Bug 2837 - ssh-agent closes listening socket on error in handle_socket_read()
Summary: ssh-agent closes listening socket on error in handle_socket_read()
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh-agent (show other bugs)
Version: 7.6p1
Hardware: All All
: P5 normal
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks: V_7_8
  Show dependency treegraph
 
Reported: 2018-03-06 19:24 AEDT by Lukas Kuster
Modified: 2018-10-19 17:17 AEDT (History)
1 user (show)

See Also:


Attachments
patch that removes close_socket() of listening socket. (645 bytes, text/plain)
2018-03-06 19:24 AEDT, Lukas Kuster
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Lukas Kuster 2018-03-06 19:24:50 AEDT
Created attachment 3132 [details]
patch that removes close_socket() of listening socket.

Hi all,

The ssh-agent closes the listening socket if handle_socket_read() fails for any reason. This makes the agent process unusable if the getpeereid check fails. Older versions before 7.6p1 used to not close the listening socket.

You can reproduce this bug by executing agent-getpeereid.sh test but instead of killing the agent process at the end, execute "ssh-add -l" again with a privileged user. You will notice that the connection will be refused because the listening socket was closed by the agent.

On our AIX test server we had a more severe issue because of this bug. The ssh client tries to check if a ssh-agent is present by connecting to it and immediately closing the socket again. On the agent side, this can cause the call to getpeereid() to fail with the errormessage "Connection closed" causing the listening socket to be closed as well, making any future connections to the agent process impossible.

Thanks
Comment 1 Damien Miller 2018-04-06 13:40:06 AEST
oops - well spotted. I'll take a look.
Comment 2 Damien Miller 2018-04-13 13:45:30 AEST
This has been committed on the master and V_7_7 branches. Thanks!

commit 260ede2787fe80b18b8d5920455b4fb268519c7d
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Apr 9 23:54:49 2018 +0000

    upstream: don't kill ssh-agent's listening socket entriely if we
    
    fail to accept a connection; bz#2837, patch from Lukas Kuster
    
    OpenBSD-Commit-ID: 52413f5069179bebf30d38f524afe1a2133c738f
Comment 3 Damien Miller 2018-10-19 17:17:27 AEDT
Close RESOLVED bugs with the release of openssh-8.0