Bug 2079

Summary:	openssh 6.1/6.2 disconnect due to channel bug
Product:	Portable OpenSSH	Reporter:	Eric <emilliken>
Component:	ssh	Assignee:	Assigned to nobody <unassigned-bugs>
Status:	CLOSED FIXED
Severity:	normal	CC:	djm, dtucker
Priority:	P5
Version:	6.1p1
Hardware:	amd64
OS:	FreeBSD
Bug Depends on:
Bug Blocks:	2076

Description Eric 2013-03-17 05:20:13 AEDT

To reproduce:

in one terminal:
test$ ssh host -MS /tmp/test
<<do a full login>>

in a second terminal on the same machine (2.2.2.2 is an unresponsive host):
test$ ssh 0 -S /tmp/test -W 2.2.2.2:22
^C << hit control-c >>
test$ ssh 0 -S /tmp/test -W 2.2.2.2:22
<<wait about 90 seconds for ssh to timeout and exit>>
test$ ssh 0 -S /tmp/test -W localhost:22

Now, the ssh from terminal one and two will exit immediately.  The error in terminal 1 is:
channel_by_id: 3: bad id: channel free
Disconnecting: Received open failure for non-opening channel 3.

Comment 1 Damien Miller 2013-03-17 08:00:54 AEDT

There are a few problems here:

1) Not cancelling the delayed connect when the first slave connection closes

2) Reusing channel IDs while there might still be operations pending on the server for previously-closed ones

3) Disconnecting for something that could probably be ignored

Comment 2 Eric 2013-03-20 16:56:21 AEDT

This fixes it for me on the openssh 6.1p1 tree:

change mux.c:226 from
if (sc->type != SSH_CHANNEL_OPEN) {

to:
if (sc->type != SSH_CHANNEL_OPEN && sc->type != SSH_CHANNEL_OPENING) {

Comment 3 Darren Tucker 2013-04-05 11:58:04 AEDT

the change in comment #2 looks reasonable to me

Comment 4 Damien Miller 2013-04-05 12:01:19 AEDT

Fix applied - this will be in OpenSSH 6.3. Thanks!

Comment 5 Damien Miller 2016-08-02 10:40:55 AEST

Close all resolved bugs after 7.3p1 release