openssh unix dev - Sep 2011 - Dynamic port remote listener - a BUG?

Hello,

Today I tried using "dynamically assigned" port for remote listener,
by
requesting listener on port 0. This is supposed to create a listener on a
port choosen by server. Everything seemed OK (the choosen port was sent back
to client), but forwarding was refused. So I checked the source.

in channels.c, function: channel_setup_fwd_listener

                /*
                 * listen_port == 0 requests a dynamically allocated port -
                 * record what we got.
                 */
                if (type == SSH_CHANNEL_RPORT_LISTENER && listen_port ==
0
&&
                    allocated_listen_port != NULL &&
                    *allocated_listen_port == 0) {
                        *allocated_listen_port = get_sock_port(sock, 1);
                        debug("Allocated listen port %d",
                            *allocated_listen_port);
                }

                /* Allocate a channel number for the socket. */
                c = channel_new("port listener", type, sock, sock, -1,
                    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
                    0, "port listener", 1);
                c->path = xstrdup(host);
                c->host_port = port_to_connect;
                c->listening_port = listen_port;
                success = 1;
        }
        if (success == 0)
                error("channel_setup_fwd_listener: cannot listen to port:
%d",
                    listen_port);
        freeaddrinfo(aitop);
        return success;
}

As you see allocated_listen_port gets assigned to some free port, but
then... nothing more happens with allocated_listen_port, because
c->listening_port is set to listen_port, which in this case equals 0. (note
that listen_port IS NOT set to allocated_listen_port!)

But then again - I am not a programmer. So I might be wrong.

> Hello,
> 
> Today I tried using "dynamically assigned" port for remote
listener, by
> requesting listener on port 0. This is supposed to create a listener on a
> port choosen by server. Everything seemed OK (the choosen port was sent
back
> to client), but forwarding was refused. So I checked the source.
it works for me on both portable and OpenBSD, with -R forwardings on
the initial ssh commandline or set up using -O forward.
> in channels.c, function: channel_setup_fwd_listener
> 
>                 /*
>                  * listen_port == 0 requests a dynamically allocated port -
>                  * record what we got.
>                  */
>                 if (type == SSH_CHANNEL_RPORT_LISTENER &&
listen_port == 0
> &&
>                     allocated_listen_port != NULL &&
>                     *allocated_listen_port == 0) {
>                         *allocated_listen_port = get_sock_port(sock, 1);
>                         debug("Allocated listen port %d",
>                             *allocated_listen_port);
>                 }
> 
>                 /* Allocate a channel number for the socket. */
>                 c = channel_new("port listener", type, sock,
sock, -1,
>                     CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
>                     0, "port listener", 1);
>                 c->path = xstrdup(host);
>                 c->host_port = port_to_connect;
>                 c->listening_port = listen_port;
>                 success = 1;
>         }
>         if (success == 0)
>                 error("channel_setup_fwd_listener: cannot listen to
port:
> %d",
>                     listen_port);
>         freeaddrinfo(aitop);
>         return success;
> }
> 
> As you see allocated_listen_port gets assigned to some free port, but
> then... nothing more happens with allocated_listen_port, because
> c->listening_port is set to listen_port, which in this case equals 0.
(note
> that listen_port IS NOT set to allocated_listen_port!)
> 
> But then again - I am not a programmer. So I might be wrong.
listen_port isn't used for all that much, the important thing is the
sock that is bound to the listening port.

-d