x2go-dev

x2go-dev@lists.x2go.org

5399 discussions

Windows X2Go Client: Windows XP & VcXsrv security vulnerabilities
by Michael DePaulo 19 Mar '14

19 Mar '14

Until now, I have been including VcXsrv 1.14.2.1 in the X2Go Client Windows builds because it is the last version to support Windows XP. However, it appears that there is 1, and possibly more, security vulnerabilities in that version. http://lists.x.org/archives/xorg-announce/2013-October/002332.html Since security vulnerabilities are about to become an irresolvable reality for Windows XP users, I propose that I split the X2Go Windows builds up an XP version, and a version for all later versions of Windows. The XP build will use VcXsrv 1.14.2.1, and hopefully we can get the VcXsrv project to provide security patches for it in the future. The build for all later versions of Windows will use the latest VcXsrv, unless a major regression is found in it. At this time there is no x2goclient.git source code changes needed to maintain the 2 X2Go Client Windows builds. Nor any nx-libs.git source code changes. They will merely differ in terms of this one 3rd-party dependency. (I intend to do a better job of maintaining these dependencies on x2goclient-contrib.git and integrate that git repo into the build process. I would just add every 3rd-party binary file (mostly .DLL files) to that git repo, but that resets the timestamps, and as a SysAdmin I HATE it when timestamps get reset. I'll probably zip them up to preserve the timestamps.) If anyone here thinks I should just say "screw XP" after April 8th, consider the fact that I am contributing my time to the Windows builds and I am willing to maintain the XP builds for the foreseeable future. I will probably maintain them until April 30th 2015 unless a large technical obstacle comes up. I do not condone the use of Windows XP past April 8th, but I believe that X2Go Client can be part of an organization's solution to migrate away from Windows XP. -Mike#2

1 0

libssh changes. Information for package maintainers
by Oleksandr Shneyder 18 Mar '14

18 Mar '14

Hello, as you know, I made some changes in X2Go Client code. Especially important is that X2Go Client do not open for every reverse tunnel a new ssh connection any more. To make it possible, I made some improvements in libssh. The patch is already accepted by libssh team and Mike will take care about linux packages. The libssh patch for reverse connections is here: http://code.x2go.org/releases/libssh/libssh-0.5.x-accept-forward.patch I have also found another one issue with libssh, however I have not yet an answer from libssh team if they will accept this patch. It is very important for Mac Client to use libssh with this patch. In other case you can expect the poor performance of X2Go Client. You can find a patch here: http://code.x2go.org/releases/libssh/libssh-0.5.x-unblock.patch To be able build current X2Go Client code on Mac or Windows you also need a libssh with this two patches. @Michael DePaulo. Please apply this two patches on your libssh source tree. If you don't want to build libssh by yourself, you can use binaries built by me: http://code.x2go.org/releases/libssh/libssh-0.5.5.zip @Clemens Lang. If you build libssh using brew, you can do next: - uninstall old version of libssh $brew uninstall libssh $cd $(brew --prefix) $brew update - get available libssh vesrions $brew versions libssh - switch to libssh-0.5.5 $git checkout 91e973b Library/Formula/libssh.rb - edit formula $brew edit libssh add libssh patches before def install: def patches [ "http://code.x2go.org/releases/libssh/libssh-0.5.x-accept-forward.patch", "http://code.x2go.org/releases/libssh/libssh-0.5.x-unblock.patch" ] end after that you can build libssh as usual: $brew install libssh regards Alex -- ---------------------------------------------------- Oleksandr Shneyder | Email: o.shneyder(a)phoca-gmbh.de phoca GmbH | Tel. : 0911 - 14870374 0 Bräuhausgasse 9 | Fax. : 0911 - 14870374 9 D-82205 Gilching | Mobil: 0163 - 49 64 461 Geschäftsführung: Dipl.-Inf. Oleksandr Shneyder Amtsgericht München | http://www.phoca-gmbh.de HRB 196 658 | http://www.x2go.org USt-IdNr.: DE281977973 ----------------------------------------------------

3 7

Bug#448: Here's the patch
by Michael DePaulo 17 Mar '14

17 Mar '14

Sorry for the long URL, but we can download the patch that KDE used for libssh 0.5.3 here: http://code.ohloh.net/project?pid=bnCaBd3Jo9I&prevcid=1&did=portage%2Fwin32… Based on the dates in the files, 0001-implement-support-for-putty-s-pageant-0.5.3.patch supercedes 0001-implement-support-for-putty-s-pageant.patch

3 2

Bug#448: KDE's libssh was patched for Pageant support
by Michael DePaulo 17 Mar '14

17 Mar '14

If you compare KDE's libssh 0.5.3 src/agent.c ftp://winkde.org/kde/ports/win32/releases/stable/latest/libssh-x86-mingw4-0… To the vanilla libssh 0.5.3 src/agent.c http://git.libssh.org/projects/libssh.git/tree/src/agent.c?id=libssh-0.5.3 You'll see that KDE patched it to add support for Pageant as an SSH agent for Windows. There's also winpgntc.c and winpgntc.h included in the KDE version, but not in the vanilla version. Our libssh 0.5.5 build doesn't have Pageant support: http://git.libssh.org/projects/libssh.git/tree/src/agent.c?id=libssh-0.5.5 And neither does libssh 0.6.3: http://git.libssh.org/projects/libssh.git/tree/src/agent.c?id=libssh-0.6.3 Or the current (2014-03-16) HEAD: http://git.libssh.org/projects/libssh.git/tree/src/agent.c So right now I need to find the applied patch they applied. The src.tar.bz2 file contains patches, but only for CVE vunlerabilities. I do not see .patch files for this feature, it is already applied to the source.

1 0

Bug#448: Linux not affected
by Michael DePaulo 17 Mar '14

17 Mar '14

This bug was not present on the following client setup: Fedora 20 64-bit GNOME keyring 3.10.1 (1.fc20) libssh 0.6.3 (1.fc20) x2goclient 4.0.1.3 (4.fc20) Specifically, 1. if I had not entered my passphrase for my private key into GNOME kerying yet, then upon initiating the connection GNOME keyring would prompt me. (X2Go Client did not prompt me.) Once it was done, X2Go Client would connect. 2. if I had already entered my passphrase for my private key into GNOME keyring, then upon initiating the connection, X2Go Client would connect without any prompts.

1 0

Bug#422: X2Go issue (in src:x2goclient) has been marked as pending for release
by Mike DePaulo 16 Mar '14

16 Mar '14

tag #422 pending fixed #422 4.0.2.0 thanks Hello, X2Go issue #422 (src:x2goclient) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=acbc897 The issue will most likely be fixed in src:x2goclient (4.0.2.0). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit acbc89719808a34f21888f8b66110d4ff79bd5f5 Author: Mike DePaulo <mikedep333(a)gmail.com> Date: Sun Mar 16 11:29:13 2014 -0400 Update comment for last commit and add to debian/changelog. (Fixes #422) diff --git a/debian/changelog b/debian/changelog index 30f8182..90d98ef 100644 --- a/debian/changelog +++ b/debian/changelog @@ -50,6 +50,11 @@ x2goclient (4.0.2.0-0x2go1) UNRELEASED; urgency=low * New upstream version (4.0.2.0): - Decrease HelpDialog's tab width from 320 to 30 (the width of 10 spaces.) (Fixes: #453) + - Windows: Fix compatibility with PulseAudio 3.0 & later through + new cookie handling. (Fixes: #422) + - Windows: Upgrade included PulseAudio from 1.1 to 5.0. + The 5.0 build is patched for X2Go bug #363. and available here: + https://build.opensuse.org/project/show/home:mikedep333:branches:home:mkbos… -- Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Wed, 22 Jan 2014 09:20:08 +0100

2 1

Bug#422: Just Create the .config/pulse/ dir!
by Michael DePaulo 14 Mar '14

14 Mar '14

After spending lots of time debugging this issue, largely involving comparing the debug output from pulseaudio.exe, I believe I've determined a simple fix. I observed that if I create this directory ahead of time, the pulseaudio.exe process launched by x2goclient.exe creates the "cookie" file under it & stays running. C:\Users\mike\.x2go\pulse\.config\pulse\ Therefore, I believe a simple fix for this bug is for x2goclient.exe, regardless of what version of pulseaudio.exe is installed, to: 1. Create that directory (if it DNE). 2. Include logic around onmainwindow.cpp:5149 to use the cookie at that path. If the cookie is not in that location, fall back to ".pulse-cookie". We already have this logic for Linux. I plan to write, test, and (hopefully) commit this fix tomorrow night. Note that we cannot override the cookie location due to PulseAudio Bug 75006: https://bugs.freedesktop.org/show_bug.cgi?id=75006 Note that although I am not sure why PulseAudio.exe is incapable of creating this file when launched by x2goclient.exe, compared to when it is launched by cmd.exe, I believe this is still safe approach to solving the bug. I say this because PulseAudio devs's comments & commit messages make it clear that they support both the directory already existing, and the directory not already existing. For example: http://cgit.freedesktop.org/pulseaudio/pulseaudio/commit/src/pulsecore/auth…

2 1

Bug#453: X2Go issue (in src:x2goclient) has been marked as pending for release
by Mike DePaulo 14 Mar '14

14 Mar '14

tag #453 pending fixed #453 4.0.2.0 thanks Hello, X2Go issue #453 (src:x2goclient) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=dfaaabc The issue will most likely be fixed in src:x2goclient (4.0.2.0). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit dfaaabc9680cc621e4f13e4d9c293664615fe2e4 Author: Mike DePaulo <mikedep333(a)gmail.com> Date: Thu Mar 13 21:03:05 2014 -0400 Decrease HelpDialog tab width from 320 to 30 (the width of 10 spaces.) (Fixes: #453) diff --git a/debian/changelog b/debian/changelog index 7d89bd9..30f8182 100644 --- a/debian/changelog +++ b/debian/changelog @@ -46,6 +46,11 @@ x2goclient (4.0.2.0-0x2go1) UNRELEASED; urgency=low %setup. + Copy ChangeLog.gitlog (if present) into txt/ subfolder during %setup. + [ Mike DePaulo ] + * New upstream version (4.0.2.0): + - Decrease HelpDialog's tab width from 320 to 30 + (the width of 10 spaces.) (Fixes: #453) + -- Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Wed, 22 Jan 2014 09:20:08 +0100 x2goclient (4.0.1.4-0x2go1) UNRELEASED; urgency=low

2 1

Bug#422: Commit 7fad67c4 is the culprit
by Michael DePaulo 13 Mar '14

13 Mar '14

After repeated testing of PulseAudio builds leading up to PulseAudio 3.0, I determined that this commit introduced this bug/incompatibility: 7fad67c46188991c04a42b190349ebb3f4a1756f 2012-05-15 17:06:53 (GMT) http://cgit.freedesktop.org/pulseaudio/pulseaudio/commit/?id=7fad67c4618899…

2 3

Bug#422: Also
by Michael DePaulo 12 Mar '14

12 Mar '14

Also, I forgot to write up these notes earlier. These are notes on me trying to debug this bug. These notes suggest that this bug is not a bug in PulseAudio, but rather an incompatibility between X2Go Client and PulseAudio. When pulseaudio.exe (3.0 and later) is launched from the command line, there is different behavior: 1. The cookie is created. By default, it is created at C:\Users\mike\.config\pulse\cookie 2. pulseaudio.exe stays running. I use the same command that x2go uses (with an actual x2go config file generated for pulseaudio): pulseaudio.exe -n -F c:\path-to-config.pa I also tried setting the environment variables to the same ones that x2goclient.exe sets. Still, the cookie was created and pulseaudio.exe stayed running. (I do not have the exact env vars on me at the moment. However, I viewed them using Process Explorer.) Since x2goclient.exe overrides USERPROFILE, that was one of the env vars I set. The cookie was created relative to it, for example, C:\Users\mike\.x2go\pulse\.config\pulse\cookie Maybe the use of forward slashes vs backslashes, or the use of the 8.3 format for some of the path values is to blame. However, I used the same exact values for those env vars on the command line, and still the behavior differed from when x2goclient.exe launches pulseaudio.exe

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

x2go-dev