- stevesk@cvs.openbsd.org 2002/01/27 14:57:46

     [channels.c servconf.c servconf.h session.c sshd.8 sshd_config]
     add X11UseLocalhost; ok markus@

diff --git a/ChangeLog b/ChangeLog
index 8d8db0a6547c869f91d6bc5226e67a3e5f1ceea3..a8bc781355eb715aaeb2ab969553826c30fa9442 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -22,6 +22,9 @@
      revert code to add x11 localhost display authorization entry for
      hostname/unix:d and uts.nodename/unix:d if nodename was different than
      hostname.  just add entry for unix:d instead.  ok markus@
+   - stevesk@cvs.openbsd.org 2002/01/27 14:57:46
+     [channels.c servconf.c servconf.h session.c sshd.8 sshd_config]
+     add X11UseLocalhost; ok markus@
 
 20020130
  - (djm) Delay PRNG seeding until we need it in ssh-keygen, from markus@

diff --git a/channels.c b/channels.c
index 2436e08732911b234374354769ca9af64c304651..f015a049ecd78266cf0b9652c0298288d226b8ae 100644 (file)
--- a/channels.c
+++ b/channels.c
@@ -39,7 +39,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.162 2002/01/24 21:09:25 stevesk Exp $");
+RCSID("$OpenBSD: channels.c,v 1.163 2002/01/27 14:57:46 stevesk Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -2379,7 +2379,7 @@ channel_connect_to(const char *host, u_short port)
  * an error occurs.
  */
 int
-x11_create_display_inet(int x11_display_offset, int gateway_ports,
+x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
     int single_connection)
 {
        Channel *nc = NULL;
@@ -2395,7 +2395,7 @@ x11_create_display_inet(int x11_display_offset, int gateway_ports,
                port = 6000 + display_number;
                memset(&hints, 0, sizeof(hints));
                hints.ai_family = IPv4or6;
-               hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
+               hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE;
                hints.ai_socktype = SOCK_STREAM;
                snprintf(strport, sizeof strport, "%d", port);
                if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {

diff --git a/servconf.c b/servconf.c
index 0cb744a1d833e70186eb7d292bddcb82867f2037..e33d65a5eefdb77014aa631b6f23e141a677d821 100644 (file)
--- a/servconf.c
+++ b/servconf.c
@@ -10,7 +10,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: servconf.c,v 1.98 2002/01/22 02:52:41 stevesk Exp $");
+RCSID("$OpenBSD: servconf.c,v 1.99 2002/01/27 14:57:46 stevesk Exp $");
 
 #if defined(KRB4) || defined(KRB5)
 #include <krb.h>
@@ -63,6 +63,7 @@ initialize_server_options(ServerOptions *options)
        options->print_lastlog = -1;
        options->x11_forwarding = -1;
        options->x11_display_offset = -1;
+       options->x11_use_localhost = -1;
        options->xauth_location = NULL;
        options->strict_modes = -1;
        options->keepalives = -1;
@@ -159,6 +160,8 @@ fill_default_server_options(ServerOptions *options)
                options->x11_forwarding = 0;
        if (options->x11_display_offset == -1)
                options->x11_display_offset = 10;
+       if (options->x11_use_localhost == -1)
+               options->x11_use_localhost = 1;
        if (options->xauth_location == NULL)
                options->xauth_location = _PATH_XAUTH;
        if (options->strict_modes == -1)
@@ -255,7 +258,7 @@ typedef enum {
        sChallengeResponseAuthentication,
        sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress,
        sPrintMotd, sPrintLastLog, sIgnoreRhosts,
-       sX11Forwarding, sX11DisplayOffset,
+       sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
        sStrictModes, sEmptyPasswd, sKeepAlives,
        sUseLogin, sAllowTcpForwarding,
        sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
@@ -315,6 +318,7 @@ static struct {
        { "ignoreuserknownhosts", sIgnoreUserKnownHosts },
        { "x11forwarding", sX11Forwarding },
        { "x11displayoffset", sX11DisplayOffset },
+       { "x11uselocalhost", sX11UseLocalhost },
        { "xauthlocation", sXAuthLocation },
        { "strictmodes", sStrictModes },
        { "permitemptypasswords", sEmptyPasswd },
@@ -655,6 +659,10 @@ parse_flag:
                intptr = &options->x11_display_offset;
                goto parse_int;
 
+       case sX11UseLocalhost:
+               intptr = &options->x11_use_localhost;
+               goto parse_flag;
+
        case sXAuthLocation:
                charptr = &options->xauth_location;
                goto parse_filename;

diff --git a/servconf.h b/servconf.h
index 943c7ef566a5e20db782712f53e7cab75d241f94..463a16dad204bf2b86cd73dd2973ab95ce75f59d 100644 (file)
--- a/servconf.h
+++ b/servconf.h
@@ -11,7 +11,7 @@
  * called by a name other than "ssh" or "Secure Shell".
  */
 
-/* RCSID("$OpenBSD: servconf.h,v 1.51 2001/12/19 07:18:56 deraadt Exp $"); */
+/* RCSID("$OpenBSD: servconf.h,v 1.52 2002/01/27 14:57:46 stevesk Exp $"); */
 
 #ifndef SERVCONF_H
 #define SERVCONF_H
@@ -55,6 +55,7 @@ typedef struct {
        int     x11_forwarding; /* If true, permit inet (spoofing) X11 fwd. */
        int     x11_display_offset;     /* What DISPLAY number to start
                                         * searching at */
+       int     x11_use_localhost;      /* If true, use localhost for fake X11 server. */
        char   *xauth_location; /* Location of xauth program */
        int     strict_modes;   /* If true, require string home dir modes. */
        int     keepalives;     /* If true, set SO_KEEPALIVE. */

diff --git a/session.c b/session.c
index 268d1384e0a95187230cbaee246a0be3e6cdcc4d..7e1d0a82b6adcf9b5a33d41f629af743829c4bfc 100644 (file)
--- a/session.c
+++ b/session.c
@@ -33,7 +33,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: session.c,v 1.118 2002/01/26 16:44:22 stevesk Exp $");
+RCSID("$OpenBSD: session.c,v 1.119 2002/01/27 14:57:46 stevesk Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -2021,7 +2021,7 @@ session_setup_x11fwd(Session *s)
                return 0;
        }
        s->display_number = x11_create_display_inet(options.x11_display_offset,
-           options.gateway_ports, s->single_connection);
+           options.x11_use_localhost, s->single_connection);
        if (s->display_number == -1) {
                debug("x11_create_display_inet failed.");
                return 0;
@@ -2035,7 +2035,7 @@ session_setup_x11fwd(Session *s)
         * authorization entry is added with xauth(1).  This will be
         * different than the DISPLAY string for localhost displays.
         */
-       if (!options.gateway_ports) {
+       if (options.x11_use_localhost) {
                snprintf(display, sizeof display, "localhost:%d.%d",
                    s->display_number, s->screen);
                snprintf(auth_display, sizeof auth_display, "unix:%d.%d",

diff --git a/sshd.8 b/sshd.8
index 256b2aa575cd78a3289df06b5e8edc591d5dee98..d1ddeb123daaf60ca187db19b239fb2e299fcdd5 100644 (file)
--- a/sshd.8
+++ b/sshd.8
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd.8,v 1.163 2002/01/18 20:46:34 stevesk Exp $
+.\" $OpenBSD: sshd.8,v 1.164 2002/01/27 14:57:46 stevesk Exp $
 .Dd September 25, 1999
 .Dt SSHD 8
 .Os
@@ -858,6 +858,31 @@ way, as users can always install their own forwarders.
 X11 forwarding is automatically disabled if
 .Cm UseLogin
 is enabled.
+.It Cm X11UseLocalhost
+Specifies whether
+.Nm
+should bind the X11 forwarding server to the loopback address or to
+the wildcard address.  By default,
+.Nm
+binds the forwarding server to the loopback address and sets the
+hostname part of the
+.Ev DISPLAY
+environment variable to
+.Dq localhost .
+This prevents remote hosts from connecting to the fake display.
+However, some older X11 clients may not function with this
+configuration.
+.Cm X11UseLocalhost
+may be set to
+.Dq no
+to specify that the forwarding server should be bound to the wildcard
+address.
+The argument must be
+.Dq yes
+or
+.Dq no .
+The default is
+.Dq yes .
 .It Cm XAuthLocation
 Specifies the location of the
 .Xr xauth 1

diff --git a/sshd_config b/sshd_config
index 3502ab6acec9841519b7f897d08299cc2d88318c..d1e8c6b4de9524d0659151b22c3623ea73e8f22c 100644 (file)
--- a/sshd_config
+++ b/sshd_config
@@ -1,4 +1,4 @@
-#      $OpenBSD: sshd_config,v 1.44 2002/01/16 17:40:23 stevesk Exp $
+#      $OpenBSD: sshd_config,v 1.45 2002/01/27 14:57:46 stevesk Exp $
 
 # This is the sshd server system-wide configuration file.  See sshd(8)
 # for more information.
@@ -77,6 +77,7 @@
 
 #X11Forwarding no
 #X11DisplayOffset 10
+#X11UseLocalhost yes
 #PrintMotd yes
 #PrintLastLog yes
 #KeepAlive yes