openssh bugs - May 2025 - [Bug 3827] New: UnusedConnectionTimeout hit early after ChannelTimeout

https://bugzilla.mindrot.org/show_bug.cgi?id=3827

            Bug ID: 3827
           Summary: UnusedConnectionTimeout hit early after ChannelTimeout
           Product: Portable OpenSSH
           Version: 9.6p1
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: alanthomasmt at gmail.com

Created attachment 3877
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3877&action=edit
Code to reproduce the issue

Conditions:
- Configure both UnusedConnectionTimeout and ChannelTimeout. I will
call the UnusedConnectionTimeout value as x and ChannelTimeout as y.
- Create an SSH connection and open a shell channel.
- Keep the channel idle.

Case 1: x <= y
- ChannelTimeout will be hit after y time. This is expected.
- But UnusedConnectionTimeout will be hit immediately after
ChannelTimeout. It did not wait for x time as expected.

Case 2: x > y 
- ChannelTimeout will be hit after y time. This is expected.
- But UnusedConnectionTimeout will be hit (x-y) time after
ChannelTimeout. It did not wait for x time as expected.

For example:
Case 1:
UnusedConnectionTimeout 5
ChannelTimeout =*10
Both UnusedConnectionTimeout and ChannelTimeout hit after 10 seconds.

Case 2:
UnusedConnectionTimeout 15
ChannelTimeout =*10
ChannelTimeout hits after 10 seconds. UnusedConnectionTimeout hits
after 5 seconds of channel timeout hits.
>From what I understand, the UnusedConnectionTimeout should only start
when the total channel count is zero. In the above case, the total
channel count will only become zero when the channel timeout is hit.
Hence, the connection timeout should wait for 15 seconds fully after
channel timeout.

The issue can be seen may not be visible with an openSSH client as
openSSH client disconnects on its own if channel count is zero.
I have used the attached python paramiko script to hit this.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3827

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned-bugs at mindrot.org |djm at mindrot.org
                 CC|                            |djm at mindrot.org,
                   |                            |dtucker at dtucker.net
   Attachment #3878|                            |ok?(dtucker at dtucker.net)
              Flags|                            |

--- Comment #1 from Damien Miller <djm at mindrot.org> ---
Created attachment 3878
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3878&action=edit
Ensure UnusedConnectionTimeout starts only when all channels closed

Thanks for the report. I think this should fix it

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3827

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3878|ok?(dtucker at dtucker.net)    |ok+
              Flags|                            |

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3827

????????? <gotov27 at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |enhancement
                 OS|Linux                       |All

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.