Netmiko: Cisco ASA SCP broken

[edurguti]

Trying to scp an image to asa and encountering an issue, the image is being uploaded successfully but netmiko throws an error, I'm guessing due to the new lfbff image doing additional checks.
The lfbff and SPA indicates it has FirePower IPS included in the image and this image is digitally signed which makes it tamper resistant, below is an output of a successful file transfer and it's output:

`.....[removed]asa992-32-lfbff-k8.SPA...!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

---

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Verifying file disk0:/asa992-32-lfbff-k8.SPA...
Computed Hash SHA2: d9b83d16cd493a213def1ec238f8e699
c908a0b4383e86fd09228635fe545f5a
76f8098392a0618e54e5724aa09ceb97
da5d46679d75784d7e785e5659e73d64

Embedded Hash SHA2: d9b83d16cd493a213def1ec238f8e699
c908a0b4383e86fd09228635fe545f5a
76f8098392a0618e54e5724aa09ceb97
da5d46679d75784d7e785e5659e73d64

Digital signature successfully validated

Writing file disk0:/asa992-32-lfbff-k8.SPA...

111505136 bytes copied in 391.310 secs (285179 bytes/sec)`

Netmiko throws below error after successfully uploading the file:

Copying: asa992-32-lfbff-k8.SPA to: MUCAZ-ASA5516-01: 100%|##########| 112M/112M [48:15<00:00, 48.8kb/s] Traceback (most recent call last): File "asa.py", line 332, in <module> device.upgrade() File "asa.py", line 310, in upgrade self.copy_with_progress() File "asa.py", line 242, in copy_with_progress self.ft.scp_client.put(source, dest) File "/Library/Python/2.7/site-packages/scp.py", line 154, in put self._send_files(files) File "/Library/Python/2.7/site-packages/scp.py", line 250, in _send_files self._send_file(fl, name, mode, size) File "/Library/Python/2.7/site-packages/scp.py", line 276, in _send_file self._recv_confirm() File "/Library/Python/2.7/site-packages/scp.py", line 349, in _recv_confirm raise SCPException('Invalid response from server', msg) scp.SCPException: ('Invalid response from server', 'Computed Hash SHA2: d9b83d16cd493a213def1ec238f8e699\r\n c908a0b4383e86fd09228635fe545f5a\r\n 76f8098392a0618e54e5724aa09ceb97\r\n da5d46679d75784d7e785e5659e73d64\r\n \r\nEmbedded Hash SHA2: d9b83d16cd493a213def1ec238f8e699\r\n c908a0b4383e86fd09228635fe545f5a\r\n 76f8098392a0618e54e5724aa09ceb97\r\n da5d46679d75784d7e785e5659e73d64\r\n \r\n\r\nDigital signat')

I'm guessing the output is not expected in netmiko logic.

[tonypnode]

Cursory look seems like this exception is being thrown by scp, not netmiko. Line 370 in JBardin's repo/scp.py will raise this response if there is a message response but doesn't meet only a few criteria.

    def _recv_confirm(self):
        # read scp response
        msg = b''
        try:
            msg = self.channel.recv(512)
        except SocketTimeout:
            raise SCPException('Timeout waiting for scp response')
        # slice off the first byte, so this compare will work in py2 and py3
        if msg and msg[0:1] == b'\x00':
            return
        elif msg and msg[0:1] == b'\x01':
            raise SCPException(asunicode(msg[1:]))
        elif self.channel.recv_stderr_ready():
            msg = self.channel.recv_stderr(512)
            raise SCPException(asunicode(msg))
        elif not msg:
            raise SCPException('No response from server')
        else:
            raise SCPException('Invalid response from server', msg)

You may be able to catch this error specifically and ignore it, or see there is a PR that would fix it on JBardin's.

Just a cursory look. I'm no expert.

Posting your asa.py? Could be helpful for others (smarter than me) to see what might be possible.

[tonypnode]

I suppose we might be able to add error handeling on the scp_transfer_file and scp_put_file to account for this, but I don't know if that's the direction @ktbyers wants to go with his implementation.

Leave it up to the user to implement this check? But you would just be throwing an exception that is already thrown. I don't know.

Or

Add in a catch that fixes this specific problem since it affects your user base.

the last scp repo commit was 4 months ago. He is returning the actual message in the exception, so we could key off that and account for it in netmiko, if that was the intention.

[tonypnode]

@carlniger I can try and poke at this if you give me an idea of the intent.

[carlmontanari]

@tonypnode that'd be great if you have access to a recent ASA/version! I think from what @edurguti posted and said in Slack its just having a bad day at checking the checksum once the files copy over, but I haven't looked too closely. If you dig in and run into any issues feel free to bug us and we can try to help! (here or on Slack)

[eakikel]

I think this is the same as my bug dealing with Arista
SCP.py times out too quickly on Secure Copy of large files

[carlmontanari]

@eakikel thanks for that -- hopefully in next few weeks we'll have some time to dig in and take a peak. if you have time and feel up to it PRs are welcome of course!

[edurguti]

Actually, the file gets copied/transferred successfully, just the output is different on cisco ASA 5515 than ASA55616, the new version has an extra "image check" at the end, so I'm thinking netmiko is confused what "copied successfully looks like".

I'll look into the code to see if I can figure out, although I'm quite novice on this.