StreamLocal forwarding

[Rogan Dawes]

Hi folks,

(3rd time I am sending this message, none of the other appear to have
made it through!)

Using "OpenSSH_6.9p1 Ubuntu-2ubuntu0.1, OpenSSL 1.0.2d 9 Jul 2015" on
the server, "OpenSSH_7.2p2, OpenSSL 1.0.2g  1 Mar 2016" on the client.

I am trying to use sshtunnel with StreamLocal forwarding to enable me
to connect back to the client's ssh port, without having to arbitrate
ports between clients.

The idea is to configure the server to allow StreamLocalForwarding via
a unique Unix socket on the host, that relays back to the client.

i.e. on the client (named gateway for this example, but will be unique
once deployed in volume):

/usr/bin/ssh -o CheckHostIP=yes -o LogLevel=INFO -o
ServerAliveCountMax=3 -o ServerAliveInterval=5 -o
StrictHostKeyChecking=yes -o TCPKeepAlive=yes -o
StreamLocalBindUnlink=yes -o ExitOnForwardFailure=yes -o BatchMode=yes
-nN -R /sshvpn/gateway:127.0.0.1:22 -p 52221 sshvpn at host

On the server:

Match User sshvpn
  ChrootDirectory /var/sshvpn/
  AllowTCPForwarding no
  AllowStreamLocalForwarding yes
  StreamLocalBindUnlink yes

Then to connect to the client:

$ ssh -o ProxyCommand='socat /var/sshvpn/sshvpn/gateway' root at gateway

So, it works fine the first time, when the socket does not exist. Once
the connection terminates, and the client attempts to log in again, it
fails because the socket already exists:

debug1: user sshvpn matched 'User sshvpn' at line 89
debug3: match found
debug3: reprocess config:90 setting ChrootDirectory /var/sshvpn/
debug3: reprocess config:91 setting AllowTCPForwarding no
debug3: reprocess config:92 setting AllowStreamLocalForwarding yes
debug3: reprocess config:93 setting StreamLocalBindUnlink yes
[...snip...]
debug1: server_input_global_request: rtype
streamlocal-forward at openssh.com want_reply 1
debug1: server_input_global_request: streamlocal-forward listen path
/sshvpn/gateway
debug3: channel_setup_fwd_listener_streamlocal: type 19 path /sshvpn/gateway
bind: Address already in use
unix_listener: cannot bind to path: /sshvpn/gateway

I am aware of the StreamLocalBindUnlink option, and you can see that
it is set on both the client and the server, but it doesn't seem to be
effective.

I also ran it under ltrace, and got the following:

24079 write(2, "debug3: channel_setup_fwd_listen"..., 78)  = 78
24079 umask(0177)                                          = 02
24079 socket(1, 1, 0)                                      = 8
24079 bind(8, 0x7ffc4f8915c0, 110, -1)                     = -1
24079 __errno_location()                                   = 0x7f03f55a5710
24079 strerror(98)                                         = "Address
already in use"

>From this, it appears that there is no attempt to unlink the socket if
it already exists, as would be expected from this code
(https://github.com/openssh/openssh-portable/blob/7de4b03a6e4071d454b72927ffaf52949fa34545/misc.c#L1083):

sock = socket(PF_UNIX, SOCK_STREAM, 0);
if (sock < 0) {
saved_errno = errno;
error("socket: %.100s", strerror(errno));
errno = saved_errno;
return -1;
}
if (unlink_first == 1) {
if (unlink(path) != 0 && errno != ENOENT)
error("unlink(%s): %.100s", path, strerror(errno));
}
if (bind(sock, (struct sockaddr *)&sunaddr, sizeof(sunaddr)) < 0) {
saved_errno = errno;
error("bind: %.100s", strerror(errno));
close(sock);
error("%s: cannot bind to path: %s", __func__, path);
errno = saved_errno;
return -1;
}

What am I missing?

Rogan