Exposed sshd -- looping sshd-auth

[Darren Tucker]

On Mon, 21 Sept 2026 at 18:04, Darren Tucker <dtucker at dtucker.net> wrote:
[...]
> Anyway, it's the result of an old workaround and using atomicio in a
> new context (ie, this one):
> https://github.com/openssh/openssh-portable/commit/f5bbd3b657
> BROKEN_READ_COMPARISON on NetBSD, which does this in atomicio.c:
>
> #ifndef BROKEN_READ_COMPARISON
>         pfd.events = f == read ? POLLIN : POLLOUT;
> #else
>         pfd.events = POLLIN|POLLOUT;
> #endif
>
> So atomicio() is actually saying this is readable or writeable, hence
> the hard loop.
>
> I don't recall exactly why the comparison of read() function pointers
> didn't work at the time, but I've seen other "functions" like writev
> actually be macros on some platforms.  You can confirm this by
> removing BROKEN_READ_COMPARISON from config.h and recompiling.  I
> don't know if this will resurface the problems that prompted the
> change in the first place, though.

I ran a test on removing the workaround over all NetBSD versions I
have in the VM test zoo passed (3, 4 and 8-11) which goes back well
past the versions currently supported by NetBSD so I committed the
removal: https://github.com/openssh/openssh-portable/commit/a765b86d.

Note that anyone wanting to use this will need to run "autoconf" to
rebuild configure before running ./configure again.

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.