394f1022a0
Only the first value of MaxStartups, PerSourceNetBlockSize and IPQoS in sshd_config should count when defined multiple times Resolves: RHEL-150365 Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
107 lines
3.7 KiB
Diff
107 lines
3.7 KiB
Diff
diff --color -ruNp a/regress/cfgparse.sh b/regress/cfgparse.sh
|
|
--- a/regress/cfgparse.sh 2024-09-20 00:20:48.000000000 +0200
|
|
+++ b/regress/cfgparse.sh 2026-03-05 17:30:54.959690744 +0100
|
|
@@ -51,7 +51,7 @@ listenaddress ::1
|
|
EOD
|
|
|
|
($SUDO ${SSHD} -T -f $OBJ/sshd_config.1 | \
|
|
- grep 'listenaddress ' >$OBJ/sshd_config.2 &&
|
|
+ grep '^listenaddress ' >$OBJ/sshd_config.2 &&
|
|
diff $OBJ/sshd_config.0 $OBJ/sshd_config.2) || \
|
|
fail "listenaddress order 1"
|
|
# test 2: listenaddress first
|
|
@@ -67,9 +67,22 @@ listenaddress ::1
|
|
EOD
|
|
|
|
($SUDO ${SSHD} -T -f $OBJ/sshd_config.1 | \
|
|
- grep 'listenaddress ' >$OBJ/sshd_config.2 &&
|
|
+ grep '^listenaddress ' >$OBJ/sshd_config.2 &&
|
|
diff $OBJ/sshd_config.0 $OBJ/sshd_config.2) || \
|
|
fail "listenaddress order 2"
|
|
|
|
+# Check idempotence of MaxStartups
|
|
+verbose "maxstartups idempotent"
|
|
+echo "maxstartups 1:2:3" > $OBJ/sshd_config.0
|
|
+cat > $OBJ/sshd_config.1 <<EOD
|
|
+${SSHD_KEYS}
|
|
+MaxStartups 1:2:3
|
|
+MaxStartups 8:16:32
|
|
+EOD
|
|
+($SUDO ${SSHD} -T -f $OBJ/sshd_config.1 | \
|
|
+ grep '^maxstartups ' >$OBJ/sshd_config.2 &&
|
|
+ diff $OBJ/sshd_config.0 $OBJ/sshd_config.2) || \
|
|
+ fail "maxstartups idempotence"
|
|
+
|
|
# cleanup
|
|
rm -f $OBJ/sshd_config.[012]
|
|
diff --color -ruNp a/servconf.c b/servconf.c
|
|
--- a/servconf.c 2026-03-05 16:15:49.035275297 +0100
|
|
+++ b/servconf.c 2026-03-05 17:13:29.915897329 +0100
|
|
@@ -1366,7 +1366,7 @@ process_server_config_line_depth(ServerO
|
|
struct include_list *includes)
|
|
{
|
|
char *str, ***chararrayptr, **charptr, *arg, *arg2, *p, *keyword;
|
|
- int cmdline = 0, *intptr, value, value2, n, port, oactive, r;
|
|
+ int cmdline = 0, *intptr, value, value2, value3, n, port, oactive, r;
|
|
int ca_only = 0, found = 0;
|
|
SyslogFacility *log_facility_ptr;
|
|
LogLevel *log_level_ptr;
|
|
@@ -2095,25 +2095,27 @@ process_server_config_line_depth(ServerO
|
|
if (!arg || *arg == '\0')
|
|
fatal("%s line %d: %s missing argument.",
|
|
filename, linenum, keyword);
|
|
+ /* begin:rate:max */
|
|
if ((n = sscanf(arg, "%d:%d:%d",
|
|
- &options->max_startups_begin,
|
|
- &options->max_startups_rate,
|
|
- &options->max_startups)) == 3) {
|
|
- if (options->max_startups_begin >
|
|
- options->max_startups ||
|
|
- options->max_startups_rate > 100 ||
|
|
- options->max_startups_rate < 1)
|
|
+ &value, &value2, &value3)) == 3) {
|
|
+ if (value > value3 || value2 > 100 || value2 < 1)
|
|
fatal("%s line %d: Invalid %s spec.",
|
|
filename, linenum, keyword);
|
|
- } else if (n != 1)
|
|
+ } else if (n == 1) {
|
|
+ value3 = value;
|
|
+ value = value2 = -1;
|
|
+ } else {
|
|
fatal("%s line %d: Invalid %s spec.",
|
|
filename, linenum, keyword);
|
|
- else
|
|
- options->max_startups = options->max_startups_begin;
|
|
- if (options->max_startups <= 0 ||
|
|
- options->max_startups_begin <= 0)
|
|
+ }
|
|
+ if (value3 <= 0 || (value2 != -1 && value <= 0))
|
|
fatal("%s line %d: Invalid %s spec.",
|
|
filename, linenum, keyword);
|
|
+ if (*activep && options->max_startups == -1) {
|
|
+ options->max_startups_begin = value;
|
|
+ options->max_startups_rate = value2;
|
|
+ options->max_startups = value3;
|
|
+ }
|
|
break;
|
|
|
|
case sPerSourceNetBlockSize:
|
|
@@ -2133,7 +2135,7 @@ process_server_config_line_depth(ServerO
|
|
if (n != 1 && n != 2)
|
|
fatal("%s line %d: Invalid %s spec.",
|
|
filename, linenum, keyword);
|
|
- if (*activep) {
|
|
+ if (*activep && options->per_source_masklen_ipv4 == -1) {
|
|
options->per_source_masklen_ipv4 = value;
|
|
options->per_source_masklen_ipv6 = value2;
|
|
}
|
|
@@ -2621,7 +2623,7 @@ process_server_config_line_depth(ServerO
|
|
else if ((value2 = parse_ipqos(arg)) == -1)
|
|
fatal("%s line %d: Bad %s value: %s",
|
|
filename, linenum, keyword, arg);
|
|
- if (*activep) {
|
|
+ if (*activep && options->ip_qos_interactive == -1) {
|
|
options->ip_qos_interactive = value;
|
|
options->ip_qos_bulk = value2;
|
|
}
|