Merge ~kstenerud/ubuntu/+source/openssh:openssh-broken-tunnel-forwarding-1801128 into ubuntu/+source/openssh:ubuntu/cosmic-devel

[Karl Stenerud]

Applied upstream patch to fix tunnel forwarding broken in 7.7p1.
https://github.com/openssh/openssh-portable/commit/cfb1d9bc76734681e3dea532a1504fcd466fbe91

PPA: ppa:kstenerud/openssh-broken-tunnel-forwarding-1801128

Steps to test:

# lxc launch ubuntu:cosmic tester && lxc exec tester bash

# apt update && \
apt dist-upgrade -y && \
sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g' /etc/ssh/sshd_config && \
sed -i 's/#PermitTunnel no/PermitTunnel yes/g' /etc/ssh/sshd_config && \
sed -i 's/#AllowTcpForwarding yes/AllowTcpForwarding yes/g' /etc/ssh/sshd_config && \
service sshd restart && \
echo ubuntu:ubuntu | chpasswd
# ssh -w any ubuntu@localhost
ubuntu@localhost's password:
Tunnel device open failed.
Could not request tunnel forwarding.

# add-apt-repository -y ppa:kstenerud/openssh-broken-tunnel-forwarding-1801128 && \
apt update && \
apt dist-upgrade -y
# ssh -w any ubuntu@localhost

* Should not say "Tunnel device open failed"

Package test results:

autopkgtest [10:43:29]: test regress: -----------------------]
autopkgtest [10:43:29]: test regress: - - - - - - - - - - results - - - - - - - - - -
regress PASS
autopkgtest [10:43:29]: @@@@@@@@@@@@@@@@@@@@ summary
regress PASS

[Christian Ehrhardt  (paelzer)]

minor style question - since I had no time for a full review I added a personal slot for me to add this.

[Christian Ehrhardt  (paelzer)]

The MP is good, but Disco has to complete the fix first.
+1

https://launchpad.net/ubuntu/+source/openssh/1:7.9p1-1 still is in proposed.
Only failures on snapd.

None of them seems related to the ssh upload
x86: tty ioctl issue
arm64: service didn't start

I re-kicked the tests, to check if the reproduce the error.
But I'd ask to get in touch with the snap people (MVO?) to ask if these are known issues that they plan to force override.

review: Approve

[Christian Ehrhardt  (paelzer)]

Arm resolved on the re-run
X86 still fails but this time on the same thing arm had before.

Unfortunately this seems to be a flaky test.
Please check the outcome the next few days and let us know once it completes or if you need help.

[Christian Ehrhardt  (paelzer)]

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/openssh
 * [new tag] upload/1%7.7p1-4ubuntu0.1 -> upload/1%7.7p1-4ubuntu0.1

[Christian Ehrhardt  (paelzer)]

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading openssh_7.7p1-4ubuntu0.1.dsc: done.
  Uploading openssh_7.7p1-4ubuntu0.1.debian.tar.xz: done.
  Uploading openssh_7.7p1-4ubuntu0.1_source.buildinfo: done.
  Uploading openssh_7.7p1-4ubuntu0.1_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index e0aab97..d7b02d6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openssh (1:7.7p1-4ubuntu0.1) cosmic; urgency=medium
+
+  * debian/patches/fix-broken-tunnel-forwarding.patch: Fix tunnel forwarding
+    broken in 7.7p1. Thanks to Damien Miller <[e-mail]>. (LP: #1801128)
+
+ -- Karl Stenerud <[e-mail]>  Wed, 07 Nov 2018 14:52:49 +0100
+
 openssh (1:7.7p1-4) unstable; urgency=high
 
   * Apply upstream patch to delay bailout for invalid authenticating user
diff --git a/debian/patches/fix-broken-tunnel-forwarding.patch b/debian/patches/fix-broken-tunnel-forwarding.patch
new file mode 100644
index 0000000..c2523fa
--- /dev/null
+++ b/debian/patches/fix-broken-tunnel-forwarding.patch
@@ -0,0 +1,30 @@
+Description: Fix tunnel forwarding broken in 7.7p1
+Origin: upstream, https://github.com/openssh/openssh-portable/commit/cfb1d9bc76734681e3dea532a1504fcd466fbe91
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2855
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1801128
+Last-Update: 2018-11-07
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+
+diff --git a/openbsd-compat/port-net.c b/openbsd-compat/port-net.c
+index 7050629c..bb535626 100644
+--- a/openbsd-compat/port-net.c
++++ b/openbsd-compat/port-net.c
+@@ -185,7 +185,7 @@ sys_tun_open(int tun, int mode, char **ifname)
+ 	else
+ 		debug("%s: %s mode %d fd %d", __func__, ifr.ifr_name, mode, fd);
+ 
+-	if (ifname != NULL && (*ifname = strdup(ifr.ifr_name)))
++	if (ifname != NULL && (*ifname = strdup(ifr.ifr_name)) == NULL)
+ 		goto failed;
+ 
+ 	return (fd);
+@@ -272,7 +272,7 @@ sys_tun_open(int tun, int mode, char **ifname)
+ 			goto failed;
+ 	}
+ 
+-	if (ifname != NULL && (*ifname = strdup(ifr.ifr_name)))
++	if (ifname != NULL && (*ifname = strdup(ifr.ifr_name)) == NULL)
+ 		goto failed;
+ 
+ 	close(sock);
diff --git a/debian/patches/series b/debian/patches/series
index e1eb167..ba24bda 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -26,3 +26,4 @@ seccomp-getuid-geteuid.patch
 seccomp-s390-ioctl-ep11-crypto.patch
 upstream-relax-checking-of-authorized_keys-environme.patch
 upstream-delay-bailout-for-invalid-authenticating-user.patch
+fix-broken-tunnel-forwarding.patch