1 files changed, 53 insertions, 2 deletions

diff --git a/sshd.c b/sshd.c
index 2b2cc81a5..248ad2976 100644
--- a/sshd.c
+++ b/sshd.c
@@ -254,6 +254,11 @@ Buffer loginmsg;
 /* Unprivileged user */
 struct passwd *privsep_pw = NULL;
 
+#ifdef OOM_ADJUST
+/* Linux out-of-memory killer adjustment */
+static char oom_adj_save[8];
+#endif
+
 /* Prototypes for various functions defined later in this file. */
 void destroy_sensitive_data(void);
 void demote_sensitive_data(void);
@@ -313,6 +318,7 @@ sighup_restart(void)
         close_listen_socks();
         close_startup_pipes();
         alarm(0);  /* alarm timer persists across exec */
+        signal(SIGHUP, SIG_IGN); /* will be restored after exec */
         execv(saved_argv[0], saved_argv);
         logit("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv[0],
             strerror(errno));
@@ -420,7 +426,8 @@ sshd_exchange_identification(int sock_in, int sock_out)
                 minor = PROTOCOL_MINOR_1;
         }
         snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor,
-            SSH_VERSION, newline);
+            options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM,
+            newline);
         server_version_string = xstrdup(buf);
 
         /* Send our protocol version identification. */
@@ -908,6 +915,31 @@ recv_rexec_state(int fd, Buffer *conf)
         debug3("%s: done", __func__);
 }
 
+#ifdef OOM_ADJUST
+/*
+ * If requested in the environment, tell the Linux kernel's out-of-memory
+ * killer to avoid sshd. The old state will be restored when forking child
+ * processes.
+ */
+static void
+oom_adjust_startup(void)
+{
+        const char *oom_adj = getenv("SSHD_OOM_ADJUST");
+
+        if (!oom_adj || !*oom_adj)
+                return;
+        oom_adj_get(oom_adj_save, sizeof(oom_adj_save));
+        oom_adj_set(oom_adj);
+}
+
+static void
+oom_restore(void)
+{
+        if (oom_adj_save[0])
+                oom_adj_set(oom_adj_save);
+}
+#endif
+
 /* Accept a connection from inetd */
 static void
 server_accept_inetd(int *sock_in, int *sock_out)
@@ -1325,7 +1357,12 @@ main(int ac, char **av)
                         /* ignored */
                         break;
                 case 'q':
-                        options.log_level = SYSLOG_LEVEL_QUIET;
+                        if (options.log_level == SYSLOG_LEVEL_QUIET) { 
+                                options.log_level = SYSLOG_LEVEL_SILENT; 
+                        } 
+                        else if (options.log_level != SYSLOG_LEVEL_SILENT) { 
+                                options.log_level = SYSLOG_LEVEL_QUIET; 
+                        } 
                         break;
                 case 'b':
                         options.server_key_bits = (int)strtonum(optarg, 256,
@@ -1518,6 +1555,11 @@ main(int ac, char **av)
                         sensitive_data.host_keys[i] = NULL;
                         continue;
                 }
+                if (reject_blacklisted_key(key, 1) == 1) {
+                        key_free(key);
+                        sensitive_data.host_keys[i] = NULL;
+                        continue;
+                }
                 switch (key->type) {
                 case KEY_RSA1:
                         sensitive_data.ssh1_host_key = key;
@@ -1665,6 +1707,11 @@ main(int ac, char **av)
         /* ignore SIGPIPE */
         signal(SIGPIPE, SIG_IGN);
 
+#ifdef OOM_ADJUST
+        /* Adjust out-of-memory killer */
+        oom_adjust_startup();
+#endif
+
         /* Get a connection, either from inetd or a listening TCP socket */
         if (inetd_flag) {
                 server_accept_inetd(&sock_in, &sock_out);
@@ -1703,6 +1750,10 @@ main(int ac, char **av)
         /* This is the child processing a new connection. */
         setproctitle("%s", "[accepted]");
 
+#ifdef OOM_ADJUST
+        oom_restore();
+#endif
+
         /*
          * Create a new session and process group since the 4.4BSD
          * setlogin() affects the entire process group.  We don't