diff options
| -rw-r--r-- | crypto/openssh/servconf.c | 13 | ||||
| -rw-r--r-- | crypto/openssh/sshd.8 | 25 | ||||
| -rw-r--r-- | crypto/openssh/sshd.c | 63 | ||||
| -rw-r--r-- | crypto/openssh/sshd_config | 3 |
4 files changed, 2 insertions, 102 deletions
diff --git a/crypto/openssh/servconf.c b/crypto/openssh/servconf.c index ec6682f..928db29 100644 --- a/crypto/openssh/servconf.c +++ b/crypto/openssh/servconf.c @@ -680,18 +680,7 @@ parse_flag: break; case sConnectionsPerPeriod: - arg = strdelim(&cp); - if (cp == NULL) - fatal("%.200s line %d: missing (>= 0) number argument.\n", - filename, linenum); - if (sscanf(arg, "%u/%u", &options->connections_per_period, - &options->connections_period) != 2) - fatal("%.200s line %d: invalid numerical argument(s).\n", - filename, linenum); - if (options->connections_per_period != 0 && - options->connections_period == 0) - fatal("%.200s line %d: invalid connections period.\n", - filename, linenum); + fatal("ConnectionsPerPeriod has been deprecated."); break; case sSubsystem: diff --git a/crypto/openssh/sshd.8 b/crypto/openssh/sshd.8 index f2a7544..c8ab125 100644 --- a/crypto/openssh/sshd.8 +++ b/crypto/openssh/sshd.8 @@ -337,31 +337,6 @@ Specifies whether should check for new mail for interactive logins. The default is .Dq yes . -.It Cm ConnectionsPerPeriod -This keyword allows for rate-limiting of connections, and -is followed by two numbers in the format -.Dq n/s , -where -.Ar n -is the number of connections from a certain address group -accepted per period of -.Ar s -seconds. Any connection after the number -.Ar n -connection in the period of -.Ar s -seconds will be dropped, and an informational message will be logged. -A connection will belong to a certain group, of which there are 13 -by default, according to its IP address. -The default for this keyword is -.Dq 0/0 , -and rate-limiting can be explicitly turned off by using an -.Ar n -parameter of -.Ql 0 -and any -.Ar s -parameter. .It Cm DenyGroups This keyword can be followed by a number of group names, separated by spaces. diff --git a/crypto/openssh/sshd.c b/crypto/openssh/sshd.c index 6dcc066..ad69883 100644 --- a/crypto/openssh/sshd.c +++ b/crypto/openssh/sshd.c @@ -167,32 +167,6 @@ unsigned char session_id[16]; unsigned char *session_id2 = NULL; int session_id2_len = 0; -/* These are used to implement connections_per_period. */ -struct ratelim_connection { - struct timeval connections_begin; - unsigned int connections_this_period; -} *ratelim_connections; - -static void -ratelim_init(void) { - ratelim_connections = calloc(num_listen_socks, - sizeof(struct ratelim_connection)); - if (ratelim_connections == NULL) - fatal("calloc: %s", strerror(errno)); -} - -static __inline struct timeval -timevaldiff(struct timeval *tv1, struct timeval *tv2) { - struct timeval diff; - int carry; - - carry = tv1->tv_usec > tv2->tv_usec; - diff.tv_sec = tv2->tv_sec - tv1->tv_sec - (carry ? 1 : 0); - diff.tv_usec = tv2->tv_usec - tv1->tv_usec + (carry ? 1000000 : 0); - - return diff; -} - /* record remote hostname or ip */ unsigned int utmp_len = MAXHOSTNAMELEN; @@ -508,7 +482,6 @@ main(int ac, char **av) int opt, sock_in = 0, sock_out = 0, newsock, j, i, fdsetsz, on = 1; pid_t pid; socklen_t fromlen; - int ratelim_exceeded = 0; int silent = 0; fd_set *fdset; struct sockaddr_storage from; @@ -874,8 +847,6 @@ main(int ac, char **av) for (i = 0; i < options.max_startups; i++) startup_pipes[i] = -1; - ratelim_init(); - /* * Stay listening for connections until the system crashes or * the daemon is killed with a signal. @@ -948,27 +919,6 @@ main(int ac, char **av) break; } - if (options.connections_per_period != 0) { - struct timeval diff, connections_end; - struct ratelim_connection *rc; - - (void)gettimeofday(&connections_end, NULL); - rc = &ratelim_connections[i]; - diff = timevaldiff(&rc->connections_begin, - &connections_end); - if (diff.tv_sec >= options.connections_period) { - /* - * Slide the window forward only after - * completely leaving it. - */ - rc->connections_begin = connections_end; - rc->connections_this_period = 1; - } else { - if (++rc->connections_this_period > - options.connections_per_period) - ratelim_exceeded = 1; - } - } /* * Got connection. Fork a child to handle it, unless @@ -987,19 +937,6 @@ main(int ac, char **av) startup_pipe = -1; pid = getpid(); break; - } else if (ratelim_exceeded) { - const char *myaddr; - - myaddr = get_ipaddr(newsock); - log("rate limit (%u/%u) on %s port %d " - "exceeded by %s", - options.connections_per_period, - options.connections_period, myaddr, - get_sock_port(newsock, 1), ntop); - free((void *)myaddr); - close(newsock); - ratelim_exceeded = 0; - continue; } else { /* * Normal production daemon. Fork, and have diff --git a/crypto/openssh/sshd_config b/crypto/openssh/sshd_config index 13fb265..7da9ce7 100644 --- a/crypto/openssh/sshd_config +++ b/crypto/openssh/sshd_config @@ -12,8 +12,7 @@ ServerKeyBits 768 LoginGraceTime 120 KeyRegenerationInterval 3600 PermitRootLogin no -# Deprecated: rate-limit sshd connections to 5 connections per 10 seconds -# ConnectionsPerPeriod 5/10 +# ConnectionsPerPeriod has been deprecated completely # After 10 unauthenticated connections, refuse 30% of the new ones, and # refuse any more than 60 total. |
