Add ca_reset plugin also when backend starts as -s none
This commit is contained in:
Olof hagsand
parent
200e258ded
commit
f65efa3e5e
4 changed files with 375 additions and 33 deletions
268
util/clixon_util_netconf_ssh_callhome.c
Normal file
268
util/clixon_util_netconf_ssh_callhome.c
Normal file
|
|
@ -0,0 +1,268 @@
|
|||
/*
|
||||
*
|
||||
***** BEGIN LICENSE BLOCK *****
|
||||
|
||||
Copyright (C) 2009-2016 Olof Hagsand and Benny Holmgren
|
||||
Copyright (C) 2017-2019 Olof Hagsand
|
||||
Copyright (C) 2020-2021 Olof Hagsand and Rubicon Communications, LLC (Netgate)
|
||||
|
||||
This file is part of CLIXON.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
||||
Alternatively, the contents of this file may be used under the terms of
|
||||
the GNU General Public License Version 3 or later (the "GPL"),
|
||||
in which case the provisions of the GPL are applicable instead
|
||||
of those above. If you wish to allow use of your version of this file only
|
||||
under the terms of the GPL, and not to allow others to
|
||||
use your version of this file under the terms of Apache License version 2,
|
||||
indicate your decision by deleting the provisions above and replace them with
|
||||
the notice and other provisions required by the GPL. If you do not delete
|
||||
the provisions above, a recipient may use your version of this file under
|
||||
the terms of any one of the Apache License version 2 or the GPL.
|
||||
|
||||
***** END LICENSE BLOCK *****
|
||||
|
||||
* Create stream socket, connect to remote address, then exec sshd -e that takes over the
|
||||
* tcp connection.
|
||||
device client
|
||||
+-----------------+ tcp 4321 +-----------------+
|
||||
| util_netconf_ssh| <----------------> | xxx |
|
||||
| | | +-----------------+
|
||||
| exec v | 4322 | tcp
|
||||
| | ssh +-----------------+
|
||||
| sshd -e | <----------------> | ssh |
|
||||
+-----------------+ +-----------------+
|
||||
| stdio | stdio
|
||||
+-----------------+
|
||||
| clixon_netconf |
|
||||
+-----------------+
|
||||
|
|
||||
+-----------------+
|
||||
| clixon_backend |
|
||||
+-----------------+
|
||||
|
||||
Example sshd-config (-c option):n
|
||||
Port 2592
|
||||
UsePrivilegeSeparation no
|
||||
TCPKeepAlive yes
|
||||
AuthorizedKeysFile ~.ssh/authorized_keys
|
||||
Subsystem netconf /usr/local/bin/clixon_netconf
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <errno.h>
|
||||
#include <assert.h>
|
||||
#include <netinet/in.h>
|
||||
#include <arpa/inet.h>
|
||||
|
||||
#define NETCONF_CH_SSH 4334
|
||||
#define SSHDBIN_DEFAULT "/usr/sbin/sshd"
|
||||
#define UTIL_OPTS "hD:f:a:p:s:c:"
|
||||
|
||||
static int
|
||||
callhome_connect(struct sockaddr *sa,
|
||||
size_t sa_len,
|
||||
int *sp)
|
||||
{
|
||||
int retval = -1;
|
||||
int s;
|
||||
|
||||
if ((s = socket(sa->sa_family, SOCK_STREAM, 0)) < 0) {
|
||||
perror("socket");
|
||||
goto done;
|
||||
}
|
||||
if (connect(s, sa, sa_len) < 0){
|
||||
perror("connect");
|
||||
close(s);
|
||||
goto done;
|
||||
}
|
||||
*sp = s;
|
||||
retval = 0;
|
||||
done:
|
||||
return retval;
|
||||
}
|
||||
|
||||
static int
|
||||
exec_sshd(int s,
|
||||
char *sshdbin,
|
||||
char *configfile)
|
||||
{
|
||||
int retval = -1;
|
||||
char **argv = NULL;
|
||||
int i;
|
||||
int nr;
|
||||
|
||||
if (s < 0){
|
||||
errno = EINVAL;
|
||||
perror("socket s");
|
||||
goto done;
|
||||
}
|
||||
if (sshdbin == NULL){
|
||||
errno = EINVAL;
|
||||
perror("sshdbin");
|
||||
goto done;
|
||||
}
|
||||
if (configfile == NULL){
|
||||
errno = EINVAL;
|
||||
perror("configfile");
|
||||
goto done;
|
||||
}
|
||||
nr = 7; // XXX
|
||||
if ((argv = calloc(nr, sizeof(char *))) == NULL){
|
||||
perror("calloc");
|
||||
goto done;
|
||||
}
|
||||
i = 0;
|
||||
argv[i++] = sshdbin;
|
||||
argv[i++] = "-i"; /* Specifies that sshd is being run from inetd(8) */
|
||||
argv[i++] = "-d";
|
||||
argv[i++] = "-e";
|
||||
argv[i++] = "-f";
|
||||
argv[i++] = configfile;
|
||||
argv[i++] = NULL;
|
||||
assert(i==nr);
|
||||
if (setreuid(0, 0) < 0){
|
||||
perror("setreuid");
|
||||
goto done;
|
||||
}
|
||||
if (dup2(s, STDIN_FILENO) < 0){
|
||||
perror("dup2");
|
||||
return -1;
|
||||
}
|
||||
if (dup2(s, STDOUT_FILENO) < 0){
|
||||
perror("dup2");
|
||||
return -1;
|
||||
}
|
||||
if (execv(argv[0], argv) < 0) {
|
||||
perror("execv");
|
||||
exit(1);
|
||||
}
|
||||
/* Should reach here */
|
||||
retval = 0;
|
||||
done:
|
||||
return retval;
|
||||
}
|
||||
|
||||
static int
|
||||
usage(char *argv0)
|
||||
{
|
||||
fprintf(stderr, "usage:%s [options]\n"
|
||||
"where options are\n"
|
||||
"\t-h \tHelp\n"
|
||||
"\t-D <level> \tDebug\n"
|
||||
"\t-f ipv4|ipv6 \tSocket address family(ipv4 default)\n"
|
||||
"\t-a <addrstr> \tIP address (eg 1.2.3.4) - mandatory\n"
|
||||
"\t-p <port> \tPort (default 4334)\n"
|
||||
"\t-c <file> \tSSHD config file - mandatory\n"
|
||||
"\t-s <sshd> \tPath to sshd binary, default %s\n"
|
||||
,
|
||||
argv0, SSHDBIN_DEFAULT);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
int
|
||||
main(int argc,
|
||||
char **argv)
|
||||
{
|
||||
int retval = -1;
|
||||
int c;
|
||||
char *family = "ipv4";
|
||||
char *addr = NULL;
|
||||
struct sockaddr *sa;
|
||||
struct sockaddr_in6 sin6 = { 0 };
|
||||
struct sockaddr_in sin = { 0 };
|
||||
size_t sin_len;
|
||||
int debug = 0;
|
||||
uint16_t port = NETCONF_CH_SSH;
|
||||
int s = -1;
|
||||
char *sshdbin = SSHDBIN_DEFAULT;
|
||||
char *configfile = NULL;
|
||||
|
||||
optind = 1;
|
||||
opterr = 0;
|
||||
while ((c = getopt(argc, argv, UTIL_OPTS)) != -1)
|
||||
switch (c) {
|
||||
case 'h':
|
||||
usage(argv[0]);
|
||||
break;
|
||||
case 'D':
|
||||
debug++;
|
||||
break;
|
||||
case 'f':
|
||||
family = optarg;
|
||||
break;
|
||||
case 'a':
|
||||
addr = optarg;
|
||||
break;
|
||||
case 'p':
|
||||
port = atoi(optarg);
|
||||
break;
|
||||
case 'c':
|
||||
configfile = optarg;
|
||||
break;
|
||||
case 's':
|
||||
sshdbin = optarg;
|
||||
break;
|
||||
default:
|
||||
usage(argv[0]);
|
||||
break;
|
||||
}
|
||||
if (port == 0){
|
||||
fprintf(stderr, "-p <port> is invalid\n");
|
||||
usage(argv[0]);
|
||||
goto done;
|
||||
}
|
||||
if (addr == NULL){
|
||||
fprintf(stderr, "-a <addr> is NULL\n");
|
||||
usage(argv[0]);
|
||||
goto done;
|
||||
}
|
||||
if (configfile == NULL){
|
||||
fprintf(stderr, "-c <file> is NULL\n");
|
||||
usage(argv[0]);
|
||||
goto done;
|
||||
}
|
||||
if (strcmp(family, "ipv6") == 0){
|
||||
sin_len = sizeof(struct sockaddr_in6);
|
||||
sin6.sin6_port = htons(port);
|
||||
sin6.sin6_family = AF_INET6;
|
||||
inet_pton(AF_INET6, addr, &sin6.sin6_addr);
|
||||
sa = (struct sockaddr *)&sin6;
|
||||
}
|
||||
else if (strcmp(family, "ipv4") == 0){
|
||||
sin_len = sizeof(struct sockaddr_in);
|
||||
sin.sin_family = AF_INET;
|
||||
sin.sin_port = htons(port);
|
||||
sin.sin_addr.s_addr = inet_addr(addr);
|
||||
sa = (struct sockaddr *)&sin;
|
||||
}
|
||||
else{
|
||||
fprintf(stderr, "-f <%s> is invalid family\n", family);
|
||||
goto done;
|
||||
}
|
||||
if (callhome_connect(sa, sin_len, &s) < 0)
|
||||
goto done;
|
||||
if (exec_sshd(s, sshdbin, configfile) < 0)
|
||||
goto done;
|
||||
if (s >= 0)
|
||||
close(s);
|
||||
retval = 0;
|
||||
done:
|
||||
return retval;
|
||||
}
|
||||
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue