Skip to content
  • dan's avatar
    Allows the use of CLX clients over an ssh-forwarded connection. · 1b0cfaa2
    dan authored
    Allows the use of CLX clients over an ssh-forwarded connection.
    Thanks to Eric Marsden for explaining this one and writing the code
    in CMUCL CLX that fixes it.
    
    The X authority database is a small file typically found in
    $HOME/.Xauthority, each of the records in which is a binary-encoded
    tuple of
    
      (protocol address display-num auth-scheme-name auth-data)
    
    protocol is typically FamilyInternet or FamilyDECnet or something. The
    interpretation of address is protocol-specific, the display is a
    number, and the auth-data depends on the auth-scheme-name.  With that
    said, I don't know of any any authorization schemes other than
    MIT-MAGIC-COOKIE-1, for which the auth data is 16 bytes of binary guck.
    
    For FamilyInternet, the address is just the IP address.  That's easy.
    However, the authority database may be shared between multiple
    machines (for example, if you have NFS-mounted $HOME), so it has to do
    something special with local transports (unix sockets, shm, etc) so
    that they don't all overwrite each other.  xauth invents some more
    Family* constants: the important one here is FamilyLocal, for which
    the address is the machine hostname as returned by gethostname().  If
    your DISPLAY is set to ":n" or "unix:n", this conventionally indicates
    a local connection, so these go into xauthority as FamilyLocal, wich
    the machine hostname to disambiguate them.
    
    Many people use SSH X connection forwarding to securely open remote X
    displays.  If you're on host A, and you ssh to host B with X
    connection forwarding (ssh -X B), the daemon on host B opens a server
    socket bound to 127.0.0.1, port 6010 , then sets up your DISPLAY
    variable as localhost:10 (6011, 6012 etc as more connections are made).
    So, we have the same problem here as we do with local connections:
    127.0.0.1 is localhost _everywhere_, so xauth actually specialcases
    any host whose address is 127.0.0.1 in the same way as it does "" and "unix"
    
    In summary, then, the necessary action to open a connection to the
    nth ssh-forwarded server on a machine is
    
      1) obtain authentication data for FamilyLocal, display n+10
      2) open the display at FamilyInternet host localhost port n+6010
    
    darcs-hash:20030209190313-2591e-21921051977c5b3ba91bbd38241e666cb26a6687.gz
    1b0cfaa2