[Openvas-devel] occasional gnutls_handschake error

[Jan-Oliver Wagner]

Hi,

working with SLAD as described on
http://www.openvas.org/using-slad.html

I occasionally got this messages from openvasd:

| [16496] gnutls_handshake: A TLS packet with unexpected length was received.
| [16507] gnutls_handshake: A record packet with illegal version was received.
| [16509] gnutls_handshake: Function was interrupted.

after patching slad_ssh.inc to use get_ssh_error() for better error messages
I got:

| Reported by NVT "SLAD Fetch Results" (1.3.6.1.4.1.25623.1.0.90003):
| 
| SSH login failed: Public key authentication failed.

Funny enough, SLAD Run script executed successfully.
Later on, SAD Fetch worked as well and I received the
SLAD analysis results.

The above error message is produced in ssh_func.inc:

|...
|   # code 60 (SSH_MSG_USERAUTH_PK_OK)
|   payload = recv_ssh_packet(socket:socket);
|   if ((ord(payload[0]) == 52) || (ord(payload[0]) == 60))
|      authenticated = 1;
|
|   if (!authenticated)
|    {
|     payload = "Public key authentication failed.";
|...

Seems the first character of the ssh packet is sometimes bad.

Just to let you know there is something to keep in mind.
Maybe someone likes to dig into this further.

Best

	Jan

-- 
Dr. Jan-Oliver Wagner                        Intevation GmbH, Osnabrück
Amtsgericht Osnabrück, HR B 18998             http://www.intevation.de/
Geschäftsführer: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner