[openssh-commits] [openssh] 01/04: upstream: fix ChannelTimeout and RekeyLimit not being applied in

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit caa6d7d19dc5dde5c2807277189ed2178b097e42
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Tue Jul 21 06:17:42 2026 +0000

    upstream: fix ChannelTimeout and RekeyLimit not being applied in
    
    sshd_config Match blocks; reported by Alex Harrison
    
    OpenBSD-Commit-ID: 2d8866b841fc92e6e079e3f37590ba5948531b3d
---
 auth.c         | 5 ++++-
 monitor_wrap.c | 4 +++-
 packet.c       | 5 ++++-
 sshconnect2.c  | 7 +++----
 sshd-auth.c    | 7 +++----
 5 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/auth.c b/auth.c
index a0217a811..a4a37c11a 100644
--- a/auth.c
+++ b/auth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.c,v 1.164 2026/02/11 22:57:16 djm Exp $ */
+/* $OpenBSD: auth.c,v 1.165 2026/07/21 06:17:42 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -480,7 +480,10 @@ getpwnamallow(struct ssh *ssh, const char *user)
 	log_verbose_reset();
 	for (i = 0; i < options.num_log_verbose; i++)
 		log_verbose_add(options.log_verbose[i]);
+	server_process_channel_timeouts(ssh);
 	server_process_permitopen(ssh);
+	ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
+	    options.rekey_interval);
 
 #if defined(_AIX) && defined(HAVE_SETAUTHDB)
 	aix_setauthdb(user);
diff --git a/monitor_wrap.c b/monitor_wrap.c
index e2b9a2802..e9a771b34 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_wrap.c,v 1.147 2026/05/31 11:30:50 djm Exp $ */
+/* $OpenBSD: monitor_wrap.c,v 1.148 2026/07/21 06:17:42 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos at citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus at openbsd.org>
@@ -384,6 +384,8 @@ out:
 	server_process_permitopen(ssh);
 	server_process_channel_timeouts(ssh);
 	kex_set_server_sig_algs(ssh, options.pubkey_accepted_algos);
+	ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
+	    options.rekey_interval);
 	sshbuf_free(m);
 
 	return (pw);
diff --git a/packet.c b/packet.c
index 4c89e60c5..cb4284795 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.339 2026/06/30 00:09:01 djm Exp $ */
+/* $OpenBSD: packet.c,v 1.340 2026/07/21 06:17:42 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -2356,6 +2356,9 @@ ssh_packet_get_maxsize(struct ssh *ssh)
 void
 ssh_packet_set_rekey_limits(struct ssh *ssh, uint64_t bytes, uint32_t seconds)
 {
+	if (bytes == 0 && seconds == 0)
+		return;
+
 	debug3("rekey after %llu bytes, %u seconds", (unsigned long long)bytes,
 	    (unsigned int)seconds);
 	ssh->state->rekey_limit = bytes;
diff --git a/sshconnect2.c b/sshconnect2.c
index d1555ee97..ef2c23da8 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.388 2026/07/06 07:49:58 djm Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.389 2026/07/21 06:17:42 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -227,9 +227,8 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
 	xxx_hostaddr = *hostaddr;
 	xxx_conn_info = ssh_conn_info_dup(cinfo);
 
-	if (options.rekey_limit || options.rekey_interval)
-		ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
-		    options.rekey_interval);
+	ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
+	    options.rekey_interval);
 
 	/*
 	 * If the user has not specified HostkeyAlgorithms, or has only
diff --git a/sshd-auth.c b/sshd-auth.c
index fb1bab66f..83178e868 100644
--- a/sshd-auth.c
+++ b/sshd-auth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd-auth.c,v 1.16 2026/06/14 03:59:34 djm Exp $ */
+/* $OpenBSD: sshd-auth.c,v 1.17 2026/07/21 06:17:42 djm Exp $ */
 /*
  * SSH2 implementation:
  * Privilege Separation:
@@ -772,9 +772,8 @@ do_ssh2_kex(struct ssh *ssh)
 	struct kex *kex;
 	int r;
 
-	if (options.rekey_limit || options.rekey_interval)
-		ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
-		    options.rekey_interval);
+	ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
+	    options.rekey_interval);
 
 	if (options.compression == COMP_NONE)
 		compression = "none";

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.