Mercurial > dropbear

comparison sysoptions.h @ 1861:2b3a8026a6ce

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Add re-exec for server This allows ASLR to re-randomize the address space for every connection, preventing some vulnerabilities from being exploitable by repeated probing. Overhead (memory and time) is yet to be confirmed. At present this is only enabled on Linux. Other BSD platforms with fexecve() would probably also work though have not been tested.
author Matt Johnston <matt@ucc.asn.au>
date Sun, 30 Jan 2022 10:14:56 +0800
parents 35d504d59c05
children 6f265a35159a
comparison
equal deleted inserted replaced
1860:5001e9c5641f 1861:2b3a8026a6ce
26 #define DROPBEAR_SVR_PUBKEY_OPTIONS_BUILT ((DROPBEAR_SVR_PUBKEY_AUTH) && (DROPBEAR_SVR_PUBKEY_OPTIONS)) 26 #define DROPBEAR_SVR_PUBKEY_OPTIONS_BUILT ((DROPBEAR_SVR_PUBKEY_AUTH) && (DROPBEAR_SVR_PUBKEY_OPTIONS))
27 27
28 #if !(NON_INETD_MODE || INETD_MODE) 28 #if !(NON_INETD_MODE || INETD_MODE)
29 #error "NON_INETD_MODE or INETD_MODE (or both) must be enabled." 29 #error "NON_INETD_MODE or INETD_MODE (or both) must be enabled."
30 #endif 30 #endif
31
32 /* Would probably work on freebsd but hasn't been tested */
33 #define DROPBEAR_DO_REEXEC (defined(HAVE_FEXECVE) && DROPBEAR_REEXEC && defined(__linux__))
31 34
32 /* A client should try and send an initial key exchange packet guessing 35 /* A client should try and send an initial key exchange packet guessing
33 * the algorithm that will match - saves a round trip connecting, has little 36 * the algorithm that will match - saves a round trip connecting, has little
34 * overhead if the guess was "wrong". */ 37 * overhead if the guess was "wrong". */
35 #ifndef DROPBEAR_KEX_FIRST_FOLLOWS 38 #ifndef DROPBEAR_KEX_FIRST_FOLLOWS