From a43be164ecc1af7ddf9238c5f5e174fda4077c81 Mon Sep 17 00:00:00 2001
From: Dmitry Belyavskiy <dbelyavs@redhat.com>
Date: Oct 23 2023 11:33:49 +0000
Subject: Limit artificial delays in sshd while login using AD user


Resolves: RHEL-2469

---

diff --git a/openssh-9.4p2-limit-delay.patch b/openssh-9.4p2-limit-delay.patch
new file mode 100644
index 0000000..8c1cbcb
--- /dev/null
+++ b/openssh-9.4p2-limit-delay.patch
@@ -0,0 +1,33 @@
+diff -u -p -r1.166 auth2.c
+--- a/auth2.c	8 Mar 2023 04:43:12 -0000	1.166
++++ b/auth2.c	28 Aug 2023 08:32:44 -0000
+@@ -208,6 +208,7 @@ input_service_request(int type, u_int32_
+ }
+ 
+ #define MIN_FAIL_DELAY_SECONDS 0.005
++#define MAX_FAIL_DELAY_SECONDS 5.0
+ static double
+ user_specific_delay(const char *user)
+ {
+@@ -233,6 +234,12 @@ ensure_minimum_time_since(double start, 
+ 	struct timespec ts;
+ 	double elapsed = monotime_double() - start, req = seconds, remain;
+ 
++	if (elapsed > MAX_FAIL_DELAY_SECONDS) {
++		debug3_f("elapsed %0.3lfms exceeded the max delay "
++		    "requested %0.3lfms)", elapsed*1000, req*1000);
++		return;
++	}
++
+ 	/* if we've already passed the requested time, scale up */
+ 	while ((remain = seconds - elapsed) < 0.0)
+ 		seconds *= 2;
+@@ -317,7 +324,7 @@ input_userauth_request(int type, u_int32
+ 		debug2("input_userauth_request: try method %s", method);
+ 		authenticated =	m->userauth(ssh);
+ 	}
+-	if (!authctxt->authenticated)
++	if (!authctxt->authenticated && strcmp(method, "none") != 0)
+ 		ensure_minimum_time_since(tstart,
+ 		    user_specific_delay(authctxt->user));
+ 	userauth_finish(ssh, authenticated, method, NULL);
diff --git a/openssh.spec b/openssh.spec
index f89feac..810da66 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -284,6 +284,8 @@ Patch1014: openssh-8.7p1-UTC-time-parse.patch
 Patch1015: openssh-9.3p1-upstream-cve-2023-38408.patch
 #upstream commit b7afd8a4ecaca8afd3179b55e9db79c0ff210237
 Patch1016: openssh-9.3p1-openssl-compat.patch
+#upstream commit 01dbf3d46651b7d6ddf5e45d233839bbfffaeaec
+Patch1017: openssh-9.4p2-limit-delay.patch
 
 License: BSD
 Requires: /sbin/nologin
@@ -504,6 +506,7 @@ popd
 %patch1014 -p1 -b .utc_parse
 %patch1015 -p1 -b .cve-2023-38408
 %patch1016 -p1 -b .openssl3compat
+%patch1017 -p1 -b .limitdelay
 
 autoreconf
 pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@@ -793,6 +796,8 @@ test -f %{sysconfig_anaconda} && \
 * Mon Oct 23 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-35
 - Relax OpenSSH checks for OpenSSL version
   Resolves: RHEL-4734
+- Limit artificial delays in sshd while login using AD user
+  Resolves: RHEL-2469
 
 * Thu Jul 20 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-34
 - Avoid remote code execution in ssh-agent PKCS#11 support