[gentoo-portage-dev] [PATCH v4] Support escaping network-sandbox through SOCKSv5 proxy

[Michał Górny]

Add a minimal SOCKSv5-over-UNIX-socket proxy to Portage, and start it
whenever ebuilds are started with network-sandbox enabled. Pass the
socket address in PORTAGE_SOCKS5_PROXY and DISTCC_SOCKS_PROXY variables.
The proxy can be used to escape the network sandbox whenever network
access is really desired, e.g. in distcc.

The proxy is based on asynchronous I/O using the asyncio module.
Therefore, it requires the asyncio module that is built-in in Python 3.4
and available stand-alone for Python 3.3. Escaping the sandbox is not
supported with older versions of Python.

The proxy supports connecting to IPv6 & IPv4 TCP hosts. UDP and socket
binding are not supported. SOCKSv5 authentication schemes are not
supported (UNIX sockets provide a security layer).
---
 bin/save-ebuild-env.sh                             |   5 +-
 bin/socks5-server.py                               | 190 +++++++++++++++++++++
 .../package/ebuild/_config/special_env_vars.py     |   2 +-
 pym/portage/package/ebuild/doebuild.py             |  11 ++
 pym/portage/util/socks5.py                         |  53 ++++++
 5 files changed, 258 insertions(+), 3 deletions(-)
 create mode 100644 bin/socks5-server.py
 create mode 100644 pym/portage/util/socks5.py

diff --git a/bin/save-ebuild-env.sh b/bin/save-ebuild-env.sh
index c6bffb5..477ed28 100644
--- a/bin/save-ebuild-env.sh
+++ b/bin/save-ebuild-env.sh
@@ -92,7 +92,7 @@ __save_ebuild_env() {
 
 	# portage config variables and variables set directly by portage
 	unset ACCEPT_LICENSE BAD BRACKET BUILD_PREFIX COLS \
-		DISTCC_DIR DISTDIR DOC_SYMLINKS_DIR \
+		DISTCC_DIR DISTCC_SOCKS5_PROXY DISTDIR DOC_SYMLINKS_DIR \
 		EBUILD_FORCE_TEST EBUILD_MASTER_PID \
 		ECLASS_DEPTH ENDCOL FAKEROOTKEY \
 		GOOD HILITE HOME \
@@ -105,7 +105,8 @@ __save_ebuild_env() {
 		PORTAGE_DOHTML_WARN_ON_SKIPPED_FILES \
 		PORTAGE_NONFATAL PORTAGE_QUIET \
 		PORTAGE_SANDBOX_DENY PORTAGE_SANDBOX_PREDICT \
-		PORTAGE_SANDBOX_READ PORTAGE_SANDBOX_WRITE PREROOTPATH \
+		PORTAGE_SANDBOX_READ PORTAGE_SANDBOX_WRITE \
+		PORTAGE_SOCKS5_PROXY PREROOTPATH \
 		QA_INTERCEPTORS \
 		RC_DEFAULT_INDENT RC_DOT_PATTERN RC_ENDCOL RC_INDENTATION  \
 		ROOT ROOTPATH RPMDIR TEMP TMP TMPDIR USE_EXPAND \
diff --git a/bin/socks5-server.py b/bin/socks5-server.py
new file mode 100644
index 0000000..6bd71e4
--- /dev/null
+++ b/bin/socks5-server.py
@@ -0,0 +1,190 @@
+#!/usr/bin/env python
+# SOCKSv5 proxy server for network-sandbox
+# Copyright 2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+import asyncio
+import errno
+import os
+import socket
+import struct
+import sys
+
+class Socks5Server(object):
+	@asyncio.coroutine
+	def handle_proxy_conn(self, reader, writer):
+		try:
+			# SOCKS hello
+			data = yield from reader.readexactly(2)
+			vers, method_no = struct.unpack('!BB', data)
+
+			if vers != 0x05:
+				writer.close()
+				return
+
+			# ...and auth method list
+			data = yield from reader.readexactly(method_no)
+			for method in data:
+				if method == 0x00:
+					break
+			else:
+				# no supported method
+				method = 0xFF
+
+			# auth reply
+			repl = struct.pack('!BB', 0x05, method)
+			writer.write(repl)
+			yield from writer.drain()
+			if method == 0xFF:
+				writer.close()
+				return
+
+			# request
+			data = yield from reader.readexactly(4)
+			vers, cmd, rsv, atyp = struct.unpack('!BBBB', data)
+
+			if vers != 0x05 or rsv != 0x00:
+				self.close()
+				return
+
+			rpl = 0x00
+			if cmd != 0x01: # CONNECT
+				rpl = 0x07 # command not supported
+			elif atyp == 0x01: # IPv4
+				data = yield from reader.readexactly(4)
+				addr = socket.inet_ntoa(data)
+			elif atyp == 0x03: # domain name
+				data = yield from reader.readexactly(1)
+				addr_len, = struct.unpack('!B', data)
+				addr = yield from reader.readexactly(addr_len)
+			elif atyp == 0x04: # IPv6
+				data = yield from reader.readexactly(16)
+				addr = socket.inet_ntop(socket.AF_INET6, data)
+			else:
+				rpl = 0x08 # address type not supported
+
+			repl_addr = None
+
+			# try to connect
+			if rpl == 0x00:
+				data = yield from reader.readexactly(2)
+				port, = struct.unpack('!H', data)
+
+				try:
+					# establish proxied connection
+					proxied_reader, proxied_writer = yield from asyncio.open_connection(
+							addr, port)
+				except (socket.gaierror, socket.herror):
+					rpl = 0x04 # host unreachable
+				except OSError as e:
+					if e.errno in (errno.ENETUNREACH, errno.ENETDOWN):
+						rpl = 0x03 # network unreachable
+					elif e.errno in (errno.EHOSTUNREACH, errno.EHOSTDOWN):
+						rpl = 0x04 # host unreachable
+					elif e.errno in (errno.ECONNREFUSED, errno.ETIMEDOUT):
+						rpl = 0x05 # connection refused
+					else:
+						raise
+				else:
+					sock = proxied_writer.get_extra_info('socket')
+					addr = sock.getsockname()
+					if sock.family == socket.AF_INET:
+						host, port = addr
+						bin_host = socket.inet_aton(host)
+
+						repl_addr = struct.pack('!B4sH',
+								0x01, bin_host, port)
+					elif sock.family == socket.AF_INET6:
+						# discard flowinfo, scope_id
+						host, port = addr[:2]
+						bin_host = socket.inet_pton(sock.family, host)
+
+						repl_addr = struct.pack('!B16sH',
+								0x04, bin_host, port)
+
+			if repl_addr is None:
+				# fallback to 0.0.0.0:0
+				repl_addr = struct.pack('!BLH', 0x01, 0x00000000, 0x0000)
+
+			# reply to the request
+			repl = struct.pack('!BBB', 0x05, rpl, 0x00)
+			writer.write(repl + repl_addr)
+			yield from writer.drain()
+
+			# close if an error occured
+			if rpl != 0x00:
+				writer.close()
+				return
+
+			# otherwise, start two loops:
+			# remote -> local...
+			t = asyncio.async(self.handle_proxied_conn(
+					proxied_reader, writer, asyncio.Task.current_task()))
+
+			# and local -> remote...
+			try:
+				try:
+					while True:
+						data = yield from reader.read(4096)
+						if data == b'':
+							t.cancel()
+							break
+						
+						proxied_writer.write(data)
+						yield from proxied_writer.drain()
+				except OSError:
+					t.cancel()
+				except:
+					t.cancel()
+					raise
+			finally:
+				proxied_writer.close()
+				writer.close()
+
+		except (OSError, asyncio.IncompleteReadError, asyncio.CancelledError):
+			writer.close()
+			return
+		except:
+			writer.close()
+			raise
+
+	@asyncio.coroutine
+	def handle_proxied_conn(self, proxied_reader, writer, parent_task):
+		try:
+			try:
+				while True:
+					data = yield from proxied_reader.read(4096)
+					if data == b'':
+						break
+
+					writer.write(data)
+					yield from writer.drain()
+			finally:
+				parent_task.cancel()
+		except (OSError, asyncio.CancelledError):
+			return
+
+
+if __name__ == '__main__':
+	if len(sys.argv) != 2:
+		print('Usage: %s <socket-path>' % sys.argv[0])
+		sys.exit(1)
+
+	loop = asyncio.get_event_loop()
+	s = Socks5Server()
+	server = loop.run_until_complete(
+		asyncio.start_unix_server(s.handle_proxy_conn, sys.argv[1], loop=loop))
+
+	ret = 0
+	try:
+		try:
+			loop.run_forever()
+		except KeyboardInterrupt:
+			pass
+		except:
+			ret = 1
+	finally:
+		server.close()
+		loop.run_until_complete(server.wait_closed())
+		loop.close()
+		os.unlink(sys.argv[1])
diff --git a/pym/portage/package/ebuild/_config/special_env_vars.py b/pym/portage/package/ebuild/_config/special_env_vars.py
index 6bb3c95..905d5e7 100644
--- a/pym/portage/package/ebuild/_config/special_env_vars.py
+++ b/pym/portage/package/ebuild/_config/special_env_vars.py
@@ -71,7 +71,7 @@ environ_whitelist += [
 	"PORTAGE_PYM_PATH", "PORTAGE_PYTHON",
 	"PORTAGE_PYTHONPATH", "PORTAGE_QUIET",
 	"PORTAGE_REPO_NAME", "PORTAGE_REPOSITORIES", "PORTAGE_RESTRICT",
-	"PORTAGE_SIGPIPE_STATUS",
+	"PORTAGE_SIGPIPE_STATUS", "PORTAGE_SOCKS5_PROXY",
 	"PORTAGE_TMPDIR", "PORTAGE_UPDATE_ENV", "PORTAGE_USERNAME",
 	"PORTAGE_VERBOSE", "PORTAGE_WORKDIR_MODE", "PORTAGE_XATTR_EXCLUDE",
 	"PORTDIR", "PORTDIR_OVERLAY", "PREROOTPATH",
diff --git a/pym/portage/package/ebuild/doebuild.py b/pym/portage/package/ebuild/doebuild.py
index 791b5c3..6329b62 100644
--- a/pym/portage/package/ebuild/doebuild.py
+++ b/pym/portage/package/ebuild/doebuild.py
@@ -68,6 +68,7 @@ from portage.util import apply_recursive_permissions, \
 	writemsg, writemsg_stdout, write_atomic
 from portage.util.cpuinfo import get_cpu_count
 from portage.util.lafilefixer import rewrite_lafile	
+from portage.util.socks5 import get_socks5_proxy
 from portage.versions import _pkgsplit
 from _emerge.BinpkgEnvExtractor import BinpkgEnvExtractor
 from _emerge.EbuildBuildDir import EbuildBuildDir
@@ -1487,6 +1488,16 @@ def spawn(mystring, mysettings, debug=False, free=False, droppriv=False,
 		keywords['unshare_net'] = not networked
 		keywords['unshare_ipc'] = not ipc
 
+		if not networked:
+			# Provide a SOCKS5-over-UNIX-socket proxy to escape sandbox
+			try:
+				proxy = get_socks5_proxy(mysettings)
+			except NotImplementedError:
+				pass
+			else:
+				mysettings['PORTAGE_SOCKS5_PROXY'] = proxy
+				mysettings['DISTCC_SOCKS_PROXY'] = proxy
+
 	# TODO: Enable fakeroot to be used together with droppriv.  The
 	# fake ownership/permissions will have to be converted to real
 	# permissions in the merge phase.
diff --git a/pym/portage/util/socks5.py b/pym/portage/util/socks5.py
new file mode 100644
index 0000000..286cccf
--- /dev/null
+++ b/pym/portage/util/socks5.py
@@ -0,0 +1,53 @@
+# SOCKSv5 proxy manager for network-sandbox
+# Copyright 2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+import os
+import signal
+
+from portage import _python_interpreter
+from portage.data import portage_gid, portage_uid, userpriv_groups
+from portage.process import atexit_register, spawn
+
+
+class ProxyManager(object):
+	socket_path = None
+	_pids = None
+
+	def start(self, settings):
+		try:
+			import asyncio
+		except ImportError:
+			raise NotImplementedError('SOCKSv5 proxy requires asyncio module')
+
+		self.socket_path = os.path.join(settings['PORTAGE_TMPDIR'],
+				'.portage.%d.net.sock' % os.getpid())
+		server_bin = os.path.join(settings['PORTAGE_BIN_PATH'], 'socks5-server.py')
+		self._pids = spawn([_python_interpreter, server_bin, self.socket_path],
+				returnpid=True, uid=portage_uid, gid=portage_gid,
+				groups=userpriv_groups, umask=0o077)
+
+		atexit_register(self.stop)
+
+	def stop(self):
+		self.socket_path = None
+
+		for p in self._pids:
+			os.kill(p, signal.SIGINT)
+			os.waitpid(p, 0)
+
+	def __bool__(self):
+		return self.socket_path is not None
+
+	def __nonzero__(self):
+		return self.__bool__()
+
+
+running_proxy = ProxyManager()
+
+
+def get_socks5_proxy(settings):
+	if not running_proxy:
+		running_proxy.start(settings)
+
+	return running_proxy.socket_path
-- 
2.2.2