openssh unix dev - Mar 2022 - sshd Failing New Inbound Connections

Thorsten Glaser wrote in
 <1f7ddbf7-b4da-10a2-62cc-4356ec12534 at tarent.de>:
 |On Sat, 19 Mar 2022, Steffen Nurpmeso wrote:
 |>>|getaddrinfo() sometimes supports AI_NUMERICHOST which could perhaps
 |>>|be tried once opportunistically, before trying again with it unset?
 |
 |This sounds sensible. AIUI that one skips the resolver.
 |
 |> actually even standardized that "octal numbers" are not
supported

..inet_pton..

 |> 127.000.000.001 in form fields etc.
 |
 |These are decimal, to add insult to injury, not octal.
 |
 |Blame the Windows? 95 input fields?

I do.  But here we are and inet_pton was carefully designed to
require academics on the input side.

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)

On Mon, 21 Mar 2022, Steffen Nurpmeso wrote:
>  |> actually even standardized that "octal numbers" are not
supported
> 
> ..inet_pton..
Huh. Not that but inet_aton on GNU, and other functions apparently.

This is idiotic, and I guess the same POSIX that insists on octals
for leading-zero numbers in shell, causing no small amount of bugs,
is responsible. Hmph.
>  |> 127.000.000.001 in form fields etc.
|            $ ./a.out 226.000.000.037      # Last byte is in octal

Given that these may be either decimal or octal, depending on where
they come from, it?s probably for the best to reject them.

(My RFC822-and-related-parser certainly does.)

bye,
//mirabilos
-- 
Infrastrukturexperte ? tarent solutions GmbH
Am Dickobskreuz 10, D-53121 Bonn ? http://www.tarent.de/
Telephon +49 228 54881-393 ? Fax: +49 228 54881-235
HRB AG Bonn 5168 ? USt-ID (VAT): DE122264941
Gesch?ftsf?hrer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg

                        ****************************************************
/?\ The UTF-8 Ribbon
??? Campaign against      Mit dem tarent-Newsletter nichts mehr verpassen:
??? HTML eMail! Also,     https://www.tarent.de/newsletter
??? header encryption!
                        ****************************************************