openssh: blocklist: Add the other fatal exit probe
Needs ReviewPublic
Actions

Authored by jlduran on Jul 16 2026, 3:55 PM.

Details

Reviewers

emaste
christos_netbsd.org

Summary

To replicate:

ssh nonexistent@server & sleep 0.5; kill $!

Reported by: Jana Steuernagel

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 74852
Build 71735: arc lint + arc unit

Event Timeline

jlduran created this revision.Jul 16 2026, 3:55 PM

Herald added a subscriber: imp. · View Herald TranscriptJul 16 2026, 3:55 PM

jlduran requested review of this revision.Jul 16 2026, 3:55 PM

Harbormaster completed remote builds in B74852: Diff 182082.Jul 16 2026, 3:55 PM

Sure enough (https://reviews.freebsd.org/D58083?id=181447#inline-344443).
The patch for NetBSD would be:

diff
--- a/crypto/external/bsd/openssh/dist/sshd-session.c
+++ b/crypto/external/bsd/openssh/dist/sshd-session.c
@@ -1346,7 +1346,9 @@ cleanup_exit(int i)
                pfilter_notify(1);
                _exit(EXIT_AUTH_ATTEMPTED);
        }
-       if (i == 255 && monitor_invalid_user())
+       if (i == 255 && monitor_invalid_user()) {
+               pfilter_notify(1);
                _exit(EXIT_INVALID_USER);
+       }
        _exit(i);
 }

I think this effectively leaves us (FreeBSD) open to a username enumeration vulnerability, because we do not have a blocklist probe in grace_alarm_handler().
I have been exploring simpler options to try to make our BLOCKLIST_NOTIFY() signal-safe.