Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: OpenSSH: Dev

Dynamic port remote listener - a BUG?

 

 

OpenSSH dev RSS feed   Index | Next | Previous | View Threaded


qus123 at gmail

Sep 8, 2011, 8:24 AM

Post #1 of 4 (450 views)
Permalink
Dynamic port remote listener - a BUG?

Hello,

Today I tried using "dynamically assigned" port for remote listener, by
requesting listener on port 0. This is supposed to create a listener on a
port choosen by server. Everything seemed OK (the choosen port was sent back
to client), but forwarding was refused. So I checked the source.

in channels.c, function: channel_setup_fwd_listener

/*
* listen_port == 0 requests a dynamically allocated port -
* record what we got.
*/
if (type == SSH_CHANNEL_RPORT_LISTENER && listen_port == 0
&&
allocated_listen_port != NULL &&
*allocated_listen_port == 0) {
*allocated_listen_port = get_sock_port(sock, 1);
debug("Allocated listen port %d",
*allocated_listen_port);
}

/* Allocate a channel number for the socket. */
c = channel_new("port listener", type, sock, sock, -1,
CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
0, "port listener", 1);
c->path = xstrdup(host);
c->host_port = port_to_connect;
c->listening_port = listen_port;
success = 1;
}
if (success == 0)
error("channel_setup_fwd_listener: cannot listen to port:
%d",
listen_port);
freeaddrinfo(aitop);
return success;
}

As you see allocated_listen_port gets assigned to some free port, but
then... nothing more happens with allocated_listen_port, because
c->listening_port is set to listen_port, which in this case equals 0. (note
that listen_port IS NOT set to allocated_listen_port!)

But then again - I am not a programmer. So I might be wrong.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev


djm at mindrot

Sep 9, 2011, 3:18 AM

Post #2 of 4 (442 views)
Permalink
Re: Dynamic port remote listener - a BUG? [In reply to]

> Hello,
>
> Today I tried using "dynamically assigned" port for remote listener, by
> requesting listener on port 0. This is supposed to create a listener on a
> port choosen by server. Everything seemed OK (the choosen port was sent back
> to client), but forwarding was refused. So I checked the source.

it works for me on both portable and OpenBSD, with -R forwardings on
the initial ssh commandline or set up using -O forward.

> in channels.c, function: channel_setup_fwd_listener
>
> /*
> * listen_port == 0 requests a dynamically allocated port -
> * record what we got.
> */
> if (type == SSH_CHANNEL_RPORT_LISTENER && listen_port == 0
> &&
> allocated_listen_port != NULL &&
> *allocated_listen_port == 0) {
> *allocated_listen_port = get_sock_port(sock, 1);
> debug("Allocated listen port %d",
> *allocated_listen_port);
> }
>
> /* Allocate a channel number for the socket. */
> c = channel_new("port listener", type, sock, sock, -1,
> CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
> 0, "port listener", 1);
> c->path = xstrdup(host);
> c->host_port = port_to_connect;
> c->listening_port = listen_port;
> success = 1;
> }
> if (success == 0)
> error("channel_setup_fwd_listener: cannot listen to port:
> %d",
> listen_port);
> freeaddrinfo(aitop);
> return success;
> }
>
> As you see allocated_listen_port gets assigned to some free port, but
> then... nothing more happens with allocated_listen_port, because
> c->listening_port is set to listen_port, which in this case equals 0. (note
> that listen_port IS NOT set to allocated_listen_port!)
>
> But then again - I am not a programmer. So I might be wrong.

listen_port isn't used for all that much, the important thing is the
sock that is bound to the listening port.

-d
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev


djm at mindrot

Sep 9, 2011, 3:24 AM

Post #3 of 4 (444 views)
Permalink
Re: Dynamic port remote listener - a BUG? [In reply to]

On Fri, 9 Sep 2011, Damien Miller wrote:

>
> > Hello,
> >
> > Today I tried using "dynamically assigned" port for remote listener, by
> > requesting listener on port 0. This is supposed to create a listener on a
> > port choosen by server. Everything seemed OK (the choosen port was sent back
> > to client), but forwarding was refused. So I checked the source.
>
> it works for me on both portable and OpenBSD, with -R forwardings on
> the initial ssh commandline or set up using -O forward.

there is a bug in there though - is more than one -R 0:... foward is
created, the later ones will all direct their connections to the
destination specified for the first -R0 forward.

i'll look at it when i have slept...

-d
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev


djm at mindrot

Sep 9, 2011, 3:44 AM

Post #4 of 4 (447 views)
Permalink
Re: Dynamic port remote listener - a BUG? [In reply to]

On Fri, 9 Sep 2011, Damien Miller wrote:

> On Fri, 9 Sep 2011, Damien Miller wrote:
>
> >
> > > Hello,
> > >
> > > Today I tried using "dynamically assigned" port for remote listener, by
> > > requesting listener on port 0. This is supposed to create a listener on a
> > > port choosen by server. Everything seemed OK (the choosen port was sent back
> > > to client), but forwarding was refused. So I checked the source.
> >
> > it works for me on both portable and OpenBSD, with -R forwardings on
> > the initial ssh commandline or set up using -O forward.
>
> there is a bug in there though - is more than one -R 0:... foward is
> created, the later ones will all direct their connections to the
> destination specified for the first -R0 forward.
>
> i'll look at it when i have slept...

Couldn't get to sleep.

The problem is our s->c forwarded-tcpip channel opens use a listen_port
of 0, which causes client_request_forwarded_tcpip()->
channel_connect_by_listen_address() to always return the same destination.

So we should set c->listening_port, but we need to fix up permitted_opens
when we receive the open confirmation message otherwise the client will
refuse the requests. I think this will break backwards compat for -R 0...
forwardings from a new server (>=openssh-6.0) to an older client, since
the older clients expect a listen_port of 0 in the channel open messages.
We could do a compat.[ch] hack or live with the breakage...

-d
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

OpenSSH dev RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.