9b511fc610
Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185848 Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
57 lines
1.6 KiB
Diff
57 lines
1.6 KiB
Diff
diff --git a/channels.c b/channels.c
|
|
--- a/channels.c (revision 8241b9c0529228b4b86d88b1a6076fb9f97e4a99)
|
|
+++ b/channels.c (date 1703026069921)
|
|
@@ -5075,11 +5075,13 @@
|
|
}
|
|
|
|
static int
|
|
-connect_local_xsocket_path(const char *pathname)
|
|
+connect_local_xsocket_path(const char *pathname, int len)
|
|
{
|
|
int sock;
|
|
struct sockaddr_un addr;
|
|
|
|
+ if (len <= 0)
|
|
+ return -1;
|
|
sock = socket(AF_UNIX, SOCK_STREAM, 0);
|
|
if (sock == -1) {
|
|
error("socket: %.100s", strerror(errno));
|
|
@@ -5087,11 +5089,12 @@
|
|
}
|
|
memset(&addr, 0, sizeof(addr));
|
|
addr.sun_family = AF_UNIX;
|
|
- strlcpy(addr.sun_path, pathname, sizeof addr.sun_path);
|
|
- if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == 0)
|
|
+ if (len > sizeof addr.sun_path)
|
|
+ len = sizeof addr.sun_path;
|
|
+ memcpy(addr.sun_path, pathname, len);
|
|
+ if (connect(sock, (struct sockaddr *)&addr, sizeof addr - (sizeof addr.sun_path - len) ) == 0)
|
|
return sock;
|
|
close(sock);
|
|
- error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
|
|
return -1;
|
|
}
|
|
|
|
@@ -5099,8 +5102,19 @@
|
|
connect_local_xsocket(u_int dnr)
|
|
{
|
|
char buf[1024];
|
|
- snprintf(buf, sizeof buf, _PATH_UNIX_X, dnr);
|
|
- return connect_local_xsocket_path(buf);
|
|
+ int len, ret;
|
|
+ len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr);
|
|
+#ifdef linux
|
|
+ if (getenv("SSH_INSECURE_ABSTRACT_SOCKET_ENABLED") != NULL) {
|
|
+ buf[0] = '\0';
|
|
+ if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
|
|
+ return ret;
|
|
+ }
|
|
+#endif
|
|
+ if ((ret = connect_local_xsocket_path(buf + 1, len)) >= 0)
|
|
+ return ret;
|
|
+ error("connect %.100s: %.100s", buf + 1, strerror(errno));
|
|
+ return -1;
|
|
}
|
|
|
|
#ifdef __APPLE__
|