openssh unix dev - Apr 2015 - Determining the reverse port tunnels

Hi all,

If I were to connect to a system with a command like this:

ssh -R *:0:localhost:3000 user at server

Is there any way for openssh to tell my shell what ports it opened for me?

i.e. what port on server is my localhost:3000 exposed to?

I know that there is a stderr / stdout printout of the port, but wonder if
there is a way to know in my shell.  Maybe an env var?  Maybe some grepping
of netstat?

Thanks!
Cary FitzHugh

On Wed, Apr 22, 2015 at 9:43 AM, Cary FitzHugh <cary.fitzhugh at
gmail.com>
wrote:
> Hi all,
>
> If I were to connect to a system with a command like this:
>
> ssh -R *:0:localhost:3000 user at server
>
> Is there any way for openssh to tell my shell what ports it opened for me?
>
> i.e. what port on server is my localhost:3000 exposed to?
>
> I know that there is a stderr / stdout printout of the port, but wonder if
> there is a way to know in my shell.  Maybe an env var?

There's no general way to do this: port forwards can be added and deleted
at any time but the environment variables can only be set and shell startup
time.

>   Maybe some grepping of netstat?
>
The parent process ID of your shell is the sshd that's listening, so
something like this should work:

lsof -p $PPID | grep LISTEN

or the equivalent with netstat if your platform can map port numbers to
PIDs.

The cleanest solution is probably using a control socket which returns the
port number to the client., something like

ssh -N -MS /tmp/ctl yourserver &
port=`ssh -S /tmp/ctl -O forward -R 0:127.0.0.1:22 yourserver`
ssh -S /tmp/ctl yourserver command --port $port
ssh -S /tmp/ctl -O exit yourserver

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

On Tue, 21 Apr 2015, Cary FitzHugh wrote:
> Hi all,
> 
> If I were to connect to a system with a command like this:
> 
> ssh -R *:0:localhost:3000 user at server
> 
> Is there any way for openssh to tell my shell what ports it opened for me?
> 
> i.e. what port on server is my localhost:3000 exposed to?
> 
> I know that there is a stderr / stdout printout of the port, but wonder if
> there is a way to know in my shell.  Maybe an env var?  Maybe some grepping
> of netstat?
At the moment, the only way is to use the multiplexing support. E.g.

$ ssh -nNfS -oControlPath=~/.ssh/ctl-%r@%h:%p 127.0.0.1
$ ssh -oControlPath=~/.ssh/ctl-%r@%h:%p -O forward -R 0:127.0.0.1:9999 127.0.0.1
Allocated port 27313 for mux remote forward to 127.0.0.1:9999
Allocated port 27313 for remote forward to 127.0.0.1:9999
27313

The double logging is a bug - patch below.

In general, it's unreliable to put the port number in an environment
variable because the remote shell session is separate to the forwardings
and may be establised before they are set up.

-d

Index: mux.c
==================================================================RCS file:
/cvs/src/usr.bin/ssh/mux.c,v
retrieving revision 1.50
diff -u -p -r1.50 mux.c
--- mux.c	20 Jan 2015 23:14:00 -0000	1.50
+++ mux.c	22 Apr 2015 01:30:43 -0000
@@ -592,7 +594,7 @@ mux_confirm_remote_forward(int type, u_i
 	if (type == SSH2_MSG_REQUEST_SUCCESS) {
 		if (rfwd->listen_port == 0) {
 			rfwd->allocated_port = packet_get_int();
-			logit("Allocated port %u for mux remote forward"
+			debug("Allocated port %u for mux remote forward"
 			    " to %s:%d", rfwd->allocated_port,
 			    rfwd->connect_host, rfwd->connect_port);
 			buffer_put_int(&out, MUX_S_REMOTE_PORT);
@@ -1703,7 +1716,7 @@ mux_client_forward(int fd, int cancel_fl
 		if (cancel_flag)
 			fatal("%s: got MUX_S_REMOTE_PORT for cancel", __func__);
 		fwd->allocated_port = buffer_get_int(&m);
-		logit("Allocated port %u for remote forward to %s:%d",
+		verbose("Allocated port %u for remote forward to %s:%d",
 		    fwd->allocated_port,
 		    fwd->connect_host ? fwd->connect_host : "",
 		    fwd->connect_port);