Page MenuHomeFreeBSD

sshd: do not resolve refused client hostname
ClosedPublic

Authored by glebius on May 11 2023, 7:11 PM.
Tags
None
Referenced Files
F165594072: D40069.id124942.diff
Sat, Aug 8, 6:30 PM
F165571413: D40069.id121873.diff
Sat, Aug 8, 5:04 PM
Unknown Object (File)
Sat, Aug 8, 11:06 AM
Unknown Object (File)
Thu, Aug 6, 9:18 AM
Unknown Object (File)
Sat, Jul 25, 5:51 PM
Unknown Object (File)
Tue, Jul 21, 1:49 PM
Unknown Object (File)
Tue, Jul 21, 10:30 AM
Unknown Object (File)
Mon, Jul 20, 4:11 AM
Subscribers

Details

Summary

This is a compromise between POLA and practical reasoning. We don't
want to block the main server loop in an attempt to resolve. But we
need to keep the format of the logged message as is, for sake of
sshguard and other scripts. So let's print just the IP address twice,
this is what libwrap's refuse() would do if it failed to resolve.

PR: 269456

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

philip added a subscriber: philip.

I think this is a good compromise. I suggest some minor grammar/wording changes to clarify the comment. Nothing consequential. This looks good to me.

crypto/openssh/sshd.c
1299–1314
This revision is now accepted and ready to land.May 16 2023, 8:30 AM
This revision was automatically updated to reflect the committed changes.