Mercurial > dropbear

comparison svr-runopts.c @ 1861:2b3a8026a6ce

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Add re-exec for server This allows ASLR to re-randomize the address space for every connection, preventing some vulnerabilities from being exploitable by repeated probing. Overhead (memory and time) is yet to be confirmed. At present this is only enabled on Linux. Other BSD platforms with fexecve() would probably also work though have not been tested.
author Matt Johnston <matt@ucc.asn.au>
date Sun, 30 Jan 2022 10:14:56 +0800
parents 8f28519e34b0
children 4a6725ac957c
comparison
equal deleted inserted replaced
1860:5001e9c5641f 1861:2b3a8026a6ce
245 #if INETD_MODE 245 #if INETD_MODE
246 case 'i': 246 case 'i':
247 svr_opts.inetdmode = 1; 247 svr_opts.inetdmode = 1;
248 break; 248 break;
249 #endif 249 #endif
250 #if DROPBEAR_DO_REEXEC && NON_INETD_MODE
251 /* For internal use by re-exec */
252 case '2':
253 svr_opts.reexec_child = 1;
254 break;
255 #endif
250 case 'p': 256 case 'p':
251 nextisport = 1; 257 nextisport = 1;
252 break; 258 break;
253 case 'P': 259 case 'P':
254 next = &svr_opts.pidfile; 260 next = &svr_opts.pidfile;
417 } 423 }
418 424
419 if (svr_opts.forced_command) { 425 if (svr_opts.forced_command) {
420 dropbear_log(LOG_INFO, "Forced command set to '%s'", svr_opts.forced_command); 426 dropbear_log(LOG_INFO, "Forced command set to '%s'", svr_opts.forced_command);
421 } 427 }
428
429 #if INETD_MODE
430 if (svr_opts.inetdmode && (
431 opts.usingsyslog == 0
432 #if DEBUG_TRACE
433 || debug_trace
434 #endif
435 )) {
436 /* log output goes to stderr which would get sent over the inetd network socket */
437 dropbear_exit("Dropbear inetd mode is incompatible with debug -v or non-syslog");
438 }
439 #endif
440
422 #if DROPBEAR_PLUGIN 441 #if DROPBEAR_PLUGIN
423 if (pubkey_plugin) { 442 if (pubkey_plugin) {
424 char *args = strchr(pubkey_plugin, ','); 443 char *args = strchr(pubkey_plugin, ',');
425 if (args) { 444 if (args) {
426 *args='\0'; 445 *args='\0';