[PATCH] home: services: ssh: Allow unset boolean options in ssh-config.

Done

Details

3 participants

Andrew Tropin
Efraim Flashner
Ludovic Courtès

Owner: unassigned

Submitted by: Efraim Flashner

Severity: normal

Debbugs page

Efraim Flashner wrote 2 years ago

Recipients:(address . guix-patches@gnu.org)(name . Efraim Flashner)(address . efraim@flashner.co.il)

Message-ID:6f1959b0041895af538fec1b72a02d7767451767.1685371966.git.efraim@flashner.co.il

From man 5 ssh_config:
Unless noted otherwise, for each parameter, the first obtained value
will be used.

We want to allow falling through to the first actual user defined value.

* gnu/home/services.ssh.scm (define-maybe boolean): New configuration.
(openssh-host)[forward-x11?, forward-x11-trusted?, forward-agent?,
compression?]: Replace default value with maybe-boolean.
* doc/guix.texi (Secure Shell): Update documentation to match the
changes in the code.
---
 doc/guix.texi             | 10 +++++-----
 gnu/home/services/ssh.scm | 11 +++++++----
 2 files changed, 12 insertions(+), 9 deletions(-)

Toggle diff (88 lines)diff --git a/doc/guix.texi b/doc/guix.texi
index 31dc33fb97..d22924e522 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -33,7 +33,7 @@
 Copyright @copyright{} 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023 Ricardo Wurmus@*
 Copyright @copyright{} 2016 Ben Woodcroft@*
 Copyright @copyright{} 2016, 2017, 2018, 2021 Chris Marusich@*
-Copyright @copyright{} 2016, 2017, 2018, 2019, 2020, 2021, 2022 Efraim Flashner@*
+Copyright @copyright{} 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023 Efraim Flashner@*
 Copyright @copyright{} 2016 John Darrington@*
 Copyright @copyright{} 2016, 2017 Nikita Gillmann@*
 Copyright @copyright{} 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023 Jan Nieuwenhuizen@*
@@ -43017,19 +43017,19 @@ Secure Shell
 @item @code{user} (type: maybe-string)
 User name on the remote host.
 
-@item @code{forward-x11?} (default: @code{#f}) (type: boolean)
+@item @code{forward-x11?} (type: maybe-boolean)
 Whether to forward remote client connections to the local X11 graphical
 display.
 
-@item @code{forward-x11-trusted?} (default: @code{#f}) (type: boolean)
+@item @code{forward-x11-trusted?} (type: maybe-boolean)
 Whether remote X11 clients have full access to the original X11
 graphical display.
 
-@item @code{forward-agent?} (default: @code{#f}) (type: boolean)
+@item @code{forward-agent?} (type: maybe-boolean)
 Whether the authentication agent (if any) is forwarded to the remote
 machine.
 
-@item @code{compression?} (default: @code{#f}) (type: boolean)
+@item @code{compression?} (type: maybe-boolean)
 Whether to compress data in transit.
 
 @item @code{proxy} (type: maybe-proxy-command-or-jump-list)
diff --git a/gnu/home/services/ssh.scm b/gnu/home/services/ssh.scm
index 628dc743ae..0a4b37d84e 100644
--- a/gnu/home/services/ssh.scm
+++ b/gnu/home/services/ssh.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2022 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2023 Janneke Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2023 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -104,6 +105,8 @@ (define (serialize-natural-number field value)
   (string-append "  " (serialize-field-name field) " "
                  (number->string value) "\n"))
 
+(define-maybe boolean)
+
 (define (serialize-boolean field value)
   (string-append "  " (serialize-field-name field) " "
                  (if value "yes" "no") "\n"))
@@ -194,19 +197,19 @@ (define-configuration openssh-host
    maybe-string
    "User name on the remote host.")
   (forward-x11?
-   (boolean #f)
+   maybe-boolean
    "Whether to forward remote client connections to the local X11 graphical
 display.")
   (forward-x11-trusted?
-   (boolean #f)
+   maybe-boolean
    "Whether remote X11 clients have full access to the original X11 graphical
 display.")
   (forward-agent?
-   (boolean #f)
+   maybe-boolean
    "Whether the authentication agent (if any) is forwarded to the remote
 machine.")
   (compression?
-   (boolean #f)
+   maybe-boolean
    "Whether to compress data in transit.")
   (proxy-command
    maybe-string

base-commit: 7b400e7f8751e6b0cc6e66d3f7ecfb7f5bd51309
-- 
Efraim Flashner   <efraim@flashner.co.il>   רנשלפ םירפא
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

Ludovic Courtès wrote 2 years ago

Recipients:(name . Efraim Flashner)(address . efraim@flashner.co.il)(address . 63786@debbugs.gnu.org)

Message-ID:87ilbx1xku.fsf@gnu.org

Hello!

Efraim Flashner <efraim@flashner.co.il> skribis:

Toggle quote (6 lines)

>>From man 5 ssh_config:

> Unless noted otherwise, for each parameter, the first obtained value

> will be used.

> We want to allow falling through to the first actual user defined value.

What do you mean by “first actual user-defined value”? This service is

what generates all the “user-defined values”, no?

Overall my take is that default values should be specified in our code

(as default values of configuration record fields) rather than left

unspecified. I think this is clearer and more predictable than relying

on upstream’s default values.

Thanks,

Ludo’.

Efraim Flashner wrote 2 years ago

Re: bug#63786: [PATCH] home: services: ssh: Allow unset boolean

Recipients:(address . 63786@debbugs.gnu.org)

Message-ID:ZIV8pvv8U5ras1X2@3900XT

options in ssh-config.
Reply-To: 
X-PGP-Key-ID: 0x41AAE7DCCA3D8351
X-PGP-Key: https://flashner.co.il/~efraim/efraim_flashner.asc
X-PGP-Fingerprint: A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351

For some reason this didn't get sent to the bug.

-- 
Efraim Flashner   <efraim@flashner.co.il>   רנשלפ םירפא
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

Date: Fri, 9 Jun 2023 16:24:26 +0300
From: Efraim Flashner <efraim@flashner.co.il>
To: Ludovic =?utf-8?Q?Court=C3=A8s?= <ludo@gnu.org>
Subject: Re: bug#63786: [PATCH] home: services: ssh: Allow unset boolean
 options in ssh-config.
Message-ID: <ZIMoCIMm22unHsc4@3900XT>
References: <6f1959b0041895af538fec1b72a02d7767451767.1685371966.git.efraim@flashner.co.il>
 <87ilbx1xku.fsf@gnu.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="/+KKtAVMmHMtW/th"
Content-Disposition: inline
In-Reply-To: <87ilbx1xku.fsf@gnu.org>
X-PGP-Key-ID: 0x41AAE7DCCA3D8351
X-PGP-Key: https://flashner.co.il/~efraim/efraim_flashner.asc
X-PGP-Fingerprint: A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351


--/+KKtAVMmHMtW/th
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Jun 08, 2023 at 10:57:37PM +0200, Ludovic Court=C3=A8s wrote:

Toggle quote (11 lines)> Hello!
>=20
> Efraim Flashner <efraim@flashner.co.il> skribis:
>=20
> >>From man 5 ssh_config:
> > Unless noted otherwise, for each parameter, the first obtained value
> > will be used.
> >
> > We want to allow falling through to the first actual user defined value.
>=20
> What do you mean by =E2=80=9Cfirst actual user-defined value=E2=80=9D?  T=

his service is

Toggle quote (2 lines)

> what generates all the =E2=80=9Cuser-defined values=E2=80=9D, no?

Right now my ~/.ssh/config has

Host do1-tor
    Hostname <insert tor address>
    IdentityFile ~/.ssh/id_ed25519
Host *.onion *-tor
    #ProxyCommand /gnu/store/dgvybjrj154f4cyfbkrbqyirv5gd8ic2-netcat-openbs=
d-1.218-2/bin/nc -X 5 -x localhost:9050 %h %p
    ProxyCommand /home/efraim/bin/openbsd-netcat -X 5 -x localhost:9050 %h =
%p
    ControlPath ${XDG_RUNTIME_DIR}/%r@%k-%p
    Compression yes

The way the ssh config is read is that `ssh do1-tor` first matches
do1-tor and then also matches *-tor, so I can factor our ProxyCommand,
ControlPath and Compression for use with the other *-tor Hosts I have
listed.

This configuration could be
(openssh-host (name "do1-tor")
              (host-name <insert tor address>)
              (identity-file "~/.ssh/id_ed25519"))
(openssh-host (name "*-onion *-tor)
              (compression? #t)
              (proxy
               (proxy-command ...))
              (extra-content "  ControlPath ...\n"))

If this is all I enter, then my .ssh/config is generated like this:

Host do1-tor
  Hostname <insert tor address>
  IdentityFile ~/.ssh/id_ed25519
  ForwardX11 no
  ForwardX11Trusted no
  ForwardAgent no
  Compression no
Host *.onion *-tor
  ForwardX11 no
  ForwardX11Trusted no
  ForwardAgent no
  Compression yes
  ProxyCommand /home/efraim/bin/openbsd-netcat -X 5 -x localhost:9050 %h %p
  ControlPath ${XDG_RUNTIME_DIR}/%r@%k-%p

Compression might default to no, but in my hand crafted .ssh/config I've
set it to yes for *-tor Hosts. Forward* might all default to no, and
it's not set anywhere, but being explicit about the default here could
cause problems if I want X11 forwarding across an entire range of hosts,
not just individual ones.

Toggle quote (5 lines)

> Overall my take is that default values should be specified in our code

> (as default values of configuration record fields) rather than left

> unspecified. I think this is clearer and more predictable than relying

> on upstream=E2=80=99s default values.

In general this is a good plan, but here it actually interferes with the

expected configuration output. 'Fall through' is the default, not the

actual default for each of the individual configuration options. They

only get set if that field isn't set by any of the possibly multiple

configuration matches set it first.

--=20

Efraim Flashner <efraim@flashner.co.il> =D7=A8=D7=A0=D7=A9=D7=9C=D7=A4 =

=D7=9D=D7=99=D7=A8=D7=A4=D7=90

GPG key =3D A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351

Confidentiality cannot be guaranteed on emails sent or received unencrypted

--/+KKtAVMmHMtW/th

Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEoov0DD5VE3JmLRT3Qarn3Mo9g1EFAmSDKAQACgkQQarn3Mo9

g1GEVBAAshjlsAjh/+PR650tR4unLPpp7yCTbMmsiNjizrxNIFIRaMc1y7S/8Mcj

5iu0+b8p8Z+4sVWNdEemZLgZAUf6rafv2Ujlk9Ky1HCbWgTXVqe0KNCjDP9Q8t3D

Lu3y+jreMjuJ/PLvFXR0ZOLoqh8kzn5RdrHc25nc92ev1KDzUKH9jlCbanSDRx4x

vISV8euOFA+P2JZvhvs6hn/aF2gcZzuivTiAoGY5PgVOU52dbLebUAAe79fe1fJb

sRjH+tglhEvxqV8D8BWABbASp0VmV3LjV4yJg3dHWRcsqwRmmKxIqtbKjkYIAd5f

MTP6w858BCXLTx0Am5MpfadzSS4FIFOgq885Ze5PCGcEP0Ut9LnDd9jYHicW19MO

td7zvpQUUmiu70viWD/P2m0c+yWmg+S0AhmjArwnTG1yP4ua+mjmOmca8HqYjTiU

DsunVxyiXlffJOi/wstk//idsVPH8IV7CpJsxwUfDdwFZ5cnS3Tbb3Z9ILNhWc/d

olnndyctzU3avX2r7zWaC/ISbap9o90eXBS4tEfSGy/sL6pHwChBKr6i7jVX5xL/

p8YX8YmwvNiDXUHq9pYc+0KHTlNz6lsKY1jDNpH+5gxI1fjkXDw377YT8vXR8Vzl

R2ERChBH+gh5eF2OtvycAzO5vqRw7zy6yOshh1D+MeNGqddBx2g=

=luXe

-----END PGP SIGNATURE-----

--/+KKtAVMmHMtW/th--

Andrew Tropin wrote 2 years ago

Re: [bug#63786] [PATCH] home: services: ssh: Allow unset boolean

Recipients:

Message-ID:87r0qhmg45.fsf@trop.in

On 2023-06-11 10:49, Efraim Flashner wrote:

Toggle quote (91 lines)> options in ssh-config.
> Reply-To: 
> X-PGP-Key-ID: 0x41AAE7DCCA3D8351
> X-PGP-Key: https://flashner.co.il/~efraim/efraim_flashner.asc
> X-PGP-Fingerprint: A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
>
> For some reason this didn't get sent to the bug.
>
> -- 
> Efraim Flashner   <efraim@flashner.co.il>   רנשלפ םירפא
> GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
> Confidentiality cannot be guaranteed on emails sent or received unencrypted
> From: Efraim Flashner <efraim@flashner.co.il>
> Subject: Re: bug#63786: [PATCH] home: services: ssh: Allow unset boolean options in ssh-config.
> To: Ludovic Courtès <ludo@gnu.org>
> Date: Fri, 09 Jun 2023 16:24:26 +0300
>
> On Thu, Jun 08, 2023 at 10:57:37PM +0200, Ludovic Courtès wrote:
>> Hello!
>> 
>> Efraim Flashner <efraim@flashner.co.il> skribis:
>> 
>> >>From man 5 ssh_config:
>> > Unless noted otherwise, for each parameter, the first obtained value
>> > will be used.
>> >
>> > We want to allow falling through to the first actual user defined value.
>> 
>> What do you mean by “first actual user-defined value”?  This service is
>> what generates all the “user-defined values”, no?
>
> Right now my ~/.ssh/config has
>
> Host do1-tor
>     Hostname <insert tor address>
>     IdentityFile ~/.ssh/id_ed25519
> Host *.onion *-tor
>     #ProxyCommand /gnu/store/dgvybjrj154f4cyfbkrbqyirv5gd8ic2-netcat-openbsd-1.218-2/bin/nc -X 5 -x localhost:9050 %h %p
>     ProxyCommand /home/efraim/bin/openbsd-netcat -X 5 -x localhost:9050 %h %p
>     ControlPath ${XDG_RUNTIME_DIR}/%r@%k-%p
>     Compression yes
>
> The way the ssh config is read is that `ssh do1-tor` first matches
> do1-tor and then also matches *-tor, so I can factor our ProxyCommand,
> ControlPath and Compression for use with the other *-tor Hosts I have
> listed.
>
> This configuration could be
> (openssh-host (name "do1-tor")
>               (host-name <insert tor address>)
>               (identity-file "~/.ssh/id_ed25519"))
> (openssh-host (name "*-onion *-tor)
>               (compression? #t)
>               (proxy
>                (proxy-command ...))
>               (extra-content "  ControlPath ...\n"))
>
> If this is all I enter, then my .ssh/config is generated like this:
>
> Host do1-tor
>   Hostname <insert tor address>
>   IdentityFile ~/.ssh/id_ed25519
>   ForwardX11 no
>   ForwardX11Trusted no
>   ForwardAgent no
>   Compression no
> Host *.onion *-tor
>   ForwardX11 no
>   ForwardX11Trusted no
>   ForwardAgent no
>   Compression yes
>   ProxyCommand /home/efraim/bin/openbsd-netcat -X 5 -x localhost:9050 %h %p
>   ControlPath ${XDG_RUNTIME_DIR}/%r@%k-%p
>
> Compression might default to no, but in my hand crafted .ssh/config I've
> set it to yes for *-tor Hosts. Forward* might all default to no, and
> it's not set anywhere, but being explicit about the default here could
> cause problems if I want X11 forwarding across an entire range of hosts,
> not just individual ones.
>
>> Overall my take is that default values should be specified in our code
>> (as default values of configuration record fields) rather than left
>> unspecified.  I think this is clearer and more predictable than relying
>> on upstream’s default values.
>
> In general this is a good plan, but here it actually interferes with the
> expected configuration output. 'Fall through' is the default, not the
> actual default for each of the individual configuration options. They
> only get set if that field isn't set by any of the possibly multiple
> configuration matches set it first.

A few years ago, when we were implementing the first version of ssh home

service in rde we went a slightly different way and didn't hardcode any

record fields and let user set an alist of key/value pairs:

https://git.sr.ht/~abcdw/rde/tree/19c2d2f0996624eea8b7a87b14bbc31e4a9b943b/src/gnu/home-services/ssh.scm#L204

It's not a perfect solution either, but quite flexible. Also, it's

relatively easy to implement default values: we can provide

%default-host-options and ask people to do something like this on user

side configuration:

(merge %default-host-options '((compression . #f)))

Of course "asking people" won't work, so it's possible to set a default

value of options field to %default-host-options

https://git.sr.ht/~abcdw/rde/tree/19c2d2f0996624eea8b7a87b14bbc31e4a9b943b/src/gnu/home-services/ssh.scm#L100

and let people override it with '((compression . #f)) or enrich with

(merge %default-host-options '((compression . #f))).

It's not a proposal or something, just sharing how it's implemented in

rde.

P.S. Note that (gnu home-services *) modules are subject to deprecation

and when (rde home services ssh) appear, it will have a slightly

different interface.

Best regards,

Andrew Tropin

Efraim Flashner wrote 2 years ago

Recipients:(name . Andrew Tropin)(address . andrew@trop.in)(address . 63786-done@debbugs.gnu.org)

Message-ID:ZIoSH795GQcn9Llb@3900XT

On Mon, Jun 12, 2023 at 08:58:18AM +0400, Andrew Tropin wrote:

Toggle quote (22 lines)> 
> A few years ago, when we were implementing the first version of ssh home
> service in rde we went a slightly different way and didn't hardcode any
> record fields and let user set an alist of key/value pairs:
> https://git.sr.ht/~abcdw/rde/tree/19c2d2f0996624eea8b7a87b14bbc31e4a9b943b/src/gnu/home-services/ssh.scm#L204
> 
> It's not a perfect solution either, but quite flexible.  Also, it's
> relatively easy to implement default values: we can provide
> %default-host-options and ask people to do something like this on user
> side configuration:
> 
> (merge %default-host-options '((compression . #f)))
> 
> Of course "asking people" won't work, so it's possible to set a default
> value of options field to %default-host-options
> https://git.sr.ht/~abcdw/rde/tree/19c2d2f0996624eea8b7a87b14bbc31e4a9b943b/src/gnu/home-services/ssh.scm#L100
> and let people override it with '((compression . #f)) or enrich with
> (merge %default-host-options '((compression . #f))).
> 
> It's not a proposal or something, just sharing how it's implemented in
> rde.

I'm still undecided about the alist as a comparison. It would make it

easier to add arbitrary fields, but then I feel like maybe we should be

adding something to validate the configurations.

Toggle quote (5 lines)

> P.S. Note that (gnu home-services *) modules are subject to deprecation

> and when (rde home services ssh) appear, it will have a slightly

> different interface.

I went ahead and pushed the patch. I believe that, after having added to

a .ssh/config file over a period of time, line by line or entry by

entry, people will be surprised to see a bunch of fields filled in

automatically, and with different results from what they had before.

Efraim Flashner <efraim@flashner.co.il> רנשלפ םירפא

GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351

Confidentiality cannot be guaranteed on emails sent or received unencrypted

Closed

Your comment

This issue is archived.

To comment on this conversation send an email to 63786@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it

mumi current 63786

Then, you may apply the latest patchset in this issue (with sign off)

mumi am -- -s

Or, compose a reply to this issue

mumi compose

Or, send patches to this issue

mumi send-email *.patch

You may also tag this issue. See list of standard tags. For example, to set the confirmed and easy tags

mumi command -t +confirmed -t +easy

Or, remove the moreinfo tag and set the help tag

mumi command -t -moreinfo -t +help

is:open	open issues
is:done	closed issues
submitter:<who>	search issue submitter
author:<who>	search by message author
date:yesterday..now	search by issue date
mdate:3m..2d	search by message date