[Bug 3994] New: ChannelTimeout: session= timeout broken by channel_set_xtype; global= shows 0 in debug logs

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=3994

            Bug ID: 3994
           Summary: ChannelTimeout: session= timeout broken by
                    channel_set_xtype; global= shows 0 in debug logs
           Product: Portable OpenSSH
           Version: 10.5p1
          Hardware: 68k
                OS: Mac OS X
            Status: NEW
          Severity: major
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: bhagavathiyappan.shanmugam at ibm.com

Created attachment 3980
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3980&action=edit
Fix patch for channels.c - ChannelTimeout session= broken by
channel_set_xtype and global= debug shows 0

channels: fix ChannelTimeout deadline handling for global= and xctype
refinement

channel_set_xtype() is called after channel_new() to refine the channel
type (e.g. \"session\" -> \"session:shell\"). When ChannelTimeout
session=5s is configured, lookup_timeout(\"session:shell\") returns 0
because the pattern \"session\" does not match \"session:shell\". The
previous code unconditionally overwrote inactive_deadline with 0,
destroying the value set by channel_new() and preventing the timeout
from ever firing.

Fix: only update inactive_deadline when the xctype lookup finds a
configured match, so a more specific xctype pattern can still override
the ctype-level deadline but an unmatched xctype never erases it.

Also fix three debug messages that printed 0 instead of the configured
value when ChannelTimeout global=Xs is used. The global deadline is
stored in sc->global_deadline, not c->inactive_deadline, so the log
messages now fall back to sc->global_deadline when inactive_deadline
is 0.

Bug 1 — Functional: session= timeout never fires (CRITICAL)
-----------------------------------------------------------
When ChannelTimeout session=5s is configured, the timeout is correctly
set in channel_new() but silently destroyed by channel_set_xtype() when
the channel is refined from "session" to "session:shell" or
"session:command". lookup_timeout("session:shell") returns 0 because
the
pattern "session" does not match "session:shell", and the old code
unconditionally overwrote inactive_deadline with 0.

Steps to reproduce:
  ssh -o ChannelTimeout="session=5s" user at host "sleep 8"

Expected: connection killed after 5 seconds of inactivity
Actual:   sleep 8 completes after 8 seconds, timeout never fires

Debug evidence:
  debug1: channel 0: new session [client-session] (inactive timeout: 5)
  debug2: channel_set_xtype: labeled channel 0 as session:command
(inactive timeout 0)
  [session runs for full 8 seconds, no timeout]
  debug1: Exit status 0


Bug 2 — Display: global= shows 0 in three debug messages
----------------------------------------------------------
When ChannelTimeout global=10s is configured, three debug messages
incorrectly print 0 instead of 10. The global deadline is stored in
sc->global_deadline, not c->inactive_deadline, but the messages only
read c->inactive_deadline.

Steps to reproduce:
  ssh -vvv -o ChannelTimeout="global=10s" user at host

Expected debug output:
  channel 0: new session [client-session] (inactive timeout: 10)
  channel_set_xtype: labeled channel 0 as session:shell (inactive
timeout 10)
  channel 0: closing after 10 seconds of inactivity

Actual debug output:
  channel 0: new session [client-session] (inactive timeout: 0)
  channel_set_xtype: labeled channel 0 as session:shell (inactive
timeout 0)
  channel 0: closing after 0 seconds of inactivity


Fix
---
See attached patch. Tested on OpenSSH_10.5p1 (macOS).

Fix 1: In channel_set_xtype(), only overwrite inactive_deadline when
the xctype lookup actually finds a match — preserving the ctype-level
deadline otherwise.

Fix 2: In three debug messages, fall back to sc->global_deadline when
c->inactive_deadline is 0.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.