openssh unix dev - Oct 2000 - Open connections when using agent-forwarding

Hi!

I have problems with connections being left open with both 2.2.0p1 and the
latest snapshot when using agent-forwarding. (I didn't use this with older
versions, so I don't know whether this problem is older.)

Scenario:
I have a secret key that I run with ssh-agent on host "host-A". I then
connect
to "host-B" using 'slogin -A host-B'. When executing a command
on "host-C"
(for which the secret key is needed), the command is executed fine, but
after finishing I cannot exit the slogin command:
host-A> slogin -A host-B
...
host-B> ssh host-C "ls -al"
... [output from ls -al command]
host-B> exit
logout
Waiting for forwarded connections to terminate...
The following connections are open:
  #2 accepted auth socket (t4 r0 i8/0 o16/0 fd 9/9)
  #3 accepted auth socket (t4 r1 i8/0 o16/0 fd 10/10)
I have to kill the "slogin -A host-B" process on "host-A" to
terminate the
session.

When connecting from host-B to host-D, for which RSA host authentication
is allowed (and hence my personal key not needed), only one connection
stays open.

I am not quite sure at which places to look for the problem, so I rather
send this bug report instead of providing a patch :-)

Best regards,
	Lutz
PS. Platform is HP-UX 10.20/OpenSSL 0.9.6 but it should not matter.
I have two keys (one RSA, one DSA) in ssh-agent; experiments carried out
with SSH-1 protocol only.
-- 
Lutz Jaenicke                             Lutz.Jaenicke at aet.TU-Cottbus.DE
BTU Cottbus               http://www.aet.TU-Cottbus.DE/personen/jaenicke/
Lehrstuhl Allgemeine Elektrotechnik                  Tel. +49 355 69-4129
Universitaetsplatz 3-4, D-03044 Cottbus              Fax. +49 355 69-4153

On Mon, Oct 02, 2000 at 01:47:02PM +0200, Lutz Jaenicke
wrote:
> host-A> slogin -A host-B
> ...
> host-B> ssh host-C "ls -al"
> ... [output from ls -al command]
> host-B> exit
> logout
> Waiting for forwarded connections to terminate...
> The following connections are open:
>   #2 accepted auth socket (t4 r0 i8/0 o16/0 fd 9/9)
>   #3 accepted auth socket (t4 r1 i8/0 o16/0 fd 10/10)
> I have to kill the "slogin -A host-B" process on
"host-A" to terminate the
> session.
> 
> When connecting from host-B to host-D, for which RSA host authentication
> is allowed (and hence my personal key not needed), only one connection
> stays open.
In the meantime I have strolled around through the code a little bit, even
though that I must state, that I am not completely sure that I understand
everything :-)

For me it seems, that when using the forward agent connections, the
authentication channels are opened on the host-B sshd and then closed
again, but only for reading:
debug1: channel 3: new [accepted auth socket]
debug1: channel 3: istate=1, ostate=16
debug1: channel 3: read<=0 rfd 12 len 0
debug1: channel 3: read failed
debug1: channel 3: input open -> drain
debug1: channel 3: close_read
debug1: channel 3: input: no drain shortcut
debug1: channel 3: ibuf empty
debug1: channel 3: input drain -> wait_oclose
debug1: channel 3: send ieof
debug1: channel 3: istate=4, ostate=16
debug1: channel 3: istate=4, ostate=16
debug1: channel 3: istate=4, ostate=16
debug1: channel 3: istate=4, ostate=16
debug1: channel 3: istate=4, ostate=16
debug1: channel 3: rcvd oclose
debug1: channel 3: input wait_oclose -> closed
debug1: channel 3: istate=8, ostate=16

(the istate=, ostate= I have added to
chan_delete_if_full_closed1()).
>From there it seems, that the ostate is always left at
#define CHAN_OUTPUT_OPEN                0x10
so that the channel will never be see channel_free(c->self).

Best regards,
	Lutz
-- 
Lutz Jaenicke                             Lutz.Jaenicke at aet.TU-Cottbus.DE
BTU Cottbus               http://www.aet.TU-Cottbus.DE/personen/jaenicke/
Lehrstuhl Allgemeine Elektrotechnik                  Tel. +49 355 69-4129
Universitaetsplatz 3-4, D-03044 Cottbus              Fax. +49 355 69-4153