Page MenuHomeFreeBSD

sshd: do not resolve refused client hostname
ClosedPublic

Authored by glebius on May 11 2023, 7:11 PM.
Tags
None
Referenced Files
Unknown Object (File)
Jan 26 2025, 6:09 PM
Unknown Object (File)
Jan 20 2025, 12:06 PM
Unknown Object (File)
Jan 10 2025, 1:45 PM
Unknown Object (File)
Jan 5 2025, 11:41 PM
Unknown Object (File)
Jan 5 2025, 2:42 AM
Unknown Object (File)
Dec 10 2024, 11:01 AM
Unknown Object (File)
Dec 9 2024, 3:11 PM
Unknown Object (File)
Dec 6 2024, 5:03 PM
Subscribers

Details

Summary

This is a compromise between POLA and practical reasoning. We don't
want to block the main server loop in an attempt to resolve. But we
need to keep the format of the logged message as is, for sake of
sshguard and other scripts. So let's print just the IP address twice,
this is what libwrap's refuse() would do if it failed to resolve.

PR: 269456

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 51453
Build 48344: arc lint + arc unit

Event Timeline

philip added a subscriber: philip.

I think this is a good compromise. I suggest some minor grammar/wording changes to clarify the comment. Nothing consequential. This looks good to me.

crypto/openssh/sshd.c
1299–1311
This revision is now accepted and ready to land.May 16 2023, 8:30 AM
This revision was automatically updated to reflect the committed changes.