NetBSD Problem Report #60563
From he@smistad.uninett.no Sun Aug 9 13:09:45 2026
Return-Path: <he@smistad.uninett.no>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
client-signature RSA-PSS (2048 bits) client-digest SHA256)
(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id 2B2001A923B
for <gnats-bugs@gnats.NetBSD.org>; Sun, 9 Aug 2026 13:09:45 +0000 (UTC)
Message-Id: <20260809130940.AE75D43FB49@smistad.uninett.no>
Date: Sun, 9 Aug 2026 15:09:40 +0200 (CEST)
From: he@NetBSD.org
Reply-To: he@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: exposed sshd w/o password-login causes sshd-auth looping
X-Send-Pr-Version: 3.95
X-From4GNATS: "he@NetBSD.org via gnats" <gnats-admin@NetBSD.org>
>Number: 60563
>Category: pkg
>Synopsis: exposed sshd w/o password-login causes sshd-auth looping
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: pkg-manager
>State: closed
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Sun Aug 09 13:10:00 +0000 2026
>Closed-Date: Tue Oct 13 14:35:09 +0000 2026
>Last-Modified: Tue Oct 13 14:35:09 +0000 2026
>Originator: Havard Eidnes
>Release: NetBSD 10.1
>Organization:
I try...
>Environment:
System: NetBSD castor.urc.uninett.no 10.1 NetBSD 10.1 (GENERIC) #0: Mon Dec 16 13:08:11 UTC 2024 mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:
I manage a few exposed sshd installations.
They are all configured to dis-allow password or keyboard-interactive
authentication methods, in other words: they insist on ssh key-based
logins, via:
PasswordAuthentication no
KbdInteractiveAuthentication no
in /etc/ssh/sshd_config.
Also, these sshd's are from the pkgsrc security/openssh package,
via /etc/rc.conf.d/sshd containing
command=/usr/pkg/sbin/sshd
Of course these sshd's get probed by automated scanners, so
I have installed "denyhosts" to get rid of the worst of it.
But of course, some still manage to connect. And a few of
these again appear to expose a "resource consumption problem"
at my end: some connections cause the sshd-auth process to
enter a rather tight loop doing syscalls, in particular a
loop with poll() and read(). An example demonstrating this
is shown with "ktruss -R -p 6007":
6007 6007 sshd-auth 0.000001846 poll(0x7f7fff737090, 0x1, 0xffffffff) = 1
6007 6007 sshd-auth 0.000024690 read(0x5, 0x7f7fff73712f, 0x1) Err#35 EAGAIN
6007 6007 sshd-auth 0.000002275 poll(0x7f7fff737090, 0x1, 0xffffffff) = 1
6007 6007 sshd-auth 0.000001622 read(0x5, 0x7f7fff73712f, 0x1) Err#35 EAGAIN
6007 6007 sshd-auth 0.000002040 poll(0x7f7fff737090, 0x1, 0xffffffff) = 1
6007 6007 sshd-auth 0.000001593 read(0x5, 0x7f7fff73712f, 0x1) Err#35 EAGAIN
6007 6007 sshd-auth 0.000001924 poll(0x7f7fff737090, 0x1, 0xffffffff) = 1
This process is eventually culled by the main sshd, but only
after it has spent 10 minutes CPU time on this activity.
The file descriptor involved above (5) appears to be the TCP
connection back to the scanner:
castor# fstat -n -p 6007
USER CMD PID FD DEV INUM MODE SZ|DV R/W
sshd sshd-auth 6007 root 168,1 48394025 40755 512 r
sshd sshd-auth 6007 wd 168,1 48394025 40755 512 r
sshd sshd-auth 6007 0 168,1 19910412 20666 2,2 rw
sshd sshd-auth 6007 1 168,1 19910412 20666 2,2 rw
sshd sshd-auth 6007 2 168,1 19910412 20666 2,2 rw
sshd sshd-auth 6007 3* unix stream 0xfffffe850732db80 <-> 0xfffffe8c35cffd00
sshd sshd-auth 6007 4* pipe 0xfffffe97e008eae0 -> 0xfffffe9a4520bbf8 w
sshd sshd-auth 6007 5* internet stream tcp 45.176.232.161:36048 <-> 217.144.76.202:22
castor# netstat -f inet -n | egrep 45.176.232.161\|Q
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 22 217.144.76.202.22 45.176.232.161.36048 ESTABLISHED
castor#
So ... admittedly I have not looked at the code of sshd-auth,
but if it is programmed "correctly", poll() should not indicate
that there is readable data on the FD in question, when the
EAGAIN indicate there is not (evidently the FD is in non-blocking
mode). So currently it's a bit unclear whether this is a bug
hiding inside sshd-auth or whether it's a NetBSD networking bug.
Oh, this is with
castor# pkg_info | grep openssh
openssh-10.4p1 Open Source Secure shell client and server (remote login program)
castor#
>How-To-Repeat:
See above.
>Fix:
That would be nice.
>Release-Note:
>Audit-Trail:
From: Havard Eidnes <he@NetBSD.org>
To: gnats-bugs@netbsd.org
Cc:
Subject: Re: pkg/60563: exposed sshd w/o password-login causes sshd-auth
looping
Date: Tue, 22 Sep 2026 09:40:48 +0200 (CEST)
Hi,
an update, after having been a trip via the openssh-unix-dev
mailing list, and the discussion thread is available at
https://lists.mindrot.org/pipermail/openssh-unix-dev/2026-September/042758.html
and a fix was committed upstream:
https://github.com/openssh/openssh-portable/commit/a765b86d
Unless I hear objections, I'll take a stab at applying this to
our pkgsrc openssh.
Regards,
- Havard
From: Havard Eidnes <he@NetBSD.org>
To: gnats-bugs@NetBSD.org
Cc:
Subject: Re: pkg/60563: exposed sshd w/o password-login causes sshd-auth
looping
Date: Tue, 22 Sep 2026 13:02:51 +0200 (CEST)
----Next_Part(Tue_Sep_22_13_02_51_2026_679)--
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
This fix (plus Thomas' following removal of my accidntal commit
of the CFLAGS setting) appear to fix the mild DoS-aspect of this
issue.
Regards,
- Havard
----Next_Part(Tue_Sep_22_13_02_51_2026_679)--
Content-Type: Message/Rfc822
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Delivery-Date: Tue, 22 Sep 2026 10:32:44 +0200
MIME-Version: 1.0
Received: by mail.netbsd.org (Postfix, from userid 605)
id 9D93485784; Tue, 22 Sep 2026 08:04:01 +0000 (UTC)
Delivered-To: pkgsrc-changes@NetBSD.org
Received: by cvs.NetBSD.org (Postfix, from userid 500)
id B2A8AFA2D; Tue, 22 Sep 2026 08:03:59 +0000 (UTC)
Content-Transfer-Encoding: 7bit
Content-Type: multipart/mixed; boundary="_----------=_1790064239251930"
Date: Tue, 22 Sep 2026 08:03:59 +0000
From: "Havard Eidnes" <he@netbsd.org>
Subject: CVS commit: pkgsrc/security/openssh
To: pkgsrc-changes@NetBSD.org
Reply-To: he@netbsd.org
X-Mailer: log_accum
Message-Id: <20260922080359.B2A8AFA2D@cvs.NetBSD.org>
Sender: pkgsrc-changes-owner@NetBSD.org
List-Id: <pkgsrc-changes.NetBSD.org>
Precedence: bulk
List-Unsubscribe: <mailto:majordomo@NetBSD.org?subject=Unsubscribe%20pkgsrc-changes&body=unsubscribe%20pkgsrc-changes>
--_----------=_1790064239251930
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="US-ASCII"
Module Name: pkgsrc
Committed By: he
Date: Tue Sep 22 08:03:59 UTC 2026
Modified Files:
pkgsrc/security/openssh: Makefile distinfo
pkgsrc/security/openssh/patches: patch-configure.ac
Added Files:
pkgsrc/security/openssh/patches: patch-atomicio.c
Log Message:
security/openssh: remove no-longer-needed BROKEN_READ_COMPARISON code.
This mirrors upstream change:
https://github.com/openssh/openssh-portable/commit/a765b86d
ref. mailing list thread at
https://lists.mindrot.org/pipermail/openssh-unix-dev/2026-September/042758.html
Bump PKGREVISION.
To generate a diff of this commit:
cvs rdiff -u -r1.294 -r1.295 pkgsrc/security/openssh/Makefile
cvs rdiff -u -r1.132 -r1.133 pkgsrc/security/openssh/distinfo
cvs rdiff -u -r0 -r1.4 pkgsrc/security/openssh/patches/patch-atomicio.c
cvs rdiff -u -r1.11 -r1.12 pkgsrc/security/openssh/patches/patch-configure.ac
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
--_----------=_1790064239251930
Content-Disposition: inline
Content-Length: 4950
Content-Transfer-Encoding: binary
Content-Type: text/x-diff; charset=us-ascii
Modified files:
Index: pkgsrc/security/openssh/Makefile
diff -u pkgsrc/security/openssh/Makefile:1.294 pkgsrc/security/openssh/Makefile:1.295
--- pkgsrc/security/openssh/Makefile:1.294 Tue Aug 11 07:16:40 2026
+++ pkgsrc/security/openssh/Makefile Tue Sep 22 08:03:59 2026
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.294 2026/08/11 07:16:40 wiz Exp $
+# $NetBSD: Makefile,v 1.295 2026/09/22 08:03:59 he Exp $
DISTNAME= openssh-10.5p1
+PKGREVISION= 1
CATEGORIES= security
MASTER_SITES= ${MASTER_SITE_OPENBSD:=OpenSSH/portable/}
@@ -19,6 +20,8 @@ BROKEN_ON_PLATFORM+= OpenBSD-*-*
USE_GCC_RUNTIME= yes
USE_TOOLS+= autoconf perl
+CFLAGS+= -g
+
# retain the following line, for IPv6-ready pkgsrc webpage
BUILD_DEFS+= IPV6_READY
Index: pkgsrc/security/openssh/distinfo
diff -u pkgsrc/security/openssh/distinfo:1.132 pkgsrc/security/openssh/distinfo:1.133
--- pkgsrc/security/openssh/distinfo:1.132 Tue Aug 11 07:16:40 2026
+++ pkgsrc/security/openssh/distinfo Tue Sep 22 08:03:59 2026
@@ -1,9 +1,10 @@
-$NetBSD: distinfo,v 1.132 2026/08/11 07:16:40 wiz Exp $
+$NetBSD: distinfo,v 1.133 2026/09/22 08:03:59 he Exp $
BLAKE2s (openssh-10.5p1.tar.gz) = 0a7483f05aa98e39cd4c7c8f2c259a3f5dd96d784e8934f6a7e94d6bf0a47c83
SHA512 (openssh-10.5p1.tar.gz) = 5336c1945527b29ed59cc500fa8bfbd918f5ba97e85512daad9ab7241418929bf7152d300e5f3c5f9a8c8d699dfde5a64c5faa4fc33b2758ab52dd04040d6284
Size (openssh-10.5p1.tar.gz) = 2333659 bytes
SHA1 (patch-Makefile.in) = d58adac52e169f25f0b0c3a321f154b44b0475e6
-SHA1 (patch-configure.ac) = 10894c1b98298a1672ec151a223f6180bf841fa4
+SHA1 (patch-atomicio.c) = cfb54868643d946cded4f2f5d6054bc26d299290
+SHA1 (patch-configure.ac) = ea50059cf979d5c00f8beae027e0419fbd68cdb2
SHA1 (patch-defines.h) = c1dbb18076b4fa399b0f791bb543ef1e5cb0408e
SHA1 (patch-sshkey.h) = aaaf622f377e455c49683fcc2ca42576ccd097bb
Index: pkgsrc/security/openssh/patches/patch-configure.ac
diff -u pkgsrc/security/openssh/patches/patch-configure.ac:1.11 pkgsrc/security/openssh/patches/patch-configure.ac:1.12
--- pkgsrc/security/openssh/patches/patch-configure.ac:1.11 Tue Feb 18 09:33:07 2025
+++ pkgsrc/security/openssh/patches/patch-configure.ac Tue Sep 22 08:03:59 2026
@@ -1,8 +1,13 @@
-$NetBSD: patch-configure.ac,v 1.11 2025/02/18 09:33:07 wiz Exp $
+$NetBSD: patch-configure.ac,v 1.12 2026/09/22 08:03:59 he Exp $
+
+Remove no-longer-needed BROKEN_READ_COMPARISON, ref.
+ https://github.com/openssh/openssh-portable/commit/a765b86d
+
+Tweak for wtmpx location probing.
--- configure.ac.orig 2024-07-01 04:36:28.000000000 +0000
+++ configure.ac
-@@ -380,6 +380,9 @@ AC_ARG_WITH([rpath],
+@@ -388,6 +388,9 @@ AC_ARG_WITH([rpath],
]
)
@@ -12,7 +17,16 @@ $NetBSD: patch-configure.ac,v 1.11 2025/
# Allow user to specify flags
AC_ARG_WITH([cflags],
[ --with-cflags Specify additional flags to pass to compiler],
-@@ -5568,9 +5571,17 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+@@ -1144,8 +1147,6 @@ mips-sony-bsd|mips-sony-newsos4)
+ AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
+ [Prepend the address family to IP tunnel traffic])
+ TEST_MALLOC_OPTIONS="AJRX"
+- AC_DEFINE([BROKEN_READ_COMPARISON], [1],
+- [NetBSD read function is sometimes redirected, breaking atomicio comparisons against it])
+ ;;
+ *-*-freebsd*)
+ AC_DEFINE([LOCKED_PASSWD_PREFIX], ["*LOCKED*"], [Account locked with pw(1)])
+@@ -5742,9 +5743,17 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
])
if test -z "$conf_wtmpx_location"; then
if test x"$system_wtmpx_path" = x"no" ; then
@@ -32,7 +46,7 @@ $NetBSD: patch-configure.ac,v 1.11 2025/
AC_DEFINE_UNQUOTED([CONF_WTMPX_FILE], ["$conf_wtmpx_location"],
[Define if you want to specify the path to your wtmpx file])
fi
-@@ -5677,7 +5688,7 @@ echo "OpenSSH has been configured with t
+@@ -5853,7 +5862,7 @@ echo "OpenSSH has been configured with t
echo " User binaries: $B"
echo " System binaries: $C"
echo " Configuration files: $D"
Added files:
Index: pkgsrc/security/openssh/patches/patch-atomicio.c
diff -u /dev/null pkgsrc/security/openssh/patches/patch-atomicio.c:1.4
--- /dev/null Tue Sep 22 08:03:59 2026
+++ pkgsrc/security/openssh/patches/patch-atomicio.c Tue Sep 22 08:03:59 2026
@@ -0,0 +1,24 @@
+$NetBSD: patch-atomicio.c,v 1.4 2026/09/22 08:03:59 he Exp $
+
+Remove no-longer-needed BROKEN_READ_COMPARISON code, to mirror
+
+ https://github.com/openssh/openssh-portable/commit/a765b86d
+
+ref. mailing list thread at
+
+ https://lists.mindrot.org/pipermail/openssh-unix-dev/2026-September/042758.html
+
+--- atomicio.c.orig 2026-09-22 07:42:45.683284535 +0000
++++ atomicio.c
+@@ -51,11 +51,7 @@ atomicio6(ssize_t (*f) (int, void *, siz
+ struct pollfd pfd;
+
+ pfd.fd = fd;
+-#ifndef BROKEN_READ_COMPARISON
+ pfd.events = f == read ? POLLIN : POLLOUT;
+-#else
+- pfd.events = POLLIN|POLLOUT;
+-#endif
+ while (n > pos) {
+ res = (f) (fd, s + pos, n - pos);
+ switch (res) {
--_----------=_1790064239251930--
----Next_Part(Tue_Sep_22_13_02_51_2026_679)----
State-Changed-From-To: open->closed
State-Changed-By: he@NetBSD.org
State-Changed-When: Tue, 22 Sep 2026 19:57:14 +0000
State-Changed-Why:
Fix applied from upstream to pkgsrc.
Also edited away a lot of the MS mail headers.
From: Havard Eidnes <he@uninett.no>
To: gnats-bugs@NetBSD.org
Cc:
Subject: Re: pkg/60563: exposed sshd w/o password-login causes sshd-auth
looping
Date: Sat, 03 Oct 2026 20:51:36 +0200 (CEST)
Hm,
it doesn't look like the fix to net/openssh which gave us
10.5p1nb1 resolves this issue correctly.
The issue is reportedly triggered by just connecting to the sshd
port, and not giving any input, so no "ultra-malicious motives"
are needed.
What this will cause is sshd-auth will enter a tight loop where
it tests via poll() that the FD is *writable*, and then do read()
on the FD, and getting EAGAIN because nothing is possible to read
because nothing is and the FD is in non-blocking mode, and the
cycle repeats. It will repeat this cycle until the self-imposed
10 minutes CPU time resource limit expires.
The pattern the code uses is
In kex_exchange_identification() the code does (among other
things):
len = atomicio(read, ssh_packet_get_connection_in(ssh),
&c, 1);
In other words, it tries to pass "read" as a function pointer.
atomicio() in atomicio.c is
size_t
atomicio(ssize_t (*f) (int, void *, size_t), int fd, void *_s, size_t n)
{
return atomicio6(f, fd, _s, n, NULL, NULL);
}
and then inside atomicio6() we find:
pfd.events = f == read ? POLLIN : POLLOUT;
...
while (n > pos) {
res = (f) (fd, s + pos, n - pos);
switch (res) {
case -1:
if (errno == EINTR) {
/* possible SIGALARM, update callback */
if (cb != NULL && cb(cb_arg, 0) == -1) {
errno = EINTR;
return pos;
}
continue;
} else if (errno == EAGAIN || errno == EWOULDBLOCK) {
(void)poll(&pfd, 1, -1);
continue;
}
Now, the issue is that pfd.events in that first conditional ends
up as POLLOUT, not POLLIN:
#define POLLIN 0x0001
#define POLLPRI 0x0002
#define POLLOUT 0x0004
even though the code invocation from
kex_exchange_identification() is passing "read" as the first
argument:
(gdb) where
#0 0x00007b8ff90473fa in read () from /usr/lib/libc.so.12
#1 0x00007b8ff8c08579 in read () from /usr/lib/libpthread.so.1
#2 0x00000000448723f1 in atomicio6 (f=f@entry=0x44882cd0 <read>, fd=5,
_s=_s@entry=0x7f7ffffdae2f, n=n@entry=1, cb=cb@entry=0x0,
cb_arg=cb_arg@entry=0x0) at atomicio.c:56
#3 0x00000000448724c5 in atomicio (f=f@entry=0x44882cd0 <read>,
fd=<optimized out>, _s=_s@entry=0x7f7ffffdae2f, n=n@entry=1)
at atomicio.c:88
#4 0x0000000044885f11 in kex_exchange_identification (
ssh=ssh@entry=0x7b8ffb03d000, timeout_ms=<optimized out>,
timeout_ms@entry=-1, version_addendum=<optimized out>) at kex.c:1322
#5 0x00000000448b662d in do_ssh2_kex (ssh=0x7b8ffb03d000) at sshd-auth.c:787
#6 main (ac=<optimized out>, av=<optimized out>) at sshd-auth.c:735
(gdb)
(gdb) down
#3 0x00000000448724c5 in atomicio (f=f@entry=0x44882cd0 <read>,
fd=<optimized out>, _s=_s@entry=0x7f7ffffdae2f, n=n@entry=1)
at atomicio.c:88
88 return atomicio6(f, fd, _s, n, NULL, NULL);
(gdb) down
#2 0x00000000448723f1 in atomicio6 (f=f@entry=0x44882cd0 <read>, fd=5,
_s=_s@entry=0x7f7ffffdae2f, n=n@entry=1, cb=cb@entry=0x0,
cb_arg=cb_arg@entry=0x0) at atomicio.c:56
56 res = (f) (fd, s + pos, n - pos);
(gdb) p f
$7 = (ssize_t (*)(int, void *, size_t)) 0x44882cd0 <read>
(gdb) p read
$8 = {ssize_t (int, void *, size_t)} 0x44872150 <read>
(gdb)
(gdb) p pfd
$9 = {fd = 5, events = 4, revents = 4}
(gdb)
(gdb) up
#3 0x00000000448724c5 in atomicio (f=f@entry=0x44882cd0 <read>,
fd=<optimized out>, _s=_s@entry=0x7f7ffffdae2f, n=n@entry=1)
at atomicio.c:88
88 return atomicio6(f, fd, _s, n, NULL, NULL);
(gdb) up
#4 0x0000000044885f11 in kex_exchange_identification (
ssh=ssh@entry=0x7b8ffb03d000, timeout_ms=<optimized out>,
timeout_ms@entry=-1, version_addendum=<optimized out>) at kex.c:1322
1322 len = atomicio(read, ssh_packet_get_connection_in(ssh),
(gdb)
Those two $7 and $8 are *not* the same, while the code appears to
assume that they will be in this case.
The $9 result shows that pfd.events is POLLOUT. But that's not
what's wanted to test for, it should here be testing whether the
FD is readable (POLLIN), not whether it's writable.
Now... __SSP_FORTIFY_LEVEL may play into this. Not sure what it
is by default, but possibly and probably not 0, so read() doesn't
get defined via this entry in <unistd.h>:
#if __SSP_FORTIFY_LEVEL == 0
ssize_t read(int, void *, size_t);
#endif
but instead via <ssp/unistd.h> as
__ssp_redirect0(ssize_t, read, (int __fd, void *__buf, size_t __len), \
(__fd, __buf, __len));
and <ssp/ssp.h> has
#define __ssp_redirect0(rtype, fun, args, call) \
__ssp_redirect_raw(rtype, fun, fun, args, call, 1, __ssp_bos0)
and
#define __ssp_redirect_raw(rtype, fun, symbol, args, call, cond, bos) \
rtype __ssp_real_(fun) args __RENAME(symbol); \
__ssp_inline rtype fun args __RENAME(__ssp_protected_ ## fun); \
__ssp_inline rtype fun args { \
if (cond) \
__ssp_check(__buf, __len, bos); \
return __ssp_real_(fun) call; \
}
but ... is that messing things up for the openssh code in this
case?
There is also the issue that the address taken may not point to
the "real" function but to an entry in the procedure linkage
table(?) But why is the value different as seen from the two
different functions? I beleive I've not understood why the
pattern used by openssh fails.
Any hints about how to do this "correctly"?
State-Changed-From-To: closed->open
State-Changed-By: he@NetBSD.org
State-Changed-When: Sat, 03 Oct 2026 21:15:49 +0000
State-Changed-Why:
Issue is not fixed.
From: Taylor R Campbell <riastradh@NetBSD.org>
To: Havard Eidnes <he@NetBSD.org>
Cc: gnats-bugs@NetBSD.org, pkgsrc-bugs@NetBSD.org,
joerg@NetBSD.org, christos@NetBSD.org
Subject: Re: pkg/60563: exposed sshd w/o password-login causes sshd-auth looping
Date: Sun, 4 Oct 2026 15:29:44 +0000
[resent with magic gnats subject line corrected and cc'd to
pkgsrc-bugs@]
This is essentially a duplicate of PR bin/45200: Scp hangs after
sending (https://gnats.NetBSD.org/45200), which we worked around in
the base openssh by using a different function which happens not to
have an ssp wrapper, which is not great. But we have since fixed the
underlying problem in NetBSD>=3D11, though unfortunately a pullup
wouldn't help for packages built against 10.0 as we do.
> Date: Sat, 03 Oct 2026 20:51:36 +0200 (CEST)
> From: Havard Eidnes <he@uninett.no>
>=20
> Now... __SSP_FORTIFY_LEVEL may play into this. Not sure what it
> is by default, but possibly and probably not 0, so read() doesn't
> get defined via this entry in <unistd.h>:
> [...]
> but ... is that messing things up for the openssh code in this
> case?
>=20
> There is also the issue that the address taken may not point to
> the "real" function but to an entry in the procedure linkage
> table(?) But why is the value different as seen from the two
> different functions? I beleive I've not understood why the
> pattern used by openssh fails.
The procedure linkage table is not relevant: the toolchain ensures
that even when there's PLT indirections involved, the address you get
for a library symbol will be the same for all objects in the process,
which is constraint that is annoying for some optimization purposes
(e.g., see the comments about it on pp. 19-20 of
https://web.archive.org/web/20250328091912/https://akkadia.org/drepper/dsoh=
owto.pdf).
But you are right that fortify/ssp plays a role -- specifically,
defining _FORTIFY_SOURCE in the build, as pkgsrc does with
PKGSRC_USE_FORTIFY, which is on by default.
>From NetBSD 6 through NetBSD 10, we defined the fortify/ssp wrappers
roughly like so:
/* make C function `__ssp_real_read' use ELF symbol `read' */
ssize_t __ssp_real_read(int, void *, size_t) __asm("read");
/* make C function `read' do ssp checks before calling ELF symbol */
static inline __attribute__((__always_inline__, __gnu_inline_))
ssize_t read(int fd, void *buf, size_t len)
{
if (__builtin_object_size(buf, 0) !=3D (size_t)-1 &&
len > __builtin_object_size(__buf, 0))
__chk_fail();
return __ssp_real_read(fd, buf, len);
}
Unfortunately, this gets copied in each .c file, so if you take the
address of the `read' function, there is a _different definition_ in
each .o file. That leads to the problem you saw.
What changed in NetBSD 11 is that we switched from `static inline' to
`extern inline':
If you specify both inline and extern in the function
definition, then the definition is used only for inlining. In
no case is the function compiled on its own, not even if you
refer to its address explicitly. Such an address becomes an
external reference, as if you had only declared the function,
and had not defined it.
This combination of inline and extern has almost the effect of
a macro. The way to use it is to put a function definition in
a header file with these keywords, and put another copy of the
definition (lacking inline and extern) in a library file. The
definition in the header file causes most calls to the
function to be inlined. If any uses of the function remain,
they refer to the single copy in the library.
https://gcc.gnu.org/onlinedocs/gcc-10.5.0/gcc/Inline.html
The ssp wrapper macros also, by the way, introduce _another_ inline
declaration of `read' with __asm(__ssp_protected_read), causing the
_inline definition_ to have the ELF symbol `__ssp_protected_read' if
it is ever materialized. And, when you take the address of a _static_
inline function, it _is_ materialized as a separate function, distinct
from the library function. So if you objdump -dlr atomicio.o on
NetBSD<=3D10, you'll see:
0000000000000000 <__ssp_protected_read>:
read():
/usr/include/ssp/unistd.h:39
0: e9 00 00 00 00 jmpq 5 <atomiciov6.part.0>
1: R_X86_64_PLT32 read-0x4
...
000000000000022d <atomicio6>:
...
/home/riastradh/pkgsrc/current/work/security/openssh/work/openssh-10.5p1/at=
omicio.c:55
25c: 48 8d 05 9d fd ff ff lea -0x263(%rip),%rax # 0 <__ssp_=
protected_read>
263: 49 39 c5 cmp %rax,%r13
And you'll find the same _content_ of __ssp_protected_read with a
different identity (so it will have a different address) in kex.o (and
different alignment in objdump output because kex.o has four digits of
instruction offsets vs atomicio.o's three):
0000000000000000 <__ssp_protected_read>:
read():
/usr/include/ssp/unistd.h:39
0: e9 00 00 00 00 jmpq 5 <kex_protocol_error>
1: R_X86_64_PLT32 read-0x4
...
000000000000309b <kex_exchange_identification>:
...
3235: 48 8d 3d c4 cd ff ff lea -0x323c(%rip),%rdi # =
0 <__ssp_protected_read>
323c: e8 00 00 00 00 callq 3241 <kex_exchange_identific=
ation+0x1a6> =20
323d: R_X86_64_PLT32 atomicio-0x4
In the final sshd-auth binary, you'll see both definitions (actually,
many of them) under the same name but at different addresses:
0000000000072040 <__ssp_protected_read>:
read():
/usr/include/ssp/unistd.h:39
72040: e9 5b 99 f9 ff jmpq b9a0 <read@plt>
...
000000000007226d <atomicio6>:
...
7229c: 48 8d 05 9d fd ff ff lea -0x263(%rip),%rax # 7=
2040 <__ssp_protected_read>
722a3: 49 39 c5 cmp %rax,%r13
...
0000000000082bd0 <__ssp_protected_read>:
read():
/usr/include/ssp/unistd.h:39
82bd0: e9 cb 8d f8 ff jmpq b9a0 <read@plt>
...
0000000000085c6b <kex_exchange_identification>:
...
85e05: 48 8d 3d c4 cd ff ff lea -0x323c(%rip),%rdi # =
82bd0 <__ssp_protected_read>
85e0c: e8 99 c5 fe ff callq 723aa <atomicio>
(Note that they all jump to read@plt -- and if you were to take the
address of the read function _without_ the ssp indirections, that's
the address you would get.)
I'm not clear why we still have this extra declaration now that we've
switched to `extern inline' (which should guarantee it is never
materialized as a separate function, even if we refer to its address),
and I think we should delete it.
The way gcc reacts to such an `extern inline' declaration with an ELF
symbol __asm("__ssp_protected_read") changed between 10 and 12 --
gcc10 rejects it; gcc12 accepts it.
In any case, while we could backport the ssp.h `extern inline' change
to netbsd-10 (and remove the __asm("__ssp_protected_read") part), it
wouldn't help for packages built against 10.0. So we have to keep
workarounds in the packages until we drop support for all NetBSD<11.
From: "Havard Eidnes" <he@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60563 CVS commit: pkgsrc/security/openssh
Date: Mon, 5 Oct 2026 18:08:15 +0000
Module Name: pkgsrc
Committed By: he
Date: Mon Oct 5 18:08:15 UTC 2026
Modified Files:
pkgsrc/security/openssh: Makefile distinfo
pkgsrc/security/openssh/patches: patch-atomicio.c
Log Message:
security/openssh: pull in fix from the main NetBSD source tree for PR#60563.
This tests for vwrite() instead of read() in atomicio.c, so
as to avoid the renaming shenanigans done by SSP of read().
Thanks to riastradh@ for pointing me in the right direction.
Bump PKGREVISION.
To generate a diff of this commit:
cvs rdiff -u -r1.296 -r1.297 pkgsrc/security/openssh/Makefile
cvs rdiff -u -r1.133 -r1.134 pkgsrc/security/openssh/distinfo
cvs rdiff -u -r1.4 -r1.5 pkgsrc/security/openssh/patches/patch-atomicio.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: Christos Zoulas <christos@zoulas.com>
To: gnats-bugs@netbsd.org
Cc: pkg-manager@netbsd.org,
gnats-admin@netbsd.org,
pkgsrc-bugs@netbsd.org,
"he@netbsd.org" <he@NetBSD.org>
Subject: Re: PR/60563 CVS commit: pkgsrc/security/openssh
Date: Mon, 5 Oct 2026 14:49:32 -0400
That was back in 2011:
revision 1.4
date: 2011-08-01 11:55:00 -0400; author: christos; state: Exp; lines: =
+7 -3;
branches: 1.4.4; 1.4.10; 1.4.18; 1.4.22;
PR/45200: : J. Hannken-Illjes: Scp hangs after sending:
- check for vwrite() instead of read() to avoid read() being renamed by =
SSP
christos
> On Oct 5, 2026, at 2:10=E2=80=AFPM, Havard Eidnes <he@netbsd.org> =
wrote:
>=20
> The following reply was made to PR pkg/60563; it has been noted by =
GNATS.
>=20
> From: "Havard Eidnes" <he@netbsd.org>
> To: gnats-bugs@gnats.NetBSD.org
> Cc:=20
> Subject: PR/60563 CVS commit: pkgsrc/security/openssh
> Date: Mon, 5 Oct 2026 18:08:15 +0000
>=20
> Module Name: pkgsrc
> Committed By: he
> Date: Mon Oct 5 18:08:15 UTC 2026
>=20
> Modified Files:
> pkgsrc/security/openssh: Makefile distinfo
> pkgsrc/security/openssh/patches: patch-atomicio.c
>=20
> Log Message:
> security/openssh: pull in fix from the main NetBSD source tree for =
PR#60563.
>=20
> This tests for vwrite() instead of read() in atomicio.c, so
> as to avoid the renaming shenanigans done by SSP of read().
>=20
> Thanks to riastradh@ for pointing me in the right direction.
>=20
> Bump PKGREVISION.
>=20
>=20
> To generate a diff of this commit:
> cvs rdiff -u -r1.296 -r1.297 pkgsrc/security/openssh/Makefile
> cvs rdiff -u -r1.133 -r1.134 pkgsrc/security/openssh/distinfo
> cvs rdiff -u -r1.4 -r1.5 =
pkgsrc/security/openssh/patches/patch-atomicio.c
>=20
> Please note that diffs are not public domain; they are subject to the
> copyright notices on the relevant files.
>=20
From: Havard Eidnes <he@NetBSD.org>
To: christos@zoulas.com
Cc: gnats-bugs@netbsd.org, pkg-manager@netbsd.org, gnats-admin@netbsd.org,
pkgsrc-bugs@netbsd.org
Subject: Re: PR/60563 CVS commit: pkgsrc/security/openssh
Date: Mon, 05 Oct 2026 21:48:27 +0200 (CEST)
> That was back in 2011:
>
> revision 1.4
> date: 2011-08-01 11:55:00 -0400; author: christos; state: Exp; lin=
es: +7 -3;
> branches: 1.4.4; 1.4.10; 1.4.18; 1.4.22;
> PR/45200: : J. Hannken-Illjes: Scp hangs after sending:
> - check for vwrite() instead of read() to avoid read() being renamed =
by SSP
Yep, I should have mentioned you as well, sorry.
By the looks of it, Theo isn't adopting it, ref.
https://marc.info/?l=3Dopenssh-unix-dev&m=3D179122266596684&w=3D2
I'm resisting getting sucked in to that discussion, it's their
turf and their decision to make.
Regards,
- H=E5vard
State-Changed-From-To: open->closed
State-Changed-By: he@NetBSD.org
State-Changed-When: Tue, 06 Oct 2026 08:58:40 +0000
State-Changed-Why:
This particular bug should now finally be fixed.
State-Changed-From-To: closed->pending-pullups
State-Changed-By: bsiegert@NetBSD.org
State-Changed-When: Tue, 06 Oct 2026 19:18:34 +0000
State-Changed-Why:
There is a pullup ticket pending for this.
From: "Maya Rashish" <maya@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/60563 CVS commit: [pkgsrc-2026Q3] pkgsrc/security/openssh
Date: Mon, 12 Oct 2026 01:16:44 +0000
Module Name: pkgsrc
Committed By: maya
Date: Mon Oct 12 01:16:44 UTC 2026
Modified Files:
pkgsrc/security/openssh [pkgsrc-2026Q3]: Makefile distinfo
pkgsrc/security/openssh/patches [pkgsrc-2026Q3]: patch-atomicio.c
patch-configure.ac
Log Message:
Pullup ticket #7270 - requested by he
security/openssh: Security fix, bug fix
Revisions pulled up:
- security/openssh/Makefile 1.297-1.299
- security/openssh/distinfo 1.134-1.135
- security/openssh/options.mk 1.52-1.53
- security/openssh/patches/patch-atomicio.c 1.5-1.6
- security/openssh/patches/patch-configure.ac 1.13
---
Module Name: pkgsrc
Committed By: he
Date: Mon Oct 5 18:08:15 UTC 2026
Modified Files:
pkgsrc/security/openssh: Makefile distinfo
pkgsrc/security/openssh/patches: patch-atomicio.c
Log Message:
security/openssh: pull in fix from the main NetBSD source tree for PR#60563.
This tests for vwrite() instead of read() in atomicio.c, so
as to avoid the renaming shenanigans done by SSP of read().
Thanks to riastradh@ for pointing me in the right direction.
Bump PKGREVISION.
---
Module Name: pkgsrc
Committed By: he
Date: Mon Oct 5 18:48:24 UTC 2026
Modified Files:
pkgsrc/security/openssh: Makefile
Log Message:
security/openssh: sigh, remove debug and a false turn.
---
Module Name: pkgsrc
Committed By: he
Date: Wed Oct 7 15:22:05 UTC 2026
Modified Files:
pkgsrc/security/openssh: Makefile distinfo options.mk
pkgsrc/security/openssh/patches: patch-atomicio.c patch-configure.ac
Log Message:
security/openssh: update to version 10.6p1.
Pkgsrc changes:
* Adapt patches to what's changed upstream.
* Version & checksum changes.
Upstream changes:
Changes since OpenSSH 10.5
==========================
This release contains a number of security fixes, several new
features and some small bugfixes.
Security
========
* sftp(1): more strictly validate paths returned from the server to
avoid some cases where a server could return paths that could
manipulate a recursive copy operation into writing outside its
target directory. Report and patch from Junghoon Cho.
* sshd(8): when GSSAPIAuthentication is in use, only store GSSAPI
credentials when authentication has succeeded. Avoids a situation
where credentials from a failed GSSAPIAuthentication attempt may
persist and be made inappropriately available if another
authentication subsequently succeeds. Issue report and patch from
Moritz Theile.
* sshd(8): reset GSSAPIAuthentication before authentication, avoiding
state from one authentication attempt being confused with that of
a later attempt. Report and feedback from Moritz Theile.
* sshd(8), ssh(1): disable LZ77 dictionary coder to mitigate the
side-channel leaks described in "Crossing the Streams: SSH
Plaintext Recovery via a Common Compression Context in
Multiplexed Channels" by Fabian B�umer and Marcus Brinkmann,
preprint https://arxiv.org/abs/2609.07709 (2026)
A chosen-plaintext attack method exists which makes use of
dictionary-based compression to recover secrets from one channel
by interacting with the SSH session's shared compression
dictionary through another channel.
Attacker-controlled input can recognizably reflect into the
total length of transmitted ciphertexts by virtue of LZ77
replacing repeated strings with back-references into the SSH
session's encoder search buffer, which is shared across all
channels. For this reason, the documentation already recommended
against enabling compression for connections that share trusted
and untrusted traffic.
This change will reduce the effectiveness of the Compression
option. Users are encouraged to use application-level compression
over the SSH protocol where possible, as this will typically be
more effective and will be completely immune to this type of
attack.
* ssh(1): disallow '$' and '\' characters in usernames entered on
the command-line to avoid usernames from untrusted sources
yielding injection in shell context via ProxyCommand, Match exec,
etc. Usernames specified via the configuration files are not
subject this this control. Reported by SecBuddyF KeenLab Tencent
(CodeBuddy Security)
We continue to recommend against directly exposing ssh(1) and
other tools' command-lines to untrusted input. Mitigations such
as this can not be absolute given the variety of shells and user
configurations in use.
* ssh-keygen(1): correct handling of Daylight Saving Time when
converting dates. Previous handling could cause errors of
up to +/- 1 hour (unless you are in the Antarctica/Troll
timezone, where the error could be +/- 2 hours). These errors
could result in creation of certificates with incorrect expiry
times. bz4004; from Khush Patel
* sshd(8), ssh(1): ensure that compressed payloads don't inflate
past the maximum supported packet length. Reported by Oleh Konko.
* sshd(8): fully honor the authorized_keys "restrict" keyword,
which was not being properly applied to tunnel forwarding
(PermitTunnel, disabled by default). This is a separate problem
to the one fixed in openssh-10.5.
* sshd(8): correctly handle some options that accept "none". Some
options, including AuthorizedPrincipalsFile, were documented as
accepting "none" as a way to disable them; however, when
overridden by an sshd_config(5) Match keyword, this argument was
being incorrectly interpreted as a literal file.
With Chris Rohlf in collaboration with Claude and Anthropic Research
* sshd(8): On OS X SDK >= 27, sandboxing is no longer supported
as the API we depended upon has been removed and no obvious
alternative provided.
* sshd(8): on platforms that do not support file descriptor passing
and that require root for PTY allocation, the post-authentication
sshd-session process retains root privilege, whereas on other
platforms this process runs with the privilege of the logged-in
user. When sshd-session was run with elevated privilege, it could
perform certain actions as root and circumvent controls that
would normally have applied to the user, such as making unix
domain socket connections or binding (via -R forwarding) to low-
numbered TCP ports.
For this reason, this release disables the GatewayPorts and
StreamLocalForwarding options and support for these (few)
platforms will be removed in future if no alternatives to
requiring privilege in the post-authentication process are found.
Affected platforms include QNX 6, SCO OpenServer 5 and builds
that were made with the --disable-fd-passing configure option.
This problem was reported separately by sn0x-sharma and by Dark
River.
New features
------------
* All: enable hybrid post-quantum ssh-mldsa44-ed25519 signature
algorithm. Note that this no longer uses the "@openssh.com"
vendor extension suffix that the previous experimental
implementation used. Keys generated with the previous experimental
support must be regenerated and/or removed.
* sshd(8): Add the WarnWeakCrypto option to sshd_config(5). This
option was previously available for the client only. This option
is enabled by default and will log when the client uses a key
agreement scheme that is not post-quantum safe.
* ssh-keygen(1), ssh-add(1): preserve user-verification (PIN or
biometric) requirement for resident keys loaded from a FIDO
token, by checking the credential's credProtect policy.
GHPR701 from Savely Krasovsky
* ssh(1): include local and remote version strings in the ~I
connection information display.
* ssh-add(1): add a -P flag to skip PIN entry for FIDO and PKCS#11
tokens that do not require it.
* sftp(1): add '-p' flag for mkdir/lmkdir to create directories as
required. This flag has similar ergonomics to mkdir(1), and
previously-existing directories do not cause an error.
* ssh-keygen(1): add a "hexdump" key export mode that dumps the SSH
wire-formatted key blob in hex format. Useful when writing
documentation, tests, etc. E.g. `ssh-keygen -em hexdump -f /key`
* ssh(1), sshd(8): ChannelTimeout now accepts timeouts with
fractional seconds.
* sshd(8): allow specification of the location of $SSH_AUTH_SOCK
used for agent forwarding using a new AgentSocketPath option.
This supports both using a user-specific path, such as the
default of a subdirectory of $HOME ("user:.ssh/agent"), and
the previous approach of allowing agent forwarding sockets to be
located in a shared directory (e.g. "shared:/tmp"). Sockets
created in shared directories will be created inside a
subdirectory with a randomised name. bz3860
* ssh-agent(1): allow specification of agent socket directories
using a -A flag. It accepts "user:" and "shared:" directory
styles similar to the sshd AgentSocketPath option.
* sshd(8): account for public key authentication "key ok" tests
separately to auth attempts. Add a `PubkeyOptions max-pk-ok:nnnn`
option to allow a number of PK_OK tests (asking whether the
server might accept a given public key) that do not count against
MaxAuthTries, defaulting to 6 attempts. After these attempts are
exhausted, further attempts count as failed authentications
against MaxAuthTries. Practically, this allows more keys on disk
or held in ssh-agent to be checked for use before the server
disconnects.
* ssh(1), sshd(8): extend the existing TCPKeepAlive option to also
support setting keepalives on sockets created for forwarding
connections. Previously this option controlled keepalives on the
connection socket only. TCPKeepAlive "yes" or "transport" enables
keepalives on the connection socket. "TCPKeepAlive all" additionally
enables them for forwarding sockets. bz3921
Bugfixes
--------
* sshd(8), ssh(1): fix configuration matching on more Turkic
languages which have disjoint dotted and dotless i/I characters,
specifically Azerbaijani and Crimean Tatar. bz3991
* ssh(1), sshd(8): don't attempt to set TCP_NODELAY on non-IP/IPv6
sockets. Eliminates some noise in debug logs.
* ssh(1): fix case for ssh -G option output; bz4005
* ssh(1), sshd(8): Fix ChannelTimeout specificity; previously a
more specific channel type (e.g. "session:shell") could clobber
a user-specified ChannelTimeout if it was less specific (e.g.
"session"). Also, in some cases, the debug messages were
printing 0 instead of the effective timeout. bz3994
* sftp(1): avoid NULL dereference crash in some circumstances when
a server fails a stat/lstat operation. GHPR707
* sshd(8): close a race condition where a SIGTERM/SIGQUIT would be
ignored if it was received by the server while it was processing a
SIGHUP restart request. bz3981
* sshd(8), ssh(1): check key and CA signature types during key
parsing against allowlists (PubkeyAcceptedAlgorithms, etc) as
early as possible. This reduces the attack surface presented by
disabled algorithms. Suggested by and with extensive feedback
from Chris Rohlf in collaboration with Claude and Anthropic
Research.
* All: switch the fallback implementation of the ed25519 signature
algorithm used when libcrypto is disabled from SUPERCOP ed25519
to libsodium. The libsodium implementation includes a number of
strictness checks over the original reference implementation we
have used to this point and a more ergonomic API.
* ssh-add(1), ssh(1), ssh-keygen(1): fix spin on password entry when
the program attempting to read a password was started in a
background process group, with no TTY and with certain signals
ignored. bz3995
* scp(1): disallow nul byte in received scp -O filename. This was
not reachable in normal operation. Reported by Chua Wei Xun.
* ssh-keygen(1), ssh(1), sshd(8): implement a maximum number of KDF
rounds that will be accepted when writing an OpenSSH-format
private key or when loading one. This limit is set quite high
(1M), but ensures that a service that is passed a bad key with a
ridiculously high number of rounds will eventually complete
parsing it.
* ssh-keygen(1): bump the default number of KDF rounds from 24 to
32 (this is a linear increase, not like bcrypt(3) which is
exponential).
* ssh(1): make StreamLocalBindMask properly respect Host/Match
blocks and make it first-match-wins as documented. bz4013
* sshd(8): make StreamLocalBindMask properly first-match-wins.
Portability
-----------
* All: remove the NetBSD BROKEN_READ_COMPARISON workaround. This
appears to be no longer required and caused pre-auth CPU spinning.
* sshd(8): don't link sshd against libselinux when SELinux support
is enabled (note: this library is still linked for the sshd-auth
and sshd-session helper binaries).
* sshd(8): allow madvise(..., MADV_DONTNEED_LOCKED) in the seccomp
sandbox; needed by GrapheneOS' hardened allocator. bz4001
* sshd(8): restrict mremap(2) flags accepted by the seccomp
sandbox. Only MREMAP_MAYMOVE is now accepted as other flags may
have some utility in attack chains. Reported by: Mohammad Hossein
Abedini.
* sshd(8): allow PAMServiceName in Match (regressed in 10.4).
During the refactor of server option parsing, the ability to set
PAMServiceName in Match blocks was accidentally disabled.
* sshd(8): the --disable-fd-passing configure option has been
removed.
---
Module Name: pkgsrc
Committed By: he
Date: Wed Oct 7 15:26:42 UTC 2026
Modified Files:
pkgsrc/security/openssh: options.mk
Log Message:
security/openssl: undo change to search builtin openssl; it was fine as was.
To generate a diff of this commit:
cvs rdiff -u -r1.294.2.1 -r1.294.2.2 pkgsrc/security/openssh/Makefile
cvs rdiff -u -r1.132.2.1 -r1.132.2.2 pkgsrc/security/openssh/distinfo
cvs rdiff -u -r1.4.2.2 -r1.4.2.3 \
pkgsrc/security/openssh/patches/patch-atomicio.c
cvs rdiff -u -r1.11.14.1 -r1.11.14.2 \
pkgsrc/security/openssh/patches/patch-configure.ac
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: pending-pullups->closed
State-Changed-By: bsiegert@NetBSD.org
State-Changed-When: Tue, 13 Oct 2026 14:35:09 +0000
State-Changed-Why:
Pulled up
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.51 2026/08/10 02:28:17 riastradh Exp $
$NetBSD: gnats_config.sh,v 1.10 2026/05/13 22:00:09 riastradh Exp $
Copyright © 1994-2026
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home