Attachment 3023 Details for Bug 2158 – Mask sigterm and replace select with pselect in server_accept_loop

[patch] Mask sigterm and replace select with pselect in server_accept_loop

ssh-sigterm-race.patch (text/plain), 1.75 KB, created by Darren Tucker on 2017-07-28 15:24:45 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: Darren Tucker

Created: 2017-07-28 15:24:45 AEST

Size: 1.75 KB

patch

obsolete

>Index: sshd.c
>===================================================================
>RCS file: /cvs/src/usr.bin/ssh/sshd.c,v
>retrieving revision 1.491
>diff -u -p -r1.491 sshd.c
>--- sshd.c	1 Jul 2017 13:50:45 -0000	1.491
>+++ sshd.c	28 Jul 2017 04:48:21 -0000
>@@ -155,6 +155,9 @@ char **rexec_argv;
> int listen_socks[MAX_LISTEN_SOCKS];
> int num_listen_socks = 0;
> 
>+/* Original signal set, unblocked during pselect and in child */
>+sigset_t orig_sigset;
>+
> /*
>  * the client's version string, passed by sshd2 in compat mode. if != NULL,
>  * sshd will skip the version-number exchange
>@@ -1073,7 +1076,7 @@ server_accept_loop(int *sock_in, int *so
> 				FD_SET(startup_pipes[i], fdset);
> 
> 		/* Wait in select until there is a connection. */
>-		ret = select(maxfd+1, fdset, NULL, NULL, NULL);
>+		ret = pselect(maxfd+1, fdset, NULL, NULL, NULL, &orig_sigset);
> 		if (ret < 0 && errno != EINTR)
> 			error("select: %.100s", strerror(errno));
> 		if (received_sigterm) {
>@@ -1705,8 +1708,17 @@ main(int ac, char **av)
> 	if (inetd_flag) {
> 		server_accept_inetd(&sock_in, &sock_out);
> 	} else {
>+		sigset_t sigset;
>+
> 		server_listen();
> 
>+		sigemptyset(&sigset);
>+		sigaddset(&sigset, SIGHUP);
>+		sigaddset(&sigset, SIGTERM);
>+		sigaddset(&sigset, SIGQUIT);
>+		if (sigprocmask(SIG_BLOCK, &sigset, &orig_sigset) == -1)
>+			error("sigprocmask block: %s", strerror(errno));
>+
> 		signal(SIGHUP, sighup_handler);
> 		signal(SIGCHLD, main_sigchld_handler);
> 		signal(SIGTERM, sigterm_handler);
>@@ -1798,6 +1810,8 @@ main(int ac, char **av)
> 	signal(SIGTERM, SIG_DFL);
> 	signal(SIGQUIT, SIG_DFL);
> 	signal(SIGCHLD, SIG_DFL);
>+	if (sigprocmask(SIG_UNBLOCK, &orig_sigset, NULL) == -1)
>+		error("sigprocmask unblock: %s", strerror(errno));
> 
> 	/*
> 	 * Register our connection.  This turns encryption off because we do

Actions: View | Diff

Attachments on bug 2158: 3023 | 3520 | 3523