RepoMirrors
/
openssh
mirror of git://anongit.mindrot.org/openssh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream: limit artificial login delay to a reasonable maximum (5s) 

and don't delay at all for the "none" authentication mechanism. Patch by
Dmitry Belyavskiy in bz3602 with polish/ok dtucker@

OpenBSD-Commit-ID: 85b364676dd84cf1de0e98fc2fbdcb1a844ce515
This commit is contained in:
djm@openbsd.org 2023-08-28 09:48:11 +00:00 committed by Damien Miller
parent 528da5b9d7
commit 01dbf3d466
No known key found for this signature in database
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
auth2.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: auth2.c,v 1.166 2023/03/08 04:43:12 guenther Exp $ */ /* $OpenBSD: auth2.c,v 1.167 2023/08/28 09:48:11 djm Exp $ */
/* /*
* Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2000 Markus Friedl. All rights reserved.
* *
@ -218,6 +218,7 @@ input_service_request(int type, u_int32_t seq, struct ssh *ssh)
} }
#define MIN_FAIL_DELAY_SECONDS 0.005 #define MIN_FAIL_DELAY_SECONDS 0.005
#define MAX_FAIL_DELAY_SECONDS 5.0
static double static double
user_specific_delay(const char *user) user_specific_delay(const char *user)
{ {
@ -243,6 +244,12 @@ ensure_minimum_time_since(double start, double seconds)
struct timespec ts; struct timespec ts;
double elapsed = monotime_double() - start, req = seconds, remain; double elapsed = monotime_double() - start, req = seconds, remain;
if (elapsed > MAX_FAIL_DELAY_SECONDS) {
debug3_f("elapsed %0.3lfms exceeded the max delay "
"requested %0.3lfms)", elapsed*1000, req*1000);
return;
}
/* if we've already passed the requested time, scale up */ /* if we've already passed the requested time, scale up */
while ((remain = seconds - elapsed) < 0.0) while ((remain = seconds - elapsed) < 0.0)
seconds *= 2; seconds *= 2;
@ -334,7 +341,7 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
debug2("input_userauth_request: try method %s", method); debug2("input_userauth_request: try method %s", method);
authenticated = m->userauth(ssh, method); authenticated = m->userauth(ssh, method);
} }
if (!authctxt->authenticated) if (!authctxt->authenticated && strcmp(method, "none") != 0)
ensure_minimum_time_since(tstart, ensure_minimum_time_since(tstart,
user_specific_delay(authctxt->user)); user_specific_delay(authctxt->user));
userauth_finish(ssh, authenticated, method, NULL); userauth_finish(ssh, authenticated, method, NULL);