openssh unix dev - Sep 2008 - "on-the-fly" SSH Port Forwarding

Hi,

I am using the following version of OpenSSH for reference:

root at proxy:/root# ssh -V
OpenSSH_4.8, OpenSSL 0.9.7j 04 May 2006

root at proxy:/root# uname -a
OpenBSD proxy.localdomain 4.3 GENERIC#698 i386

I am developing an application which uses on-the-fly SSH port forwarding
by using the "~C" escape sequence to add local port forwards when
needed
(through Expect). It would appear that there is no option to remove
local port forwards and only remote port forwards:

ssh> -h
Commands:
      -L[bind_address:]port:host:hostport    Request local forward
      -R[bind_address:]port:host:hostport    Request remote forward
      -KR[bind_address:]port                 Cancel remote forward

I am hitting scalability issues as I am not able to cancel local
forwards and after about 251 tunnels I am unable to add any more. (I am
assuming this is platform/machine dependent as it complains about "No
buffer space").

How come there isn't an option to remove local forwards when there is to
remove remote ones? Is this by design or something that was never
implemented?

Thanks in advance,
Chris

On Sun, 7 Sep 2008, Chris Mason wrote:
> Hi,
> 
> I am using the following version of OpenSSH for reference:
> 
> root at proxy:/root# ssh -V
> OpenSSH_4.8, OpenSSL 0.9.7j 04 May 2006
> 
> root at proxy:/root# uname -a
> OpenBSD proxy.localdomain 4.3 GENERIC#698 i386
> 
> I am developing an application which uses on-the-fly SSH port forwarding
> by using the "~C" escape sequence to add local port forwards when
needed
> (through Expect). It would appear that there is no option to remove
> local port forwards and only remote port forwards:
> 
> ssh> -h
> Commands:
>       -L[bind_address:]port:host:hostport    Request local forward
>       -R[bind_address:]port:host:hostport    Request remote forward
>       -KR[bind_address:]port                 Cancel remote forward
> 
> I am hitting scalability issues as I am not able to cancel local
> forwards and after about 251 tunnels I am unable to add any more. (I am
> assuming this is platform/machine dependent as it complains about "No
> buffer space").
Could you please send a debug trace of this happening? ("ssh -vvv")
There is IIRC a fixed limit to the number of forwards that you can
establish, but it should give at least a more friendly error message.
> How come there isn't an option to remove local forwards when there is
to
> remove remote ones? Is this by design or something that was never
> implemented?
It was never implemented, but probably would be quite easy to do. 

Another option, which would probably be way better for your application
is to use the dynamic/SOCKS port forwarding and possibly a small helper
application.

Still another option is to implement addition/removal of port-forwards
via the control multiplexing socket. This has been on my TODO list for
quite a while.

-d