openssh bugs - Mar 2013 - [Bug 2079] New: openssh 6.1/6.2 disconnect due to channel bug

https://bugzilla.mindrot.org/show_bug.cgi?id=2079

            Bug ID: 2079
           Summary: openssh 6.1/6.2 disconnect due to channel bug
    Classification: Unclassified
           Product: Portable OpenSSH
           Version: 6.1p1
          Hardware: amd64
                OS: FreeBSD
            Status: NEW
          Severity: normal
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: emilliken at gmail.com

To reproduce:

in one terminal:
test$ ssh host -MS /tmp/test
<<do a full login>>

in a second terminal on the same machine (2.2.2.2 is an unresponsive
host):
test$ ssh 0 -S /tmp/test -W 2.2.2.2:22
^C << hit control-c >>
test$ ssh 0 -S /tmp/test -W 2.2.2.2:22
<<wait about 90 seconds for ssh to timeout and exit>>
test$ ssh 0 -S /tmp/test -W localhost:22

Now, the ssh from terminal one and two will exit immediately.  The
error in terminal 1 is:
channel_by_id: 3: bad id: channel free
Disconnecting: Received open failure for non-opening channel 3.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2079

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org

--- Comment #1 from Damien Miller <djm at mindrot.org> ---
There are a few problems here:

1) Not cancelling the delayed connect when the first slave connection
closes

2) Reusing channel IDs while there might still be operations pending on
the server for previously-closed ones

3) Disconnecting for something that could probably be ignored

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2079

--- Comment #2 from Eric <emilliken at gmail.com> ---
This fixes it for me on the openssh 6.1p1 tree:

change mux.c:226 from
if (sc->type != SSH_CHANNEL_OPEN) {

to:
if (sc->type != SSH_CHANNEL_OPEN && sc->type !=
SSH_CHANNEL_OPENING) {

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2079

Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at zip.com.au

--- Comment #3 from Darren Tucker <dtucker at zip.com.au> ---
the change in comment #2 looks reasonable to me

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2079

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED
             Blocks|                            |2076

--- Comment #4 from Damien Miller <djm at mindrot.org> ---
Fix applied - this will be in OpenSSH 6.3. Thanks!

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2079

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #5 from Damien Miller <djm at mindrot.org> ---
Close all resolved bugs after 7.3p1 release

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.