It is now possible to disable network interface probing in sudo.conf

by changing the value of the probe_interfaces setting.

diff --git a/NEWS b/NEWS
index 6c3ea8006273091678fdf1885c0e8cbb2e121259..c2efbca25b7743c3c9e18b2547461314e3a608d9 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,9 @@
+What's new in Sudo 1.8.10?
+
+ * It is now possible to disable network interface probing in
+   sudo.conf by changing the value of the probe_interfaces
+   setting.
+
 What's new in Sudo 1.8.9p4?
 
  * Fixed a bug where sudo could consume large amounts of CPU while

diff --git a/common/sudo_conf.c b/common/sudo_conf.c
index 0704a7b1dd8c592c9de3e24386cc6f98cd103924..d45ac1957b58eb1dc22393774fc2fb191267e734 100644 (file)
--- a/common/sudo_conf.c
+++ b/common/sudo_conf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2009-2013 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 2009-2014 Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -86,6 +86,7 @@ static void set_variable(const char *entry, const char *conf_file);
 static void set_var_disable_coredump(const char *entry, const char *conf_file);
 static void set_var_group_source(const char *entry, const char *conf_file);
 static void set_var_max_groups(const char *entry, const char *conf_file);
+static void set_var_probe_interfaces(const char *entry, const char *conf_file);
 
 static unsigned int conf_lineno;
 
@@ -101,17 +102,20 @@ static struct sudo_conf_table sudo_conf_table_vars[] = {
     { "disable_coredump", sizeof("disable_coredump") - 1, set_var_disable_coredump },
     { "group_source", sizeof("group_source") - 1, set_var_group_source },
     { "max_groups", sizeof("max_groups") - 1, set_var_max_groups },
+    { "probe_interfaces", sizeof("probe_interfaces") - 1, set_var_probe_interfaces },
     { NULL }
 };
 
 static struct sudo_conf_data {
     bool disable_coredump;
+    bool probe_interfaces;
     int group_source;
     int max_groups;
     const char *debug_flags;
     struct plugin_info_list plugins;
     struct sudo_conf_paths paths[5];
 } sudo_conf_data = {
+    true,
     true,
     GROUP_SOURCE_ADAPTIVE,
     -1,
@@ -192,6 +196,15 @@ set_var_max_groups(const char *entry, const char *conf_file)
     }
 }
 
+static void
+set_var_probe_interfaces(const char *entry, const char *conf_file)
+{
+    int val = atobool(entry);
+
+    if (val != -1)
+       sudo_conf_data.probe_interfaces = val;
+}
+
 /*
  * "Debug progname debug_file debug_flags"
  */
@@ -362,6 +375,12 @@ sudo_conf_disable_coredump(void)
     return sudo_conf_data.disable_coredump;
 }
 
+bool
+sudo_conf_probe_interfaces(void)
+{
+    return sudo_conf_data.probe_interfaces;
+}
+
 /*
  * Reads in /etc/sudo.conf and populates sudo_conf_data.
  */

diff --git a/doc/sudo.conf.cat b/doc/sudo.conf.cat
index 525b09f05557711d21f0ffbcc2e6aa13b0ece90c..dbd820f529e7cd63987058bc8a8ea566a111735d 100644 (file)
--- a/doc/sudo.conf.cat
+++ b/doc/sudo.conf.cat
@@ -204,6 +204,21 @@ D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
                This setting is only available in s\bsu\bud\bdo\bo version 1.8.7 and
                higher.
 
+     probe_interfaces
+               By default, s\bsu\bud\bdo\bo will probe the system's network interfaces and
+               pass the IP address of each enabled interface to the policy
+               plugin.  This makes it possible for the plugin to match rules
+               based on the IP address without having to query DNS.  On Linux
+               systems with a large number of virtual interfaces, this may
+               take a non-negligible amount of time.  If IP-based matching is
+               not required, network interface probing can be disabled as
+               follows:
+
+                     Set probe_interfaces false
+
+               This setting is only available in s\bsu\bud\bdo\bo version 1.8.10 and
+               higher.
+
    D\bDe\beb\bbu\bug\bg f\bfl\bla\bag\bgs\bs
      s\bsu\bud\bdo\bo versions 1.8.4 and higher support a flexible debugging framework
      that can help track down what s\bsu\bud\bdo\bo is doing internally if there is a
@@ -376,4 +391,4 @@ D\bDI\bIS\bSC\bCL\bLA\bAI\bIM\bME\bER\bR
      file distributed with s\bsu\bud\bdo\bo or http://www.sudo.ws/sudo/license.html for
      complete details.
 
-Sudo 1.8.9                     December 4, 2013                     Sudo 1.8.9
+Sudo 1.8.9                     January 22, 2014                     Sudo 1.8.9

diff --git a/doc/sudo.conf.man.in b/doc/sudo.conf.man.in
index 5721df48caad94d17713b3c7763f16c5801b0201..f08d2e751138c685856899176268f8a8411540e7 100644 (file)
--- a/doc/sudo.conf.man.in
+++ b/doc/sudo.conf.man.in
@@ -1,7 +1,7 @@
 .\" DO NOT EDIT THIS FILE, IT IS NOT THE MASTER!
 .\" IT IS GENERATED AUTOMATICALLY FROM sudo.conf.mdoc.in
 .\"
-.\" Copyright (c) 2010-2013 Todd C. Miller <Todd.Miller@courtesan.com>
+.\" Copyright (c) 2010-2014 Todd C. Miller <Todd.Miller@courtesan.com>
 .\"
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.TH "SUDO" "5" "December 4, 2013" "Sudo @PACKAGE_VERSION@" "OpenBSD Programmer's Manual"
+.TH "SUDO" "5" "January 22, 2014" "Sudo @PACKAGE_VERSION@" "OpenBSD Programmer's Manual"
 .nh
 .if n .ad l
 .SH "NAME"
@@ -405,6 +405,29 @@ This setting is only available in
 \fBsudo\fR
 version 1.8.7 and higher.
 .PD
+.TP 10n
+probe_interfaces
+By default,
+\fBsudo\fR
+will probe the system's network interfaces and pass the IP address
+of each enabled interface to the policy plugin.  This makes it
+possible for the plugin to match rules based on the IP address
+without having to query DNS.  On Linux systems with a large number
+of virtual interfaces, this may take a non-negligible amount of time.
+If IP-based matching is not required, network interface probing
+can be disabled as follows:
+.RS
+.nf
+.sp
+.RS 6n
+Set probe_interfaces false
+.RE
+.fi
+.sp
+This setting is only available in
+\fBsudo\fR
+version 1.8.10 and higher.
+.RE
 .SS "Debug flags"
 \fBsudo\fR
 versions 1.8.4 and higher support a flexible debugging framework

diff --git a/doc/sudo.conf.mdoc.in b/doc/sudo.conf.mdoc.in
index b4eeab6dff4603398cb4ba3aaafd2714c3f26775..d192995f2b5daf6db5f39c4376df6adac62eb00c 100644 (file)
--- a/doc/sudo.conf.mdoc.in
+++ b/doc/sudo.conf.mdoc.in
@@ -1,5 +1,5 @@
 .\"
-.\" Copyright (c) 2010-2013 Todd C. Miller <Todd.Miller@courtesan.com>
+.\" Copyright (c) 2010-2014 Todd C. Miller <Todd.Miller@courtesan.com>
 .\"
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd December 4, 2013
+.Dd January 22, 2014
 .Dt SUDO @mansectform@
 .Os Sudo @PACKAGE_VERSION@
 .Sh NAME
@@ -360,6 +360,23 @@ do not indicate an error when there is a lack of space.
 This setting is only available in
 .Nm sudo
 version 1.8.7 and higher.
+.It probe_interfaces
+By default,
+.Nm sudo
+will probe the system's network interfaces and pass the IP address
+of each enabled interface to the policy plugin.  This makes it
+possible for the plugin to match rules based on the IP address
+without having to query DNS.  On Linux systems with a large number
+of virtual interfaces, this may take a non-negligible amount of time.
+If IP-based matching is not required, network interface probing
+can be disabled as follows:
+.Bd -literal -offset indent
+Set probe_interfaces false
+.Ed
+.Pp
+This setting is only available in
+.Nm sudo
+version 1.8.10 and higher.
 .El
 .Ss Debug flags
 .Nm sudo

diff --git a/include/sudo_conf.h b/include/sudo_conf.h
index 27a096d065b6f7e4a2f2513ba10f72ca4e93f1d7..6350e9c76cfeeea6ab8ac8e6427700c4ed2a4e56 100644 (file)
--- a/include/sudo_conf.h
+++ b/include/sudo_conf.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 2011-2014 Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -43,6 +43,7 @@ const char *sudo_conf_plugin_dir_path(void);
 const char *sudo_conf_debug_flags(void);
 struct plugin_info_list *sudo_conf_plugins(void);
 bool sudo_conf_disable_coredump(void);
+bool sudo_conf_probe_interfaces(void);
 int sudo_conf_group_source(void);
 int sudo_conf_max_groups(void);
 

diff --git a/src/net_ifs.c b/src/net_ifs.c
index 69b20eb01475cd591e1d16f5ffebc2fe02ad7b9e..ced77a9325d96bc5cf72b241e5809f08e5a6c82d 100644 (file)
--- a/src/net_ifs.c
+++ b/src/net_ifs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 1998-2005, 2007-2013
+ * Copyright (c) 1996, 1998-2005, 2007-2014
  *     Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -55,6 +55,11 @@ struct rtentry;
 #ifdef HAVE_STRINGS_H
 # include <strings.h>
 #endif /* HAVE_STRINGS_H */
+#ifdef HAVE_STDBOOL_H
+# include <stdbool.h>
+#else
+# include "compat/stdbool.h"
+#endif /* HAVE_STDBOOL_H */
 #ifdef HAVE_UNISTD_H
 # include <unistd.h>
 #endif /* HAVE_UNISTD_H */
@@ -82,6 +87,7 @@ struct rtentry;
 #include "missing.h"
 #include "alloc.h"
 #include "fatal.h"
+#include "sudo_conf.h"
 #include "sudo_debug.h"
 
 #define DEFAULT_TEXT_DOMAIN    "sudo"
@@ -115,7 +121,7 @@ get_net_ifs(char **addrinfo)
     char *cp;
     debug_decl(get_net_ifs, SUDO_DEBUG_NETIF)
 
-    if (getifaddrs(&ifaddrs))
+    if (!sudo_conf_probe_interfaces() || getifaddrs(&ifaddrs) != 0)
        debug_return_int(0);
 
     /* Allocate space for the interfaces info string. */
@@ -221,6 +227,9 @@ get_net_ifs(char **addrinfo)
 #endif /* _ISC */
     debug_decl(get_net_ifs, SUDO_DEBUG_NETIF)
 
+    if (!sudo_conf_probe_interfaces())
+       debug_return_int(0);
+
     sock = socket(AF_INET, SOCK_DGRAM, 0);
     if (sock < 0)
        fatal(U_("unable to open socket"));