Virtualbox + 5.13 problems

RouterOS General
1

Hello,

This is probably not RouterOS related, but I thought I would mention it.

SSTP in 5.13 doesn’t work in Virtualbox. 5.12 works however. 5.13 logs a bad peer version when I try to connect and displays a 619 error on the client screen.

I tested the same thing on Xen and it works well there… but that was a more modern CPU.

So I don’t know what to make out of it. I just wish it would work in Virtualbox as the previous versions… (and who knows, maybe this is an indication of a more serious problem - like using a command set not available in older CPU’s) so maybe someone can take a look into it? I’m willing to supply Supout if needed.

Thanks
GL

2

problem is already fixed in upcoming 5.14 and it will be released shortly.

3

Thanks.

I tested 5.14 in Virtualbox and got the same error in the logs.

I noticed however that it is not enough to run
/certificate reset-certificate-cache

after the downgrade, but it is required to decrypt the keys again. It was not obvious for me, but might be for others.

GL

4

security is somehow picky, hopefully now people will find your post on what you did to solve the issue. And give some karma for a useful post

5

Hello again,

You guys should start to pay me for the number of hidden bugs I have been finding lately :->
-if not in cash, but in licenses.

Anyhow. I tested SSTP on a number of X86 architectures … and here are the results

AMD Geode on a 10 year old WRAP board → SSTP OK
AMD Athlon 64 [several installations, including different versions of Virtualbox] → SSTP OK
Pentium 4 (old 478 socket) 2GHZ [installed on the hardware] → SSTP BAD PEER VERSION ERROR
Pentium 4 3GHZ (new 775 socket) [installed in Virtualbox] → SSTP BAD PEER VERSION ERROR
Celeron 2.8Ghz (new 775 socket) [installed in Virtualbox] → SSTP BAD PEER VERSION ERROR
Pentium E6300 [installed in Virtualbox] → SSTP OK

My conclusion is that your implementation of the new SSTP cypher (RC4) is somehow architecture dependent. It seems to work on all AMD processors, but only on newer Intels.

You can test it in 5 minutes. Just install 5.14 straight from ISO to an old P4.

Thanks.
GL