openssh bugs - Feb 2020 - [Bug 3126] New: Mark the RDomain configuration option unsupported on non-openbsd builds

https://bugzilla.mindrot.org/show_bug.cgi?id=3126

            Bug ID: 3126
           Summary: Mark the RDomain configuration option unsupported on
                    non-openbsd builds
           Product: Portable OpenSSH
           Version: 8.2p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Keywords: patch
          Severity: enhancement
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: jjelen at redhat.com

Created attachment 3358
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3358&action=edit
Mark the RDomain configuration option unsupported on non-openbsd builds

Experimenting with RDomain configuration option on non-OpenBSD platform
prevents sshd from accepting connections. The release notes properly
described this option as supported only on OpenBSD, but this was not
propagated to manual page and user is left without warning until the
server does not accept any new connections with this option.

I believe the option should be marked as unsupported to avoid these
surprises and documentation should be adjusted accordingly.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3126

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at dtucker.net

--- Comment #1 from Darren Tucker <dtucker at dtucker.net> ---
(In reply to Jakub Jelen from comment #0)
> Created attachment 3358 [details]
> Mark the RDomain configuration option unsupported on non-openbsd
> builds
I don't think that patch is correct.  sshd should fail with a warning
on platforms that don't have an rdomain equivalent (in
sshd.c:set_process_rdomain).  In the case of Linux, it's a little
convoluted but it should end up using the code in
openbsd-compat/port-net.c.
> Experimenting with RDomain configuration option on non-OpenBSD
> platform prevents sshd from accepting connections.
If the Linux rdomain code doesn't work as expected that's a separate
issue.
> The release notes
> properly described this option as supported only on OpenBSD,
That was true when rdomain was added, but it's since added Linux
support.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3126

--- Comment #2 from Jakub Jelen <jjelen at redhat.com> ---
(In reply to Darren Tucker from comment #1)
> (In reply to Jakub Jelen from comment #0)
> > Created attachment 3358 [details]
> > Mark the RDomain configuration option unsupported on non-openbsd
> > builds
> 
> I don't think that patch is correct.  sshd should fail with a
> warning on platforms that don't have an rdomain equivalent (in
> sshd.c:set_process_rdomain).  In the case of Linux, it's a little
> convoluted but it should end up using the code in
> openbsd-compat/port-net.c.
Yes, that code contains only
> fatal("%s: not supported", __func__);
> > Experimenting with RDomain configuration option on non-OpenBSD
> > platform prevents sshd from accepting connections.
> 
> If the Linux rdomain code doesn't work as expected that's a
separate
> issue.
There is no linux code for this configuration option.
> > The release notes
> > properly described this option as supported only on OpenBSD,
> 
> That was true when rdomain was added, but it's since added Linux
> support.
According to the code, this is still the case. See above. I did not
investigate whether there is already a way to change rdomain for
process in Linux, but having an option which is without warning in
manual page breaking all connections is dangerous.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3126

--- Comment #3 from Darren Tucker <dtucker at dtucker.net> ---
(In reply to Jakub Jelen from comment #2)
> (In reply to Darren Tucker from comment #1)
[...]
> > If the Linux rdomain code doesn't work as expected that's a
> > separate issue.
> 
> There is no linux code for this configuration option.
https://github.com/openssh/openssh-portable/blob/master/openbsd-compat/port-net.c#L48
> I did not
> investigate whether there is already a way to change rdomain for
> process in Linux, but having an option which is without warning in
> manual page breaking all connections is dangerous.
The problem looks to be specific to the Linux code.  On any platform
other than OpenBSD or Linux (this is FreeBSD 10) I get this error at
startup when attempting to set an rdomain:

$ sudo `pwd`/sshd -ddd -o rdomain=1
Routing domains are not supported on this platform
command-line line 0: bad routing domain

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3126

--- Comment #4 from Jakub Jelen <jjelen at redhat.com> ---
(In reply to Darren Tucker from comment #3)
> (In reply to Jakub Jelen from comment #2)
> > (In reply to Darren Tucker from comment #1)
> [...]
> > > If the Linux rdomain code doesn't work as expected that's
a
> > > separate issue.
> > 
> > There is no linux code for this configuration option.
> 
> https://github.com/openssh/openssh-portable/blob/master/openbsd-
> compat/port-net.c#L48
But this is for set/get_rdomain() on socket. The above option is about
setting the context for process, which is not supported in Linux:

https://github.com/openssh/openssh-portable/blob/master/openbsd-compat/port-net.c#L119
> > I did not
> > investigate whether there is already a way to change rdomain for
> > process in Linux, but having an option which is without warning in
> > manual page breaking all connections is dangerous.
> 
> The problem looks to be specific to the Linux code.  On any platform
> other than OpenBSD or Linux (this is FreeBSD 10) I get this error at
> startup when attempting to set an rdomain:
> 
> $ sudo `pwd`/sshd -ddd -o rdomain=1
> Routing domains are not supported on this platform
> command-line line 0: bad routing domain
Right. Thank you for checking. I missed this part of the code which is
shared between listenaddress and rdomain options. But the patch as it
is above, still address the original issue. If you think that the
option should fail and not report as unsupported, I can rewrite the
patch to do that.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3126

--- Comment #5 from Jakub Jelen <jjelen at redhat.com> ---
One more clarification. The reproducer is just setting this in the
sshd_config:

RDomain %D

With this configuration, restart and configuration parsing passes fine,
but fails to accept connections:

sshd[4831]: Server listening on :: port 22.
systemd[1]: Started OpenSSH server daemon.
sshd[4833]: fatal: Unable to set routing domain: not supported in this
platform

Indeed, setting up anything else fails already during the configuration
parsing, so marking the configuration option as unsupported on
non-OpenBSD builds would make sense from here.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3126

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |3117

--- Comment #6 from Darren Tucker <dtucker at dtucker.net> ---
ok thanks.  putting on list for next release.


Referenced Bugs:

https://bugzilla.mindrot.org/show_bug.cgi?id=3117
[Bug 3117] Tracking bug for 8.3 release
-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3126

Jakub Jelen <jjelen at redhat.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3358|0                           |1
        is obsolete|                            |

--- Comment #7 from Jakub Jelen <jjelen at redhat.com> ---
Created attachment 3370
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3370&action=edit
Mark the RDomain configuration option unsupported on non-openbsd builds
v2

Second version -- we need to prevent dumping the configuration option
too as it is would create invalid configuration files and testsuite
would fail on Linux.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3126

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3370|0                           |1
        is obsolete|                            |
                 CC|                            |djm at mindrot.org
   Attachment #3386|                            |ok?(djm at mindrot.org)
              Flags|                            |

--- Comment #8 from Darren Tucker <dtucker at dtucker.net> ---
Created attachment 3386
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3386&action=edit
fatal out if config has unsupported rdomain keyword

Revised patch which causes it to fatal out at parse time if rdomain is
unsupported instead of just logging a warning.  Rationale: the user
might think they have applied a restriction but actually have not.

It uses HAVE_SYS_SET_PROCESS_RDOMAIN in addition to __OpenBSD__ since
that would be set if a platform did support it (although no platform
currently does, the infrastructure is there).

It also removes the entry in the man page.  Rationale: there are many
configuration options that depend on platform and/or build time support
 and including all of them in the man page would be a) unwieldy and b)
a maintenance burden since it would make it harder to keep in sync with
upstream.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3126

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3386|ok?(djm at mindrot.org)        |ok+
              Flags|                            |

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3126

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Darren Tucker <dtucker at dtucker.net> ---
Patch applied, please let us know if you have any additional feedback
or problems with it.

Thanks.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3126

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #10 from Damien Miller <djm at mindrot.org> ---
closing resolved bugs as of 8.6p1 release

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3126

Ahmed Sayeed <ahmedsayeed1982 at yahoo.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ahmedsayeed1982 at yahoo.com

--- Comment #11 from Ahmed Sayeed <ahmedsayeed1982 at yahoo.com> ---
With this patch (not sure yet whether it's relevant) in place:  
... http://www-look-4.com/category/computers/
diff --git a/gdb/testsuite/lib/gdbserver-support.exp
b/gdb/testsuite/lib/gdbserver-support.
Exp https://komiya-dental.com/health/healthy-foods/
index a2cc80f28d..7b9c0eef6e 100644
--- a/gdb/testsuite/lib/gdbserver-support.exp
http://www.iu-bloomington.com/services/travel-services/
+++ b/gdb/testsuite/lib/gdbserver-support.exp
@@ -451,8 +451,10 @@ proc gdbserver_exit { is_mi } {
https://waytowhatsnext.com/technology/korean-technology/
            # We use expect rather than gdb_expect because
            # we want to suppress printing exception messages,
otherwise, http://www.wearelondonmade.com/category/health/
            # remote_expect, invoked by gdb_expect, prints the
exceptions.
+           set read_prompt 0
            expect { http://www.jopspeech.com/category/property/
                -i "$gdb_spawn_id" -re "$gdb_prompt $" {
+                   set read_prompt 1
http://joerg.li/category/technology/
                    exp_continue
                }
                -i "$server_spawn_id" eof {
http://connstr.net/property/mars-researches/
@@ -463,6 +465,7 @@ proc gdbserver_exit { is_mi } {
                    warning "Timed out waiting for EOF in server after
$monitor_exit"
                }
}       
+           gdb_assert {$read_prompt}
        }
     } http://embermanchester.uk/health/social-privacy/
     close_gdbserver
...
and running in parallel with:
...
$ stress -c 5 http://www.slipstone.co.uk/category/services/
...
I ran into:
...
(gdb) PASS: gdb.multi/multi-target.exp: continue: non-stop=on: inferior
2 http://www.logoarts.co.uk/category/travel/
Remote debugging from host ::1, port 34088^M
Process build/gdb/testsuite/outputs/gdb.multi/multi-target/multi-target
created; pid = 8649^M
monitor exit^M
(gdb) Killing process(es): 8649^M
http://www.acpirateradio.co.uk/technology/facetime/
#9 0x16a2c57 in pop_all_targets_at_and_above(strata)
/home/vries/gdb_versions/devel/src/gdb/target.c:678
    #10 0x1442749 in remote_unpush_target 
http://www.compilatori.com/tech/xiaomi/
/home/vries/gdb_versions/devel/src/gdb/remote.c:5522
    #11 0x1458c16 in remote_target::readchar(int)
/home/vries/gdb_versions/devel/src/gdb/remote.c:9137
https://www.webb-dev.co.uk/sports/how-to-choose-sportwear/ 
    #12 0x145b25b in
remote_target::getpkt_or_notif_sane_1(std::vector<char,
gdb::default_init_allocator<char, std::allocator<char> > >*, int,
int,
int*)

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.