4 files changed, 32 insertions, 0 deletions

diff --git a/debian/changelog b/debian/changelog
index 0341a15a7..9ed26d33d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+openssh (1:6.2p2-7) UNRELEASED; urgency=low
+
+  * When running under Upstart, only consider the daemon started once it is
+    ready to accept connections (by raising SIGSTOP at that point and using
+    "expect stop").
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 12 Aug 2013 12:52:19 +0100
+
 openssh (1:6.2p2-6) unstable; urgency=low
 
   * Update config.guess and config.sub automatically at build time.
diff --git a/debian/openssh-server.ssh.upstart b/debian/openssh-server.ssh.upstart
index 21a6bc50b..10ab744f1 100644
--- a/debian/openssh-server.ssh.upstart
+++ b/debian/openssh-server.ssh.upstart
@@ -11,6 +11,9 @@ respawn
 respawn limit 10 5
 umask 022
 
+env SSH_SIGSTOP=1
+expect stop
+
 # 'sshd -D' leaks stderr and confuses things in conjunction with 'console log'
 console none
 
diff --git a/debian/patches/series b/debian/patches/series
index c99a496b5..0e43d9fe9 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -45,4 +45,5 @@ ssh-agent-setgid.patch
 
 # Debian-specific configuration
 gnome-ssh-askpass2-icon.patch
+sigstop.patch
 debian-config.patch
diff --git a/debian/patches/sigstop.patch b/debian/patches/sigstop.patch
new file mode 100644
index 000000000..42bee0739
--- /dev/null
+++ b/debian/patches/sigstop.patch
@@ -0,0 +1,20 @@
+Description: Support synchronisation with service supervisor using SIGSTOP
+Author: Colin Watson <cjwatson@debian.org>
+Forwarded: no
+Last-Update: 2013-08-12
+
+Index: b/sshd.c
+===================================================================
+--- a/sshd.c
++++ b/sshd.c
+@@ -1855,6 +1855,10 @@
+                        }
+                }
+ 
++               if (getenv("SSH_SIGSTOP"))
++                       /* Tell service supervisor that we are ready. */
++                       kill(getpid(), SIGSTOP);
++
+                /* Accept a connection and return in a forked child */
+                server_accept_loop(&sock_in, &sock_out,
+                    &newsock, config_s);