Attachment 3071 Details for Bug 2784 – Add RoutingDomain option

[patch] Add RoutingDomain option

0002-routingdomain.patch (text/plain), 4.74 KB, created by Damien Miller on 2017-10-21 15:32:06 AEDT

(hide)

Description:

Filename:

MIME Type:

Creator: Damien Miller

Created: 2017-10-21 15:32:06 AEDT

Size: 4.74 KB

patch

obsolete

>From da084dcc02979664de7cf1da263901fa1e0927e3 Mon Sep 17 00:00:00 2001
>From: Damien Miller <djm@mindrot.org>
>Date: Fri, 20 Oct 2017 15:40:17 +1100
>Subject: [PATCH 2/3] routingdomain
>
>---
> servconf.c | 19 ++++++++++++++++++-
> servconf.h |  3 +++
> sshd.c     | 28 ++++++++++++++++++++++++++++
> 3 files changed, 49 insertions(+), 1 deletion(-)
>
>diff --git a/servconf.c b/servconf.c
>index db364b4..57f08ba 100644
>--- a/servconf.c
>+++ b/servconf.c
>@@ -77,6 +77,7 @@ initialize_server_options(ServerOptions *options)
> 	options->listen_addrs = NULL;
> 	options->num_listen_addrs = 0;
> 	options->address_family = -1;
>+	options->routing_domain = NULL;
> 	options->num_host_key_files = 0;
> 	options->num_host_cert_files = 0;
> 	options->host_key_agent = NULL;
>@@ -385,6 +386,7 @@ fill_default_server_options(ServerOptions *options)
> 	CLEAR_ON_NONE(options->authorized_principals_file);
> 	CLEAR_ON_NONE(options->adm_forced_command);
> 	CLEAR_ON_NONE(options->chroot_directory);
>+	CLEAR_ON_NONE(options->routing_domain);
> 	for (i = 0; i < options->num_host_key_files; i++)
> 		CLEAR_ON_NONE(options->host_key_files[i]);
> 	for (i = 0; i < options->num_host_cert_files; i++)
>@@ -435,7 +437,7 @@ typedef enum {
> 	sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
> 	sStreamLocalBindMask, sStreamLocalBindUnlink,
> 	sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding,
>-	sExposeAuthInfo,
>+	sExposeAuthInfo, sRoutingDomain,
> 	sDeprecated, sIgnore, sUnsupported
> } ServerOpCodes;
> 
>@@ -564,6 +566,7 @@ static struct {
> 	{ "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },
> 	{ "disableforwarding", sDisableForwarding, SSHCFG_ALL },
> 	{ "exposeauthinfo", sExposeAuthInfo, SSHCFG_ALL },
>+	{ "routingdomain", sRoutingDomain, SSHCFG_ALL },
> 	{ NULL, sBadOption, 0 }
> };
> 
>@@ -1928,6 +1931,19 @@ process_server_config_line(ServerOptions *options, char *line,
> 		intptr = &options->expose_userauth_info;
> 		goto parse_flag;
> 
>+	case sRoutingDomain:
>+		charptr = &options->routing_domain;
>+		arg = strdelim(&cp);
>+		if (!arg || *arg == '\0')
>+			fatal("%.200s line %d: Missing argument.",
>+			    filename, linenum);
>+		if (strcasecmp(arg, "none") != 0 && strcmp(arg, "%D") == 0 &&
>+		    !valid_rdomain(arg))
>+			fatal("%s line %d: bad routing domain",
>+			    filename, linenum);
>+		if (*activep && *charptr == NULL)
>+			*charptr = xstrdup(arg);
>+
> 	case sDeprecated:
> 	case sIgnore:
> 	case sUnsupported:
>@@ -2410,6 +2426,7 @@ dump_config(ServerOptions *o)
> 	    o->hostkeyalgorithms : KEX_DEFAULT_PK_ALG);
> 	dump_cfg_string(sPubkeyAcceptedKeyTypes, o->pubkey_key_types ?
> 	    o->pubkey_key_types : KEX_DEFAULT_PK_ALG);
>+	dump_cfg_string(sRoutingDomain, o->routing_domain);
> 
> 	/* string arguments requiring a lookup */
> 	dump_cfg_string(sLogLevel, log_level_name(o->log_level));
>diff --git a/servconf.h b/servconf.h
>index cd8a097..8fc816f 100644
>--- a/servconf.h
>+++ b/servconf.h
>@@ -78,6 +78,8 @@ typedef struct {
> 	u_int	num_listen_addrs;
> 	int	address_family;		/* Address family used by the server. */
> 
>+	char	*routing_domain;	/* Bind session to routing domain */
>+
> 	char   **host_key_files;	/* Files containing host keys. */
> 	u_int	num_host_key_files;     /* Number of files for host keys. */
> 	char   **host_cert_files;	/* Files containing host certs. */
>@@ -237,6 +239,7 @@ struct connection_info {
> 		M_CP_STROPT(authorized_principals_command_user); \
> 		M_CP_STROPT(hostbased_key_types); \
> 		M_CP_STROPT(pubkey_key_types); \
>+		M_CP_STROPT(routing_domain); \
> 		M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \
> 		M_CP_STRARRAYOPT(allow_users, num_allow_users); \
> 		M_CP_STRARRAYOPT(deny_users, num_deny_users); \
>diff --git a/sshd.c b/sshd.c
>index cc77a1a..e417e2c 100644
>--- a/sshd.c
>+++ b/sshd.c
>@@ -1292,6 +1292,31 @@ check_ip_options(struct ssh *ssh)
> 	return;
> }
> 
>+/* Set the routing domain for this process */
>+static void
>+set_process_rdomain(struct ssh *ssh, const char *name)
>+{
>+	int rtable, ortable = getrtable();
>+	const char *errstr;
>+
>+	if (name == NULL)
>+		return; /* default */
>+
>+	if (strcmp(name, "%D") == 0) {
>+		/* "expands" to routing domain of connection */
>+		if ((name = ssh_packet_rdomain_in(ssh)) == NULL)
>+			return;
>+	}
>+
>+	rtable = (int)strtonum(name, 0, 255, &errstr);
>+	if (errstr != NULL) /* Shouldn't happen */
>+		fatal("Invalid routing domain \"%s\": %s", name, errstr);
>+	if (rtable != ortable && setrtable(rtable) != 0)
>+		fatal("Unable to set routing domain %d: %s",
>+		    rtable, strerror(errno));
>+	debug("%s: set routing domain %d (was %d)", __func__, rtable, ortable);
>+}
>+
> /*
>  * Main program for the daemon.
>  */
>@@ -1910,6 +1935,9 @@ main(int ac, char **av)
> 		startup_pipe = -1;
> 	}
> 
>+	if (options.routing_domain != NULL)
>+		set_process_rdomain(ssh, options.routing_domain);
>+
> 	/*
> 	 * In privilege separation, we fork another child and prepare
> 	 * file descriptor passing.
>-- 
>2.14.2
>

Actions: View | Diff

Attachments on bug 2784: 3061 | 3064 | 3070 | 3071 | 3072 | 3075 | 3076 | 3077 | 3078 | 3079 | 3080 | 3081 | 3082