Page MenuHomeFreeBSD

sshd: do not resolve refused client hostname
ClosedPublic

Authored by glebius on May 11 2023, 7:11 PM.
Tags
None
Referenced Files
Unknown Object (File)
Jan 7 2024, 2:09 AM
Unknown Object (File)
Dec 23 2023, 9:37 AM
Unknown Object (File)
Dec 19 2023, 7:06 PM
Unknown Object (File)
Dec 12 2023, 7:20 AM
Unknown Object (File)
Nov 16 2023, 7:34 AM
Unknown Object (File)
Nov 1 2023, 2:43 PM
Unknown Object (File)
Sep 30 2023, 2:47 PM
Unknown Object (File)
Sep 22 2023, 4:50 AM
Subscribers

Details

Summary

This is a compromise between POLA and practical reasoning. We don't
want to block the main server loop in an attempt to resolve. But we
need to keep the format of the logged message as is, for sake of
sshguard and other scripts. So let's print just the IP address twice,
this is what libwrap's refuse() would do if it failed to resolve.

PR: 269456

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 51453
Build 48344: arc lint + arc unit

Event Timeline

philip added a subscriber: philip.

I think this is a good compromise. I suggest some minor grammar/wording changes to clarify the comment. Nothing consequential. This looks good to me.

crypto/openssh/sshd.c
1299–1311
This revision is now accepted and ready to land.May 16 2023, 8:30 AM
This revision was automatically updated to reflect the committed changes.