From: djm <djm@openbsd.org>
Date: Mon, 1 Jul 2024 04:31:17 +0000 (+0000)
Subject: when sending ObscureKeystrokeTiming chaff packets, we can't
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=31c74db9af79d412892b3d538b232d4571408dc1;p=openbsd

when sending ObscureKeystrokeTiming chaff packets, we can't
rely on channel_did_enqueue to tell that there is data to send.
This flag indicates that the channels code enqueued a packet
on _this_ ppoll() iteration, not that data was enqueued in _any_
ppoll() iteration in the timeslice. ok markus@
---

diff --git a/usr.bin/ssh/clientloop.c b/usr.bin/ssh/clientloop.c
index 2129c151f5d..c5296e32f04 100644
--- a/usr.bin/ssh/clientloop.c
+++ b/usr.bin/ssh/clientloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.407 2024/05/17 06:42:04 jsg Exp $ */
+/* $OpenBSD: clientloop.c,v 1.408 2024/07/01 04:31:17 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -598,8 +598,9 @@ obfuscate_keystroke_timing(struct ssh *ssh, struct timespec *timeout,
 		if (timespeccmp(&now, &chaff_until, >=)) {
 			/* Stop if there have been no keystrokes for a while */
 			stop_reason = "chaff time expired";
-		} else if (timespeccmp(&now, &next_interval, >=)) {
-			/* Otherwise if we were due to send, then send chaff */
+		} else if (timespeccmp(&now, &next_interval, >=) &&
+		    !ssh_packet_have_data_to_write(ssh)) {
+			/* If due to send but have no data, then send chaff */
 			if (send_chaff(ssh))
 				nchaff++;
 		}