Hello. So please let me ping this once, i thought it is a good time, now that OpenBSD 7.1 is out. It is a small and pretty local change, and it incorporates the comments of Darren Tucker (i finally understood what you were thinking) in another now closed pull on github (being there again for such things, but i did not read the docs..), the still open pull request is [1]. Tests run. (I will not mail again.) Thanks for your consideration, and Ciao from Germany already here. [1] https://github.com/openssh/openssh-portable/pull/297 From: Steffen Nurpmeso <steffen@xxxxxxxxxx> Date: Fri, 21 Jan 2022 00:11:18 +0100 Subject: [PATCH] ssh-agent: remove all keys upon SIGUSR1.. With the advent of per-user temporary directories it became hard for an administrator to remove all keys from all running ssh-agent instances; what formerly could be done like so if command -v ssh-add >/dev/null 2>&1; then for a in /tmp/ssh-*/agent.*; do [ -e "$a" ] || continue act "SSH_AUTH_SOCK=\"$a\" ssh-add -D </dev/null >/dev/null 2>&1 &" inc done fi has become a major undertaking, especially with even more containerization. Being able to remove all keys from all agents with a single command seems so desirable that it is available in other agents in the software world. --- regress/agent.sh | 45 +++++++++++++++++++++++---------- ssh-agent.1 | 3 +++ ssh-agent.c | 66 ++++++++++++++++++++++++++++++++++++++---------- 3 files changed, 87 insertions(+), 27 deletions(-) diff --git a/regress/agent.sh b/regress/agent.sh index f187b67572..43d4bd0724 100644 --- a/regress/agent.sh +++ b/regress/agent.sh @@ -157,30 +157,49 @@ done ## Deletion tests. +delete_cycle() { + # make sure they're gone + ${SSHADD} -l > /dev/null 2>&1 + r=$? + if [ $r -ne 1 ]; then + fail "ssh-add -l returned unexpected exit code: $r" + fi + trace "readd keys" + # re-add keys/certs to agent + for t in ${SSH_KEYTYPES}; do + ${SSHADD} $OBJ/$t-agent-private >/dev/null 2>&1 || \ + fail "ssh-add failed exit code $?" + done + # make sure they are there + ${SSHADD} -l > /dev/null 2>&1 + r=$? + if [ $r -ne 0 ]; then + fail "ssh-add -l failed: exit code $r" + fi +} + trace "delete all agent keys" ${SSHADD} -D > /dev/null 2>&1 r=$? if [ $r -ne 0 ]; then fail "ssh-add -D failed: exit code $r" fi -# make sure they're gone -${SSHADD} -l > /dev/null 2>&1 +delete_cycle + +trace "delete all agent keys via SIGUSR1" +kill -USR1 $SSH_AGENT_PID >/dev/null 2>&1 r=$? -if [ $r -ne 1 ]; then - fail "ssh-add -l returned unexpected exit code: $r" +if [ $r -ne 0 ]; then + fail "kill -USR1: exit code $r" fi -trace "readd keys" -# re-add keys/certs to agent -for t in ${SSH_KEYTYPES}; do - ${SSHADD} $OBJ/$t-agent-private >/dev/null 2>&1 || \ - fail "ssh-add failed exit code $?" -done -# make sure they are there -${SSHADD} -l > /dev/null 2>&1 +delete_cycle +trace ".. and again" +kill -USR1 $SSH_AGENT_PID >/dev/null 2>&1 r=$? if [ $r -ne 0 ]; then - fail "ssh-add -l failed: exit code $r" + fail "kill -USR1: exit code $r" fi +delete_cycle check_key_absent() { ${SSHADD} -L | grep "^$1 " >/dev/null diff --git a/ssh-agent.1 b/ssh-agent.1 index ea43cd156b..7748293791 100644 --- a/ssh-agent.1 +++ b/ssh-agent.1 @@ -178,6 +178,9 @@ will automatically use them if present. is also used to remove keys from .Nm and to query the keys that are held in one. +.Nm +will remove all keys when it receives the user signal +.Dv SIGUSR1 . .Pp Connections to .Nm diff --git a/ssh-agent.c b/ssh-agent.c index 03ae2b022e..ff091c3f8a 100644 --- a/ssh-agent.c +++ b/ssh-agent.c @@ -189,6 +189,9 @@ static int fingerprint_hash = SSH_FP_HASH_DEFAULT; /* Refuse signing of non-SSH messages for web-origin FIDO keys */ static int restrict_websafe = 1; +/* Request to remove_all_identities() pending */ +static volatile sig_atomic_t received_sigusr1 = 0; + static void close_socket(SocketEntry *e) { @@ -915,11 +918,10 @@ process_remove_identity(SocketEntry *e) } static void -process_remove_all_identities(SocketEntry *e) +remove_all_identities(void) { Identity *id; - debug2_f("entering"); /* Loop over all identities and clear the keys. */ for (id = TAILQ_FIRST(&idtab->idlist); id; id = TAILQ_FIRST(&idtab->idlist)) { @@ -929,6 +931,13 @@ process_remove_all_identities(SocketEntry *e) /* Mark that there are no identities. */ idtab->nentries = 0; +} + +static void +process_remove_all_identities(SocketEntry *e) +{ + debug2_f("entering"); + remove_all_identities(); /* Send success. */ send_status(e, 1); @@ -1874,7 +1883,8 @@ after_poll(struct pollfd *pfd, size_t npfd, u_int maxfds) } static int -prepare_poll(struct pollfd **pfdp, size_t *npfdp, int *timeoutp, u_int maxfds) +prepare_poll(struct pollfd **pfdp, size_t *npfdp, struct timespec **ptimeoutpp, + u_int maxfds) { struct pollfd *pfd = *pfdp; size_t i, j, npfd = 0; @@ -1936,17 +1946,17 @@ prepare_poll(struct pollfd **pfdp, size_t *npfdp, int *timeoutp, u_int maxfds) break; } } + + /* This also removes expired keys */ deadline = reaper(); if (parent_alive_interval != 0) deadline = (deadline == 0) ? parent_alive_interval : MINIMUM(deadline, parent_alive_interval); - if (deadline == 0) { - *timeoutp = -1; /* INFTIM */ - } else { - if (deadline > INT_MAX / 1000) - *timeoutp = INT_MAX / 1000; - else - *timeoutp = deadline * 1000; + if (deadline == 0) + *ptimeoutpp = NULL; /* INFTIM */ + else { + (*ptimeoutpp)->tv_nsec = 0; + (*ptimeoutpp)->tv_sec = deadline; } return (1); } @@ -1981,6 +1991,13 @@ cleanup_handler(int sig) _exit(2); } +/*ARGSUSED*/ +static void +onsigusr1(int sig) +{ + received_sigusr1 = 1; +} + static void check_parent_exists(void) { @@ -2022,7 +2039,8 @@ main(int ac, char **av) char pidstrbuf[1 + 3 * sizeof pid]; size_t len; mode_t prev_mask; - int timeout = -1; /* INFTIM */ + sigset_t psigset, psigseto; + struct timespec ptimeout, *ptimeoutp; struct pollfd *pfd = NULL; size_t npfd = 0; u_int maxfds; @@ -2258,18 +2276,38 @@ skip: ssh_signal(SIGINT, (d_flag | D_flag) ? cleanup_handler : SIG_IGN); ssh_signal(SIGHUP, cleanup_handler); ssh_signal(SIGTERM, cleanup_handler); + ssh_signal(SIGUSR1, onsigusr1); if (pledge("stdio rpath cpath unix id proc exec", NULL) == -1) fatal("%s: pledge: %s", __progname, strerror(errno)); platform_pledge_agent(); + /* + * Prepare signal mask that we use to block signals that might set + * received_sigusr1, so that we are guaranteed to immediately wake up + * the ppoll if a signal is received after the flag is checked. + */ + sigemptyset(&psigset); + if (d_flag | D_flag) + sigaddset(&psigset, SIGINT); + sigaddset(&psigset, SIGHUP); + sigaddset(&psigset, SIGTERM); + sigaddset(&psigset, SIGUSR1); + while (1) { - prepare_poll(&pfd, &npfd, &timeout, maxfds); - result = poll(pfd, npfd, timeout); + sigprocmask(SIG_BLOCK, &psigset, &psigseto); + if (received_sigusr1) { + received_sigusr1 = 0; + remove_all_identities(); + } + /* This also removes expired keys */ + ptimeoutp = &ptimeout; + prepare_poll(&pfd, &npfd, &ptimeoutp, maxfds); + result = ppoll(pfd, npfd, ptimeoutp, &psigseto); saved_errno = errno; + sigprocmask(SIG_SETMASK, &psigseto, NULL); if (parent_alive_interval != 0) check_parent_exists(); - (void) reaper(); /* remove expired keys */ if (result == -1) { if (saved_errno == EINTR) continue; -- 2.35.3 --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt) _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
