Port Forwarding on the proxy does not work. Debug shows "debug1: getpeername failed: Bad file descriptor". OpenSSH_7.2p2, OpenSSL 1.0.2h-fips 3 May 2016. Related to bug 2200 ("ssh -W causes "getsockname failed: Bad file descriptor" errors")? Reproduction: ~/.ssh/config: Host jump HostName my.dynamicdns.com Port 2222 User user IdentityFile ~/.ssh/user-jump_ed25519 DynamicForward 1080 Host */remote ProxyCommand ssh -vvv -W $(dirname %h) jump 2>~/sshpc.log Host target HostName target Port 22 User user IdentityFile ~/.ssh/user-target_ed25519 ssh target/remote (check ss -lant4 in second terminal: no listener on port 1080) (exit ssh session) cat sshpc.log [...] Authenticated to my.dynamicdns.com ([12.34.56.78]:2222). debug3: ssh_init_stdio_forwarding: router:22 debug1: channel_connect_stdio_fwd router:22 debug1: channel 0: new [stdio-forward] debug2: fd 4 setting O_NONBLOCK debug2: fd 5 setting O_NONBLOCK debug1: getpeername failed: Bad file descriptor debug3: send packet: type 90 debug2: fd 3 setting TCP_NODELAY debug3: ssh_packet_set_tos: set IP_TOS 0x10 debug1: Requesting no-more-sessions@openssh.com debug3: send packet: type 80 debug1: Entering interactive session. [...]
replace "router" in the debug output with "target", please ;)
(In reply to jan.stuehler from comment #0) > Port Forwarding on the proxy does not work. That's deliberate. In ssh.c where it handles the 'W' option: options.request_tty = REQUEST_TTY_NO; no_shell_flag = 1; options.clear_forwardings = 1; options.exit_on_forward_failure = 1; The reason for it is that we need to fail if we can't do the stdio forward, and right now it's all or nothing so the second and subsequent attempts to use use the jumphost will fail (and possibly the first too, eg if the port is busy). Right now because of the way the first-match options parsing works you can't override the value by setting ClearAllForwardings=no either. > Debug shows "debug1: getpeername failed: Bad file descriptor". That's harmless. The port forwarding message in the protocol has a field for the source address of the forwarded connection, and when the forwarding code tries to look up the source address of stdin it can't, so it uses the string "UNKNOWN" instead.
Created attachment 2819 [details] Allow ExitOnForwardFailure=no and ClearAllForwardings=no to be overridden when using -W. This patch defers the setting of ExitOnForwardFailure and ClearAllForwardings when using -W until after options parsing to allow them to be overridden either on the command line or in the config file. Please give it a try and let us know how it goes. $ ssh -W foo:123 -G bar | egrep -i 'exiton|clearall' clearallforwardings yes exitonforwardfailure yes $ ssh -W foo:123 -o clearallforwardings=no -o exitonforwardfailure=no -G bar | egrep -i 'exiton|clearall' clearallforwardings no exitonforwardfailure no
Ah, that looks wonderful. You mean "patch" as in "compile from source"? This will be interesting. :)
Patch has been applied and will be in the 7.3 release. https://anongit.mindrot.org/openssh.git/commit/?id=0cb2f4c2494b115d0f346ed2d8b603ab3ba643f4 Thanks.
Close all resolved bugs after 7.3p1 release