The SSHv2 connection draft specifies a global request 'cancel-tcpip-forward' which will cancel a remote->local TCP/IP forwarding connection. sshd does not understand this request.
Created attachment 494 [details] Attempt at cancel-tcpip-forward support Please give this diff a try.
Nope. It appears that the issue is that channel_cancel_rport_listener only closes open remote->local forwarding channels. If there are no channels open for forwarding, then nothing happens. What should happen is that the socket listening on the remote port should be closed so that attempts to connect to that port fail. As it stands, remote->local forwarding requests are still passed on to the client even after cancel-tcpip-forward.
are you sure? the patch looks ok to me, since only the listen socket will have type SSH_CHANNEL_RPORT_LISTENER. forwarded connections will have a different type.
Yes, I've tried the patch and the problem still exists. Netstat shows the listening socket before and after the cancel-tcpip-forward, and the server still passes on a forwarded-tcpip request to the client.
Please attach a debug output "sshd -d -d -d" from a patch sshd, receiving a cancel message.
Created attachment 505 [details] Log of a connection with cancel-tcpip-forwarding
hm, try cancelling 127.0.0.1:8080 - unless you have GatewayPorts=yes
The log shows that I ask for forwarding to be listening on all interfaces by binding to '0.0.0.0'. If sshd ignores this and binds to 127.0.0.1, how else do I indicate ports to listen on all interfaces?
You specify GatewayPorts=yes on the server. This is off by default as server administrators may not want random users to be able to listen on arbitrary high-numbered ports. I'll probably correct the patch so that it closes the forwardings based on the original forward request rather than the listening address, but I'd like to see if it works first. Does it work if you ask to cancel 127.0.0.1:8080?
Nope, doesn't work even I cancel forwarding for 127.0.0.1:1080.
Created attachment 579 [details] Patch with more debugging Please try this patch and attach the debug output on trying to close a port forward.
Created attachment 580 [details] Fixed cancel-tcpip-forward patch This one seems to work better - it also extends the process_cmdline (~C) escape with some help and the ability to cancel rforward connections.
The new attachment works great with the latest version of Conch. Thanks!
patch comitted. thanks for the report.