Commands takes 10 seconds to execute on BMC that do not support GetChannelCipherSuites #2

canteuni commented 2023年06月16日 12:19:47 +02:00

Describe the bug
Commands hangs for 10 seconds before printing Unable to get Channel Cipher Suites, then perform normally but the return code is still 1 whereas the command succeed ...

IPMITOOL Version

$ ipmitool -V
ipmitool version 1.8.19

To Reproduce
Steps to reproduce the behavior:

1. Using hardware OCP Leopard with BMC firmware from Quanta
2. Run ipmitool -I lanplus -H xxx -U xxx -P xxx lan print
3. Observe the abnormal reply: the command waits 10 seconds before printing Unable to get Channel Cipher Suites and then the rest of the command ouptut. I can speed-up the process by specifying a cipher suite like so :

   ipmitool -I lanplus -C 3 -H xxx -U xxx -P xxx lan print
   Set in Progress : Set Complete
   Auth Type Support : NONE MD2 MD5 PASSWORD 
   Auth Type Enable : Callback : NONE MD2 MD5 PASSWORD 
    : User : NONE MD2 MD5 PASSWORD 
    : Operator : NONE MD2 MD5 PASSWORD 
    : Admin : NONE MD2 MD5 PASSWORD 
    : OEM : 
   IP Address Source : DHCP Address
   IP Address : x.x.x.x
   Subnet Mask : 255.255.255.0
   MAC Address : xx:xx:xx:xx:xx:Xx
   SNMP Community String : public
   IP Header : TTL=0x00 Flags=0x00 Precedence=0x00 TOS=0x00
   

But the major issue here is that the return code of the command is 1 even if it outputs the correct lan information (except for the cipher suite part)

echo $?
1

Expected behavior
Well the command should not wait for 10 seconds, and should not return a code of 1 when the only part that failed is the "GetChannelCipherSuites" command because the rest of the actual command returned successfully.

Additional context
I did not have this problem on version 1.8.18. There are actually 2 problems here : the 10s timeout and the wrong return code.

**Describe the bug** Commands hangs for 10 seconds before printing `Unable to get Channel Cipher Suites`, then perform normally but the return code is still 1 whereas the command succeed ... **IPMITOOL Version** ```none $ ipmitool -V ipmitool version 1.8.19 ``` **To Reproduce** Steps to reproduce the behavior: 1. Using hardware OCP Leopard with BMC firmware from Quanta 2. Run `ipmitool -I lanplus -H xxx -U xxx -P xxx lan print` 3. Observe the abnormal reply: the command waits 10 seconds before printing `Unable to get Channel Cipher Suites` and then the rest of the command ouptut. I can speed-up the process by specifying a cipher suite like so : ```none ipmitool -I lanplus -C 3 -H xxx -U xxx -P xxx lan print Set in Progress : Set Complete Auth Type Support : NONE MD2 MD5 PASSWORD Auth Type Enable : Callback : NONE MD2 MD5 PASSWORD : User : NONE MD2 MD5 PASSWORD : Operator : NONE MD2 MD5 PASSWORD : Admin : NONE MD2 MD5 PASSWORD : OEM : IP Address Source : DHCP Address IP Address : x.x.x.x Subnet Mask : 255.255.255.0 MAC Address : xx:xx:xx:xx:xx:Xx SNMP Community String : public IP Header : TTL=0x00 Flags=0x00 Precedence=0x00 TOS=0x00 ``` But the major issue here is that the return code of the command is 1 even if it outputs the correct lan information (except for the cipher suite part) ```none echo $? 1 ``` **Expected behavior** Well the command should not wait for 10 seconds, and should not return a code of 1 when the only part that failed is the "GetChannelCipherSuites" command because the rest of the actual command returned successfully. **Additional context** I did not have this problem on version 1.8.18. There are actually 2 problems here : the 10s timeout and the wrong return code.

vmauery commented 2023年11月03日 19:25:17 +01:00

Odd that your BMC does not support that command; it is marked mandatory in the IPMI spec for any system that supports RMCP+.

Can you post the output of: ipmitool -I lanplus -vvvvvvv -H xxx -U xxx -P xxx lan print

This may provide more info for what is going on.

Odd that your BMC does not support that command; it is marked mandatory in the IPMI spec for any system that supports RMCP+. Can you post the output of: ipmitool -I lanplus -vvvvvvv -H xxx -U xxx -P xxx lan print This may provide more info for what is going on.

canteuni commented 2025年01月31日 12:33:08 +01:00

Sorry for the (very) late reply, at first I thought issues were still on GitHub, then I lost my account on codeberg and had issues recovering it.

Update on this issue :

• it works fine with IPMI v1.5 (without the -I lanplus)
• the return code of the command is 0 now so I have no issue with this
• but I still have the Unable to get Channel Cipher Suites message and the command takes 10 seconds to execute
• the command seems to work fine (no 10 second delay) if I add the cipher in argument -C 3

You can find in attached "ipmitool.log" file the oucput of ipmitool -I lanplus -vvvvvvv lan print

In addition, here is the output of ipmitool -I lanplus channel getciphers ipmi 1 :

Unable to Get Channel Cipher Suites
ID IANA Auth Alg Integrity Alg Confidentiality Alg
0 N/A none none none 
1 N/A hmac_sha1 none none 
2 N/A hmac_sha1 hmac_sha1_96 none 
3 N/A hmac_sha1 hmac_sha1_96 aes_cbc_128 
6 N/A hmac_md5 none none 
7 N/A hmac_md5 hmac_md5_128 none 
8 N/A hmac_md5 hmac_md5_128 aes_cbc_128 
11 N/A hmac_md5 md5_128 none 
12 N/A hmac_md5 md5_128 aes_cbc_128 
15 N/A hmac_sha256 none none 
16 N/A hmac_sha256 sha256_128 none 
17 N/A hmac_sha256 sha256_128 aes_cbc_128 

Sorry for the (very) late reply, at first I thought issues were still on GitHub, then I lost my account on codeberg and had issues recovering it. Update on this issue : - it works fine with IPMI v1.5 (without the `-I lanplus`) - the return code of the command is 0 now so I have no issue with this - but I still have the `Unable to get Channel Cipher Suites` message and the command takes 10 seconds to execute - the command seems to work fine (no 10 second delay) if I add the cipher in argument `-C 3` You can find in attached "ipmitool.log" file the oucput of `ipmitool -I lanplus -vvvvvvv lan print` In addition, here is the output of `ipmitool -I lanplus channel getciphers ipmi 1` : ``` Unable to Get Channel Cipher Suites ID IANA Auth Alg Integrity Alg Confidentiality Alg 0 N/A none none none 1 N/A hmac_sha1 none none 2 N/A hmac_sha1 hmac_sha1_96 none 3 N/A hmac_sha1 hmac_sha1_96 aes_cbc_128 6 N/A hmac_md5 none none 7 N/A hmac_md5 hmac_md5_128 none 8 N/A hmac_md5 hmac_md5_128 aes_cbc_128 11 N/A hmac_md5 md5_128 none 12 N/A hmac_md5 md5_128 aes_cbc_128 15 N/A hmac_sha256 none none 16 N/A hmac_sha256 sha256_128 none 17 N/A hmac_sha256 sha256_128 aes_cbc_128 ```

canteuni commented 2025年01月31日 15:21:45 +01:00

Here I use a compiled version of ipmitool with last commit to be sure :

# ipmitool -V
ipmitool version 1.8.19.37.gabaddb8

The BMC can respond when I perform a raw "Get Channel Cpiger Suites Command" so it does support this feature, but ipmitool keep saying that it is Unable to get Channel Cipher Suites :

# ipmitool -I lanplus -U ... raw 0x06 0x54 0x01 0x00 0x00
Unable to Get Channel Cipher Suites
 01 01 40 41 80 81
# ipmitool -I lanplus -U ... raw 0x06 0x54 0x01 0x00 0x80
Unable to Get Channel Cipher Suites
 01 c0 00 00 40 80 c0 01 01 40 80 c0 02 01 41 80
 c0

So it seems the problem is that ipmitool report that it could not get Chanel Cipher Suites whereas in fact the BMC supports it ?

Here I use a compiled version of `ipmitool` with last commit to be sure : ``` # ipmitool -V ipmitool version 1.8.19.37.gabaddb8 ``` The BMC can respond when I perform a raw "Get Channel Cpiger Suites Command" so it does support this feature, but `ipmitool` keep saying that it is `Unable to get Channel Cipher Suites` : ``` # ipmitool -I lanplus -U ... raw 0x06 0x54 0x01 0x00 0x00 Unable to Get Channel Cipher Suites 01 01 40 41 80 81 # ipmitool -I lanplus -U ... raw 0x06 0x54 0x01 0x00 0x80 Unable to Get Channel Cipher Suites 01 c0 00 00 40 80 c0 01 01 40 80 c0 02 01 41 80 c0 ``` So it seems the problem is that `ipmitool` report that it could not get Chanel Cipher Suites whereas in fact the BMC supports it ?

AlexanderAmelkin commented 2025年11月12日 19:32:17 +01:00

As with most hardware-specific problems, I have no way to debug it. I'm willing to accept a PR though if you provide one.

As with most hardware-specific problems, I have no way to debug it. I'm willing to accept a PR though if you provide one.