Extra pair of simple quote when using scp on IOS XR

[st3rk]

SUMMARY

sftp is not working with libssh on iosxr platform

ISSUE TYPE

• Bug Report

PYLISSH and LIBSSH VERSION

Name: ansible-pylibssh
Version: 1.2.3.dev286
Summary: Python bindings for libssh client specific to Ansible use case
Home-page: https://github.com/ansible/pylibssh
Author: Ansible, Inc.
Author-email: info+github/ansible/pylibssh@ansible.com
License: LGPLv2+

OS / ENVIRONMENT

IOS XR 24.3.2

STEPS TO REPRODUCE

- name: scp an RSA pub key to IOS XR
  hosts: ios_xrv
  connection: ansible.netcommon.network_cli
  gather_facts: no
  tasks:
    - name: push ssh key
      cisco.iosxr.iosxr_user:
        name: my_user_name
        public_key_contents: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDDOS/+yjcQRJ0yFV4Xb+9wMH57R1NR1avGy/ThWnBzl5ReWngUQyh42ChDonxuU0GDv8P+gtv4zaEGA5x4XcdkFvJJw4/FeV4vV3kOVgHmTOGqjg0mrYk3fF9i9CKkYyKrEq+qkU27OlwmU5ooVjjSCT4knPWiOudLquLmDV7tZLeUgecPNqK4bqtzdIyQyy1h50sENeBRe+ruB3xAK3WWF50T2GlMvMlZJhWFvjDs2zMd9hquf0KaMbHXe2/wlTydYFGJifDz4JWbFum9K8SHDjT8sJz4lkHYqkSHASApQ56m9cXI/rQj62CBDS6AEcGRBcNujpK8K+ab+dE4AYKeRHi06vAurgP2sygu6vuQ8D+98bERucjRmpWGOsGfPAt0XD7vXq1J1PP3c+o+ptUq9Ozaba3Ur6Oq1d5uWRL+O7ZOhKESbh60SNrqzSxBAkMqdc00VdGL2j8qZJ6qsbr1dPVDrG7TyS25tRKx+UcfvycyMMH+pn8itMNkOnRS3AQ9wUsoUy/+vcjLCjql7888eCier53LfvZsf0QJfAXfdZPXK+e8f2cRSQMsfe14SNNMdGqt3rNy9uG9aGuL+9NXAFjHUplB++q5Rf4+Epd+BsvZRkEEu9I6azCMsRRnDKSGq1oHg7qzVajr+JiLzssDKvy/M+ZtaUmtV2YfIcgN5w== my_user_key"

EXPECTED RESULTS

The SSH key should be scp to the IOS XR router, then added to the configuration.

ACTUAL RESULTS

The scp fails with this ansible error:

    "Error transferring file to /harddisk:/publickey_me.b64: Can't write to remote file: b'Remote channel is closed'

On the router, we can see these scp logs:

RP/0/RP0/CPU0:Sep  1 08:44:01.859 UTC: scp_server[66605]: main: priv:root-lr cisco-support
RP/0/RP0/CPU0:Sep  1 08:44:01.859 UTC: scp_server[66605]: main: Sink:'/harddisk:/publickey_my_user_name.b64'
RP/0/RP0/CPU0:Sep  1 08:44:01.859 UTC: scp_server[66605]: In main pipe descriptors fdin=127 fdout=130 parent_out=129 parent_in=128
RP/0/RP0/CPU0:Sep  1 08:44:01.925 UTC: scp_server[66605]: communication_handler entry
RP/0/RP0/CPU0:Sep  1 08:44:01.925 UTC: scp_server[66605]: communication_handler not disconnected
RP/0/RP0/CPU0:Sep  1 08:44:01.925 UTC: scp_server[66605]: Cannot modify system files/dir
RP/0/RP0/CPU0:Sep  1 08:44:01.925 UTC: scp_server[66605]: scpserver_download ends.[failure]

When manually copied with the command scp -O /tmp/my_public_key my-router-address:/harddisk:/publickey_me.b64, we have the output below:

RP/0/RP0/CPU0:Sep  1 10:36:53.224 UTC: scp_server[67804]: main: priv:root-lr cisco-support
RP/0/RP0/CPU0:Sep  1 10:36:53.224 UTC: scp_server[67804]: main: Sink:/harddisk:/publickey_my_user_name.b64
RP/0/RP0/CPU0:Sep  1 10:36:53.224 UTC: scp_server[67804]: In main pipe descriptors fdin=113 fdout=124 parent_out=123 parent_in=122 
RP/0/RP0/CPU0:Sep  1 10:36:53.275 UTC: scp_server[67804]: communication_handler entry 
RP/0/RP0/CPU0:Sep  1 10:36:53.275 UTC: scp_server[67804]: communication_handler not disconnected 
RP/0/RP0/CPU0:Sep  1 10:36:53.294 UTC: scp_server[67804]: Read Length 743 
RP/0/RP0/CPU0:Sep  1 10:36:53.294 UTC: scp_server[67804]: Updated Code  
RP/0/RP0/CPU0:Sep  1 10:36:53.294 UTC: scp_server[67804]: Path /harddisk:/publickey_my_user_name.b64 
RP/0/RP0/CPU0:Sep  1 10:36:53.294 UTC: scp_server[67804]: Local Full /harddisk:/publickey_my_user_name.b64 
RP/0/RP0/CPU0:Sep  1 10:36:53.294 UTC: scp_server[67804]: Successful read C0664 743 test 
RP/0/RP0/CPU0:Sep  1 10:36:53.305 UTC: scp_server[67804]: scpserver_download ends.[success]

It seems that pylibssh adds an extra pair of simple quotes around the destination path.

[Jakuje]

Thank you for the verbose report. Yeah, this is the libssh issue, I think part of hardening for the CVE-2019-14889:

https://www.libssh.org/2019/12/10/libssh-0-9-3-and-libssh-0-8-8-security-release/

Generally, the assumption we had back then was that the scp server is executed in a shell on the server side and the single quotes around the filename will get dropped by the shell, preventing any bash expansions, which could happen otherwise. I was not putting the patch together back then and I thought its consistent with the OpenSSH behavior, but I did not double-check. We might need to reconsider.

I recently filled the https://gitlab.com/libssh/libssh-mirror/-/issues/321 which is talking about the same issue as far as I understand it.

[st3rk]

It's indeed the same issue, thank you for the feedback.

[Jakuje]

@st3rk can you try with the following change in libssh if you have a simple way to build the stuff together:

https://gitlab.com/libssh/libssh-mirror/-/merge_requests/663

There is one more issue that the cisco devices does not seem to allow opening multiple channels so after checking the existence of the file, the upload fails regardless the above change.

ansible-collections/ansible.netcommon#674

But with these two changes, you should be able to put data to cisco devices using libssh again.