Merge ~athos-ribeiro/ubuntu/+source/openssh:lp1903516-timeout-impish into ubuntu/+source/openssh:ubuntu/impish-devel

[Athos Ribeiro]

This is an SRU proposal for LP: #1903516 for impish. Due to its size and relevance, the idea is to stage the SRU.

A PPA with the proposed changes is available at

https://launchpad.net/~athos-ribeiro/+archive/ubuntu/openssh-lp1903516-timeout/+packages

I ran the autopkgtest suite locally, here is the result summary:

autopkgtest [14:01:54]: @@@@@@@@@@@@@@@@@@@@ summary
regress PASS

[Sergio Durigan Junior (sergiodj)]

I'll take a look at this one.

[Sergio Durigan Junior (sergiodj)]

LGTM.

Patch is trivial and does indeed fix the bug. I also agree with staging this SRU. The SRU template looks great; kudos for the perl magic to make the test generic :-).

+1

review: Approve

[Sergio Durigan Junior (sergiodj)]

Uploaded:

$ dput openssh_8.4p1-6ubuntu2.2_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/openssh/openssh_8.4p1-6ubuntu2.2_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/openssh/openssh_8.4p1-6ubuntu2.2.dsc: Valid signature from 106DA1C8C3CBBF14
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading openssh_8.4p1-6ubuntu2.2.dsc: done.
  Uploading openssh_8.4p1-6ubuntu2.2.debian.tar.xz: done.
  Uploading openssh_8.4p1-6ubuntu2.2_source.buildinfo: done.
  Uploading openssh_8.4p1-6ubuntu2.2_source.changes: done.
Successfully uploaded packages.

Feel free to tag the bug as block-proposed-impish to stage the upload.

diff --git a/debian/changelog b/debian/changelog
index 858e1a7..036593f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openssh (1:8.4p1-6ubuntu2.2) impish; urgency=medium
+
+  * d/p/fix-connect-timeout-overflow.patch: prevent ConnectTimeout overflow.
+    (LP: #1903516)
+
+ -- Athos Ribeiro <[e-mail]>  Wed, 30 Mar 2022 09:40:10 -0300
+
 openssh (1:8.4p1-6ubuntu2.1) impish; urgency=medium
 
   * d/p/match-host-certs-w-public-keys.patch: Add patch
diff --git a/debian/patches/fix-connect-timeout-overflow.patch b/debian/patches/fix-connect-timeout-overflow.patch
new file mode 100644
index 0000000..2a761e9
--- /dev/null
+++ b/debian/patches/fix-connect-timeout-overflow.patch
@@ -0,0 +1,32 @@
+From 819b44e8b9af6ce18d3ec7505b9f461bf7991a1f Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Thu, 12 Nov 2020 22:38:57 +0000
+Subject: [PATCH] upstream: Prevent integer overflow when ridiculously large
+
+ConnectTimeout is specified, capping the effective value (for most platforms)
+at 24 days. bz#3229, ok djm@
+
+OpenBSD-Commit-ID: 62d4c4b7b87d111045f8e9f28b5b532d17ac5bc0
+
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=3229
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1903516
+Origin: upstream, http://anongit.mindrot.org/openssh.git/commit/?id=819b44e8b9af6ce18d3ec7505b9f461bf7991a1f
+Last-Update: 2022-03-30
+---
+ ssh.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/ssh.c
++++ b/ssh.c
+@@ -1540,7 +1540,10 @@
+ 			cleanup_exit(255); /* resolve_host logs the error */
+ 	}
+ 
+-	timeout_ms = options.connection_timeout * 1000;
++	if (options.connection_timeout >= INT_MAX/1000)
++		timeout_ms = INT_MAX;
++	else
++		timeout_ms = options.connection_timeout * 1000;
+ 
+ 	/* Open a connection to the remote host. */
+ 	if (ssh_connect(ssh, host, host_arg, addrs, &hostaddr, options.port,
diff --git a/debian/patches/series b/debian/patches/series
index 59b8e4b..892a191 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -31,3 +31,4 @@ ssh-agent-double-free.patch
 1bb130ed34721d46452529d094d9bbf045607d79.patch
 regress-includes.patch
 match-host-certs-w-public-keys.patch
+fix-connect-timeout-overflow.patch