transmission-cli 3.00-3 unauthroized user

This forum is for discussion about general software issues.

Re: transmission-cli 3.00-3 unauthroized user

Postby zebul666 » Mon Feb 14, 2022 11:39 am

With a quick check, I did not see the problem on x86_64 the rpc-server do not shock on password).

I can confirm tis is coming from base64 decoding wrong.
I have applied that simle patch

$this->bbcode_second_pass_code('', '
--- libtransmission/rpc-server.c 2022-02-14 11:47:49.994162577 +0100
+++ libtransmission/rpc-server.c 2022-02-14 11:47:37.225361472 +0100
@@ -669,6 +669,7 @@
}
}
}
+ tr_logAddNamedError(MY_NAME, "Decoded password is: %s\n", pass);

if (server->isPasswordEnabled && (pass == NULL || user == NULL || strcmp(server->username, user) != 0 ||
!tr_ssha1_matches(server->password, pass)))

')

It spits out in your transmission log the password decoded from 'Authenctication' header
And the rpc-server is wrong in tranmission-cli-3.00-3 WHEN there is padding implied in the incoming base64

I mean, the rpc-server does not decode correctly the password in authentication header (which is base64 encoded) and adds an extra '>' when there is padding (either = or ==) in coded base64 header

This explains why RuneArch's password was ok for 14 characters but 13 or 15. because 13 or 15 implies padding

transmission dev have patched libb64 for something like that at a quick lookint the code
Last edited by zebul666 on Mon Feb 14, 2022 2:47 pm, edited 1 time in total.
zebul666
 
Posts: 48
Joined: Fri Jul 10, 2015 4:55 pm

Re: transmission-cli 3.00-3 unauthroized user

Postby zebul666 » Mon Feb 14, 2022 11:53 am

To get around the bug, you need that your username and password does not give padding in base64. Like that:

$this->bbcode_second_pass_code('', '
$ echo -n 'muyser:mypass'|base64
bXV5c2VyOm15cGFzcw==
')
This has extra padding with '==' at the end. You dn't want that

but
$this->bbcode_second_pass_code('', '
echo -n 'muyser:password'|base64
bXV5c2VyOnBhc3N3b3Jk
')
will work until the bug is fixed

Something with 32 bits and 64 bits integers or something arch related ? But why broken too on aaarch64 then ?
zebul666
 
Posts: 48
Joined: Fri Jul 10, 2015 4:55 pm

Re: transmission-cli 3.00-3 unauthroized user

Postby zebul666 » Mon Feb 14, 2022 12:44 pm

@graysky

This is a bug in libb64 on armv7h (at least that is what I am testing against)

in examples directory of libb64, just run $this->bbcode_second_pass_code('', 'make'), and it will run a simple test.
on armv7h, it fails to decode 'aGVsbG8gd29ybGQ=' as 'hllo world' but instead decode it as 'hello world>'

$this->bbcode_second_pass_code('', '
~/libb64/trunk/src/libb64-1.2.1/examples$ make
makedepend -f- -g -Werror -pedantic -I../include c-example1.c c-example2.c 2> /dev/null 1> depend
cc -g -Werror -pedantic -I../include c-example1.c ../src/libb64.a -o c-example1
cc -g -Werror -pedantic -I../include c-example2.c ../src/libb64.a -o c-example2
./c-example1
encoded: aGVsbG8gd29ybGQ=
decoded: hello world>
c-example1: c-example1.c:101: main: Assertion `strcmp(input, decoded) == 0' failed.
')

this is the same extra '>' I saw in my transmission log when decoding my password

Edit:
There is working fork on github, may be switch to that one ? https://github.com/libb64/libb64
At least, one can find the patch needed to fix this, because the examples work correctly
There is some ARM specific commit to fix some bug on ARM.
Edit2:
confirming this is working with libb64-git
OK. I have uploaded a PKGBUILD on AUR for it: https://aur.archlinux.org/packages/libb64-git
zebul666
 
Posts: 48
Joined: Fri Jul 10, 2015 4:55 pm

Re: transmission-cli 3.00-3 unauthroized user

Postby RuneArch » Mon Feb 14, 2022 9:39 pm

In my case, this only occurs on ARM:

$this->bbcode_second_pass_code('', '$ uname -m
armv7l
')

And works on my laptop:

$this->bbcode_second_pass_code('', '$ uname -m
x86_64
')

Using the "mypassword" example from @zebul666, on my laptop, I set:

/var/lib/transmission/.config/transmission-daemon/settings.json :

$this->bbcode_second_pass_code('', '
"rpc-password": "mypassword",
')

I started transmission and could login successfully.

I stopped transmission and copied the SHA1SUM hash of the password over to the Raspberry Pi:

$this->bbcode_second_pass_code('', '
"rpc-password": "{414ccd07a67dcca4c8f0f3b94eb9683dfe564a37QqZBLUD4",
')

starting transmission, I am still unable to log in to the Ras Pi web interface.

Just to compare, rather than use the WebGUI, I tried with "transmission-remote"

This had the same outcome... ie the raspberry pi can successfully login to my laptop remotely, but my laptop is unable to login to the raspberry pi. This implies it's an issue with transmission "decoding" the password (comparing hashes)

Taking it 1 step further, I repeated the test with a 14 character password $this->bbcode_second_pass_code('', 'mypassword1234') (entered as plaintext on both laptop and raspberry pi) and both devices could authenticate against each other and themselves.

I haven't tried varying the password length ad nauseam, but "mypassword" fails on ARM and works on x64, whereas "mypassword1234" works on both.
RuneArch
 
Posts: 8
Joined: Fri Mar 27, 2020 10:23 am

Re: transmission-cli 3.00-3 unauthroized user

Postby RuneArch » Mon Feb 14, 2022 9:42 pm

Just to add, I noticed my Raspberry Pi was not 100% up to date... I've just updated and the issue remains the same.
RuneArch
 
Posts: 8
Joined: Fri Mar 27, 2020 10:23 am

Re: transmission-cli 3.00-3 unauthroized user

Postby RuneArch » Tue Feb 15, 2022 7:41 am

Well diagnosed @zebul666...

my username:password was double padded (==), so that appears to be the same problem

I have just tried your libb64 in the AUR and confirm that it works for me too .
RuneArch
 
Posts: 8
Joined: Fri Mar 27, 2020 10:23 am

Re: transmission-cli 3.00-3 unauthroized user

Postby eh8 » Sun Feb 20, 2022 4:44 am

Alternatively, you can just remove the $this->bbcode_second_pass_code('', '--enable-external-b64 line') in the PKGBUILD to have Transmission compile without using libb64.
eh8
 
Posts: 2
Joined: Tue Jan 05, 2021 1:52 am

Re: transmission-cli 3.00-3 unauthroized user

Postby jyno » Sat Feb 26, 2022 7:40 pm

The following passwords don't work:
$this->bbcode_second_pass_code('', '
[alarm@alarmpi ~]$ transmission-daemon -v uiyi675t6u345432ywytd5utu67ti7y78ym78y78y87y7i
[alarm@alarmpi ~]$ killall transmission-daemon
[alarm@alarmpi ~]$ transmission-daemon -v 897897i67u5nu5ry56ryeb54ey4eb4be55r45yy3hynjhni
[alarm@alarmpi ~]$ killall transmission-daemon
')

The following password DOES work:
$this->bbcode_second_pass_code('', '
[alarm@alarmpi ~]$ transmission-daemon -v 098k9775t6453323tgrvfnhgvbhgyjfndbfxbdz
')

The need to find a password that works, has never happened to me until the recent update. I'm using RPI3 for this.
jyno
 
Posts: 67
Joined: Wed May 05, 2021 4:37 pm

Re: transmission-cli 3.00-3 unauthroized user

Postby Michmich » Tue Mar 22, 2022 11:13 pm

Hi,

I installed libtransmission after transmission-cli 3.00-3. Now, it works fine.
I did not install the fork of lib664-git, transmission-cli 3.00-3 works file if we install libtransmission.

@graysky : the problem is that it's not marked as a dependency in the transmission-cli PKGBUILD, could you please add it ?

Or maybe should i report it mainstream ? But i read in this thread there no issue with the x64, only with ARM, so i do not know exactly what to do.

Thanks
Michmich
 
Posts: 1
Joined: Tue Mar 22, 2022 11:07 pm

Re: transmission-cli 3.00-3 unauthroized user

Postby zebul666 » Wed Mar 23, 2022 12:24 pm

@michmich This is weird what you are saying. libtransmission package contains only headers file and a static library that is not gonna be used by any binary in transmission-cli package.

What is acutally working after you installed libtransmission ?
Did you rebuild transmission-cli package, with libtransmission installed already ?
That would make more sense. That it workd after you rebuild the pacakge with libtransmission static lib installed...
zebul666
 
Posts: 48
Joined: Fri Jul 10, 2015 4:55 pm

Previous

Return to General

Who is online

Users browsing this forum: No registered users and 8 guests