| Summary: | ipv4 mapped address (ipv4 in ipv6) and ipv6 support fix | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | YOSHIFUJI Hideaki <yoshfuji> | ||||||||
| Component: | sshd | Assignee: | OpenSSH Bugzilla mailing list <openssh-bugs> | ||||||||
| Status: | CLOSED FIXED | ||||||||||
| Severity: | normal | CC: | cjwatson | ||||||||
| Priority: | P2 | ||||||||||
| Version: | -current | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Attachments: |
|
||||||||||
Created attachment 148 [details]
set length of sockaddr{}. run sshd with glibc-2.2 on linux-2.2
To clarify: - one is ipv4 mapped issue - another is ipv6 sin6_scope_id issue. - with latter one, we do not able to accept ipv4 connection via ipv6 socket using "ipv4-mapped address" feature on some platforms. I am not sure I understand this patch completely - I can't see anything relating to scope-id. is the scope-id incompatibility because of different sized sockaddr_in6 structure lengths? How does the problem manifest in unpatched OpenSSH? >is the scope-id incompatibility because of different sized >sockaddr_in6 structure lengths? Yes, if you try to run sshd with ipv6 support with glibc-2.2 on linux-2.2, sshd disconnects any connections. This is because - kernel gives sshd sockaddr_in6 without sin6_scope_id (size is 24 bytes) - glibc-2.2 expects sockaddr_in6 is 28 bytes long and getnameinfo() failed because length is different than one expected. >How does the problem manifest in unpatched OpenSSH? |# sshd -6 -d |: |debug1: Bind to port 22 on ::. |Server listening on :: port 22. |Generating 768 bit RSA key. |RSA key generation complete. |debug1: Server will not fork when running in debugging mode. When I connect to this sshd, sshd disconnects immediately. |% ssh -v 127.0.0.1 : |debug1: Connecting to 127.0.0.1 [127.0.0.1] port 22. |debug1: Connection established. : |ssh_exchange_identification: Connection closed by remote host |debug1: Calling cleanup 0x8064174(0x0) sshd debug messages are: |get_sock_port: getnameinfo NI_NUMERICSERV failed |debug1: Calling cleanup 0x806be4c(0x0) OK - I understand now. We generally try to "#ifdef (platform)" in portable
OpenSSH. Would you patch work if it were changed to do something like:
if (addr.ss_family == AF_INET6)
fromlen = MIN(fromlen, sizeof(struct sockaddr_in6));
Created attachment 194 [details]
patch to run openssh-3.5p1 on linux-2.2 & glibc-2.2(or later)
This is modified patch for openssh-3.5p1.
Patch is simplified.
Created attachment 195 [details]
More simple patch
This patch should be OK for all platforms without evil #ifdefs
Applied - this should be neutral to other platforms. Mass change of RESOLVED bugs to CLOSED |
There are two problems related to ipv4 mapped address support. In canohost.c, 1) we forgot to set length of structure when converting a sockaddr_in6{} which contains ipv4-mapped address to a sockaddr_in{}. 2) we failed to accept any connections on newer library with socpe-id (ex. glibc-2.2.x) on old kernel without scope-id (ex. linux-2.2.x). patch will follow.