Page MenuHomeFreeBSD

sshd: do not resolve refused client hostname
ClosedPublic

Authored by glebius on May 11 2023, 7:11 PM.
Tags
None
Referenced Files
Unknown Object (File)
Jan 7 2024, 2:09 AM
Unknown Object (File)
Dec 23 2023, 9:37 AM
Unknown Object (File)
Dec 19 2023, 7:06 PM
Unknown Object (File)
Dec 12 2023, 7:20 AM
Unknown Object (File)
Nov 16 2023, 7:34 AM
Unknown Object (File)
Nov 1 2023, 2:43 PM
Unknown Object (File)
Sep 30 2023, 2:47 PM
Unknown Object (File)
Sep 22 2023, 4:50 AM
Subscribers

Details

Summary

This is a compromise between POLA and practical reasoning. We don't
want to block the main server loop in an attempt to resolve. But we
need to keep the format of the logged message as is, for sake of
sshguard and other scripts. So let's print just the IP address twice,
this is what libwrap's refuse() would do if it failed to resolve.

PR: 269456

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

philip added a subscriber: philip.

I think this is a good compromise. I suggest some minor grammar/wording changes to clarify the comment. Nothing consequential. This looks good to me.

crypto/openssh/sshd.c
1299–1314
This revision is now accepted and ready to land.May 16 2023, 8:30 AM
This revision was automatically updated to reflect the committed changes.