i think we've stumbled upon a bug when interacting with binkd and no
session
level password...
i have a connection with a node that sends this when my binkd connects
out
to them...
OPT CRAM-MD5-411eaac235d14fa531bd059150ddac9e CRYPT
[...]
VER BinkIT/2.17,JSBinkP/1.114,sbbs3.17c/Linux binkp/1.1
my binkd reports this...
rerror: Password mismatch
when they connect inbound, they are sending this...
OPT CRYPT
[...]
VER BinkIT/2.17,JSBinkP/1.114,sbbs3.17c/Linux binkp/1.1
my binkd reports this...
unexpected password digest from the remote
there is only a tic password set in echocfg... no other passwords are
set
between the two systems...
i tried setting -nomd on their node line but since they are requesting CRYPT, we cannot talk... binkd does not have, that i can find, an option to turn off CRYPT per node...
i'm aware that binkit.js is v2.25 and binkp.jsAll about disabling CRAM-MD5 and encryption because my uplink was having issues that couldn't be easily debugged when those features were used.
v1.118 and there has been some recent work done in this area of the code...
with the above versions, i'm thinking that we're missing something since we seem to be setting CRYPT even when there is no session level password defined...
i don't know if having that node update to the latest binkp.js
and/or binkit.js will fix this particular problem with requesting CRYPT when there is no session level password set, though...
when they connect inbound, they are sending this...
OPT CRYPT
[...]
VER BinkIT/2.17,JSBinkP/1.114,sbbs3.17c/Linux binkp/1.1
That means the remote BinkIT system has a session password configured for your node. From binkp.js 1.114 ('-' is the same as a blank/no password):
if (!this.plain_auth_only && password !== '-')
this.sendCmd(this.command.M_NUL, "OPT CRYPT");
there is only a tic password set in echocfg... no other passwords are
set between the two systems...
How do you know? according to the information you provided, it certainly seems the remote system has a session password configured.
i tried setting -nomd on their node line but since they are requesting
CRYPT, we cannot talk... binkd does not have, that i can find, an option
to turn off CRYPT per node...
Setting a blank password in BinkIT will stop the CRYPT option for outbound connections. The only way to disable it for inbound connections is the new global plain-text-only option.
i'm aware that binkit.js is v2.25 and binkp.js v1.118 and there has
been some recent work done in this area of the code...
All about disabling CRAM-MD5 and encryption because my uplink was
having issues that couldn't be easily debugged when those features
were used.
with the above versions, i'm thinking that we're missing something
since we seem to be setting CRYPT even when there is no session level
password defined...
I don't think so.
i don't know if having that node update to the latest binkp.js and/or
binkit.js will fix this particular problem with requesting CRYPT when
there is no session level password set, though...
Shouldn't make any difference in that regard (for outbound connections from BinkIT).
aThat means the remote BinkIT system has a session password configured
for your node. From binkp.js 1.114 ('-' is the same as a blank/no
password):
if (!this.plain_auth_only && password !== '-')
this.sendCmd(this.command.M_NUL, "OPT CRYPT");
are you saying that if there is no session level password, we should have
'-' in the session password field in echocfg??
On 2019 Jun 13 22:34:52, you wrote to me:
when they connect inbound, they are sending this...
OPT CRYPT
[...]
VER BinkIT/2.17,JSBinkP/1.114,sbbs3.17c/Linux binkp/1.1
That means the remote BinkIT system has a session password configured for your node. From binkp.js 1.114 ('-' is the same as a blank/no password):
if (!this.plain_auth_only && password !== '-')
this.sendCmd(this.command.M_NUL, "OPT CRYPT");
are you saying that if there is no session level password, we should have a '-' in the session password field in echocfg??
i actually had nothing in the password field in my echocfg
and then also in
my binkd.conf... i've since added a '-' to my binkd.conf after reviewing my old configuration from my dead/defnuct system...
there is only a tic password set in echocfg... no other passwords are
set between the two systems...
How do you know? according to the information you provided, it certainly seems the remote system has a session password configured.
they posted me a copy of my entry in their sbbsecho.ini file... it looked exactly like the one i have for them...
----->8 snip 8<-----
[node:XXXXXXXXXXXXXXXXXX]
Name = XXXXXXXXXXXX
Comment =
Archive = None
PacketType = 2+
PacketPwd =
AreaFix = false
AreaFixPwd =
SessionPwd =
TicFilePwd = XXXXXXXX
Inbox =
Outbox =
Passive = false
Direct = true
Notify = false
Keys =
Status = Normal
LocalAddress = XXXXXXXXXXXX
GroupHub =
BinkpHost =
BinkpPort = 24554
BinkpPoll = false
BinkpPlainAuthOnly = false
BinkpAllowPlainAuth = true
BinkpAllowPlainText = true
BinkpSourceAddress = XXXXXXXXXXXXXXXXX
----->8 snip 8<-----
i tried setting -nomd on their node line but since they are requesting
CRYPT, we cannot talk... binkd does not have, that i can find, an option
to turn off CRYPT per node...
Setting a blank password in BinkIT will stop the CRYPT option for outbound connections. The only way to disable it for inbound connections is the new global plain-text-only option.
ahhh, ok... i wasn't sure how that worked... granted, i've not been into the code in several weeks...
i'm aware that binkit.js is v2.25 and binkp.js v1.118 and there has
been some recent work done in this area of the code...
All about disabling CRAM-MD5 and encryption because my uplink was having issues that couldn't be easily debugged when those features
were used.
i know that feeling... especially when CRYPT is used and the conversation is encrypted so you can't tell what's being sent/received when capturing the raw network packets...
with the above versions, i'm thinking that we're missing something
since we seem to be setting CRYPT even when there is no session level
password defined...
I don't think so.
i don't understand what's happening, then...
i don't know if having that node update to the latest binkp.js and/or
binkit.js will fix this particular problem with requesting CRYPT when
there is no session level password set, though...
Shouldn't make any difference in that regard (for outbound connections from BinkIT).
hummm...
On 2019 Jun 14 10:47:04, I wrote to you:
That means the remote BinkIT system has a session password configured
for your node. From binkp.js 1.114 ('-' is the same as a blank/no
password):
if (!this.plain_auth_only && password !== '-')
this.sendCmd(this.command.M_NUL, "OPT CRYPT");
are you saying that if there is no session level password, we should havea
'-' in the session password field in echocfg??
of course that was wrong but if one was put in there, it should work the same... i've glanced over the code and i note that if the password is undefined, it is set to '-'... is it possible that maybe the password is not just undefined but it is blank?
if (password === undefined)
password = '-';
if (password === '-')
this.require_md5 = false;
should
this.wont_crypt = true;
this.require_crypt = false;
be set up there where "this.require_md5 = false" is set instead of being set further down? then checking additional values would prevent "OPT CRYPT" from being sent as well??
Re: possible CRYPT bug with no session password
By: mark lewis to Digital Man on Fri Jun 14 2019 12:12 pm
On 2019 Jun 14 10:47:04, I wrote to you:
That means the remote BinkIT system has a session password configured
for your node. From binkp.js 1.114 ('-' is the same as a blank/no
password):
if (!this.plain_auth_only && password !== '-')
this.sendCmd(this.command.M_NUL, "OPT CRYPT");
are you saying that if there is no session level password, we should havea
'-' in the session password field in echocfg??
of course that was wrong but if one was put in there, it should work the same... i've glanced over the code and i note that if the password is undefined, it is set to '-'... is it possible that maybe the password is not just undefined but it is blank?
Yes, I think that's exactly what's happening:
this.node[sec].pass = f.iniGetValue(section, 'SessionPwd', '');
This line (from fidocfg.js) would set the password to a blank string by default (not undefined).
How do you know? according to the information you provided, it certainly seems >he remote system has a session password configured.
How do you know? according to the information you provided, it certainly seems >he remote system has a session password configured.
Uuuummmm.... he took my word for it as I showed him some of the fields I am showing you now. :)
[node:1:3634/12@fidonet]
Name =
Comment =
Archive =
PacketType = 2+
PacketPwd =
AreaFix = true
AreaFixPwd =
SessionPwd =
TicFilePwd = password (also tried with this field BLANK)
Inbox =
Outbox =
Passive = false
Direct = true
Notify = false
Keys = FIDO
Status = Normal
GroupHub =
BinkpHost = sestar.synchro.net
BinkpPort = 24554
BinkpPoll = true
BinkpAllowPlainAuth = true
BinkpAllowPlainText = true
BinkpPlainAuthOnly = false
BinkpSourceAddress =
I checked and this is the only entry for his node in my sbbsecho.ini file.
are you saying that if there is no session level password, we should
have a '-' in the session password field in echocfg??
No. The BinkP protocol processes a blank password as '-' and the binkit/binkp script automatically converts blank passwords to '-' and compares as such.
i actually had nothing in the password field in my echocfg
That would be correct.
and then also in
my binkd.conf... i've since added a '-' to my binkd.conf after reviewing
my old configuration from my dead/defnuct system...
binkd requires the '-' if you have other fields following the password.
Perhaps they made a copy/past error.
of course that was wrong but if one was put in there, it should work the
same... i've glanced over the code and i note that if the password is
undefined, it is set to '-'... is it possible that maybe the password is
not just undefined but it is blank?
Yes, I think that's exactly what's happening:
this.node[sec].pass = f.iniGetValue(section, 'SessionPwd', '');
This line (from fidocfg.js) would set the password to a blank string by default (not undefined).
be set up there where "this.require_md5 = false" is set instead of being
set further down? then checking additional values would prevent "OPT
CRYPT" from being sent as well??
No, I think that part is right. Just because you don't *require* CRAM-MD5 doesn't mean you won't allow it (and to allow it, you must send the OPT CRYPT msg).
The blank vs. undefined password thing does seem like a problem
though.
This line (from fidocfg.js) would set the password to a blank string by
default (not undefined).
Should be fixed now. Thanks for the bug report,
On 2019 Jun 14 13:50:10, you wrote to me:
of course that was wrong but if one was put in there, it should work the
same... i've glanced over the code and i note that if the password is
undefined, it is set to '-'... is it possible that maybe the password is
not just undefined but it is blank?
Yes, I think that's exactly what's happening:
this.node[sec].pass = f.iniGetValue(section, 'SessionPwd', '');
This line (from fidocfg.js) would set the password to a blank string by default (not undefined).
ahhhhhhhh...
be set up there where "this.require_md5 = false" is set instead of being
set further down? then checking additional values would prevent "OPT
CRYPT" from being sent as well??
No, I think that part is right. Just because you don't *require* CRAM-MD5 doesn't mean you won't allow it (and to allow it, you must send the OPT CRYPT msg).
ummm, what? to allow CRAM-MD5 you must also send CRYPT? i don't see that... to have/allow CRYPT, you have to do CRAM-MD5, yes... maybe i'm reading that wrongly?
ummm, what? to allow CRAM-MD5 you must also send CRYPT? i don't see
that... to have/allow CRYPT, you have to do CRAM-MD5, yes... maybe i'm
reading that wrongly?
There's no configuration setting in echofg/sbbsecho.ini which enables support for CRAM-MD5 authentication (outbound) and disables support
for encryption. A setting could be added but, since you can already disable both encryption and CRAM-MD5 (together), I'm not sure there's
a need.
On 2019 Jun 15 17:11:38, you wrote to me:
ummm, what? to allow CRAM-MD5 you must also send CRYPT? i don't see
that... to have/allow CRYPT, you have to do CRAM-MD5, yes... maybe i'm
reading that wrongly?
There's no configuration setting in echofg/sbbsecho.ini which enables support for CRAM-MD5 authentication (outbound) and disables support
for encryption. A setting could be added but, since you can already disable both encryption and CRAM-MD5 (together), I'm not sure there's
a need.
i'm not sure, either...
support for CRAM-MD5 authentication (outbound) and disables supportthere's
for encryption. A setting could be added but, since you can already
disable both encryption and CRAM-MD5 (together), I'm not sure
a need.
i'm not sure, either...
If/when someone wants it, I'll add it to the todo list. :-)
Thanks. Get the latest exec/binkit.js and load/binkp.js from CVS and see if tha
fixes you up.
Thanks. Get the latest exec/binkit.js and load/binkp.js from CVS and see
if tha fixes you up.
OK, I did a wget/rename on both of those. We will see what happens.
Sysop: | BrokenMind |
---|---|
Location: | Central Pennsylvania United States |
Users: | 60 |
Nodes: | 4 (0 / 4) |
Uptime: | 58:16:23 |
Calls: | 177 |
Files: | 2,017 |
Messages: | 20,571 |