Merge pull request #335261 from LeSuisse/openssh-gssapi-9.8

  openssh_gssapi = common rec {

    pname = "openssh-with-gssapi";

    version = "9.7p1";

    version = "9.8p1";

    extraDesc = " with GSSAPI support";

    src = fetchurl {

      url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";

      hash = "sha256-SQQm92bYKidj/KzY2D6j1weYdQx70q/y5X3FZg93P/0=";

      hash = "sha256-3YvQAqN5tdSZ37BQ3R+pr4Ap6ARh9LtsUjxJlz9aOfM=";

    };

    extraPatches = [

      ./ssh-keysign-8.5.patch

      ./openssh-9.6_p1-CVE-2024-6387.patch

      ./openssh-9.6_p1-chaff-logic.patch

      (fetchpatch {

        name = "openssh-gssapi.patch";

        url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%25${version}-3/debian/patches/gssapi.patch";

        hash = "sha256-/lEbH5sIS+o+DStEDAghFy43nZlvcIXSFJrnvp+fDdY=";

        hash = "sha256-BnmEZ5pMIbbysesMSm54ykdweH4JudM9D4Pn5uWf3EY=";

      })

    ];

https://bugs.gentoo.org/935271

Backport proposed by upstream at https://marc.info/?l=oss-security&m=171982317624594&w=2.

--- a/log.c

+++ b/log.c

@@ -451,12 +451,14 @@ void

 sshsigdie(const char *file, const char *func, int line, int showfunc,

     LogLevel level, const char *suffix, const char *fmt, ...)

 {

+#ifdef SYSLOG_R_SAFE_IN_SIGHAND

 	va_list args;

 	va_start(args, fmt);

 	sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL,

 	    suffix, fmt, args);

 	va_end(args);

+#endif

 	_exit(1);

 }

"Minor logic error in ObscureKeystrokeTiming"

https://marc.info/?l=oss-security&m=171982317624594&w=2

--- a/clientloop.c

+++ b/clientloop.c

@@ -608,8 +608,9 @@ obfuscate_keystroke_timing(struct ssh *ssh, struct timespec *timeout,

 		if (timespeccmp(&now, &chaff_until, >=)) {

 			/* Stop if there have been no keystrokes for a while */

 			stop_reason = "chaff time expired";

-		} else if (timespeccmp(&now, &next_interval, >=)) {

-			/* Otherwise if we were due to send, then send chaff */

+		} else if (timespeccmp(&now, &next_interval, >=) &&

+		    !ssh_packet_have_data_to_write(ssh)) {

+			/* If due to send but have no data, then send chaff */

 			if (send_chaff(ssh))

 				nchaff++;

 		}