search for: max_display

...there to be more than 1000 active X11 forwards active at peak usage. Beyond ~1000 active X11 forwards, sshd will fail to bind additional ports due to a hard coded range check in channels.c that limits the port range that sshd will attempt to bind. Today this is set at 1000: channels.c:152:#define MAX_DISPLAYS 1000 I have made changes to OpenSSH portable that allow this setting to be configured via an option in sshd_config named MaxDisplays. If not explicitly set, it maintains the default value of 1000. It seems to me that this setting should be configurable by the user similar to how X11DisplayOffse...

https://bugzilla.mindrot.org/show_bug.cgi?id=2580 Bug ID: 2580 Summary: Support for MaxDisplays to replace artificial MAX_DISPLAYS limit Product: Portable OpenSSH Version: 7.2p1 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 Component: sshd Assignee: unassigned-bugs at mindrot.org Reporter: openss...

...d AssignedTo: unassigned-bugs at mindrot.org ReportedBy: arekm at pld-linux.org Created attachment 2105 --> https://bugzilla.mindrot.org/attachment.cgi?id=2105 sshd log for that When AF_INET6 socket creation is allowed but bind()ing to ::1 is impossible then sshd loops until MAX_DISPLAYS is reached trying to bind to ::1 and then fails. This takes several seconds unfortunately which slows down login process a lot. When such scenario can happen, so AF_INET6 socket creation is allowed but ::1 doesn't exist? This can happen in linux-vserver.org guest or on a pure Linux system wit...

...way_ports) { int display_number, sock; u_short port; struct addrinfo hints, *ai, *aitop; char strport[NI_MAXSERV]; int gaierr, n, num_socks = 0, socks[NUM_SOCKS]; - char display[512]; - char hostname[MAXHOSTNAMELEN]; for (display_number = x11_display_offset; display_number < MAX_DISPLAYS; @@ -2416,12 +2414,12 @@ port = 6000 + display_number; memset(&hints, 0, sizeof(hints)); hints.ai_family = IPv4or6; - hints.ai_flags = AI_PASSIVE; /* XXX loopback only ? */ + hints.ai_flags = gateway_ports ? AI_PASSIVE : 0; hints.ai_socktype = SOCK_STREAM; snprintf(strport, s...

...avior, the first ai from getaddrinfo is an IPV6 address that's not valid. Errno is EADDRNOTAVAIL. Now in 4.7 the continue would make it just try the next ai. In 5.2 that continue isn't there, so instead it breaks and tries the next port number, on the same ai, which fails all the way until MAX_DISPLAYS is reached. For this situation I want to put back the if/continue, but I assume it was removed for a reason, and wanted to find out if anyone here knew. Ok, found the cvsweb, and located this: Revision 1.272.2.1: download<http://www.openbsd.org/cgi-bin/cvsweb/%7Echeckout%7E/src/usr.bin/ssh/...

...t; then subsequent IPv4 bind will fail on Linux. You could of course remove > DONT_TRY_OTHER_AF, but then you need to ignore the error on the IPv4 bind > call. Currently it will clean up (closing the already opened IPv6 socket), > and then try the next display (which will again fail) until MAX_DISPLAYS > is reached, and it will then simply fail. If the code for the ANY case > was separated from the x11_use_localhost case, you would only need > DONT_TRY_OTHER_AF in the ANY part, that is the only part where Linux is > different from *BSD. > > Stig > __________________________...

...12:18:05 2001 +++ openssh-2.9p2/channels.c Thu Aug 23 15:40:43 2001 @@ -61,6 +61,9 @@ #include "canohost.h" #include "key.h" #include "authfd.h" +#include "readconf.h" + +extern Options options; /* Maximum number of fake X11 displays to try. */ #define MAX_DISPLAYS 1000 @@ -765,6 +768,7 @@ int newsock, newch, nextstate; socklen_t addrlen; char *rtype; + int one = 1; if (FD_ISSET(c->sock, readset)) { debug("Connection to port %d forwarding " @@ -781,6 +785,13 @@ if (newsock < 0) { error("accept: %.100s", strerror...

On Mon, Jul 23, 2001 at 12:49:14AM +0100, Matthew Vernon wrote: > ------- start of forwarded message ------- > From: <mouring at etoh.eviladmin.org> > To: Matthew Vernon <matthew at empire.ucam.org> > cc: <openssh-unix-dev at mindrot.org> > Subject: Re: [patch] GNU/Hurd compatibility patches > Date: Sun, 22 Jul 2001 12:39:32 -0500 (CDT) > > > We

...ort[NI_MAXSERV]; int gaierr, n, num_socks = 0, socks[NUM_SOCKS]; char display[512]; - char hostname[MAXHOSTNAMELEN]; + char hostname[401]; /* we only use the first 400 bytes anyway*/ for (display_number = x11_display_offset; display_number < MAX_DISPLAYS; @@ -1791,7 +1791,8 @@ /* Set up a suitable value for the DISPLAY variable. */ - if (gethostname(hostname, sizeof(hostname)) < 0) + if (gethostname(hostname, sizeof(hostname)) < 0 + && errno != ENAMETOOLONG) fatal("gethostname: %...

...Oct 2 22:49:22 2000 @@ -38,6 +38,11 @@ RCSID("$OpenBSD: channels.c,v 1.66 2000/ #include "key.h" #include "authfd.h" +#ifdef LIBWRAP +#include <tcpd.h> +#include <syslog.h> +#endif /* LIBWRAP */ + /* Maximum number of fake X11 displays to try. */ #define MAX_DISPLAYS 1000 @@ -581,6 +586,30 @@ channel_post_port_listener(Channel *c, f } remote_hostname = get_remote_hostname(newsock); remote_port = get_peer_port(newsock); +#ifdef LIBWRAP + { + char fwd[80]; + void (*sigch) (int); + int res; + struct request_info req; + + snprintf(fwd, sizeo...