https://jira.opendaylight.org This file is an XML representation of an issue en-us 8.20.10 820010 22-06-2022 https://jira.opendaylight.org/browse/NETCONF-887 netconf <p>Exception is thrown when devices with old kex algorithms (SHA1) try to callhome to ODL.</p> <p>This issue looks similar to fixed <a href="https://jira.opendaylight.org/browse/NETCONF-765" title="Auth failed - Unable to negotiate key exchange for kex algorithms" class="issue-link" data-issue-key="NETCONF-765"><del>NETCONF-765</del></a> (SHA1 Nodes working properly if we add them without callhome) and probably related to disabled SHA1 algorithm  in Mina SSHD since 2.6.0, but some devices cannot be upgraded with new SSH modules (i.e. use new KEX algorithms ).</p> <p> </p> <p>debug.log details : </p> <div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent"> <pre class="code-java"> 2022-06-18T19:40:33.297Z||entLoopGroup-4-1|INFO |LoggingHandler                  |72 - io.netty.common - 4.1.69.Final|[id: 0x4914be67, L:/0.0.0.0:6666] READ: [id: 0x5d01a013, L:/10.233.72.16:6666 - R:/10.233.64.27:64288] 2022-06-18T19:40:33.299Z||entLoopGroup-4-1|INFO |LoggingHandler                  |72 - io.netty.common - 4.1.69.Final|[id: 0x4914be67, L:/0.0.0.0:6666] READ COMPLETE 2022-06-18T19:40:33.308Z||entLoopGroup-4-1|WARN |ClientSessionImpl               |402 - org.opendaylight.netconf.shaded-sshd - 2.0.11|exceptionCaught(ClientSessionImpl[<span class="code-keyword">null</span>@/10.233.64.27:64288])[state=Opened] SshException: Unable to negotiate key exchange <span class="code-keyword">for</span> kex algorithms (client: ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group18-sha512,diffie-hellman-group17-sha512,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,ext-info-c / server: diffie-hellman-group14-sha1,diffie-hellman-group1-sha1) 2022-06-18T19:40:33.308Z||entLoopGroup-4-1|INFO |ClientSessionImpl               |402 - org.opendaylight.netconf.shaded-sshd - 2.0.11|Disconnecting(ClientSessionImpl[<span class="code-keyword">null</span>@/10.233.64.27:64288]): SSH2_DISCONNECT_KEY_EXCHANGE_FAILED - Unable to negotiate key exchange <span class="code-keyword">for</span> kex algorithms (client: ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group18-sha512,diffie-hellman-group17-sha512,diffie-hellman-group16-sha512,diffie-hellman-group15-sha512,diffie-hellman-group14-sha256,ext-info-c / server: diffie-hellman-group14-sha1,diffie-hellman-group1-sha1) </pre> </div></div> <p> </p> NETCONF-887

Netconf callhome failed for devices with old KEX algorithms (SHA1)

Bug High Resolved Done Peter Suna Evgenii Limonov pt Sat, 18 Jun 2022 20:21:32 +0000 Mon, 30 Jan 2023 16:05:40 +0000 Mon, 30 Jan 2023 16:05:40 +0000 2.0.11 3.0.0 4.0.0 5.0.0 2.0.17 3.0.8 4.0.5 5.0.1 3.0.9 4.0.6 5.0.2 netconf 0 4 <p>Yeah, seems like call home is doing its own thing and not using NetconfSshClient.</p> <p>Yes, NetconfCallHomeServerBuilder is using:</p> <div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent"> <pre class="code-java"><span class="code-keyword">private</span> SshClient sshClient() { <span class="code-keyword">return</span> sshClient != <span class="code-keyword">null</span> ? sshClient : defaultSshClient(); } <span class="code-keyword">private</span> <span class="code-keyword">static</span> SshClient defaultSshClient() { <span class="code-keyword">return</span> SshClient.setUpDefaultClient(); }</pre> </div></div> <p>Lets reuse solution from <a href="https://jira.opendaylight.org/browse/NETCONF-765" title="Auth failed - Unable to negotiate key exchange for kex algorithms" class="issue-link" data-issue-key="NETCONF-765"><del>NETCONF-765</del></a>.</p> Blocks NETCONF-942 Relates NETCONF-765 Development Rank 0|i042l3: