bug: Zombie users (reproduceable)

Expected Behavior

User will be kicked when the moderator types

/kick user

Actual Behavior

When using a certain client and exiting, the user lingers and cannot be kicked or banned until restarting the server.

Steps to reproduce behavior

0. Get an android phone.
1. Download the app termius from the Google Play Store.
2. Open the app and click on continue without account.
3. Go to hosts, click on new host, and enter the details such as your username. Make sure to enter ssh.chat as the IP address.
4. Once you've successfully ssh into the ssh.chat, completely close the app but leave it running in the background. (This can be done by just swiping the app away). Now let your phone idle on battery saving mode for a long time (I'd say around 45 minutes).
5. Go back to the app, and swipe right to reveal a menu. Go to terminal, which will show you a list of active terminals.
6. Finally, close the terminal by pressing the close button. The user should linger and is unable to be kicked or banned.

Additional Comments

This bug is extremely hard to reproduce intentionally and requires some patience.

I noticed that the client for the un-kickable users was SSH-2.0-libssh2_1.9.0_DEV (maybe this can be produced with other apps that support this type of client?).

Android version: 7
Battery Saving: On
SSH Client: Termius

[shazow]

cc @voldyman you were looking at this before, any interest in investigating? :)

[voldyman]

This is interesting, what happens when you try to kick the user after they've reached this state?

[shazow]

@voldyman The usual zombie behaviour we saw before,

12:01  onelegend_: I found a possible bug
12:02  [🍮 shazow] which was...
12:03  onelegend_: try kicing onelegend
12:03  onelegend_: or Guest2458
12:03  [🍮 shazow] /kick onelegend
12:03   * onelegend was kicked by 🍮 shazow.
12:03  [🍮 shazow] /whois onelegend
12:03  -> name: onelegend
 > ip: [snip]
 > fingerprint: (no public key)
 > client: SSH-2.0-libssh2_1.9.0_DEV
 > joined: 2.6 days ago

[shazow]

Maybe a good way is to setup a server with a debugger attached/tracing, and try connecting and dropping from termius.

[voldyman]

yeah, that would be a good starting point.

[shazow]

Having trouble reproducing locally T_T

$ ssh-anon -p 2022 localhost
Warning: Permanently added '[localhost]:2022' (RSA) to the list of known hosts.
 * shazow joined. (Connected: 1)
 * Guest1 joined. (Connected: 2)
 * Guest1 left. (After 2 seconds)
 * shazow left. (After 3 minutes)
 * shazow joined. (Connected: 1)
shazow: test
 * Guest3 joined. (Connected: 2)
[Guest3] hi
[Guest3] ping shazow
 * shazow left. (After 65 seconds)
 * u0_a241 joined. (Connected: 2)
u0_a241: hi
[Guest3] /whois u0_a241
-> name: u0_a241
 > fingerprint: (no public key)
 > client: SSH-2.0-OpenSSH_8.0
 > joined: 4 seconds ago
 * shazow joined. (Connected: 3)
[Guest3] /whois shazow
-> name: shazow
 > fingerprint: (no public key)
 > client: SSH-2.0-libssh2_1.9.0_DEV
 > joined: 4 seconds ago
[Guest3] /whois shazow
-> name: shazow
 > fingerprint: (no public key)
 > client: SSH-2.0-libssh2_1.9.0_DEV
 > joined: 99 seconds ago
 * shazow left. (After 9 minutes)
 * u0_a241 left. (After 12 minutes)
[Guest3] /whois shazow
-> Err: user not found

cc @shazow Wait until you can't physically type in the terminal to close it.

[shazow]

@epicgoldenlife I haven't been able to get it to that state, any other tips? I find the user disconnects within a few minutes of swiping away the app, at least on Android 11.

I'd say instead of swiping away the app, try just pressing the home key and locking the screen. I know this isn't part of the original procedure to reproduce this bug, but I think android may have been aggressively killing the app in your case.

[shazow]

Tried that too, still can't reproduce it. :( Can you try running the latest master ssh-chat locally and connecting to it from your phone and see if you can reproduce it locally?

I also noticed that when I connect to sshchat and then hibernate my windows device, the user stays connected for a few minutes, and I'm even able to resume the session like nothing happened when the computer is booted up again.

[shazow]

It's not related, that's just an artifact of the ssh timeout procedure and the ability to resume tcp sockets until they timeout.