Skip to content

Commit

Permalink
disable Unix-domain socket forwarding when privsep is disabled
Browse files Browse the repository at this point in the history
  • Loading branch information
@djmdjm
djmdjm committed Dec 14, 2016
1 parent 022c978 commit c76fac6
Showing 1 changed file with 5 additions and 3 deletions.
8 changes: 5 additions & 3 deletions usr.bin/ssh/serverloop.c
View file
@@ -1,4 +1,4 @@
/* $OpenBSD: serverloop.c,v 1.188 2016/11/30 03:00:05 djm Exp $ */
/* $OpenBSD: serverloop.c,v 1.189 2016/12/14 00:36:34 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
Expand Down Expand Up @@ -472,7 +472,8 @@ server_request_direct_streamlocal(void)

/* XXX fine grained permissions */
if ((options.allow_streamlocal_forwarding & FORWARD_LOCAL) != 0 &&
!no_port_forwarding_flag && !options.disable_forwarding) {
!no_port_forwarding_flag && !options.disable_forwarding &&
use_privsep) {
c = channel_connect_to_path(target,
"direct-streamlocal@openssh.com", "direct-streamlocal");
} else {
Expand Down Expand Up @@ -748,7 +749,8 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt)

/* check permissions */
if ((options.allow_streamlocal_forwarding & FORWARD_REMOTE) == 0
|| no_port_forwarding_flag || options.disable_forwarding) {
|| no_port_forwarding_flag || options.disable_forwarding ||
!use_privsep) {
success = 0;
packet_send_debug("Server has disabled port forwarding.");
} else {
Expand Down

0 comments on commit c76fac6

Please sign in to comment.