expose $SSH_CONNECTION in the PAM environment

This makes the connection 4-tuple available to PAM modules that
wish to use it in decision-making. bz#2741

1 files changed, 7 insertions, 4 deletions

diff --git a/session.c b/session.c
index a3f0b3562..d2e2fbd74 100644
--- a/session.c
+++ b/session.c
@@ -1162,15 +1162,18 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell)
                 char **p;
 
                 /*
-                 * Don't allow SSH_AUTH_INFO variables posted to PAM to leak
-                 * back into the environment.
+                 * Don't allow PAM-internal env vars to leak
+                 * back into the session environment.
                  */
+#define PAM_ENV_BLACKLIST  "SSH_AUTH_INFO*,SSH_CONNECTION*"
                 p = fetch_pam_child_environment();
-                copy_environment_blacklist(p, &env, &envsize, "SSH_AUTH_INFO*");
+                copy_environment_blacklist(p, &env, &envsize,
+                    PAM_ENV_BLACKLIST);
                 free_pam_environment(p);
 
                 p = fetch_pam_environment();
-                copy_environment_blacklist(p, &env, &envsize, "SSH_AUTH_INFO*");
+                copy_environment_blacklist(p, &env, &envsize,
+                    PAM_ENV_BLACKLIST);
                 free_pam_environment(p);
         }
 #endif /* USE_PAM */