openssh unix dev - Aug 2005 - Hung ssh client connection

Hi guys,

I am running with: "OpenSSH_3.9p1 Debian-1ubuntu2, OpenSSL 0.9.7e 25 Oct
2004", as an ssh client, and am having some strange behaviour with a
firewall of ours.

We have a netscreen 5gt-plus, running ScreenOS 5.0.2, which has an ssh
daemon running.

I ssh to the firewall using `ssh username@<ip address>`, which works
correctly (ie, connects, and I can use the console of the firewall).

If I restart the firewall using the command 'reset', I get a message
that the firewall is resetting, which is good.

Now, the SSH client is hung, CTRL-C, CTRL-Z, CTRL-] don't do anything at
all.

Attaching strace:

root@<hostname>:~ # strace -p 28530
Process 28530 attached - interrupt to quit
select(7, [3 4], [], NULL, NULL <


It seems to be sitting there waiting for keyboard input, so as a last
resort, I try CTRL-~ which then disconnects (with a time out)!

Read from remote host <ip address>: Connection timed out
Connection to <ip address> closed.

What could be the cause of this connection 'hanging' ? Is it on the SSH
client, the SSH server not closing the connection correctly upon reset ?
 Or could it be something in the TCP OS layer ?

If it is expected behaviour, I apologize, though would like to
understand why this is happening on a technical level.

I am running:
# uname -a
Linux packrat 2.6.10-5-686-smp #1 SMP Tue Jun 7 09:34:54 UTC 2005 i686
GNU/Linux

which comes with glibc-2.3.2

Thanks in advance,

Damien

Damien Mascord wrote:
> We have a netscreen 5gt-plus, running ScreenOS 5.0.2, which has an ssh
> daemon running.
[...]
> If I restart the firewall using the command 'reset', I get a
message
> that the firewall is resetting, which is good.
[...]
> What could be the cause of this connection 'hanging' ? Is it on the
SSH
> client, the SSH server not closing the connection correctly upon reset ?
>  Or could it be something in the TCP OS layer ?
When you "reset" your firewall, it flushes its state table, right?  If
so then would probably include the SSH TCP connection too.

One place this might show up is in "netstat" on the client: if
there's a
constant value in the "Send-Q" column for the ssh connection to your 
firewall then that's almost certainly what's happening.
> If it is expected behaviour, I apologize, though would like to
> understand why this is happening on a technical level.
If connections *to* the firewall (as opposed to *through* it) are 
subject the the firewall rules and unless it has the capability to 
re-learn established connections then it's the behaviour I would expect.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.