e8b9919265
- Fix preauth seccomp separation on mainframes (bsc#1016709) [openssh-7.2p2-s390_hw_crypto_syscalls.patch] [openssh-7.2p2-s390_OpenSSL-ibmpkcs11_syscalls.patch] - enable case-insensitive hostname matching (bsc#1017099) [openssh-7.2p2-ssh_case_insensitive_host_matching.patch] - add CAVS tests [openssh-7.2p2-cavstest-ctr.patch] [openssh-7.2p2-cavstest-kdf.patch] - Adding missing pieces for user matching (bsc#1021626) - Properly verify CIDR masks in configuration (bsc#1005893) [openssh-7.2p2-verify_CIDR_address_ranges.patch] - Remove pre-auth compression support from the server to prevent possible cryptographic attacks. (CVE-2016-10012, bsc#1016370) [openssh-7.2p2-disable_preauth_compression.patch] - limit directories for loading PKCS11 modules (CVE-2016-10009, bsc#1016366) [openssh-7.2p2-restrict_pkcs11-modules.patch] - Prevent possible leaks of host private keys to low-privilege process handling authentication (CVE-2016-10011, bsc#1016369) [openssh-7.2p2-prevent_private_key_leakage.patch] - Do not allow unix socket forwarding when running without privilege separation (CVE-2016-10010, bsc#1016368) [openssh-7.2p2-secure_unix_sockets_forwarding.patch] - prevent resource depletion during key exchange (bsc#1005480, CVE-2016-8858) [openssh-7.2p2-kex_resource_depletion.patch] OBS-URL: https://build.opensuse.org/request/show/500279 OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=117
35 lines
958 B
Diff
35 lines
958 B
Diff
# HG changeset patch
|
|
# Parent 2afee80335d5ef7efcf64f3a797e9b10ce0de4ae
|
|
Do not throw away already open sockets for X11 forwarding if another socket
|
|
family is not available for bind()
|
|
|
|
diff --git a/openssh-7.2p2/channels.c b/openssh-7.2p2/channels.c
|
|
--- a/openssh-7.2p2/channels.c
|
|
+++ b/openssh-7.2p2/channels.c
|
|
@@ -3937,22 +3937,24 @@ x11_create_display_inet(int x11_display_
|
|
}
|
|
if (ai->ai_family == AF_INET6)
|
|
sock_set_v6only(sock);
|
|
if (x11_use_localhost)
|
|
channel_set_reuseaddr(sock);
|
|
if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
|
|
debug2("bind port %d: %.100s", port, strerror(errno));
|
|
close(sock);
|
|
-
|
|
+ continue;
|
|
+ /* do not remove successfully opened sockets
|
|
for (n = 0; n < num_socks; n++) {
|
|
close(socks[n]);
|
|
}
|
|
num_socks = 0;
|
|
break;
|
|
+ */
|
|
}
|
|
socks[num_socks++] = sock;
|
|
if (num_socks == NUM_SOCKS)
|
|
break;
|
|
}
|
|
freeaddrinfo(aitop);
|
|
if (num_socks > 0)
|
|
break;
|