1 files changed, 43 insertions, 11 deletions

diff --git a/clientloop.c b/clientloop.c
index 18a85c56c..8f4b6e1b0 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.236 2011/06/22 22:08:42 djm Exp $ */
+/* $OpenBSD: clientloop.c,v 1.238 2012/01/18 21:46:43 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -285,6 +285,23 @@ set_control_persist_exit_time(void)
         /* else we are already counting down to the timeout */
 }
 
+#define SSH_X11_VALID_DISPLAY_CHARS ":/.-_"
+static int
+client_x11_display_valid(const char *display)
+{
+        size_t i, dlen;
+
+        dlen = strlen(display);
+        for (i = 0; i < dlen; i++) {
+                if (!isalnum(display[i]) &&
+                    strchr(SSH_X11_VALID_DISPLAY_CHARS, display[i]) == NULL) {
+                        debug("Invalid character '%c' in DISPLAY", display[i]);
+                        return 0;
+                }
+        }
+        return 1;
+}
+
 #define SSH_X11_PROTO "MIT-MAGIC-COOKIE-1"
 void
 client_x11_get_proto(const char *display, const char *xauth_path,
@@ -307,6 +324,9 @@ client_x11_get_proto(const char *display, const char *xauth_path,
 
         if (xauth_path == NULL ||(stat(xauth_path, &st) == -1)) {
                 debug("No xauth program.");
+        } else if (!client_x11_display_valid(display)) {
+                logit("DISPLAY '%s' invalid, falling back to fake xauth data",
+                    display);
         } else {
                 if (display == NULL) {
                         debug("x11_get_proto: DISPLAY not set");
@@ -848,9 +868,8 @@ process_cmdline(void)
 {
         void (*handler)(int);
         char *s, *cmd, *cancel_host;
-        int delete = 0;
-        int local = 0, remote = 0, dynamic = 0;
-        int cancel_port;
+        int delete = 0, local = 0, remote = 0, dynamic = 0;
+        int cancel_port, ok;
         Forward fwd;
 
         bzero(&fwd, sizeof(fwd));
@@ -876,8 +895,12 @@ process_cmdline(void)
                     "Request remote forward");
                 logit("      -D[bind_address:]port                  "
                     "Request dynamic forward");
+                logit("      -KL[bind_address:]port                 "
+                    "Cancel local forward");
                 logit("      -KR[bind_address:]port                 "
                     "Cancel remote forward");
+                logit("      -KD[bind_address:]port                 "
+                    "Cancel dynamic forward");
                 if (!options.permit_local_command)
                         goto out;
                 logit("      !args                                  "
@@ -906,11 +929,7 @@ process_cmdline(void)
                 goto out;
         }
 
-        if ((local || dynamic) && delete) {
-                logit("Not supported.");
-                goto out;
-        }
-        if (remote && delete && !compat20) {
+        if (delete && !compat20) {
                 logit("Not supported for SSH protocol version 1.");
                 goto out;
         }
@@ -933,7 +952,21 @@ process_cmdline(void)
                         logit("Bad forwarding close port");
                         goto out;
                 }
-                channel_request_rforward_cancel(cancel_host, cancel_port);
+                if (remote)
+                        ok = channel_request_rforward_cancel(cancel_host,
+                            cancel_port) == 0;
+                else if (dynamic)
+                        ok = channel_cancel_lport_listener(cancel_host,
+                            cancel_port, 0, options.gateway_ports) > 0;
+                else
+                        ok = channel_cancel_lport_listener(cancel_host,
+                            cancel_port, CHANNEL_CANCEL_PORT_STATIC,
+                            options.gateway_ports) > 0;
+                if (!ok) {
+                        logit("Unkown port forwarding.");
+                        goto out;
+                }
+                logit("Canceled forwarding.");
         } else {
                 if (!parse_forward(&fwd, s, dynamic, remote)) {
                         logit("Bad forwarding specification.");
@@ -954,7 +987,6 @@ process_cmdline(void)
                                 goto out;
                         }
                 }
-
                 logit("Forwarding port.");
         }