bz#2147: fix multiple remote forwardings with dynamically assigned

listen ports. In the s->c message to open the channel we were sending
zero (the magic number to request a dynamic port) instead of the actual
listen port. The client therefore had no way of discriminating between
them.

Diagnosis and fix by ronf AT timeheart.net

1 files changed, 7 insertions, 4 deletions

diff --git a/usr.bin/ssh/channels.c b/usr.bin/ssh/channels.c
index 9d3fbff9281..32156413b23 100644
--- a/usr.bin/ssh/channels.c
+++ b/usr.bin/ssh/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.327 2013/11/08 00:39:15 djm Exp $ */
+/* $OpenBSD: channels.c,v 1.328 2013/12/19 01:04:36 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1377,6 +1377,8 @@ port_open_helper(Channel *c, char *rtype)
 {
 	int direct;
 	char buf[1024];
+	char *local_ipaddr = get_local_ipaddr(c->sock);
+	int local_port = get_sock_port(c->sock, 1);
 	char *remote_ipaddr = get_peer_ipaddr(c->sock);
 	int remote_port = get_peer_port(c->sock);
 
@@ -1391,9 +1393,9 @@ port_open_helper(Channel *c, char *rtype)
 
 	snprintf(buf, sizeof buf,
 	    "%s: listening port %d for %.100s port %d, "
-	    "connect from %.200s port %d",
+	    "connect from %.200s port %d to %.100s port %d",
 	    rtype, c->listening_port, c->path, c->host_port,
-	    remote_ipaddr, remote_port);
+	    remote_ipaddr, remote_port, local_ipaddr, local_port);
 
 	free(c->remote_name);
 	c->remote_name = xstrdup(buf);
@@ -1411,7 +1413,7 @@ port_open_helper(Channel *c, char *rtype)
 		} else {
 			/* listen address, port */
 			packet_put_cstring(c->path);
-			packet_put_int(c->listening_port);
+			packet_put_int(local_port);
 		}
 		/* originator host and port */
 		packet_put_cstring(remote_ipaddr);
@@ -1428,6 +1430,7 @@ port_open_helper(Channel *c, char *rtype)
 		packet_send();
 	}
 	free(remote_ipaddr);
+	free(local_ipaddr);
 }
 
 static void