python3Packages.clustershell: remove blocking test

remove tests/TreeGatewayTest.py because it does not return.

apparently

    def wait(self):
        """wait for task/thread termination"""
        # can be blocked indefinitely if StreamWorker doesn't complete
        self.task.join()

does apply in nix sandbox

fixes #315146

(cherry picked from commit c217dc9717)

pkgs/development/python-modules/clustershell/default.nix

@@ -67,10 +67,9 @@ buildPythonPackage rec {
     rm tests/TaskDistantPdshMixin.py
     rm tests/TaskDistantPdshTest.py
     rm tests/TaskRLimitsTest.py
+    rm tests/TreeGatewayTest.py
 
     nosetests -v \
-      -e test_channel_ctl_shell_remote1 \
-      -e test_channel_ctl_shell_remote2 \
       -e test_fromall_grouplist \
       -e test_rank_placeholder \
       -e test_engine_on_the_fly_launch \
@@ -90,9 +89,6 @@ buildPythonPackage rec {
       -e testClushConfigSetRlimit  \
       -e testTimerInvalidateInHandler \
       -e testTimerSetNextFireInHandler \
-      -e test_channel_ctl_shell_mlocal1 \
-      -e test_channel_ctl_shell_mlocal2 \
-      -e test_channel_ctl_shell_mlocal3 \
       -e test_node_placeholder \
     tests/*.py
   '';

pkgs/tools/networking/openssh/default.nix

@@ -12,7 +12,11 @@ in
       hash = "sha256-kQIRwHJVqMWtZUORtA7lmABxDdgRndU2LeCThap6d3w=";
     };
 
-    extraPatches = [ ./ssh-keysign-8.5.patch ];
+    extraPatches = [
+      ./ssh-keysign-8.5.patch
+      ./openssh-9.6_p1-CVE-2024-6387.patch
+      ./openssh-9.6_p1-chaff-logic.patch
+    ];
     extraMeta.maintainers = with lib.maintainers; [ das_j ];
   };
 
@@ -29,6 +33,8 @@ in
     extraPatches = let url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/b3f86656fc67aa397f60747c85f7f7b967c3279d/security/openssh-portable/files/extra-patch-hpn"; in
     [
       ./ssh-keysign-8.5.patch
+      ./openssh-9.6_p1-CVE-2024-6387.patch
+      ./openssh-9.6_p1-chaff-logic.patch
 
       # HPN Patch from FreeBSD ports
       (fetchpatch {
@@ -68,6 +74,8 @@ in
 
     extraPatches = [
       ./ssh-keysign-8.5.patch
+      ./openssh-9.6_p1-CVE-2024-6387.patch
+      ./openssh-9.6_p1-chaff-logic.patch
 
       (fetchpatch {
         name = "openssh-gssapi.patch";

pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch

@@ -0,0 +1,19 @@
+https://bugs.gentoo.org/935271
+Backport proposed by upstream at https://marc.info/?l=oss-security&m=171982317624594&w=2.
+--- a/log.c
++++ b/log.c
+@@ -451,12 +451,14 @@ void
+ sshsigdie(const char *file, const char *func, int line, int showfunc,
+     LogLevel level, const char *suffix, const char *fmt, ...)
+ {
++#ifdef SYSLOG_R_SAFE_IN_SIGHAND
+ 	va_list args;
+ 
+ 	va_start(args, fmt);
+ 	sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL,
+ 	    suffix, fmt, args);
+ 	va_end(args);
++#endif
+ 	_exit(1);
+ }
+ 

pkgs/tools/networking/openssh/openssh-9.6_p1-chaff-logic.patch

@@ -0,0 +1,16 @@
+"Minor logic error in ObscureKeystrokeTiming"
+https://marc.info/?l=oss-security&m=171982317624594&w=2
+--- a/clientloop.c
++++ b/clientloop.c
+@@ -608,8 +608,9 @@ obfuscate_keystroke_timing(struct ssh *ssh, struct timespec *timeout,
+ 		if (timespeccmp(&now, &chaff_until, >=)) {
+ 			/* Stop if there have been no keystrokes for a while */
+ 			stop_reason = "chaff time expired";
+-		} else if (timespeccmp(&now, &next_interval, >=)) {
+-			/* Otherwise if we were due to send, then send chaff */
++		} else if (timespeccmp(&now, &next_interval, >=) &&
++		    !ssh_packet_have_data_to_write(ssh)) {
++			/* If due to send but have no data, then send chaff */
+ 			if (send_chaff(ssh))
+ 				nchaff++;
+ 		}