1
0
mirror of https://github.com/systemd/systemd.git synced 2025-01-06 17:18:12 +03:00
Commit Graph

23 Commits

Author SHA1 Message Date
Mantas Mikulėnas
2424a67c02 ssh-generator: silence "Binding to socket" messages 2024-11-19 11:00:20 +01:00
Yu Watanabe
f769518c9a tree-wide: drop doubled empty lines 2024-10-07 09:51:37 +02:00
Yu Watanabe
07dbbda0fc ssh-generator: make sd_json_dispatch_field table static 2024-09-19 01:34:56 +09:00
Lennart Poettering
a8ea7c1940 meson: tweak meson conditionalization for ssh{d,}_config drop-ins
Let's make sure "no" is an acceptable setting for these paths.
2024-09-09 19:03:48 +02:00
Lennart Poettering
25ff515b39 sd-varlink: make our internal Varlink API public as sd-varlink.[ch]
It's time. sd-json was already done earlier in this cycle, let's now
make sd-varlink public too.

This is mostly just a search/replace job of epical proportions.

I left some functions internal (mostly IDL handling), and I turned some
static inline calls into regular calls.
2024-07-16 11:57:32 +02:00
Lennart Poettering
26b455d815 ssh-proxy: add support for connecting to VMs by AF_VSOCK via "machine/…" host specs
With this one can type "ssh machine/foobar" to connect to locally
registered machine "foobar" via SSH-over-AF_VSOCK.
2024-06-21 17:28:16 +02:00
Yu Watanabe
e367b42664 tree-wide: replace strv_sort() + strv_uniq() -> strv_sort_uniq() 2024-06-18 00:37:50 +09:00
Lennart Poettering
432977a0a4 iovec-util: add exported constant empty but valid (i.e. non-NULL) iovec
Also, make sure the NUL byte iovec becomes an exported constant too.

This is better than the previous situation where this was a macro
resolving to a compount expression, since the lifetime of the expression
is limited to its invoking scope. By turning this into a proper variable
the lifetime becomes unbounded, which makes it easier to use in various
scenarios, such as "if" blocks.
2024-06-14 12:42:07 +01:00
Дамјан Георгиевски
d357f129b2 vsock-mux ssh proxy
allow the ssh-proxy to connect to cloud-hypervisor/Firecracker guests,
via their unix-domain socket to AF_VSOCK multiplexer:

https://github.com/cloud-hypervisor/cloud-hypervisor/blob/main/docs/vsock.md
https://github.com/firecracker-microvm/firecracker/blob/main/docs/vsock.md
2024-06-12 18:36:21 +09:00
Franck Bui
de0f11d790 meson: don't put a symlink pointing to '20-systemd-ssh-proxy.conf' in /etc in all cases
On distros like SUSE where ssh config dropins in /usr are supported, there's no
need for a symlink in /etc/ssh/ssh_config.d/ that points to the dropin
installed somewhere in /usr (that is not reachable by ssh).
2024-05-27 17:20:26 +02:00
Mike Yuan
a688e5fefd
ssh-generator: fix pointer cast type 2024-05-08 18:20:59 +08:00
Frantisek Sumsal
516bb9c0be Simplify a couple of conditions 2024-04-02 18:08:22 +02:00
Luca Boccassi
1b5f3f5662
Merge pull request #31670 from CodethinkLabs/vmspawn/generate_ssh_keys
vmspawn: generate ssh keys
2024-03-22 16:28:03 +00:00
Lennart Poettering
95be59f907 ssh-generator: introduce ssh-access.target
This new passive target is supposed to be pulled in by SSH
implementations and should be reached when remote SSH access is
possible. The idea is that this target can be used as indicator for
other components to determine if and when SSH access is possible.

One specific usecase for this is the new sd_notify() logic in PID 1 that
sends its own supervisor notifications whenever target units are
reached. This can be used to precisely schedule SSH connections from
host to VM/container, or just to identify systems where SSH is even
available.
2024-03-14 17:23:28 +01:00
Sam Leonard
071155a1fb
ssh-generator: support ssh.ephemeral-key.all-users 2024-03-14 11:55:54 +00:00
Mike Yuan
7dfc71399d
path-lookup: rename lookup_paths_free -> _done
This is stack-allocated, so update to match our usual rules.
2024-03-07 02:01:57 +08:00
Lennart Poettering
d52320337e ssh-generator: don't do AF_VSOCK stuff if we run in a container
Tighten our VM check: whether we run in a VM is not enough to do
AF_VSOCK. We also need to check if we are run in a container, because if
we run in a container inside a VM then we should *not* do the AF_VSOCK
stuff, but leave the port free for the VM itself.

As discussed here:

https://github.com/systemd/systemd/pull/31544#issuecomment-1971455401
2024-02-29 20:43:12 +00:00
Lennart Poettering
f557129ecb ssh-generator: handle gracefully if AF_VSOCK works, but /dev/vsock doesn't
Apparently this case exists, let's handle it gracefully.

Prompted by: https://github.com/systemd/systemd/pull/31544#issuecomment-1971241397
2024-02-29 18:28:01 +01:00
Frantisek Sumsal
62670a7752 meson: don't install broken tmpfiles config with sshd?confdir == 'no'
20-systemd-ssh-generator.conf expands SSHCONFDIR, which is bogus when we
build with -Dsshconfdir=no. Similarly, avoid expanding SSHDCONFDIR in
20-systemd-userdb.conf when building with -Dsshconfdir=no.

Follow-up 6c7fc5d5f2.
2024-01-30 17:56:21 +00:00
Frantisek Sumsal
6c7fc5d5f2 meson: correctly handle "no" value for sshd?confdir options 2024-01-22 22:01:39 +00:00
Lennart Poettering
631cdd59e1 ssh-generator: correct log level of one function
add_export_unix_socket() generally logs about errors, but we forgot one
case.
2024-01-17 13:13:13 +01:00
Lennart Poettering
0abd510f7f ssh-proxy: add ssh ProxyCommand tool that can connect to AF_UNIX + AF_VSOCK sockets
This adds a tiny binary that is hooked into SSH client config via
ProxyCommand and which simply connects to an AF_UNIX or AF_VSOCK socket
of choice.

The syntax is as simple as this:

     ssh unix/some/path     # (this connects to AF_UNIX socket /some/path)

or:

     ssh vsock/4711

I used "/" as separator of the protocol ID and the value since ":" is
already taken by SSH itself when doing sftp. And "@" is already taken
for separating the user name.
2024-01-11 16:05:20 +01:00
Lennart Poettering
0e3220684c ssh-generator: add simple new generator 2024-01-11 16:05:20 +01:00