1 files changed, 51 insertions, 2 deletions

diff --git a/sshd.c b/sshd.c
index 4228ca550..f61d79ec7 100644
--- a/sshd.c
+++ b/sshd.c
@@ -253,6 +253,11 @@ Buffer loginmsg;
 /* Unprivileged user */
 struct passwd *privsep_pw = NULL;
 
+#ifdef OOM_ADJUST
+/* Linux out-of-memory killer adjustment */
+static char oom_adj_save[8];
+#endif
+
 /* Prototypes for various functions defined later in this file. */
 void destroy_sensitive_data(void);
 void demote_sensitive_data(void);
@@ -419,7 +424,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
                 minor = PROTOCOL_MINOR_1;
         }
         snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor,
-            SSH_VERSION, newline);
+            SSH_RELEASE, newline);
         server_version_string = xstrdup(buf);
 
         /* Send our protocol version identification. */
@@ -907,6 +912,31 @@ recv_rexec_state(int fd, Buffer *conf)
         debug3("%s: done", __func__);
 }
 
+#ifdef OOM_ADJUST
+/*
+ * If requested in the environment, tell the Linux kernel's out-of-memory
+ * killer to avoid sshd. The old state will be restored when forking child
+ * processes.
+ */
+static void
+oom_adjust_startup(void)
+{
+        const char *oom_adj = getenv("SSHD_OOM_ADJUST");
+
+        if (!oom_adj || !*oom_adj)
+                return;
+        oom_adj_get(oom_adj_save, sizeof(oom_adj_save));
+        oom_adj_set(oom_adj);
+}
+
+static void
+oom_restore(void)
+{
+        if (oom_adj_save[0])
+                oom_adj_set(oom_adj_save);
+}
+#endif
+
 /* Accept a connection from inetd */
 static void
 server_accept_inetd(int *sock_in, int *sock_out)
@@ -1324,7 +1354,12 @@ main(int ac, char **av)
                         /* ignored */
                         break;
                 case 'q':
-                        options.log_level = SYSLOG_LEVEL_QUIET;
+                        if (options.log_level == SYSLOG_LEVEL_QUIET) { 
+                                options.log_level = SYSLOG_LEVEL_SILENT; 
+                        } 
+                        else if (options.log_level != SYSLOG_LEVEL_SILENT) { 
+                                options.log_level = SYSLOG_LEVEL_QUIET; 
+                        } 
                         break;
                 case 'b':
                         options.server_key_bits = (int)strtonum(optarg, 256,
@@ -1517,6 +1552,11 @@ main(int ac, char **av)
                         sensitive_data.host_keys[i] = NULL;
                         continue;
                 }
+                if (reject_blacklisted_key(key, 1) == 1) {
+                        key_free(key);
+                        sensitive_data.host_keys[i] = NULL;
+                        continue;
+                }
                 switch (key->type) {
                 case KEY_RSA1:
                         sensitive_data.ssh1_host_key = key;
@@ -1664,6 +1704,11 @@ main(int ac, char **av)
         /* ignore SIGPIPE */
         signal(SIGPIPE, SIG_IGN);
 
+#ifdef OOM_ADJUST
+        /* Adjust out-of-memory killer */
+        oom_adjust_startup();
+#endif
+
         /* Get a connection, either from inetd or a listening TCP socket */
         if (inetd_flag) {
                 server_accept_inetd(&sock_in, &sock_out);
@@ -1702,6 +1747,10 @@ main(int ac, char **av)
         /* This is the child processing a new connection. */
         setproctitle("%s", "[accepted]");
 
+#ifdef OOM_ADJUST
+        oom_restore();
+#endif
+
         /*
          * Create a new session and process group since the 4.4BSD
          * setlogin() affects the entire process group.  We don't