blacklist: sshd: Add pending probes
AbandonedPublic
Actions

Authored by jlduran on Tue, Mar 25, 10:07 PM.

Details

Reviewers

emaste
dch

Summary

This change was already on FreeBSD, it has not been submitted upstream
yet.

It fixes when, for example, a bot script tries to authenticate with an
unsupported cipher:

ssh -oCiphers=3des-cbc -l "" <ssh-server>

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

jlduran created this revision.Tue, Mar 25, 10:07 PM

Herald added a subscriber: imp. · View Herald TranscriptTue, Mar 25, 10:07 PM

jlduran requested review of this revision.Tue, Mar 25, 10:07 PM

Harbormaster completed remote builds in B63121: Diff 152673.Tue, Mar 25, 10:07 PM

jlduran added a parent revision: D49503: blacklist: Adapt NetBSD's probes and changes to OpenSSH.Tue, Mar 25, 10:07 PM

jlduran added a child revision: D49506: blacklist: Fix an off-by-one less character.

Update missing patches to be upstreamed.

I forget that @christos_netbsd.org can be conveniently tagged here:

As much as I found NetBSD's build.sh amazing, I have not been able to link it in order to submit this change.

This particular probe is not working.
Sorry for the noise.

Revision Contents
Changeset List

Path

Size

crypto/

openssh/

packet.c

3 lines

Diff 152683

View Options

crypto/openssh/packet.c

Show First 20 Lines • Show All 107 Lines • ▼ Show 20 Lines	if (rte->rt_flags & RTF_GATEWAY) {
pnh4->nh_addr = gw->sin_addr;		pnh4->nh_addr = gw->sin_addr;
} else		} else
pnh4->nh_addr = dst;		pnh4->nh_addr = dst;
/* Set flags */		/* Set flags */
pnh4->nh_flags = fib_rte_to_nh_flags(rte->rt_flags);		pnh4->nh_flags = fib_rte_to_nh_flags(rte->rt_flags);
gw = (struct sockaddr_in *)rt_key(rte);		gw = (struct sockaddr_in *)rt_key(rte);
if (gw->sin_addr.s_addr == 0)		if (gw->sin_addr.s_addr == 0)
pnh4->nh_flags \|= NHF_DEFAULT;		pnh4->nh_flags \|= NHF_DEFAULT;
/* XXX: Set RTF_BROADCAST if GW address is broadcast */

ia = ifatoia(rte->rt_ifa);		ia = ifatoia(rte->rt_ifa);
pnh4->nh_src = IA_SIN(ia)->sin_addr;		pnh4->nh_src = IA_SIN(ia)->sin_addr;

		/* XXXGL: this mimics logic from ip_output(). */
		if (((rte->rt_flags & (RTF_HOST \| RTF_BROADCAST)) ==
		(RTF_HOST \| RTF_BROADCAST)) \|\|
		((pnh4->nh_ifp->if_flags & IFF_BROADCAST) &&
		in_ifaddr_broadcast(pnh4->nh_addr, ia)))
		pnh4->nh_flags \|= NHF_BROADCAST;
		else
		pnh4->nh_flags &= ~NHF_BROADCAST;
}		}

/*		/*
* Performs IPv4 route table lookup on @dst. Returns 0 on success.		* Performs IPv4 route table lookup on @dst. Returns 0 on success.
* Stores nexthop info provided @pnh4 structure.		* Stores nexthop info provided @pnh4 structure.
* Note that		* Note that
* - nh_ifp cannot be safely dereferenced		* - nh_ifp cannot be safely dereferenced
* - nh_ifp represents logical transmit interface (rt_ifp) (e.g. if		* - nh_ifp represents logical transmit interface (rt_ifp) (e.g. if
▲ Show 20 Lines • Show All 108 Lines • Show Last 20 Lines

blacklist: sshd: Add pending probesAbandonedPublicActions