[jira] [Created] (SSHD-206) Race between SSH_MSG_CHANNEL_DATA and SSH_MSG_CHANNEL_CLOSE in ChannelForwardedTcpip?

["Andrew C (JIRA)" <ji...@apache.org>]

Andrew C created SSHD-206:
-----------------------------

             Summary: Race between SSH_MSG_CHANNEL_DATA and SSH_MSG_CHANNEL_CLOSE in ChannelForwardedTcpip?
                 Key: SSHD-206
                 URL: https://issues.apache.org/jira/browse/SSHD-206
             Project: MINA SSHD
          Issue Type: Bug
    Affects Versions: 0.8.0
            Reporter: Andrew C


I've noticed what I believe is a race between ChannelForwardTcpip receiving SSH_MSG_CHANNEL_CLOSE from the remote end and it trying to send data to the remote end - it ends up sending data after it closed the channel :-(

The sequence is roughly:
- remote forwards tcp channel to local
- remote and local chatter
- remote gets a close and sends SSH_MSG_CHANNEL_CLOSE to local
- local responds accordingly
meanwhile, there's data intended for the remote end still sitting in a local queue somewhere and local proceeds to send it across the now dead channel
- remote responds to the protocol violation with extreme prejudice killing the entire ssh session ;-)

This is the local log (s/RelaySessionSshChannelRecipient/ChannelForwardTcpip/, they are essentially the same)

[09:42:32.451] [NioProcessor-2] DEBUG org.apache.sshd.client.session.ClientSessionImpl - Received packet SSH_MSG_CHANNEL_CLOSE
[09:42:32.451] [NioProcessor-2] DEBUG RelaySessionSshChannelRecipient - Received SSH_MSG_CHANNEL_CLOSE on channel 0
[09:42:32.452] [NioProcessor-2] DEBUG RelaySessionSshChannelRecipient - Send SSH_MSG_CHANNEL_CLOSE on channel 0
[09:42:32.453] [NioProcessor-2] DEBUG RelaySessionSshChannelRecipient - Closing channel 0 immediately
[09:42:32.452] [NioProcessor-3] DEBUG RelaySessionSshChannelRecipient - Send SSH_MSG_CHANNEL_DATA on channel 0
[09:42:32.460] [NioProcessor-2] DEBUG org.apache.sshd.client.session.ClientSessionImpl - Closing session

for reference, this is the remote log, it helps to more clearly show the sequence of packets going to/from the local end:

[09:42:32.449] [NioProcessor-1] DEBUG RelaySession - networkSessionClosed
[09:42:32.450] [NioProcessor-1] DEBUG RelaySessionSshChannelSender - Send SSH_MSG_CHANNEL_CLOSE on channel 0
[09:42:32.456] [NioProcessor-4] DEBUG SshSession - Received packet SSH_MSG_CHANNEL_CLOSE
[09:42:32.456] [NioProcessor-4] DEBUG RelaySessionSshChannelSender - Received SSH_MSG_CHANNEL_CLOSE on channel 0
[09:42:32.457] [NioProcessor-4] DEBUG SshSession - Received packet SSH_MSG_CHANNEL_DATA
[09:42:32.457] [NioProcessor-4] WARN SshSession - Exception caught
org.apache.sshd.common.SshException: Received SSH_MSG_CHANNEL_DATA on unknown channel 0



--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira