Antonio Larrosa
869b2ae788
* 0001-upstream-fix-proxy-multiplexing-mode_-broken-when-keystroke.patch - Add patch from upstream to restore correctly sigprocmask * 0001-upstream-correctly-restore-sigprocmask-around-ppoll.patch - Add patch from upstream to fix a logic error in ObscureKeystrokeTiming that rendered this feature ineffective, allowing a passive observer to detect which network packets contained real keystrokes (bsc#1227318, CVE-2024-39894): * 0001-upstream-when-sending-ObscureKeystrokeTiming-chaff-packets_.patch OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=271
39 lines
1.5 KiB
Diff
39 lines
1.5 KiB
Diff
From 146c420d29d055cc75c8606327a1cf8439fe3a08 Mon Sep 17 00:00:00 2001
|
|
From: "djm@openbsd.org" <djm@openbsd.org>
|
|
Date: Mon, 1 Jul 2024 04:31:17 +0000
|
|
Subject: [PATCH] upstream: when sending ObscureKeystrokeTiming chaff packets,
|
|
we
|
|
|
|
can't rely on channel_did_enqueue to tell that there is data to send. This
|
|
flag indicates that the channels code enqueued a packet on _this_ ppoll()
|
|
iteration, not that data was enqueued in _any_ ppoll() iteration in the
|
|
timeslice. ok markus@
|
|
|
|
OpenBSD-Commit-ID: 009b74fd2769b36b5284a0188ade182f00564136
|
|
---
|
|
clientloop.c | 7 ++++---
|
|
1 file changed, 4 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/clientloop.c b/clientloop.c
|
|
index 0b6f3c9be02..8ed8b1c3449 100644
|
|
--- a/clientloop.c
|
|
+++ b/clientloop.c
|
|
#@@ -1,4 +1,4 @@
|
|
#-/* $OpenBSD: clientloop.c,v 1.407 2024/05/17 06:42:04 jsg Exp $ */
|
|
#+/* $OpenBSD: clientloop.c,v 1.408 2024/07/01 04:31:17 djm Exp $ */
|
|
# /*
|
|
# * Author: Tatu Ylonen <ylo@cs.hut.fi>
|
|
# * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
|
@@ -607,8 +607,9 @@ obfuscate_keystroke_timing(struct ssh *ssh, struct timespec *timeout,
|
|
if (timespeccmp(&now, &chaff_until, >=)) {
|
|
/* Stop if there have been no keystrokes for a while */
|
|
stop_reason = "chaff time expired";
|
|
- } else if (timespeccmp(&now, &next_interval, >=)) {
|
|
- /* Otherwise if we were due to send, then send chaff */
|
|
+ } else if (timespeccmp(&now, &next_interval, >=) &&
|
|
+ !ssh_packet_have_data_to_write(ssh)) {
|
|
+ /* If due to send but have no data, then send chaff */
|
|
if (send_chaff(ssh))
|
|
nchaff++;
|
|
}
|