diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2023-08-28 09:48:11 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2023-08-28 19:50:04 +1000 |
| commit | 01dbf3d46651b7d6ddf5e45d233839bbfffaeaec (patch) | |
| tree | ced41404920ae3f802f415c12ffd0385874e4785 | |
| parent | 528da5b9d7c5da01ed7a73ff21c722e1b5326006 (diff) | |
upstream: limit artificial login delay to a reasonable maximum (5s)
and don't delay at all for the "none" authentication mechanism. Patch by
Dmitry Belyavskiy in bz3602 with polish/ok dtucker@
OpenBSD-Commit-ID: 85b364676dd84cf1de0e98fc2fbdcb1a844ce515
| -rw-r--r-- | auth2.c | 11 |
1 files changed, 9 insertions, 2 deletions
@@ -1,4 +1,4 @@ -/* $OpenBSD: auth2.c,v 1.166 2023/03/08 04:43:12 guenther Exp $ */ +/* $OpenBSD: auth2.c,v 1.167 2023/08/28 09:48:11 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -218,6 +218,7 @@ input_service_request(int type, u_int32_t seq, struct ssh *ssh) } #define MIN_FAIL_DELAY_SECONDS 0.005 +#define MAX_FAIL_DELAY_SECONDS 5.0 static double user_specific_delay(const char *user) { @@ -243,6 +244,12 @@ ensure_minimum_time_since(double start, double seconds) struct timespec ts; double elapsed = monotime_double() - start, req = seconds, remain; + if (elapsed > MAX_FAIL_DELAY_SECONDS) { + debug3_f("elapsed %0.3lfms exceeded the max delay " + "requested %0.3lfms)", elapsed*1000, req*1000); + return; + } + /* if we've already passed the requested time, scale up */ while ((remain = seconds - elapsed) < 0.0) seconds *= 2; @@ -334,7 +341,7 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh) debug2("input_userauth_request: try method %s", method); authenticated = m->userauth(ssh, method); } - if (!authctxt->authenticated) + if (!authctxt->authenticated && strcmp(method, "none") != 0) ensure_minimum_time_since(tstart, user_specific_delay(authctxt->user)); userauth_finish(ssh, authenticated, method, NULL); |