On Tue, 19 Feb 2019 22:33:53 -0700 "Theo de Raadt" <dera...@openbsd.org> wrote: > I think that's really gross. > > route domains are a concept usable by some people, not everyone should > need to see this.
Ah, may be yes. I am using sshd on routing domain other than 0, but actually I'll add "RDomain 0" to sshd_config for keeping rdomain 0 for shells logged in, to avoid this kind of confusion. >> I think rc.d should specify the routing domain explicitly when it >> executes the daemon program even if the daemon's rtable is configured >> 0 since the executed routing domain may not be 0. >> >> Exmaple: >> >> (run sshd on rtable 100) >> $ doas ifconfig lo100 rdomain 100 127.0.0.1/8 >> $ doas ln -s sshd /etc/rc.d/sshd100 >> $ doas rcctl enable sshd100 >> $ doas rcctl set sshd100 rtable 100 >> $ doas rcctl start sshd100 >> >> (ssh login from rdomain 100) >> $ route -T100 exec ssh 127.0.0.1 >> >> (logged in, default routing domain becomes 100) >> $ doas rcctl get ntpd rtable >> 0 >> $ doas rcctl restart ntpd >> ntpd(ok) >> ntpd(ok) >> >> $ doas /etc/rc.d/ntpd check >> ntpd(failed) >> $ ps ax -o 'pid comm rtable' | grep ntpd >> 26036 ntpd 100 >> 2924 ntpd 100 >> 78901 ntpd 100 >> $ >> >> "check" fails because /var/run/rc.d/ntpd rtable is 0, but it is >> actually running on 100. >> >> ok? >> >> Execute the daemon program on the configured routing table always even >> if its rtable is configured 0 and rc.d is executed on a routing domain >> other than 0. >> >> Index: etc/rc.d/rc.subr >> =================================================================== >> RCS file: /cvs/src/etc/rc.d/rc.subr,v >> retrieving revision 1.130 >> diff -u -p -r1.130 rc.subr >> --- etc/rc.d/rc.subr 20 Jan 2019 04:52:07 -0000 1.130 >> +++ etc/rc.d/rc.subr 20 Feb 2019 03:57:37 -0000 >> @@ -320,5 +320,4 @@ unset _rcflags _rcrtable _rcuser _rctime >> # make sure pexp matches the process (i.e. doesn't include the quotes) >> pexp="$(eval echo ${daemon}${daemon_flags:+ ${daemon_flags}})" >> rcexec="su -l -c ${daemon_class} -s /bin/sh ${daemon_user} -c" >> -[ "${daemon_rtable}" -eq 0 ] || >> - rcexec="route -T ${daemon_rtable} exec ${rcexec}" >> +rcexec="route -T ${daemon_rtable} exec ${rcexec}" >>