--- //depot/vendor/freebsd/src/contrib/netcat/nc.1 2011-05-11 22:36:59.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/contrib/netcat/nc.1 2011-08-05 23:01:13.000000000 0000 @@ -27,7 +27,7 @@ .\" .\" $FreeBSD: src/contrib/netcat/nc.1,v 1.21 2011/05/11 21:52:26 delphij Exp $ .\" -.Dd January 8, 2011 +.Dd July 19, 2011 .Dt NC 1 .Os .Sh NAME @@ -175,6 +175,9 @@ Specifies that source and/or destination ports should be chosen randomly instead of sequentially within a range or in the order that the system assigns them. +.It Fl -rcv-uto +Specifies that the UTO value sent by the peer should be accepted when TCP +computes the local User Timeout. .It Fl S Enables the RFC 2385 TCP MD5 signature option. .It Fl s Ar source @@ -240,6 +243,9 @@ .Fl w flag. The default is no timeout. +.Tf +This timeout also controls the User Timeout advertised to the peer by +TCP. .It Fl X Ar proxy_protocol Requests that .Nm --- //depot/vendor/freebsd/src/contrib/netcat/netcat.c 2011-05-11 22:36:59.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/contrib/netcat/netcat.c 2011-08-05 23:01:13.000000000 0000 @@ -83,6 +83,7 @@ char *Pflag; /* Proxy username */ char *pflag; /* Localport flag */ int rflag; /* Random ports flag */ +int utoflag; /* Accept peer UTO. */ char *sflag; /* Source Address */ int tflag; /* Telnet Emulation */ int uflag; /* UDP - Default to TCP */ @@ -140,6 +141,7 @@ char unix_dg_tmp_socket_buf[UNIX_DG_TMP_SOCKET_SIZE]; struct option longopts[] = { { "no-tcpopt", no_argument, &FreeBSD_Oflag, 1 }, + { "rcv-uto", no_argument, &utoflag, 1 }, { NULL, 0, NULL, 0 } }; @@ -250,7 +252,6 @@ timeout = strtonum(optarg, 0, INT_MAX / 1000, &errstr); if (errstr) errx(1, "timeout %s: %s", errstr, optarg); - timeout *= 1000; break; case 'x': xflag = 1; @@ -283,6 +284,9 @@ case 'T': Tflag = parse_iptos(optarg); break; + case 0: + /* getopt_long returns 0 for --long-options. */ + break; default: usage(1); } @@ -742,7 +746,7 @@ if (iflag) sleep(iflag); - if ((n = poll(pfd, 2 - dflag, timeout)) < 0) { + if ((n = poll(pfd, 2 - dflag, timeout * 1000)) < 0) { close(nfd); err(1, "Polling Error"); } @@ -938,6 +942,19 @@ &FreeBSD_Oflag, sizeof(FreeBSD_Oflag)) == -1) err(1, "disable TCP options"); } + /* + * Try to set the sent timeout but don't die on error. The timeout + * option was here before UTO so this would break existing + * applications on systems where UTO is disabled. + */ + if (timeout > 0 && setsockopt(s, IPPROTO_TCP, TCP_SNDUTO_TIMEOUT, + &timeout, sizeof(timeout))) + perror("setsokopt send TCP UTO"); + + /* Set the disposition to accept the timeout of the peer. */ + if (utoflag && setsockopt(s, IPPROTO_TCP, TCP_RCVUTO_TIMEOUT, + &utoflag, sizeof(utoflag))) + err(1, "setsokopt receive TCP UTO"); } int @@ -983,6 +1000,7 @@ \t-P proxyuser\tUsername for proxy authentication\n\ \t-p port\t Specify local port for remote connects\n\ \t-r Randomize remote ports\n\ + \t--rcv-uto Accept peer User Timeout\n\ \t-S Enable the TCP MD5 signature option\n\ \t-s addr\t Local source address\n\ \t-T ToS\t Set IP Type of Service\n\ --- //depot/vendor/freebsd/src/contrib/telnet/telnet/commands.c 2010-04-30 20:35:27.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/contrib/telnet/telnet/commands.c 2011-08-20 12:28:18.000000000 0000 @@ -78,6 +78,7 @@ #include #include #include +#include #ifndef MAXHOSTNAMELEN #define MAXHOSTNAMELEN 256 @@ -877,6 +878,7 @@ { "escape", "character to escape back to telnet command mode", NULL, &escape }, { "rlogin", "rlogin escape character", 0, &rlogin }, { "tracefile", "file to write trace information to", SetNetTrace, (cc_t *)NetTraceFile}, + { "timeout", "tcp timeout for this connection", set_timeout, NULL}, { " ", "", NULL, NULL }, { " ", "The following need 'localchars' to be toggled true", NULL, NULL }, { "flushoutput", "character to cause an Abort Output", NULL, termFlushCharp }, @@ -919,6 +921,25 @@ } } +void +set_timeout(char *s) +{ +#ifdef TCP_SNDUTO_TIMEOUT + if (s == NULL) { + uto = 0; + /* There is not way to "take it back". */ + return; + } + /* Setting the timeout if net is a valid descriptor. */ + uto = strtonum(s, 0, INT_MAX, NULL); + if (uto && net > 0 && setsockopt(net, IPPROTO_TCP, TCP_SNDUTO_TIMEOUT, + &uto, sizeof(uto))) + perror("setsockopt UTO"); +#else + fprintf(stderr, "Warning: UTO not supported. timeout ignored\n"); +#endif +} + static int setcmd(int argc, char *argv[]) { @@ -976,7 +997,8 @@ return 0; } else if (ct->handler) { (*ct->handler)(argv[2]); - printf("%s set to \"%s\".\n", ct->name, (char *)ct->charp); + if (ct->charp) + printf("%s set to \"%s\".\n", ct->name, (char *)ct->charp); } else { if (strcmp("off", argv[2])) { value = special(argv[2]); @@ -1042,7 +1064,8 @@ return 0; } else if (ct->handler) { (*ct->handler)(0); - printf("%s reset to \"%s\".\n", ct->name, (char *)ct->charp); + if (ct->charp) + printf("%s reset to \"%s\".\n", ct->name, (char *)ct->charp); } else { *(ct->charp) = _POSIX_VDISABLE; printf("%s character is '%s'.\n", ct->name, control(*(ct->charp))); @@ -2442,6 +2465,9 @@ goto fail; } #endif + if (uto && setsockopt(net, IPPROTO_TCP, TCP_SNDUTO_TIMEOUT, &uto, + sizeof(uto))) + perror("setsockopt UTO"); if (connect(net, res->ai_addr, res->ai_addrlen) < 0) { struct addrinfo *next; --- //depot/vendor/freebsd/src/contrib/telnet/telnet/externs.h 2010-04-30 20:35:27.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/contrib/telnet/telnet/externs.h 2011-08-05 23:43:09.000000000 0000 @@ -129,6 +129,7 @@ termdata, /* Print out terminal data flow */ telnet_debug, /* Debug level */ doaddrlookup, /* do a reverse lookup? */ + uto, /* Request User Timeout. */ clienteof; /* Client received EOF */ extern cc_t escape; /* Escape to command mode */ @@ -260,6 +261,7 @@ setcommandmode(void), set_escape_char(char *s), setneturg(void), + set_timeout(char *s), sys_telnet_init(void), telnet(char *), tel_enter_binary(int), --- //depot/vendor/freebsd/src/contrib/telnet/telnet/main.c 2005-01-09 11:38:01.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/contrib/telnet/telnet/main.c 2011-08-05 23:43:09.000000000 0000 @@ -97,7 +97,7 @@ "[-4] [-6] [-8] [-E] [-L] [-N] [-S tos] [-c] [-d]", "\n\t[-e char] [-l user] [-n tracefile] ", #endif - "[-r] [-s src_addr] [-u] ", + "[-r] [-s src_addr] [-t timeout] [-u] ", #if defined(IPSEC) && defined(IPSEC_POLICY_IPSEC) "[-P policy] " #endif @@ -154,7 +154,7 @@ #define IPSECOPT #endif while ((ch = getopt(argc, argv, - "468EKLNS:X:acde:fFk:l:n:rs:uxy" IPSECOPT)) != -1) + "468EKLNS:X:acde:fFk:l:n:rs:ut:xy" IPSECOPT)) != -1) #undef IPSECOPT { switch(ch) { @@ -303,6 +303,12 @@ case 's': src_addr = optarg; break; + case 't': + set_timeout(optarg); + if (!uto) + fprintf(stderr, "Warning: timeout `%s'" + " ignored\n", optarg); + break; case 'u': family = AF_UNIX; break; --- //depot/vendor/freebsd/src/contrib/telnet/telnet/telnet.1 2006-09-30 00:41:04.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/contrib/telnet/telnet/telnet.1 2011-08-05 23:43:09.000000000 0000 @@ -50,6 +50,7 @@ .Op Fl l Ar user .Op Fl n Ar tracefile .Op Fl s Ar src_addr +.Op Fl t Ar timeout .Oo .Ar host .Op Ar port @@ -203,6 +204,14 @@ connection to .Ar src_addr , which can be an IP address or a host name. +.It Fl t Ar timeout +Sets the requested timeout (UTO) for the connection. +If the server accepts this value, the connection will be kept for +.Ar timeout +seconds in the absence of network connectivity. +.Pp +This is server-dependent, but usually it only works with authentication, +for security reasons. .It Fl u Forces .Nm --- //depot/vendor/freebsd/src/contrib/telnet/telnet/telnet.c 2010-04-30 20:35:27.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/contrib/telnet/telnet/telnet.c 2011-08-05 23:43:09.000000000 0000 @@ -112,6 +112,7 @@ dontlecho, /* do we suppress local echoing right now? */ globalmode, doaddrlookup = 1, /* do a reverse address lookup? */ + uto = 0, /* Request User Timeout. */ clienteof = 0; char *prompt = 0; --- //depot/vendor/freebsd/src/contrib/telnet/telnetd/telnetd.8 2008-08-29 00:37:52.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/contrib/telnet/telnetd/telnetd.8 2011-08-05 23:43:09.000000000 0000 @@ -32,7 +32,7 @@ .\" @(#)telnetd.8 8.4 (Berkeley) 6/1/94 .\" $FreeBSD: src/contrib/telnet/telnetd/telnetd.8,v 1.22 2008/08/29 00:04:37 trhodes Exp $ .\" -.Dd August 28, 2008 +.Dd August 05, 2011 .Dt TELNETD 8 .Os .Sh NAME @@ -42,7 +42,7 @@ protocol server .Sh SYNOPSIS .Nm /usr/libexec/telnetd -.Op Fl 46BUhlkn +.Op Fl 46BUhlknt .Op Fl D Ar debugmode .Op Fl S Ar tos .Op Fl X Ar authtype @@ -263,6 +263,14 @@ TOS name found in the .Pa /etc/iptos file. +.It Fl t +Accepts UTO (User Timeout) suggestion from client. +Normally a TCP connection is dropped if data is not acknowledged for a period +of time. +A client may influnce this period by advertising a timeout value. +.Pp +The value sent by the client is only accepted after successful authentication, +for security reasons. .It Fl u Ar len This option is used to specify the size of the field in the --- //depot/vendor/freebsd/src/contrib/telnet/telnetd/telnetd.c 2010-01-13 19:35:37.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/contrib/telnet/telnetd/telnetd.c 2011-08-20 12:28:18.000000000 0000 @@ -49,6 +49,7 @@ #include #include +#include /* For UTO. */ #ifdef AUTHENTICATION #include @@ -80,6 +81,7 @@ static int debug = 0; int keepalive = 1; const char *altlogin; +int uto = 0; /* Accept advertised timeout. */ void doit(struct sockaddr *); int terminaltypeok(char *); @@ -93,7 +95,7 @@ * passed off to getopt(). */ char valid_opts[] = { - 'd', ':', 'h', 'k', 'n', 'p', ':', 'S', ':', 'u', ':', 'U', + 'd', ':', 'h', 'k', 'n', 'p', ':', 'S', ':', 't', 'u', ':', 'U', '4', '6', #ifdef AUTHENTICATION 'a', ':', 'X', ':', @@ -285,6 +287,15 @@ #endif break; + case 't': +#ifdef TCP_RCVUTO_TIMEOUT + /* Enable TCP_RCVUTO_TIMEOUT after authentication.*/ + uto = 1; +#else + warnx("UTO not supported."); +#endif + break; + case 'u': utmp_len = (size_t)atoi(optarg); if (utmp_len >= sizeof(remote_hostname)) @@ -445,6 +456,7 @@ #ifdef HAS_GETTOS fprintf(stderr, " [-S tos]"); #endif + fprintf(stderr, " [-t]"); #ifdef AUTHENTICATION fprintf(stderr, " [-X auth-type]"); #endif @@ -931,6 +943,11 @@ DIAG(TD_REPORT, output_data("td: Entering processing loop\r\n")); + /* If authenticated we'll accept the received UTO. */ + if (uto && level && setsockopt(net, IPPROTO_TCP, TCP_RCVUTO_TIMEOUT, &uto, + sizeof(uto))) + perror("setsockopt UTO"); + /* * Startup the login process on the slave side of the terminal * now. We delay this until here to insure option negotiation --- //depot/vendor/freebsd/src/crypto/openssh/readconf.c 2011-05-04 08:35:39.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/crypto/openssh/readconf.c 2011-08-20 11:56:07.000000000 0000 @@ -138,7 +138,7 @@ oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand, oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication, oKexAlgorithms, oIPQoS, - oVersionAddendum, + oVersionAddendum, oUserTimeout, oDeprecated, oUnsupported } OpCodes; @@ -227,6 +227,11 @@ { "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost }, { "rekeylimit", oRekeyLimit }, { "connecttimeout", oConnectTimeout }, +#ifdef TCP_SNDUTO_TIMEOUT + { "usertimeout", oUserTimeout }, +#else + { "usertimeout", oUnsupported }, +#endif { "addressfamily", oAddressFamily }, { "serveraliveinterval", oServerAliveInterval }, { "serveralivecountmax", oServerAliveCountMax }, @@ -415,6 +420,10 @@ *intptr = value; break; + case oUserTimeout: + intptr = &options->user_timeout; + goto parse_time; + case oForwardAgent: intptr = &options->forward_agent; parse_flag: @@ -1132,6 +1141,7 @@ options->address_family = -1; options->connection_attempts = -1; options->connection_timeout = -1; + options->user_timeout = -1; options->number_of_password_prompts = -1; options->cipher = -1; options->ciphers = NULL; --- //depot/vendor/freebsd/src/crypto/openssh/readconf.h 2011-05-04 08:35:39.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/crypto/openssh/readconf.h 2011-08-05 22:38:23.000000000 0000 @@ -69,6 +69,7 @@ * giving up */ int connection_timeout; /* Max time (seconds) before * aborting connection attempt */ + int user_timeout; /* Timeout value (seconds) sent to server. */ int number_of_password_prompts; /* Max number of password * prompts. */ int cipher; /* Cipher to use. */ --- //depot/vendor/freebsd/src/crypto/openssh/servconf.c 2011-05-04 08:35:39.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/crypto/openssh/servconf.c 2011-08-20 11:56:07.000000000 0000 @@ -109,6 +109,7 @@ options->compression = -1; options->allow_tcp_forwarding = -1; options->allow_agent_forwarding = -1; + options->allow_user_timeout = -1; options->num_allow_users = 0; options->num_deny_users = 0; options->num_allow_groups = 0; @@ -326,7 +327,7 @@ sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2, sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel, sMatch, sPermitOpen, sForceCommand, sChrootDirectory, - sUsePrivilegeSeparation, sAllowAgentForwarding, + sUsePrivilegeSeparation, sAllowAgentForwarding, sAllowUserTimeout, sZeroKnowledgePasswordAuthentication, sHostCertificate, sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile, sKexAlgorithms, sIPQoS, @@ -422,6 +423,11 @@ { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL }, /* obsolete alias */ { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL }, { "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL }, +#ifdef TCP_RCVUTO_TIMEOUT + { "allowusertimeout", sAllowUserTimeout, SSHCFG_ALL }, +#else + { "allowusertimeout", sUnsupported, SSHCFG_ALL }, +#endif { "allowusers", sAllowUsers, SSHCFG_GLOBAL }, { "denyusers", sDenyUsers, SSHCFG_GLOBAL }, { "allowgroups", sAllowGroups, SSHCFG_GLOBAL }, @@ -1085,6 +1091,10 @@ case sAllowAgentForwarding: intptr = &options->allow_agent_forwarding; goto parse_flag; + + case sAllowUserTimeout: + intptr = &options->allow_user_timeout; + goto parse_flag; case sUsePrivilegeSeparation: intptr = &use_privsep; --- //depot/vendor/freebsd/src/crypto/openssh/servconf.h 2011-05-04 08:35:39.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/crypto/openssh/servconf.h 2011-08-05 22:38:23.000000000 0000 @@ -111,6 +111,7 @@ int compression; /* If true, compression is allowed */ int allow_tcp_forwarding; int allow_agent_forwarding; + int allow_user_timeout; /* Accept the client timeout if true. */ u_int num_allow_users; char *allow_users[MAX_ALLOW_USERS]; u_int num_deny_users; --- //depot/vendor/freebsd/src/crypto/openssh/ssh.1 2011-05-04 08:35:39.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/crypto/openssh/ssh.1 2011-08-05 22:38:23.000000000 0000 @@ -35,7 +35,7 @@ .\" .\" $OpenBSD: ssh.1,v 1.316 2010/11/18 15:01:00 jmc Exp $ .\" $FreeBSD: src/crypto/openssh/ssh.1,v 1.44 2011/05/04 07:34:44 des Exp $ -.Dd November 18, 2010 +.Dd August 05, 2011 .Dt SSH 1 .Os .Sh NAME @@ -60,6 +60,7 @@ .Op Fl p Ar port .Op Fl R Oo Ar bind_address : Oc Ns Ar port : Ns Ar host : Ns Ar hostport .Op Fl S Ar ctl_path +.Op Fl u Ar timeout .Op Fl W Ar host : Ns Ar port .Op Fl w Ar local_tun Ns Op : Ns Ar remote_tun .Oo Ar user Ns @ Oc Ns Ar hostname @@ -466,6 +467,7 @@ .It TunnelDevice .It UsePrivilegedPort .It User +.It UserTimeout .It UserKnownHostsFile .It VerifyHostKeyDNS .It VersionAddendum @@ -557,6 +559,14 @@ options force tty allocation, even if .Nm has no local tty. +.It Fl u Ar timeout +Sets the requested timeout (UTO) for the connection. +If the option is accepted by the server, the connection will be kept for +the specified time in the absence of network connectivity. +.Pp +This option can also be enabled using the UserTimeout directive as described +in +.Xr ssh_config 5 . .It Fl V Display the version number and exit. .It Fl v --- //depot/vendor/freebsd/src/crypto/openssh/ssh.c 2011-05-04 08:35:39.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/crypto/openssh/ssh.c 2011-08-20 11:56:07.000000000 0000 @@ -70,6 +70,7 @@ #include #include +#include #include #include @@ -200,7 +201,7 @@ " [-L [bind_address:]port:host:hostport]\n" " [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]\n" " [-R [bind_address:]port:host:hostport] [-S ctl_path]\n" -" [-W host:port] [-w local_tun[:remote_tun]]\n" +" [-u timeout] [-W host:port] [-w local_tun[:remote_tun]]\n" " [user@]hostname [command]\n" ); exit(255); @@ -297,7 +298,7 @@ argv0 = av[0]; again: - while ((opt = getopt(ac, av, "1246ab:c:e:fgi:kl:m:no:p:qstvx" + while ((opt = getopt(ac, av, "1246ab:c:e:fgi:kl:m:no:p:qstu:vx" "ACD:F:I:KL:MNO:PR:S:TVw:W:XYy")) != -1) { switch (opt) { case '1': @@ -392,6 +393,16 @@ force_tty_flag = 1; tty_flag = 1; break; + case 'u': +#ifdef TCP_SNDUTO_TIMEOUT + options.user_timeout = convtime(optarg); + if (options.user_timeout == -1) + fatal("Invalid User Timeout value"); +#else + fprintf(stderr, "Warning, TCP_SNDUTO_TIMEOUT not" + " supported, timeout ignored\n"); +#endif + break; case 'v': if (debug_flag == 0) { debug_flag = 1; @@ -905,6 +916,15 @@ } else { verbose("Authenticated to %s (via proxy).", host); } + + /* + * Attempt to send the option after authenticating. If the server + * didn't record it at SYN, it should now. + */ + if (options.user_timeout && setsockopt(packet_get_connection_in(), + IPPROTO_TCP, TCP_SNDUTO_TIMEOUT, &options.user_timeout, + sizeof(options.user_timeout))) + error("setsockopt TCP_SNDUTO_TIMEOUT: %.100s", strerror(errno)); /* We no longer need the private host keys. Clear them now. */ if (sensitive_data.nkeys != 0) { --- //depot/vendor/freebsd/src/crypto/openssh/ssh_config.5 2011-05-04 08:35:39.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/crypto/openssh/ssh_config.5 2011-08-05 22:38:23.000000000 0000 @@ -35,7 +35,7 @@ .\" .\" $OpenBSD: ssh_config.5,v 1.146 2010/12/08 04:02:47 djm Exp $ .\" $FreeBSD: src/crypto/openssh/ssh_config.5,v 1.32 2011/05/04 07:34:44 des Exp $ -.Dd December 8, 2010 +.Dd July 19, 2011 .Dt SSH_CONFIG 5 .Os .Sh NAME @@ -1137,6 +1137,20 @@ This can be useful when a different user name is used on different machines. This saves the trouble of having to remember to give the user name on the command line. +.It Cm UserTimeout +Specifies the UserTimeout (TCP UTO) for this connection. +If the server accepts this option, the connection will be kept for the +specified time in the absence of network connectivity. +.Pp +Usually a server will only allow certain users to use this option, due to +the security risks involved. +.Pp +The values that can be specified are subject to +.Dv net.inet.tcp.uto.min_timeout +and +.Dv net.inet.tcp.uto.max_timeout . +.Pp +By default no timeout is used. .It Cm UserKnownHostsFile Specifies a file to use for the user host key database instead of --- //depot/vendor/freebsd/src/crypto/openssh/sshconnect.c 2011-05-04 08:35:39.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/crypto/openssh/sshconnect.c 2011-08-05 22:38:23.000000000 0000 @@ -25,6 +25,7 @@ #endif #include +#include #include #include @@ -389,6 +390,17 @@ /* Any error is already output */ continue; + /* + * Attempt to set the UTO value before connecting. + * Some hosts might not accept it if we send it later. + */ + if (options.user_timeout > 0 && + setsockopt(sock, IPPROTO_TCP, TCP_SNDUTO_TIMEOUT, + &options.user_timeout, + sizeof(options.user_timeout)) < 0) + error("setsockopt TCP_SNDUTO_TIMEOUT: %.100s", + strerror(errno)); + if (timeout_connect(sock, ai->ai_addr, ai->ai_addrlen, timeout_ms) >= 0) { /* Successful connection. */ --- //depot/vendor/freebsd/src/crypto/openssh/sshd.c 2011-05-04 08:35:39.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/crypto/openssh/sshd.c 2011-08-05 22:38:23.000000000 0000 @@ -59,6 +59,8 @@ #include "openbsd-compat/sys-queue.h" #include +#include + #include #include #include @@ -2027,6 +2029,17 @@ startup_pipe = -1; } + /* + * After authentication it's safe to enable User Timeout. The + * connection will not be dropped for this period of time even if + * the client stays silent (doesn't ACK our data). + */ + if (options.allow_user_timeout && packet_connection_is_on_socket() && + setsockopt(sock_in, IPPROTO_TCP, TCP_RCVUTO_TIMEOUT, &on, + sizeof(on)) < 0) + error("setsockopt TCP_RCVUTO_TIMEOUT: %.100s", strerror(errno)); + + #ifdef SSH_AUDIT_EVENTS audit_event(SSH_AUTH_SUCCESS); #endif --- //depot/vendor/freebsd/src/crypto/openssh/sshd_config.5 2011-05-04 08:35:39.000000000 0000 +++ //depot/projects/soc2011/cnicutar_tcputo_9/src/crypto/openssh/sshd_config.5 2011-08-05 22:38:23.000000000 0000 @@ -35,7 +35,7 @@ .\" .\" $OpenBSD: sshd_config.5,v 1.131 2010/12/08 04:02:47 djm Exp $ .\" $FreeBSD: src/crypto/openssh/sshd_config.5,v 1.38 2011/05/04 07:34:44 des Exp $ -.Dd December 8, 2010 +.Dd July 19, 2011 .Dt SSHD_CONFIG 5 .Os .Sh NAME @@ -152,6 +152,22 @@ in .Xr ssh_config 5 for more information on patterns. +.It Cm AllowUserTimeout +This directive specifies that the UserTimeout requested by the client will +be accepted after authentication. +When a UserTimeout is accepted TCP will not drop the connection for the +specified time even if the client remains silent (doesn't ACK data). +.Pp +The values that can be accepted are subject to the system-wide +.Dv net.inet.tcp.uto.min_timeout +and +.Dv net.inet.tcp.uto.max_timeout . +.Pp +A server should only allow trusted users to use this option, due to +the security risks involved. +.Pp +The default value is +.Dq no . .It Cm AuthorizedKeysFile Specifies the file that contains the public keys that can be used for user authentication.