Skip to content

Commit 367d38c

Browse files
committed
fix: cap max X11 forwarding ports and evict old
1 parent eca6381 commit 367d38c

File tree

2 files changed

+271
-74
lines changed

2 files changed

+271
-74
lines changed

agent/agentssh/agentssh.go

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -130,9 +130,10 @@ type Server struct {
130130
// a lock on mu but protected by closing.
131131
wg sync.WaitGroup
132132

133-
Execer agentexec.Execer
134-
logger slog.Logger
135-
srv *ssh.Server
133+
Execer agentexec.Execer
134+
logger slog.Logger
135+
srv *ssh.Server
136+
x11Forwarder *x11Forwarder
136137

137138
config *Config
138139

@@ -188,6 +189,14 @@ func NewServer(ctx context.Context, logger slog.Logger, prometheusRegistry *prom
188189
config: config,
189190

190191
metrics: metrics,
192+
x11Forwarder: &x11Forwarder{
193+
logger: logger,
194+
x11HandlerErrors: metrics.x11HandlerErrors,
195+
fs: fs,
196+
displayOffset: *config.X11DisplayOffset,
197+
sessions: make(map[*x11Session]struct{}),
198+
connections: make(map[net.Conn]struct{}),
199+
},
191200
}
192201

193202
srv := &ssh.Server{
@@ -455,7 +464,7 @@ func (s *Server) sessionHandler(session ssh.Session) {
455464

456465
x11, hasX11 := session.X11()
457466
if hasX11 {
458-
display, handled := s.x11Handler(ctx, x11)
467+
display, handled := s.x11Forwarder.x11Handler(ctx, session)
459468
if !handled {
460469
logger.Error(ctx, "x11 handler failed")
461470
closeCause("x11 handler failed")
@@ -1114,6 +1123,9 @@ func (s *Server) Close() error {
11141123

11151124
s.mu.Unlock()
11161125

1126+
s.logger.Debug(ctx, "closing X11 forwarding")
1127+
_ = s.x11Forwarder.Close()
1128+
11171129
s.logger.Debug(ctx, "waiting for all goroutines to exit")
11181130
s.wg.Wait() // Wait for all goroutines to exit.
11191131

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy