Date: Wed, 29 Jan 2025 18:55:25 GMT From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 88d5d8108711 - releng/14.1 - OpenSSH: correct logic error in ObscureKeystrokeTiming Message-ID: <202501291855.50TItPw0064833@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch releng/14.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=88d5d81087113112fcafff109b14ae21d7e3a687 commit 88d5d81087113112fcafff109b14ae21d7e3a687 Author: Ed Maste <emaste@FreeBSD.org> AuthorDate: 2024-07-01 13:14:15 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2025-01-29 17:13:08 +0000 OpenSSH: correct logic error in ObscureKeystrokeTiming Cherry-pick fix: upstream: when sending ObscureKeystrokeTiming chaff packets, we can't rely on channel_did_enqueue to tell that there is data to send. This flag indicates that the channels code enqueued a packet on _this_ ppoll() iteration, not that data was enqueued in _any_ ppoll() iteration in the timeslice. ok markus@ OpenBSD-Commit-ID: 009b74fd2769b36b5284a0188ade182f00564136 Approved by: so Security: FreeBSD-SA-25:01.openssh Obtained from: openssh-portable 146c420d29d0 Reviewed by: gordon Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D45823 (cherry picked from commit b81424adf7181d816c10b1345aaa3305ab0ec304) (cherry picked from commit bf9a275b24f6655616cc691555fe1a36ed5e4338) --- crypto/openssh/clientloop.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/crypto/openssh/clientloop.c b/crypto/openssh/clientloop.c index 8ec36af94b3f..6dcd6c8535aa 100644 --- a/crypto/openssh/clientloop.c +++ b/crypto/openssh/clientloop.c @@ -608,8 +608,9 @@ obfuscate_keystroke_timing(struct ssh *ssh, struct timespec *timeout, if (timespeccmp(&now, &chaff_until, >=)) { /* Stop if there have been no keystrokes for a while */ stop_reason = "chaff time expired"; - } else if (timespeccmp(&now, &next_interval, >=)) { - /* Otherwise if we were due to send, then send chaff */ + } else if (timespeccmp(&now, &next_interval, >=) && + !ssh_packet_have_data_to_write(ssh)) { + /* If due to send but have no data, then send chaff */ if (send_chaff(ssh)) nchaff++; }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202501291855.50TItPw0064833>