6dac324cb7
- enable support for SSHv1 protocol and discourage its usage
(bsc#983307)
- enable DSA by default for backward compatibility and discourage
its usage (bsc#983784)
[openssh-7.2p2-allow_DSS_by_default.patch]
- upgrade to 7.2p2
upstream package without any SUSE patches
Distilled upstream log:
- OpenSSH 6.7
Potentially-incompatible changes:
* sshd(8): The default set of ciphers and MACs has been
altered to remove unsafe algorithms. In particular, CBC
ciphers and arcfour* are disabled by default.
The full set of algorithms remains available if configured
explicitly via the Ciphers and MACs sshd_config options.
* sshd(8): Support for tcpwrappers/libwrap has been removed.
* OpenSSH 6.5 and 6.6 have a bug that causes ~0.2% of
connections using the curve25519-sha256@libssh.org KEX
exchange method to fail when connecting with something that
implements the specification correctly. OpenSSH 6.7 disables
this KEX method when speaking to one of the affected
versions.
New Features:
* ssh(1), sshd(8): Add support for Unix domain socket
forwarding. A remote TCP port may be forwarded to a local
Unix domain socket and vice versa or both ends may be a Unix
domain socket.
* ssh(1), ssh-keygen(1): Add support for SSHFP DNS records for
ED25519 key types.
OBS-URL: https://build.opensuse.org/request/show/407066
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=107
77 lines
2.2 KiB
Diff
77 lines
2.2 KiB
Diff
# HG changeset patch
|
|
# Parent 5469eb754184144e42c341ccc038309e2880cadc
|
|
block SIGALRM while logging through syslog to prevent deadlocks
|
|
(through grace_alarm_handler())
|
|
|
|
bnc#57354
|
|
|
|
diff --git a/openssh-7.2p2/log.c b/openssh-7.2p2/log.c
|
|
--- a/openssh-7.2p2/log.c
|
|
+++ b/openssh-7.2p2/log.c
|
|
@@ -46,16 +46,17 @@
|
|
#include <syslog.h>
|
|
#include <unistd.h>
|
|
#include <errno.h>
|
|
#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
|
|
# include <vis.h>
|
|
#endif
|
|
|
|
#include "log.h"
|
|
+#include <signal.h>
|
|
|
|
static LogLevel log_level = SYSLOG_LEVEL_INFO;
|
|
static int log_on_stderr = 1;
|
|
static int log_stderr_fd = STDERR_FILENO;
|
|
static int log_facility = LOG_AUTH;
|
|
static char *argv0;
|
|
static log_handler_fn *log_handler;
|
|
static void *log_handler_ctx;
|
|
@@ -383,16 +384,17 @@ do_log(LogLevel level, const char *fmt,
|
|
{
|
|
#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)
|
|
struct syslog_data sdata = SYSLOG_DATA_INIT;
|
|
#endif
|
|
char msgbuf[MSGBUFSIZ];
|
|
char fmtbuf[MSGBUFSIZ];
|
|
char *txt = NULL;
|
|
int pri = LOG_INFO;
|
|
+ sigset_t nset, oset;
|
|
int saved_errno = errno;
|
|
log_handler_fn *tmp_handler;
|
|
|
|
if (level > log_level)
|
|
return;
|
|
|
|
switch (level) {
|
|
case SYSLOG_LEVEL_FATAL:
|
|
@@ -441,20 +443,29 @@ do_log(LogLevel level, const char *fmt,
|
|
tmp_handler = log_handler;
|
|
log_handler = NULL;
|
|
tmp_handler(level, fmtbuf, log_handler_ctx);
|
|
log_handler = tmp_handler;
|
|
} else if (log_on_stderr) {
|
|
snprintf(msgbuf, sizeof msgbuf, "%s\r\n", fmtbuf);
|
|
(void)write(log_stderr_fd, msgbuf, strlen(msgbuf));
|
|
} else {
|
|
+ /* Prevent a race between the grace_alarm
|
|
+ * which writes a log message and terminates
|
|
+ * and main sshd code that leads to deadlock
|
|
+ * as syslog is not async safe.
|
|
+ */
|
|
+ sigemptyset(&nset);
|
|
+ sigaddset(&nset, SIGALRM);
|
|
+ sigprocmask(SIG_BLOCK, &nset, &oset);
|
|
#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)
|
|
openlog_r(argv0 ? argv0 : __progname, LOG_PID, log_facility, &sdata);
|
|
syslog_r(pri, &sdata, "%.500s", fmtbuf);
|
|
closelog_r(&sdata);
|
|
#else
|
|
openlog(argv0 ? argv0 : __progname, LOG_PID, log_facility);
|
|
syslog(pri, "%.500s", fmtbuf);
|
|
closelog();
|
|
#endif
|
|
+ sigprocmask(SIG_SETMASK, &oset, NULL);
|
|
}
|
|
errno = saved_errno;
|
|
}
|