openssh: blocklist: Add the other fatal exit probe

[jlduran]

Summary

To replicate:

ssh nonexistent@server & sleep 0.5; kill $!

Reported by: Jana Steuernagel

[jlduran]

Sure enough (https://reviews.freebsd.org/D58083?id=181447#inline-344443).
The patch for NetBSD would be:

diff
--- a/crypto/external/bsd/openssh/dist/sshd-session.c
+++ b/crypto/external/bsd/openssh/dist/sshd-session.c
@@ -1346,7 +1346,9 @@ cleanup_exit(int i)
                pfilter_notify(1);
                _exit(EXIT_AUTH_ATTEMPTED);
        }
-       if (i == 255 && monitor_invalid_user())
+       if (i == 255 && monitor_invalid_user()) {
+               pfilter_notify(1);
                _exit(EXIT_INVALID_USER);
+       }
        _exit(i);
 }

[jlduran]

I think this effectively leaves us (FreeBSD) open to a username enumeration vulnerability, because we do not have a blocklist probe in grace_alarm_handler().
I have been exploring simpler options to try to make our BLOCKLIST_NOTIFY() signal-safe.

[jlduran]

Upstream (NetBSD) has added this probe (https://github.com/NetBSD/src/commit/4c264db34495dbbbf67409a9ed92526ceb5f2da9). I'll work on this patch this week.