Page MenuHomeFreeBSD

sshd: do not resolve refused client hostname
ClosedPublic

Authored by glebius on May 11 2023, 7:11 PM.
Tags
None
Referenced Files
F102686875: D40069.id.diff
Fri, Nov 15, 9:13 PM
Unknown Object (File)
Oct 8 2024, 12:07 PM
Unknown Object (File)
Oct 2 2024, 8:26 PM
Unknown Object (File)
Sep 24 2024, 4:34 PM
Unknown Object (File)
Sep 23 2024, 3:31 AM
Unknown Object (File)
Sep 22 2024, 12:09 AM
Unknown Object (File)
Sep 21 2024, 6:30 AM
Unknown Object (File)
Sep 20 2024, 6:27 PM
Subscribers

Details

Summary

This is a compromise between POLA and practical reasoning. We don't
want to block the main server loop in an attempt to resolve. But we
need to keep the format of the logged message as is, for sake of
sshguard and other scripts. So let's print just the IP address twice,
this is what libwrap's refuse() would do if it failed to resolve.

PR: 269456

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

philip added a subscriber: philip.

I think this is a good compromise. I suggest some minor grammar/wording changes to clarify the comment. Nothing consequential. This looks good to me.

crypto/openssh/sshd.c
1299–1314
This revision is now accepted and ready to land.May 16 2023, 8:30 AM
This revision was automatically updated to reflect the committed changes.