Bug#1136816: marked as done (openssh-client: TCP connect hang in OpenSSH 10.0p2, nc works)
"Debian Bug Tracking System" <[email protected]> Sun, 24 May 2026 14:15:02 +0000
| Newsgroups | gmane.linux.debian.devel.ssh |
|---|---|
| Message-ID | <handler.1136816.D1136816.1779631989628726.ackdone@bugs.debian.org> |
This is a multi-part message in MIME format... ------------=_1779632102-630021-0 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Your message dated Sun, 24 May 2026 15:13:05 +0100 with message-id <[email protected]> and subject line Re: Bug#1136816: Acknowledgement (openssh-client: TCP conn= ect hang in OpenSSH 10.0p2, nc works) has caused the Debian Bug report #1136816, regarding openssh-client: TCP connect hang in OpenSSH 10.0p2, nc works to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) --=20 1136816: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D1136816 Debian Bug Tracking System Contact [email protected] with problems ------------=_1779632102-630021-0 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at submit) by bugs.debian.org; 16 May 2026 12:09:15 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-13.6 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU, DKIM_VALID_EF,FOURLA,FREEMAIL_FROM,HAS_PACKAGE,HTML_MESSAGE,MULTALT, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 51; hammy, 144; neutral, 38; spammy, 1. spammytokens:0.950-+--instantly hammytokens:0.000-+--trixie, 0.000-+--Trixie, 0.000-+--apparmor, 0.000-+--AppArmor, 0.000-+--deb13-amd64 Return-path: <[email protected]> Received: from mail-wr1-x432.google.com ([2a00:1450:4864:20::432]:57460) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128) (Exim 4.96) (envelope-from <[email protected]>) id 1wODpS-001lrS-00 for [email protected]; Sat, 16 May 2026 12:09:15 +0000 Received: by mail-wr1-x432.google.com with SMTP id ffacd0b85a97d-449de065cb3so591478f8f.2 for <[email protected]>; Sat, 16 May 2026 05:09:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1778933349; cv=none; d=google.com; s=arc-20240605; b=Qsdjzx+z7qnt+o+uHSn2ZujxF7IAxH67RWIxVwlmxLCDvpRZSG8XPGg5B7FSFgw2Rg ni/NZ7TJDsAqY975Si7Y/VJ4xKr8lZynhCl6iIsDEvnld31sD5P/s2Bx6g2a+kREHxsu 1WcEHN9ZSKmGA7nKwwCX8CtEMEgbDEap5S0McfzsGVzYi8AGeeH8JEkGwmfSRt/FzR74 3lv+29SzeP0Buzkn8B13r9irw/lzGfUyLuqIiAD2PCVQSxfzDeoCbaG9QXAmMa6rqpwy 4ydML3WRrnuGYvC8PyUkcsYJBQx6xuYaabEd9R6dyYW5cuOEFjBmTxajrP8BRSBqYq3n kiTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=/hy2YTJbXFZAeMeG9gIF6No/+oltuMKPNAaiI5zkm9U=; fh=lIR/7veID2U00tj1D35G+ANF85YwqTAbTuNH/WGncTs=; b=asbPalxrMrxxbS6Bjyu0LtCOITeT9xz+Z5GZ0QurSd74ILz5uATMbMRaEEm7wUOxa2 OOa8kqSrAz5QeqG6r7oNOG+bKUgLQ5UZdsqRetO+fULejAtd8ZP2fPGbMfA2ae4U7rAI Z9lFn1jFsk7hplwFjhIRghdBm3xkcZGeWk+jGCvC6wOtLzvW0Lv6WjT2Cxu9pTsrKxyd YO5bH+xaTv+IByXUrluhvXPxojR2C0NWEEMENYtWqHrxhFX0yfBZlzLEeq8pnqyDI52F btlzpeuPp/lnXAnKk8xooIqP2w83PccpKfg5/gyM5GPjo4o2tXbk0NwRhfryQKFfnvQL SEXA==; darn=bugs.debian.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778933349; x=1779538149; darn=bugs.debian.org; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=/hy2YTJbXFZAeMeG9gIF6No/+oltuMKPNAaiI5zkm9U=; b=KRLi4Cw1fGhmylp5m48Ud+qsUDA8oPxoH6FrpZPczoT+t9RKdS++Np6bTjT8QK5tzT hIROSdVvYahRnobI3cTFmxVZcWdJz6Kg8zrhmC3ihhK7fnfODrf8ag86e9D1INc/NAz7 BLMi6TAV8UULk/+i5k0/rbc5ormV1RRDxORtQOyvsWRSdSpuc2pwn/zbXbnnFvb4grD3 cTbV4n72JaOmQTiHP0SO6e9y96R2GzTvvemJGhNa8hw8g9LJOLEA4Ah8cQZ/0K9VIqwo 3VYfL5URfvGuhFV9RUrhp98pFwUli3fjvE/IDIKRX3ln8lacgD6BPGThn3viKxHu5SYC qabQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778933349; x=1779538149; h=to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=/hy2YTJbXFZAeMeG9gIF6No/+oltuMKPNAaiI5zkm9U=; b=s94SRoxsbplDz4mJpWPgMqND4vbsi21vhPDmgINlBSyoND84KsbCWoqxbj+IjbqzgV L+chYWzbxbjQzhTM0mBDxoov3yc4zKvZMuqIw9om41M/O1Bex/kVh1Xit4cwopbgaTCh 1vM3k/h7+Jpa9acieoactZDuykOxZOO5LGzNvVfh3kCdxS/zl4ZM61LhrV+1oxUfx+lk /911Y5aza9e2ARKNFaDdHZnqI/zSLqM8NlGNVgu2vGZWZVpj4jua1iezFKzR9YscR2m1 6sGH7kcJjUOrpu3y9PcFJr2dn5LPPnTBfRxo04+BDVmUGmTy0wUvMRXmIhF6B2wQ5Z/X Qt7w== X-Gm-Message-State: AOJu0YxOuiC4TCgJYU+DJsH1mL1TFow6whfXZZDPdN4PYl8fb6BLbCko NJ7Fb0UWuDl6woYSqONX7QwbEst3iQ1NdJo/kmghG7cbE1zqJHmCcxOh1Mod1gfwTVeeC6Wlp+1 M+8tVwChZ76Z+Nykn6dIl4IqcjE2KXwDgsqY4 X-Gm-Gg: Acq92OHBd+yPsnryLpz2K67goIKyGCgvgdRzCkMUk+erDSrCHNauFFfjWVKewyAi1CA xj+ZdkIiDt5IwYmEhRq6ioGu7jJ7sbe4TaoFkom0rU/Uw1dFCNcUU/j77EyXZuW5b6jc6VaN/ZC H7eyLCDqTAuLZ3xyxq1fLJLE8Z+bC4+WOfP5OeAGvMk5J4NQ9HXZoz5DaDsGD0osSG+tYuAQi5n M9DsQcyyyDYeUR6M+kYh3VhUQCJrQOVJ3PIpnYkrkXmHb74R8jvbutkLCfngGImMTzOEZzPAMEz /TGyAQ== X-Received: by 2002:a05:6000:40cd:b0:439:c62a:6dc2 with SMTP id ffacd0b85a97d-45e5c5ddd3dmr11128616f8f.41.1778933349065; Sat, 16 May 2026 05:09:09 -0700 (PDT) MIME-Version: 1.0 From: Ezequiel Fernandez <[email protected]> Date: Sat, 16 May 2026 14:08:57 +0200 X-Gm-Features: AVHnY4LvocBkDRf_gzPJplFvHw-KMVhBTmvRgTGc0dHiNOVIA6gpByUnpSjxP6E Message-ID: <CABMGfG1fJhzb40vyObwD-8NKy30cspmT=L72rmvPqEsancDk7Q@mail.gmail.com> Subject: openssh-client: TCP connect hang in OpenSSH 10.0p2, nc works To: [email protected] Content-Type: multipart/alternative; boundary="00000000000059a8e50651ee32ab" Delivered-To: [email protected] --00000000000059a8e50651ee32ab Content-Type: text/plain; charset="UTF-8" Package: openssh-client Version: 1:10.0p2-7 Severity: normal OpenSSH 10.0p2 in Debian Trixie hangs indefinitely on TCP connect() to any remote host. nc(1) and curl(1) to the same IP:port work instantly, confirming this is not a network or firewall issue. Steps to reproduce: 1. ssh -V -> OpenSSH_10.0p2 Debian-7+deb13u2, OpenSSL 3.5.5 2. ssh -vT [email protected] 3. Hangs at: "Connecting to ssh.github.com [140.82.121.35] port 443." 4. Must Ctrl-C after ~30-60s. No error message, just timeout. Expected result: SSH handshake begins immediately (as with nc/curl). Actual result: connect() syscall never returns; connection stalls. Evidence: - nc -vz github.com 22 -> open (instant) - nc -vz ssh.github.com 443 -> open (instant) - curl -I https://github.com -> HTTP/2 200 (instant) - strace -e trace=network ssh -vT [email protected] shows: socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3 connect(3, {sa_family=AF_INET, sin_port=htons(443), sin_addr=inet_addr("140.82.121.35")}, 16) <-- hangs here Environment: - Fresh Debian 13 (Trixie) install, kernel 6.12.88+deb13-amd64 - No local firewall: iptables/nftables empty, no proxy env vars - No AppArmor denials in dmesg Workaround: Adding "ProxyCommand nc -q 0 %h %p" to ~/.ssh/config completely bypasses the bug, confirming the issue is specifically in OpenSSH's direct socket creation/connect path, not in the network layer. --00000000000059a8e50651ee32ab Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Package: openssh-client<br>Version: 1:10.0p2-7<br>Severity= : normal<br><br>OpenSSH 10.0p2 in Debian Trixie hangs indefinitely on TCP c= onnect()<br>to any remote host. nc(1) and curl(1) to the same IP:port work<= br>instantly, confirming this is not a network or firewall issue.<br><br>St= eps to reproduce:<br>1. ssh -V =C2=A0-> =C2=A0OpenSSH_10.0p2 Debian-7+de= b13u2, OpenSSL 3.5.5<br>2. ssh -vT <a href=3D"mailto:[email protected]">git@gi= thub.com</a><br>3. Hangs at: "Connecting to <a href=3D"http://ssh.gith= ub.com">ssh.github.com</a> [140.82.121.35] port 443."<br>4. Must Ctrl-= C after ~30-60s. No error message, just timeout.<br><br>Expected result: SS= H handshake begins immediately (as with nc/curl).<br>Actual result: connect= () syscall never returns; connection stalls.<br><br>Evidence:<br>- nc -vz <= a href=3D"http://github.com">github.com</a> 22 =C2=A0 =C2=A0 =C2=A0-> = =C2=A0open (instant)<br>- nc -vz <a href=3D"http://ssh.github.com">ssh.gith= ub.com</a> 443 -> =C2=A0open (instant)<br>- curl -I <a href=3D"https://g= ithub.com">https://github.com</a> -> =C2=A0HTTP/2 200 (instant)<br>- str= ace -e trace=3Dnetwork ssh -vT <a href=3D"mailto:[email protected]">git@github= .com</a> shows:<br>=C2=A0 socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) =3D 3<b= r>=C2=A0 connect(3, {sa_family=3DAF_INET, sin_port=3Dhtons(443), <br>=C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 sin_addr=3Dinet_addr("140.82.121.35"= )}, 16) =C2=A0<-- hangs here<br><br>Environment:<br>- Fresh Debian 13 (T= rixie) install, kernel 6.12.88+deb13-amd64<br>- No local firewall: iptables= /nftables empty, no proxy env vars<br>- No AppArmor denials in dmesg<br><br= >Workaround:<br>Adding "ProxyCommand nc -q 0 %h %p" to ~/.ssh/con= fig completely<br>bypasses the bug, confirming the issue is specifically in= OpenSSH's<br>direct socket creation/connect path, not in the network l= ayer.</div> --00000000000059a8e50651ee32ab-- ------------=_1779632102-630021-0 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at 1136816-done) by bugs.debian.org; 24 May 2026 14:13:09 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-109.6 required=4.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FROMDEVELOPER, HAS_BUG_NUMBER,SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 18; hammy, 131; neutral, 25; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <[email protected]> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:41888) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <[email protected]>) id 1wR9Zk-002dYY-0i for [email protected]; Sun, 24 May 2026 14:13:08 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:To:From:Date:Reply-To:Cc: Content-Transfer-Encoding:Content-ID:Content-Description; bh=kees+0avV8+tnll6s1XoLfQ1C1KvcrcFohj93kywa7k=; b=u74TZrNJLQVAz2JW4V4dKLXtDI P9KlK677P5Y5Xj0Zm54hLdrXSSDw9L0xmDBGogYjaFen1TDczTgWCjdnnsBCUh6Alj+5sWMU0l2za YclYEegwohn73gak6BjK6UGn9LuOWKzZNYzGMA2fj/+qOe6GVft5/bCkXww3SocQFT/KlKG3e5LUE dR92S0fO0N83TgTaWmUmkI31ABC/nrCKR97JIirBpNT4OJ1We36suLz3ZN+4VoIFOTxPHqsgoV9SE jq2VoXzlptnjP4g3TzSITbjeRJJn+Am9Wf4WCUH+4oZCjczsk1c5nOd9wP0TPZbhui0JCx54zpVoO 7BEk21Pg==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <[email protected]>) id 1wR9Zj-000r09-0J for [email protected]; Sun, 24 May 2026 14:13:07 +0000 Received: from ns1.rosewood.vpn.ucam.org ([172.20.153.2] helo=riva.ucam.org) by riva.rosewood.vpn.ucam.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from <[email protected]>) id 1wR9Zi-0000000A5xe-1xHa for [email protected]; Sun, 24 May 2026 15:13:06 +0100 Date: Sun, 24 May 2026 15:13:05 +0100 From: Colin Watson <[email protected]> To: [email protected] Subject: Re: Bug#1136816: Acknowledgement (openssh-client: TCP connect hang in OpenSSH 10.0p2, nc works) Message-ID: <[email protected]> References: <CABMGfG1fJhzb40vyObwD-8NKy30cspmT=L72rmvPqEsancDk7Q@mail.gmail.com> <[email protected]> <CABMGfG1fJhzb40vyObwD-8NKy30cspmT=L72rmvPqEsancDk7Q@mail.gmail.com> <CABMGfG2ks+iY1t4-AcNNeX6HFqj99SqxyX5F_NnmyZacn1j=Dg@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: <CABMGfG2ks+iY1t4-AcNNeX6HFqj99SqxyX5F_NnmyZacn1j=Dg@mail.gmail.com> X-Debian-User: cjwatson Source: openssh Source-Version: 1:10.0p1-7+deb13u4 On Mon, May 18, 2026 at 08:37:08AM +0200, Ezequiel Fernandez wrote: > Confirmed fixed in 1:10.0p1-7+deb13u4. > > ssh -T [1][email protected] and git clone now work immediately without any > workaround. The connect() stall is gone. Thanks for confirming. Closing this bug, then. Regards,