ssh bug in 380.70, plus a funny one before it

[Pila]

ssh does not return proper exit codes. My routers are 380.59 except for the new one which is 380.70. The old fw has even quite unbelivable extra ssh bug!

On my network, there is a .2.8 computer and there is no .2.18 one. Meaning: ssh itself fails when .2.18 is the destination. So, I will use that to illustrate the bug.

Dissastrous bug in 380.70! When I do:

ssh root@192.168.2.8 "exit 123"; echo $?

We must get 123 back. Right? Yes, we get 123. But if we do:

ssh root@192.168.2.18 "exit 123"; echo $?

we must get 255 back because ssh itself failed. Right? Wrong! We get 1 back! Meaning: bug in the ssh (one of several) does not allow us to differentiate if the ssh itself failed or its remote command failed. OK, we can easily work around this. Just saying there is a bug.

It would be nice if someone would test this bug on the current fw, just for fun.

Funny thing happens on my 380.59 routers. OK, this is old fw, it is partiall fixed, I am not complaining, but it is funny! Redirection kills ssh returns completely.

ssh root@192.168.2.8 "exit 123" 2>&- ; echo $?

Tnis must return 123. Right? Wrong. It returns 1! Regardles where one places redirection within the command! 380.70 fixed this. Not even my Raspberry Pi at .2.8 with LibreElec 7 (quite old version) with busybox does not have any of these problems.

Irrelevant but: my routers are Asus RT-AC68U and RT-AC56U all with 380.59. my "newer is better" is Asus RT-AC66U_B1 w. fw 380.70. Unfortunatelly, 380.70 creates so much problems with ssh that I am seriously loosing my patience with it.

I am sure someone will say: you idiot, update to the latest firmware! Well, I did jump from 380.59 to 380.70! And as a result I am fightihg with the 380.70 for over a month now. I bought a new router (Asus RT-AC66U_B1 for 80€) which I do not need at all just to try to adapt to "newer is better" fw just to be prepared if one of my production routers drops dead. Old ones work 3 years with no problems I did not handle. ssh on the new one is killing me! So, if I go even newer, I can only be sure that I will have even more new problems to fix and not sure I will be able revert even to 380.70.

Do not get me wrong: I love Asus routers with huge Merlin effort invested. He deserves a monument for his work!

I am off to top up my big wine glass with some Ivan Dolac 2010, since I have some ssh commands in my 3000+ lines ddns-start script which I must rewrite. Very, very complex ones. I am fighting with changing Internet conditions with my provider, and changes are not for the better...

 

[RMerlin]

Ssh is provided by dropbear, not busybox. If you have issues with it, contact its author.

 

[sfx2000]

ssh does not return proper exit codes

255 and 1 are both acceptable result codes...

1 - generic error
255 - error occured in ssh

I am off to top up my big wine glass with some Ivan Dolac 2010, since I have some ssh commands in my 3000+ lines ddns-start script which I must rewrite. Very, very complex ones. I am fighting with changing Internet conditions with my provider, and changes are not for the better...

This might help... happy rewriting

It's good to see that err 1/2 are similar enough to handle in a script - so one can also include 255 perhaps...

but to compare results - if the error code is != 0, it's an error at the end of the day...

Error Codes
The purpose of an error code is to describe the error occurring in a
program; it may display on the command line or in a log or a trace file.

SSH Error Codes
0 Success
1 Generic error
2 Remote host connection failure

SCP/SFTP Error Codes

The numbering scheme of the SCP/SFTP error codes was derived by adding
64 to the RFC4253 error code, for example, 64 + 1 = 65.

Source: RFC4253 error code + 64

65 Host not allowed to connect
66 Protocol error
67 Key exchange failed
68 Host authentication failed
69 MAC error
70 Compression error (not used in SSH2)
71 Service not available
72 Protocol version not supported
73 Host key not verifiable
74 Connection lost
75 Disconnected by application
76 Too many connections
77 Cancelled by user
78 No more auth methods available
79 Illegal user name

Exit Codes - these are outside of RFC, but some clients to...

see Attachmate exit codes for scp/sftp

You can display an exit code by typing echo $? after executing an SSH,
SCP, or SFTP command.

0 Success
1 Undetermined error in file copy
3 Destination is not directory, but it should be
4 Connecting to host failed
5 Connection lost for some reason
6 File does not exist
7 No permission to access file
8 Undetermined error from sshfilexfer
9 File transfer protocol mismatch
255 Error occurred in SSH

Not a bug in dropbear, imho... errors on ssh generally mean that auth failed for login in your example above.

If one is doing script dev, need to capture all the error cases... and you'll need to cover this across ssh, scp, and sftp there...

There's a fair amount of result codes to capture, and most of them are indeed, failures...

When testing against a host - could be dropbear, might be openssh-server on the other end.