openssh bugs - Mar 2025 - [Bug 3797] New: PerSourcePenalty "grace-exceeded" uses tunable value for PerSourcePenalty "crash"

https://bugzilla.mindrot.org/show_bug.cgi?id=3797

            Bug ID: 3797
           Summary: PerSourcePenalty "grace-exceeded" uses tunable
value
                    for PerSourcePenalty "crash"
           Product: Portable OpenSSH
           Version: 9.9p2
          Hardware: UltraSPARC
                OS: Solaris
            Status: NEW
          Severity: trivial
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: irwin at princeton.edu

It seems that when PerSourcePenalty "grace-exceeded" is assessed, it
uses the value assigned to PerSourcePenalty "crash".

With default PerSourcePenalty tunables (crash:90s grace:10s), log says:

sshd[12345]: srclimit_penalise: ipv4: new 192.168.1.2/32 active penalty
of 90 seconds for penalty: exceeded LoginGraceTime

In srclimit_penalise() in ./srclimit.c, perhaps:
388     case SRCLIMIT_PENALTY_GRACE_EXCEEDED:
389         penalty_secs = penalty_cfg.penalty_crash;

should be:
388     case SRCLIMIT_PENALTY_GRACE_EXCEEDED:
389         penalty_secs = penalty_cfg.penalty_grace;

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3797

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
                 CC|                            |dtucker at dtucker.net
             Blocks|                            |3740
             Status|NEW                         |RESOLVED

--- Comment #1 from Darren Tucker <dtucker at dtucker.net> ---
Thanks for the report.  This was fixed in:

commit b6bba67e6c31d268480773e4fed16d0a32b4218e
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Sun Mar 2 22:44:00 2025 +0000

    upstream: fix PerSourcePenalty incorrectly using "crash" penalty
when

    LoginGraceTime was exceeded. Reported by irwin AT princeton.edu via
bz3797

and was in the 10.0 release, however we neglected to close this bug.


Referenced Bugs:

https://bugzilla.mindrot.org/show_bug.cgi?id=3740
[Bug 3740] Tracking bug for OpenSSH 10.0
-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.