Authentication not working on iperf3 3.9 (cJSON 1.7.13)

[pandafy]

I have installed the iperf3 package on Debian 11 from Debian's repository and configured it to run as a server with the following command

iperf3 --server --port 5201 --rsa-private-key-path <path-to-private-key> --authorized-users-path <path-to-credentials-csv> --pidfile iperf.pid 

I get iperf3: error - test authorization failed when I run the iperf3 test from my laptop with the following command:

IPERF3_PASSWORD="<iperf3-password>" iperf3 -c iperfserver.example.com -p 5201 -t 10 --username "<iperf3-username>" --rsa-public-key-path <path-to-public-key> -b 0 -J

I have double-checked the RSA keys and re-created credentials.csv. In an attempt to debug this issue, I also ran the iperf3 server with the --debug flag.

-----------------------------------------------------------
Server listening on 5201
-----------------------------------------------------------
get_parameters:
{
	"tcp":	true,
	"omit":	0,
	"time":	10,
	"parallel":	1,
	"len":	131072,
	"pacing_timer":	1000,
	"authtoken":	"<REDACTED>",
	"client_version":	"3.10.1"
}
Auth Token Content:
user: <iperf3-username>"
pwd:  <iperf3-password>"
ts:   1665995569
Auth Token Credentials:
--> openwisp aLa8quoo4E
Authentication failed for user 'openwisp' ts 1665995569
iperf3: error - test authorization failed

I have also tried installing different versions of the iperf3 package from https://iperf.fr/iperf-download.php#ubuntu, but I keep running into this error.

I also tried running the client command from different devices but got no luck.

Note: If I execute the client command from the same machine (i.e. the machine on which iperf3 is running in the server mode) using the public IP address, then I don't run into this authentication issue and iperf3 test runs as expected.

# iperf3 --version
iperf 3.9 (cJSON 1.7.13)
Linux openwisp-staging 5.10.0-18-cloud-amd64 #1 SMP Debian 5.10.140-1 (2022-09-02) x86_64
Optional features available: CPU affinity setting, IPv6 flow label, SCTP, TCP congestion algorithm setting, sendfile / zerocopy, socket pacing, authentication

[davidBar-On]

Note: If I execute the client command from the same machine (i.e. the machine on which iperf3 is running in the server mode) using the public IP address, then I don't run into this authentication issue and iperf3 test runs as expected.

Not sure what you mean by using the public IP address, as usually when running the client and server of the same machine, -c localhost can be used.

If the point is that the tests works o.k. when both run on the same machine, then it may be that difference between the timers on the server and client machines is greater then 10 seconds (I am not sure if Timezone is taken into account). If this is the problem, then setting --time-skew-threshold to a value greater then the difference should help.

[pandafy]

Not sure what you mean by using the public IP address, as usually when running the client and server of the same machine, -c localhost can be used.

This was to emphasise that the firewall is not blocking the iperf3 traffic.

then it may be that difference between the timers on the server and client machines is greater then 10 seconds (I am not sure if Timezone is taken into account). If this is the problem, then setting --time-skew-threshold to a value greater then the difference should help.

It turns out that the time on the server machine was lagging. I synchronised the system time of both the machines. The authentication is still failing. The iperf3 package does not recognise --time-skew-threshold flag.

[davidBar-On]

The iperf3 package does not recognise --time-skew-threshold flag.

I now see that this option was added only in 3.10. In 3.9 the check is that the time difference is not more than 10 seconds.

I synchronised the system time of both the machines. The authentication is still failing

PR #1056 fixed a time related issue for 32-bits machines. It was also added only to 3.10. If this is relevant to your machine you should use 3.10 or higher version.

The only other suggestions I have are:

1. Make sure that the time is really synchronized, including the timezone.
2. Verify that the first line in <path-to-credentials-csv> that does not start with # (not a comment line) is in the form <iperf3-username>,<iperf3-password> or <iperf3-username>,<iperf3-password>, .....

[pandafy]

Installing iperf3 from the GitHub repository solved the issue. The packages in the Debian repositories are outdated. Thank you very much for the help.