* Re: [gentoo-portage-dev] [PATCH v2] Support escaping network-sandbox through SOCKSv5 proxy
@ 2015-01-25 21:43 99% ` Zac Medico
0 siblings, 0 replies; 1+ results
From: Zac Medico @ 2015-01-25 21:43 UTC (permalink / raw
To: gentoo-portage-dev
On 01/25/2015 06:00 AM, Michał Górny wrote:
> diff --git a/bin/socks5-server.py b/bin/socks5-server.py
> new file mode 100644
> index 0000000..c079018
> --- /dev/null
> +++ b/bin/socks5-server.py
> @@ -0,0 +1,218 @@
> +#!/usr/bin/env python
> +# SOCKSv5 proxy server for network-sandbox
> +# Copyright 2015 Gentoo Foundation
> +# Distributed under the terms of the GNU General Public License v2
> +
> +import asyncore
> +import errno
> +import socket
> +import struct
> +import sys
> +
> +
> +class ProxyConnection(asyncore.dispatcher_with_send):
> + _addr = None
> + _connected = False
> + _family = socket.AF_INET
> + _proxy_conn = None
> +
> + def __init__(self, proxy_conn):
> + self._proxy_conn = proxy_conn
> + asyncore.dispatcher_with_send.__init__(self)
> + self.create_socket(self._family, socket.SOCK_STREAM)
> +
> + def start_connection(self, host, port):
> + try:
> + self.connect((host, port))
> + except:
> + self.handle_error()
This except handler should at least allow SystemExit and
KeyboardInterrupt to raise.
> diff --git a/pym/portage/package/ebuild/_config/special_env_vars.py b/pym/portage/package/ebuild/_config/special_env_vars.py
> index 6bb3c95..905d5e7 100644
> --- a/pym/portage/package/ebuild/_config/special_env_vars.py
> +++ b/pym/portage/package/ebuild/_config/special_env_vars.py
> @@ -71,7 +71,7 @@ environ_whitelist += [
> "PORTAGE_PYM_PATH", "PORTAGE_PYTHON",
> "PORTAGE_PYTHONPATH", "PORTAGE_QUIET",
> "PORTAGE_REPO_NAME", "PORTAGE_REPOSITORIES", "PORTAGE_RESTRICT",
> - "PORTAGE_SIGPIPE_STATUS",
> + "PORTAGE_SIGPIPE_STATUS", "PORTAGE_SOCKS5_PROXY",
> "PORTAGE_TMPDIR", "PORTAGE_UPDATE_ENV", "PORTAGE_USERNAME",
> "PORTAGE_VERBOSE", "PORTAGE_WORKDIR_MODE", "PORTAGE_XATTR_EXCLUDE",
> "PORTDIR", "PORTDIR_OVERLAY", "PREROOTPATH",
The DISTCC_SOCKS_PROXY variable should also be added to the whitelist.
Other than these 2 minor issues, the patch looks to me. I guess there's
no point in using portage's event loop instead of asyncore, since we
want the proxy to drop privileges, and therefore it can't run in the
main portage process.
--
Thanks,
Zac
^ permalink raw reply [relevance 99%]
Results 1-1 of 1 | reverse | options above
-- pct% links below jump to the message on this page, permalinks otherwise --
2015-01-25 14:00 [gentoo-portage-dev] [PATCH v2] Support escaping network-sandbox through SOCKSv5 proxy Michał Górny
2015-01-25 21:43 99% ` Zac Medico
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox