[ssh] Bad exit status retrieval

[tobe2098]

Describe the bug
PlainSSHProcess attempts to retrieve the exit status by registering a callback and polling. The issue is that the callback is only registered for the duration of the call, so it will miss the return code if it does not come in that time window. The callbacks should ideally be registered for the lifetime of the channel.

[tobe2098]

MRE:

1. Create a key in the current folder for the server: ssh-keygen -t rsa -f hostkey -N ""
2. Compile the files: gcc client.c -I../multipass/build/vcpkg_installed/x64-linux-release/include -L../multipass/build/vcpkg_installed/x64-linux-release/lib -lssh -lcrypto -lssl -lz -lpthread -o client
3. Run ./server in the background
4. Run ./client
server.c:

#include <libssh/libssh.h>
#include <libssh/server.h>
#include <stdio.h>

int main() {
  ssh_bind sshbind = ssh_bind_new();
  ssh_session session = ssh_new();

  // Bind to localhost:2222 and use the dummy key
  ssh_bind_options_set(sshbind, SSH_BIND_OPTIONS_RSAKEY, "hostkey");
  ssh_bind_options_set(sshbind, SSH_BIND_OPTIONS_BINDPORT_STR, "2222");

  if (ssh_bind_listen(sshbind) < 0) {
    printf("Error listening: %s\n", ssh_get_error(sshbind));
    return 1;
  }

  printf("[Server] Listening on 127.0.0.1:2222...\n");
  if (ssh_bind_accept(sshbind, session) == SSH_ERROR) {
    printf("[Server] Accept failed\n");
    return 1;
  }

  ssh_handle_key_exchange(session);
  printf("[Server] Client connected.\n");

  ssh_message message;
  ssh_channel channel = NULL;

  // Simplified event loop
  while ((message = ssh_message_get(session)) != NULL) {
    if (ssh_message_type(message) == SSH_REQUEST_AUTH) {
      ssh_message_auth_reply_success(message, 0); // Accept any auth
      ssh_message_free(message);
    } else if (ssh_message_type(message) == SSH_REQUEST_CHANNEL_OPEN) {
      channel = ssh_message_channel_request_open_reply_accept(message);
      ssh_message_free(message);
    } else if (ssh_message_type(message) == SSH_REQUEST_CHANNEL &&
               ssh_message_subtype(message) == SSH_CHANNEL_REQUEST_EXEC) {

      printf("[Server] Exec requested. Replying success and sending exit "
             "status 42 IMMEDIATELY.\n");
      ssh_message_channel_request_reply_success(message);
      ssh_message_free(message);

      // Send exit status immediately before client can register callback
      ssh_channel_request_send_exit_status(channel, 42);
      ssh_channel_send_eof(channel);
      ssh_channel_close(channel);
      break;
    } else {
      ssh_message_reply_default(message);
      ssh_message_free(message);
    }
  }

  ssh_disconnect(session);
  ssh_free(session);
  ssh_bind_free(sshbind);
  return 0;
}

client.c:

#include <libssh/callbacks.h>
#include <libssh/libssh.h>
#include <stdio.h>
#include <unistd.h>

int exit_status_received = -1;

void exit_status_cb(ssh_session session, ssh_channel channel, int exit_status,
                    void *userdata) {
  (void)session;
  (void)channel;
  (void)userdata;
  printf("[Client] CALLBACK TRIGGERED! Exit status: %d\n", exit_status);
  exit_status_received = exit_status;
}

int main() {
  ssh_session session = ssh_new();
  ssh_options_set(session, SSH_OPTIONS_HOST, "127.0.0.1");
  ssh_options_set(session, SSH_OPTIONS_PORT_STR, "2222");

  if (ssh_connect(session) != SSH_OK) {
    printf("Connection failed: %s\n", ssh_get_error(session));
    return 1;
  }

  // Server accepts anything
  ssh_userauth_none(session, NULL);

  ssh_channel channel = ssh_channel_new(session);
  ssh_channel_open_session(channel);

  printf("[Client] Requesting exec...\n");
  ssh_channel_request_exec(channel, "dummy_command");

  // --- THE REAL RACE CONDITION ---
  printf(
      "[Client] Doing a blocking read to force libssh to process packets...\n");

  // This blocking call forces libssh to read from the socket.
  // It will parse the server's immediate 'exit-status' packet internally.
  // Because no callback is registered yet, libssh quietly discards the event.
  // It returns 0 because the server sends EOF right after.
  char buf[256];
  ssh_channel_read(channel, buf, sizeof(buf), 0);

  struct ssh_channel_callbacks_struct cb = {0};
  ssh_callbacks_init(&cb);
  cb.userdata = NULL;
  cb.channel_exit_status_function = exit_status_cb;

  printf("[Client] Registering callback NOW.\n");
  ssh_set_channel_callbacks(channel, &cb);

  printf(
      "[Client] Doing a blocking read to force libssh to process packets...\n");
  // Read to pump the event loop
  ssh_channel_read(channel, buf, sizeof(buf), 0);

  if (exit_status_received == -1) {
    printf("[Client] RESULT: Callback was NEVER triggered.\n");

    // The workaround:
    printf(
        "[Client] WORKAROUND: But ssh_channel_get_exit_status() returns: %d\n",
        ssh_channel_get_exit_status(channel));
  }

  ssh_channel_close(channel);
  ssh_channel_free(channel);
  ssh_disconnect(session);
  ssh_free(session);
  return 0;
}

Output result:

$ ./client
[Server] Client connected.
[Client] Requesting exec...
[Server] Exec requested. Replying success and sending exit status 42 IMMEDIATELY.
[Client] Doing a blocking read to force libssh to process packets...
[Client] Registering callback NOW.
[Client] Doing a blocking read to force libssh to process packets...
[Client] RESULT: Callback was NEVER triggered.
[Client] WORKAROUND: But ssh_channel_get_exit_status() returns: 42

[khwlsarthak18-a11y]

I'd like to work on this, is it still open?

[tobe2098]

This is being fixed in #5004, but thank you @khwlsarthak18-a11y

[khwlsarthak18-a11y]

This is being fixed in #5004, but thank you @khwlsarthak18-a11y

If there's anything else I can help with