry=0x7fffd4003850) at
> > > ./src/socket.c:667 #3  0x00007ffff7b8d4c4 in ssh_socket_write
> > > (s=0x7fffd4003850, buffer=<optimized out>, len=len@entry=64) at
> > > ./src/socket.c:628
> > > #4  0x00007ffff7b846c3 in ssh_packet_write (session=0x7fffd4004bc0,
> > > session=0x7fffd4004bc0) at ./src/packet.c:1316 #5  packet_send2
> > > (session=session@entry=0x7fffd4004bc0) at ./src/packet.c:1386 #6
> > > 0x00007ffff7b85315 in ssh_packet_send
> > > (session=session@entry=0x7fffd4004bc0) at ./src/packet.c:1411 #7
> > > 0x00007ffff7b72d69 in channel_write_common (channel=0x7fffd40112e0,
> > > data=0x7fffdf11fce0, len=6, is_stderr=0) at ./src/channels.c:1357
> > > #8  0x0000555555640cc3 in ?? ()
> > > #9  0x0000555555644745 in ?? ()
> > > #10 0x00007ffff581de3c in ?? () from
> > > /usr/lib/x86_64-linux-gnu/libQtCore.so.4 #11 0x00007ffff558b6db in
> > > start_thread (arg=0x7fffdf1a0700) at pthread_create.c:463 #12
> > > 0x00007ffff4d1388f in clone () at
> > > ../sysdeps/unix/sysv/linux/x86_64/clone.S:95