Port clash using ssh. NAT or ssh fault?
Rafal Podeszwa
poszwa@tiger.chem.uw.edu.pl
Thu, 20 Jul 2000 19:39:55 +0200 (CEST)
I have problems with ssh local port allocation on a masquerading box
using privileges ports.
I have an open ssh connection from a box in DMZ.
DMZ box port 1023 --> MASQERADE BOX --> OUTSIDE box port 22
The packet is mangled on the MASQERADE box (kernel 2.4.0-pre4,
netfilter 1.1.1) and appears to come from
MASQUERADE box port 1023. Then when I try to make a ssh connection from
MASQUERADE box to the OUTSIZE box, the ssh freezes. The ssh -v command
on the MASQUERADE box gives
Allocating local port 1023
[ssh freezes]
In ssh-1.2.27 the relevant code is in ssh_connect.c. The procedure tries
to bind local port 1023, which return success but then it freezes during
connect to the OUTSIDE box.
A code that shows the problem is
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <errno.h>
int main()
{
int mysocket,res;
struct in_addr inp;
struct sockaddr_in soa;
mysocket = socket(PF_INET, SOCK_STREAM, 6);
soa.sin_family=PF_INET;
soa.sin_port=htons(1023); /* local port */
soa.sin_addr.s_addr=INADDR_ANY;
res = bind(mysocket, &soa, sizeof(soa));
perror(""); /* Success */
res = inet_aton(OUTSIDE_BOX, &inp);
soa.sin_family=PF_INET;
soa.sin_port=htons(22);
soa.sin_addr=inp;
res = connect(mysocket, &soa, sizeof(soa)); /* here it freezes */
perror("");
}
My questions are:
Is it OK that it the MASQUERADING box allows binding to the local
port used in NAT? Why then connect freezes? Should it rather return an
error?
The ssh code that allocates privileged ports is not perfect but anyway it
should not freeze.
Regards,
Rafal