- markus@cvs.openbsd.org 2007/08/15 08:14:46

     [clientloop.c]
     do NOT fall back to the trused x11 cookie if generation of an untrusted
     cookie fails; from security-alert at sun.com; ok dtucker

1 files changed, 24 insertions, 14 deletions

diff --git a/clientloop.c b/clientloop.c
index 538644c20..b57fda042 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.180 2007/08/07 07:32:53 djm Exp $ */
+/* $OpenBSD: clientloop.c,v 1.181 2007/08/15 08:14:46 markus Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -290,19 +290,29 @@ client_x11_get_proto(const char *display, const char *xauth_path,
                                         generated = 1;
                         }
                 }
-                snprintf(cmd, sizeof(cmd),
-                    "%s %s%s list %s 2>" _PATH_DEVNULL,
-                    xauth_path,
-                    generated ? "-f " : "" ,
-                    generated ? xauthfile : "",
-                    display);
-                debug2("x11_get_proto: %s", cmd);
-                f = popen(cmd, "r");
-                if (f && fgets(line, sizeof(line), f) &&
-                    sscanf(line, "%*s %511s %511s", proto, data) == 2)
-                        got_data = 1;
-                if (f)
-                        pclose(f);
+
+                /*
+                 * When in untrusted mode, we read the cookie only if it was
+                 * successfully generated as an untrusted one in the step
+                 * above.
+                 */
+                if (trusted || generated) {
+                        snprintf(cmd, sizeof(cmd),
+                            "%s %s%s list %s 2>" _PATH_DEVNULL,
+                            xauth_path,
+                            generated ? "-f " : "" ,
+                            generated ? xauthfile : "",
+                            display);
+                        debug2("x11_get_proto: %s", cmd);
+                        f = popen(cmd, "r");
+                        if (f && fgets(line, sizeof(line), f) &&
+                            sscanf(line, "%*s %511s %511s", proto, data) == 2)
+                                got_data = 1;
+                        if (f)
+                                pclose(f);
+                } else
+                        error("Warning: untrusted X11 forwarding setup failed: "
+                            "xauth key data not generated");
         }
 
         if (do_unlink) {