[SSHD-206] Race between SSH_MSG_CHANNEL_DATA and SSH_MSG_CHANNEL_CLOSE in ChannelForwardedTcpip?

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.8.0
• Fix Version/s: 0.9.0
• Assignee: Guillaume Nodet
• Reporter: Andrew C
• Created: 16/Jan/13 18:17
• Updated: 25/Feb/13 07:53
• Resolved: 25/Feb/13 07:53

Description

I've noticed what I believe is a race between ChannelForwardTcpip receiving SSH_MSG_CHANNEL_CLOSE from the remote end and it trying to send data to the remote end - it ends up sending data after it closed the channel

The sequence is roughly:

• remote forwards tcp channel to local
• remote and local chatter
• remote gets a close and sends SSH_MSG_CHANNEL_CLOSE to local
• local responds accordingly
  meanwhile, there's data intended for the remote end still sitting in a local queue somewhere and local proceeds to send it across the now dead channel
• remote responds to the protocol violation with extreme prejudice killing the entire ssh session

This is the local log (s/RelaySessionSshChannelRecipient/ChannelForwardTcpip/, they are essentially the same)

[09:42:32.451] [NioProcessor-2] DEBUG org.apache.sshd.client.session.ClientSessionImpl - Received packet SSH_MSG_CHANNEL_CLOSE
[09:42:32.451] [NioProcessor-2] DEBUG RelaySessionSshChannelRecipient - Received SSH_MSG_CHANNEL_CLOSE on channel 0
[09:42:32.452] [NioProcessor-2] DEBUG RelaySessionSshChannelRecipient - Send SSH_MSG_CHANNEL_CLOSE on channel 0
[09:42:32.453] [NioProcessor-2] DEBUG RelaySessionSshChannelRecipient - Closing channel 0 immediately
[09:42:32.452] [NioProcessor-3] DEBUG RelaySessionSshChannelRecipient - Send SSH_MSG_CHANNEL_DATA on channel 0
[09:42:32.460] [NioProcessor-2] DEBUG org.apache.sshd.client.session.ClientSessionImpl - Closing session

for reference, this is the remote log, it helps to more clearly show the sequence of packets going to/from the local end:

[09:42:32.449] [NioProcessor-1] DEBUG RelaySession - networkSessionClosed
[09:42:32.450] [NioProcessor-1] DEBUG RelaySessionSshChannelSender - Send SSH_MSG_CHANNEL_CLOSE on channel 0
[09:42:32.456] [NioProcessor-4] DEBUG SshSession - Received packet SSH_MSG_CHANNEL_CLOSE
[09:42:32.456] [NioProcessor-4] DEBUG RelaySessionSshChannelSender - Received SSH_MSG_CHANNEL_CLOSE on channel 0
[09:42:32.457] [NioProcessor-4] DEBUG SshSession - Received packet SSH_MSG_CHANNEL_DATA
[09:42:32.457] [NioProcessor-4] WARN SshSession - Exception caught
org.apache.sshd.common.SshException: Received SSH_MSG_CHANNEL_DATA on unknown channel 0

Issue Links

• is related to: SSHD-151 Direct TCP/IP Port Forward sends EOF to client after closing channel
• relates to: SSHD-207 ChannelForward TCP/IP sends EOF to server after closing channel