[Bug 4009] New: ssh -G reports LocalForward entries to a Unix socket, or to a host named "socks", as DynamicForward

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=4009

            Bug ID: 4009
           Summary: ssh -G reports LocalForward entries to a Unix socket,
                    or to a host named "socks", as DynamicForward
           Product: Portable OpenSSH
           Version: 10.5p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: critical
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: khush2792001 at gmail.com

ssh -G misreports two kinds of LocalForward:

1. A LocalForward whose destination is a Unix-domain socket (documented
in ssh_config(5)) is
   printed twice, once as a dynamic forward that was never configured:

     $ ssh -G -F none -o 'LocalForward=1 /tmp/sock' host | grep forward
     dynamicforward 1
     localforward 1 /tmp/sock

   Feeding this output back to ssh -G adds a second "dynamicforward 1"
line, so the dump is not
   stable under reparsing. The same happens for 'LocalForward /tmp/a
/tmp/b'
   ("dynamicforward /tmp/a").

2. A LocalForward to a host literally named "socks" is printed only as
a dynamic forward, and
   the destination is lost:

     $ ssh -G -F none -o 'LocalForward=1234 socks:80' host | grep
forward
     dynamicforward 1234

   whereas 'LocalForward=1234 example:80' prints "localforward 1234
[example]:80".

Forwarding itself is not affected: at run time a dynamic forward is
recognised by
connect_port == 0 (e.g. mux.c). Only the -G output is wrong, but it is
what users and tools
read to audit the effective configuration, and here it shows a SOCKS
listener that is not
configured, or hides a configured forward.

Cause: dump_cfg_forwards() in readconf.c decides between DynamicForward
and LocalForward by
comparing connect_host with the string "socks", the placeholder
parse_forward() stores for
dynamic forwards. A socket destination has connect_host == NULL, so it
passes the
DynamicForward filter, and a real host named "socks" matches it.

Suggested fix: classify by the same test the runtime uses, e.g. in
dump_cfg_forwards()

        int dynamic = fwd->connect_port == 0;   /* connect_path
forwards use PORT_STREAMLOCAL */
        if ((code == oDynamicForward) != dynamic)
                continue;

-- 
You are receiving this mail because:
You are watching the assignee of the bug.