SSH proxy, bad packet length-CodePudding

Implementing an ssh proxy in Go, errors out with bad packet length, these are the errors with ssh in debug mode:

debug1: SSH2_MSG_KEXINIT sent
Bad packet length 1231976033.
ssh_dispatch_run_fatal: Connection to ::1 port 8080: message authentication code incorrect

Code:

func handleSSH(conn net.Conn, r *bufio.Reader, protocol string) {

    target, err := url.Parse("ssh://localhost:3333")
    if err != nil {
        fmt.Println("Error parsing target", err)
        conn.Close()
        return
    }

    targetConn, err := net.Dial("tcp", target.Host)
    if err != nil {
        fmt.Println("error dialing SSH target:", err)
        conn.Close()
        return
    }

    defer targetConn.Close()

    var wg sync.WaitGroup
    wg.Add(2)
    go func() {
        _, err := io.Copy(targetConn, conn)
        if err != nil {
            fmt.Println("error copying data to target:", err)
        }
        wg.Done()
    }()

    go func() {
        _, err := io.Copy(conn, targetConn)
        if err != nil {
            fmt.Println("error copying data from target:", err)
        }
        wg.Done()
    }()

    wg.Wait()
    conn.Close()
}

// EDIT

func connection(conn net.Conn) {

    r := bufio.NewReader(conn)
    protocol, err := r.ReadString('\n')
    if err != nil {
        fmt.Println("Error reading first line", err)
        conn.Close()
        return
    }

if protocol[0:3] == "SSH" {
        handleSSH(conn, r, protocol)
    }
}

func main() {
   ln, err := net.Listen("tcp", ":8080")
    if err != nil {
        panic(err)
    }
    defer ln.Close()

    for {
        conn, err := ln.Accept()
        if err != nil {
            panic(err)
        }
        go connection(conn)
    }
}

EDIT: added code for relevant information on how the connection is initiated and reproduce the error.

My best guess is the ssh negotiation process is being interrupted, and things goes out of sync.

CodePudding user response：

The code is reading the first line from the client and checks the kind of protocol in order to call the appropriate handler:

protocol, err := r.ReadString('\n')
...
if protocol[0:3] == "SSH" {
        handleSSH(conn, r, protocol)
    }
}

But the code fails to forward the already read bytes to the connected server. These bytes are in protocol and are given to handleSSH. But it fails to send these bytes to the connected server once the connection is established. Instead it only copies new data between client and server.

This means the server does not get the first line from the client. It therefore likely complains about a protocol error with something like Invalid SSH identification string. which gets forwarded to the client and misinterpreted as valid data from an SSH connection.