Exposed sshd -- looping sshd-auth
Theo de Raadt
deraadt at openbsd.org
Tue Sep 22 11:28:37 AEST 2026
It seems like BROKEN_NETBSD_READ_COMPARISON came into portable soon
after netbsd fortify was enabled.
netbsd's fortify is built using cpp (rather than symbol equivelancy
using __asm statements), which create an issue. Pointer value
comparisons against in certain build circumstances, in this specific
situation it was determined that "f == read" fails, but calls to f()
still reach read(). That led to the workaround to use POLLIN|POLLOUT,
which worked where it was being used, but does not use in a new place
in the code.
Furthermore, netbsd has made very weird decisions with a completely
custom build Makefile for a long time. Whoever did that owns all the
pieces. It looks like more recently, this is being done in netbsd
pkgsrc without that custom build infrastructure, with different patches
and Makefiles. That's not OpenSSH stuff. It is NetBSD stuff. I
suspect this pkgsrc flip is because the old build infrastructure would
be difficult to adapt to the new 3 very-uniquely-compiled-sshd-binaries.
Anyways, this appears to be an interaction between netbsd decisions with
fortify, which forced openssh to try to work around it to netbsd's
benefit, and now switching to different build infrastructure.
We've spent a lot of time trying to fix the consequences of netbsd decisions.
More information about the openssh-unix-dev
mailing list