← Back to branch summary

~vcs-imports/ipfire/ipfire-2.x

« back to all changes in this revision

Viewing changes to tools/checknewlog.pl

  • Committer: Peter Müller
  • Date: 2022-04-23 14:27:56 UTC
  • mto: This revision was merged to the branch mainline in revision 9750.
  • Revision ID: git-v1:7a981d94cb2c3e48ecaf07c506c8353a2c839d79
SSH: do not send spoofable TCP keep alive messages

By default, both SSH server and client rely on TCP-based keep alive
messages to detect broken sessions, which can be spoofed rather easily
in order to keep a broken session opened (and vice versa).

Since we rely on SSH-based keep alive messages, which are not vulnerable
to this kind of tampering, there is no need to double-check connections
via TCP keep alive as well.

This patch thereof disables using TCP keep alive for both SSH client and
server scenario. For usability reasons, a timeout of 5 minutes (10
seconds * 30 keep alive messages = 300 seconds) will be used for both
client and server configuration, as 60 seconds were found to be too
short for unstable connectivity scenarios.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>

Show diffs side-by-side

added added

removed removed

Lines of Context:
tools/checknewlog.pl
28
28
#       print $_."\n";
29
29
        my $Found = 0;
30
30
 
31
 
        if ( $_ =~ /$\.log/ || $_ =~ /^\.+/  || $_=~ /-install/ || $_=~ /-tools/ || $_=~ /-config/ || $_=~ /-kmod-/|| $_=~ /u-boot-.*-1/|| $_=~ /coreutils/ || $_=~ /cmake/ || $_=~ /gcc-.*-libatomic/ || $_=~ /gdb/ || $_=~ /libsigc/ || $_ eq 'FILES' ){
 
31
        if ( $_ =~ /$\.log/ || $_ =~ /^\.+/  || $_=~ /-install/ || $_=~ /-tools/ || $_=~ /-config/ || $_=~ /-kmod-/|| $_=~ /u-boot-.*-1/|| $_=~ /coreutils/ || $_=~ /cmake/ || $_=~ /gdb/ || $_=~ /libsigc/ || $_ eq 'FILES' ){
32
32
                next;
33
33
        } elsif ( $_=~ /missing_rootfile/ ){
34
34
                print "Rootfile for $_ missing!\n";