openssh bugs - Apr 2007 - [Bug 1309] X11 forwarding doesn't work with X11UseLocalhost=no

http://bugzilla.mindrot.org/show_bug.cgi?id=1309

           Summary: X11 forwarding doesn't work with X11UseLocalhost=no
           Product: Portable OpenSSH
           Version: 4.3p2
          Platform: All
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: sshd
        AssignedTo: bitbucket at mindrot.org
        ReportedBy: joss at debian.org


When setting "X11UseLocalhost no" in the configuration file - which is
necessary for our clusters - X11 forwarding stops working entirely.
Trying to connect to the TCP port it opens leads to "connection
refused".

The problem seems to be caused by IPv6 support: when forcing the server
to use only IPv4 addresses with "AddressFamily inet", X11 forwarding
works as expected.

With X11UseLocalhost=yes, the X11 tunnel binds itself to e.g. ::1:6014
in IPv6 and 127.0.0.1:6014 in IPv4 (for display :14.0). With
X11UseLocalhost=no, it binds to :::6014 in IPv6 and 0.0.0.0:6014 in
IPv4. I don't know IPv6 enough to tell, but I guess only the IPv4
version is correct.

I can reproduce this bug with RHEL4 (OpenSSH 3.9p1, Linux 2.6.9), SLES9
(OpenSSH 4.1, Linux 2.6.5) and Debian 4.0 (OpenSSH 4.3p2, Linux
2.6.18).




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1309





------- Comment #1 from dtucker at zip.com.au  2007-04-25 00:35 -------
This has been discussed on the list recently:
http://marc.info/?l=openssh-unix-dev&m=114672761011331

Summary: Try recompiling after removing DONT_TRY_OTHER_AF from
config.h.

I had looked into the history of DONT_TRY_OTHER_AF and it goes back
something like 7 years.  I'm wondering if it still serves a purpose in
modern Linux version.




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1309





------- Comment #2 from djm at mindrot.org  2007-04-26 14:59 -------
Doing the "setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, ...)" might be
sufficient now that Linux's IPv6 stack is sane (it wasn't when portable
OpenSSH was young).




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1309





------- Comment #3 from t8m at centrum.cz  2007-04-26 21:21 -------
Created an attachment (id=1266)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1266&action=view)
This is what we use in current Fedora openssh package




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.