{"thread":{"id":"31658","subject":"Discussion around a --bindtodev option for git-daemon","startedAt":"2012-09-26T16:36:37Z","lastAt":"2012-10-09T14:48:03Z","messageCount":2,"participants":["Ronan Bignaux","Jan Engelhardt"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"199955","messageId":"50632F15.1030908@scourge.biz","threadId":"31658","inReplyTo":null,"subject":"Discussion around a --bindtodev option for git-daemon","fromName":"Ronan Bignaux","fromEmail":"r.bignaux@scourge.biz","sentAt":"2012-09-26T16:36:37Z","receivedAt":"2012-09-26T16:36:37Z","isPatch":false,"sender":{"key":"r.bignaux@scourge.biz","avatar":null},"body":"I wrote this little patch to add a restrict option to bind only to a\nspecific network interface.\n\nI'd not deal with --inetd since there are some bugs in xinetd with ipv6\n( and no more maintener ) , systemd/upstart are also Linux centric and\nsubject to controversy...\n\n\"listen\" option was not more useful in my case because it need ip as\nparameter (you need fix ip or custom script for example).\n\nIt's not ready for inclusion but ready for discussion.\n\nPROS :\n* Do the job\n\nCONS :\n* Linux only\n* root only\n\nWhat do you think about such option/implementation ?\n-- \nRonan Bignaux\nEntrepreneur indépendant\nConsultant informatique\n\nScourGE SARL\n136 rue Branville\n14000 CAEN\n06.47.75.44.81\n\n\n\n>From bfebe7fc838f83065fea04cf27613fe89e962a3a Mon Sep 17 00:00:00 2001\nFrom: Bignaux Ronan \nDate: Thu, 20 Sep 2012 15:09:31 +0200\nSubject: [PATCH] add option to bind to a specific interface\n\n\nSigned-off-by: Bignaux Ronan \n---\n daemon.c | 21 ++++++++++++++++++++-\n 1 file changed, 20 insertions(+), 1 deletion(-)\n\ndiff --git a/daemon.c b/daemon.c\nindex 4602b46..755fbd3 100644\n--- a/daemon.c\n+++ b/daemon.c\n@@ -5,6 +5,10 @@\n #include \"strbuf.h\"\n #include \"string-list.h\"\n \n+#ifdef SO_BINDTODEVICE\n+#include \n+#endif\n+\n #ifndef HOST_NAME_MAX\n #define HOST_NAME_MAX 256\n #endif\n@@ -31,7 +35,7 @@ static const char daemon_usage[] =\n \" [--reuseaddr] [--pid-file=]\\n\"\n \" [--(enable|disable|allow-override|forbid-override)=]\\n\"\n \" [--access-hook=]\\n\"\n-\" [--inetd | [--listen=] [--port=]\\n\"\n+\" [--inetd | [--listen=] [--port=] [--bindtodev=]\\n\"\n \" [--detach] [--user= [--group=]]\\n\"\n \" [...]\";\n \n@@ -64,6 +68,7 @@ static char *hostname;\n static char *canon_hostname;\n static char *ip_address;\n static char *tcp_port;\n+static struct ifreq ifr;\n \n static void logreport(int priority, const char *err, va_list params)\n {\n@@ -875,6 +880,15 @@ static int setup_named_sock(char *listen_addr, int listen_port, struct socketlis\n \t\t\tcontinue;\n \t\t}\n \n+\t\tif (ifr.ifr_name) {\n+\t\t\tif (setsockopt(sockfd, SOL_SOCKET, SO_BINDTODEVICE, (void *) &ifr,\n+\t\t\t\t\tsizeof(ifr)) < 0) {\n+\t\t\t\tlogerror(\"Could not set SO_BINDTODEVICE: %s\", strerror(errno));\n+\t\t\t\tclose(sockfd);\n+\t\t\t\tcontinue;\n+\t\t\t}\n+\t\t}\n+\n #ifdef IPV6_V6ONLY\n \t\tif (ai->ai_family == AF_INET6) {\n \t\t\tint on = 1;\n@@ -1194,6 +1208,11 @@ int main(int argc, char **argv)\n \t\t\t\tcontinue;\n \t\t\t}\n \t\t}\n+\t\tif (!prefixcmp(arg, \"--bindtodev=\")) {\n+\t\t\tmemset(&ifr, 0, sizeof(ifr));\n+\t\t\tstrncpy (ifr.ifr_name, arg + 12 ,IFNAMSIZ);\n+\t\t\tcontinue;\n+\t\t}\n \t\tif (!strcmp(arg, \"--serve\")) {\n \t\t\tserve_mode = 1;\n \t\t\tcontinue;\n-- \n1.7.12\n\n\n\nbegin:vcard\nfn:Ronan Bignaux\nn:Bignaux;Ronan\norg:ScourGE SARL\nadr;dom:;;136 rue Branville ;CAEN ;;14000 \nemail;internet:r.bignaux@scourge.biz\ntitle;quoted-printable:Entrepreneur ind=C3=A9pendant ,Consultant informatique\ntel;cell:06.47.75.44.81\nversion:2.1\nend:vcard\n\n"},{"id":"200837","messageId":"alpine.LNX.2.01.1210091646430.7433@nerf07.vanv.qr","threadId":"31658","inReplyTo":"50632F15.1030908@scourge.biz","subject":"Re: Discussion around a --bindtodev option for git-daemon","fromName":"Jan Engelhardt","fromEmail":"jengelh@inai.de","sentAt":"2012-10-09T14:48:03Z","receivedAt":"2012-10-09T14:48:03Z","isPatch":false,"sender":{"key":"jengelh@inai.de","avatar":"https://avatars.githubusercontent.com/u/8861948?v=4"},"body":"On Wednesday 2012-09-26 18:36, Ronan Bignaux wrote:\n\n>I wrote this little patch to add a restrict option to bind only to a\n>specific network interface.\n>\n>I'd not deal with --inetd since there are some bugs in xinetd with ipv6\n>( and no more maintener ) , systemd/upstart are also Linux centric and\n>subject to controversy...\n>\n>\"listen\" option was not more useful in my case because it need ip as\n>parameter (you need fix ip or custom script for example).\n\nThere is a reason --listen wants an address: because bind(2) binds to \naddresses, and in principle, that is really what is wanted, since you \nwant to continue being able to connect to your service from-to \nlocalhost.\n"}]}