Bug 790 - Connection stall when client output fails and server has a lot more to send
Summary: Connection stall when client output fails and server has a lot more to send
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh (show other bugs)
Version: 3.7.1p1
Hardware: All FreeBSD
: P3 normal
Assignee: OpenSSH Bugzilla mailing list
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2004-01-15 23:24 AEDT by Matthew Dillon
Modified: 2004-04-14 12:24 AEST (History)
0 users

See Also:


Attachments
channels.c patch (1.17 KB, patch)
2004-01-16 19:56 AEDT, Jeroen Ruigrok van der Werven
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Matthew Dillon 2004-01-15 23:24:41 AEDT
Demonstrated by:  limit filesize 64k; ssh remotebox -n cat /usr/share/dict/words
| cat > junkfile.  When the write fails due to the file size limit being
reached, the client side properly closes the connection output.  However, the
server side continues to send data which the client now ignores.  This causes
the client to stop sending window updates to the server.  If the server has a
sufficient amount of data still to send it will exhaust its window and stalls
indefinitely.

The solution is to adjust the case in channel_input_data() in channels.c.  When
it  tests c->ostate != CHAN_OUTPUT_OPEN, instead of just returning we 'fake' the
consumption of the data by moving the packet_get_string() call to above the
conditional and then subtracting data_len from c->local_window and adding
data_len to c->local_consumed, then doing the appropriate xfree(data) and return;

There may be other cases where window updates could stall a connection as well,
but this one has plagued me for ages.  It can also occur when the client is
pipeing its output to a pipe which then fails (because the ssh client sets
SIGPIPE to ignore in order to process error returns). 

I can email my (possibly incomplete) patch on request, but I'm afraid I've hit
my bugzilla endurance limit.  Wish there were just an email address to send
informal bug reports to :-(.  In anycase, I think there is sufficient info above
to reproduce and fix the bug.

-Matt
Comment 1 Jeroen Ruigrok van der Werven 2004-01-16 19:56:20 AEDT
Created attachment 531 [details]
channels.c patch

Patch as present in the DragonFly BSD Project repository.
Comment 2 Markus Friedl 2004-01-19 21:52:23 AEDT
applied. thanks.
Comment 3 Damien Miller 2004-04-14 12:24:20 AEST
Mass change of RESOLVED bugs to CLOSED