Subject: [libssh2] Corrupted scp transfers

[libssh2] Corrupted scp transfers

From: Dan Fandrich <>
Date: Mon, 26 Mar 2007 16:15:36 -0700

I've added some scp tests to curl's test suite which use libssh2, and
I've found that the test file uploads (which are 30 byte files) are
corrupted sometimes. The uploaded files end up being 0 length. Running
the tests several times in succession usually causes it to work at least
once, so it looks like a timing related problem. I've tested on Linux
x86 systems using both 2.4 and 2.6 kernels and OpenSSH 3.1 and 3.9.

The following patch to libssh2_channel_close fixes the problem for that
test case (test603). Unfortunately, it causes the sftp tests to hang:

Index: channel.c
RCS file: /cvsroot/libssh2/libssh2/src/channel.c,v
retrieving revision 1.38
diff -u -r1.38 channel.c
--- channel.c 7 Feb 2007 21:42:45 -0000 1.38
+++ channel.c 26 Mar 2007 22:55:34 -0000
@@ -1381,6 +1381,8 @@
         LIBSSH2_SESSION *session = channel->session;
         unsigned char packet[5];
+ unsigned char channel_id[4], *data;
+ unsigned long data_len;
         if (channel->local.close) {
                 /* Already closed, act like we sent another close, even though we didn't... shhhhhh */
@@ -1402,6 +1404,12 @@
         /* TODO: Wait up to a timeout value for a CHANNEL_CLOSE to come back, to avoid the problem alluded to in channel_nextid */
+ libssh2_htonu32(channel_id, channel->;
+ if (libssh2_packet_require_ex(session, SSH_MSG_CHANNEL_CLOSE,
+ &data, &data_len, 1,
+ channel_id, sizeof(channel_id)) >= 0) {
+ LIBSSH2_FREE(session, data);
+ }
         return 0;

This forces libssh2 to wait for a SSH_MSG_CHANNEL_CLOSE response after it
sends a SSH_MSG_CHANNEL_CLOSE itself, which is required by
RFC4254. Presumably, this allows OpenSSH to cleanly complete
a transfer before the connection is torn down.

Unfortunately, libssh2_packet_add traps the received
SSH_MSG_CHANNEL_CLOSE message and it never actually gets returned by
the libssh2_packet_require_ex call above (instead, it returns with an
error code). Presumably, the SFTP test hangs on exit with this patch
because a SSH_MSG_CHANNEL_CLOSE message was already received by the time
the above is called and it just sits there waiting for a message that's
already been processed.

This comment is in the libssh2_packet_add CLOSE message handler:
/* TODO: Add a callback for this */
Sounds like that's what's really needed, with the callback aborting (somehow)
the libssh2_packet_require_ex call in the patch above.

>>> Dan

--              The web change of address service
          Let webmasters know that your web site has moved
Take Surveys. Earn Cash. Influence the Future of IT
Join's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
libssh2-devel mailing list
Received on 2007-03-27