openssh unix dev - Jun 2006 - [PATCH] openssh pseudo-terminal bug

hello

short description:
ssh client sends a wrong all-zero terminal info when requesting forced
pseudo-terminal
allocation while stdin is not a terminal.
sshd then sets the terminals ospeed to 0 because it receives this information
from the
client. on solaris this means that the pseudo-terminal is closed and output of
any
remote command is dropped.

longer description:
what we're doing is connecting to from host A to host C via host B. from
host
A to host B public key authentication is used, between host B and C password
autentication is used because public key is not possible.
(hostA is either tru64 with commercial SSH (working) or solaris 10 with openssh
 (non-working), hostB is always solaris 10, hostC is an embedded system)

	A -> (public key auth) -> B -> (password auth) -> C

what we're doing from host A is basically:
	ssh -a -x -t -t -l userB hostB ssh -a -x -l userC hostC

this command is inkoved from within a daemon. stdin/stdout of the command
are pipes to the daemon (pipe()/fork()/exec()).

now, when hostA is running commercial SSH everything works fine. but when using
openssh as client no data is received from the ssh invoked on hostB.
communication
to hostC is not working.

the ssh client on hostA is sending terminal info towards hostB when requesting
forced pseudo-terminal allocation ( -t -t ). now as long as STDIN on hostA is
a terminal everything works fine. but if STDIN is a pipe the ssh client wrongly
sends an all zero terminal info to the server.

attached is a diff between the server logs on hostB when connecting with
commercial
ssh (-) and when connection with openssh (+).

also attached is small patch which fixes the problem. it makes sure that the
terminal
info passed to tty_make_modes() is valid and not all zero. it should not change
behaviour in any other case.

comments?

rgds
-daniel

--------------------------------------------------------------
Daniel Ritz
Software Engineer
Alcatel Schweiz AG
OP-CCBS-OSS
Friesenbergstrasse 75, CH-8055 Z?rich

email    daniel.ritz at alcatel.ch
web      http://www.alcatel.ch
--------------------------------------------------------------

RITZ, Daniel wrote:
> attached is a diff between the server logs on hostB when connecting with
commercial
> ssh (-) and when connection with openssh (+).
Your diff was stripped by the mailing list software (it only accepts
attachments that are of MIME-type text/*). Could you please resend it
or create a bug at http://bugzilla.mindrot.org/ and attach it?

Thanks,
Damien Miller

> RITZ, Daniel wrote:
> > attached is a diff between the server logs on hostB when connecting
with
> > commercial 
> > ssh (-) and when connection with openssh (+).
> 
> Your diff was stripped by the mailing list software (it only accepts
> attachments that are of MIME-type text/*). Could you please resend it
> or create a bug at http://bugzilla.mindrot.org/ and attach it?
> 
ok, next try with a sane mailer...the log diff as attachement, the patch
inline...

rgds
-daniel

--- openssh-4.3p2/ttymodes.c~	2006-06-19 17:39:52.000000000 +0200
+++ openssh-4.3p2/ttymodes.c	2006-06-19 17:41:30.000000000 +0200
@@ -292,6 +292,9 @@
 	}
 
 	if (tiop == NULL) {
+		if (fd == -1)
+			goto end;
+
 		if (tcgetattr(fd, &tio) == -1) {
 			logit("tcgetattr: %.100s", strerror(errno));
 			goto end;
--- openssh-4.3p2/clientloop.c~	2006-06-19 17:27:58.000000000 +0200
+++ openssh-4.3p2/clientloop.c	2006-06-19 17:38:22.000000000 +0200
@@ -1862,6 +1862,7 @@
 	if (want_tty) {
 		struct winsize ws;
 		struct termios tio;
+		struct termios *tmptiop = NULL;
 
 		/* Store window size in the packet. */
 		if (ioctl(in_fd, TIOCGWINSZ, &ws) < 0)
@@ -1873,8 +1874,14 @@
 		packet_put_int(ws.ws_row);
 		packet_put_int(ws.ws_xpixel);
 		packet_put_int(ws.ws_ypixel);
-		tio = get_saved_tio();
-		tty_make_modes(-1, tiop != NULL ? tiop : &tio);
+
+		tmptiop = tiop;
+		if ((tmptiop == NULL) && get_saved_tio_valid()) {
+			tio = get_saved_tio();
+			tmptiop = &tio;
+		}
+
+		tty_make_modes(-1, tmptiop);
 		packet_send();
 		/* XXX wait for reply */
 		c->client_tty = 1;
--- openssh-4.3p2/sshpty.h~	2006-06-19 17:32:21.000000000 +0200
+++ openssh-4.3p2/sshpty.h	2006-06-19 17:32:43.000000000 +0200
@@ -17,6 +17,7 @@
 #ifndef SSHPTY_H
 #define SSHPTY_H
 
+int	 get_saved_tio_valid(void);
 struct termios get_saved_tio(void);
 void	 leave_raw_mode(void);
 void	 enter_raw_mode(void);
--- openssh-4.3p2/sshtty.c~	2006-06-19 17:29:53.000000000 +0200
+++ openssh-4.3p2/sshtty.c	2006-06-19 17:31:29.000000000 +0200
@@ -40,9 +40,16 @@
 #include "sshpty.h"
 #include "log.h"
 
+static int _saved_tio_valid;
 static struct termios _saved_tio;
 static int _in_raw_mode = 0;
 
+
+int get_saved_tio_valid(void)
+{
+	return _saved_tio_valid;
+}
+
 struct termios
 get_saved_tio(void)
 {
@@ -70,6 +77,7 @@
 		return;
 	}
 	_saved_tio = tio;
+	_saved_tio_valid = 1;
 	tio.c_iflag |= IGNPAR;
 	tio.c_iflag &= ~(ISTRIP | INLCR | IGNCR | ICRNL | IXON | IXANY | IXOFF);
 #ifdef IUCLC
-------------- next part --------------
A non-text attachment was scrubbed...
Name: log-com-open.diff
Type: text/x-diff
Size: 3178 bytes
Desc: not available
Url :
http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20060621/1c9317ec/attachment.bin