October 2013 - tor-commits - lists.torproject.org

[tlsdate/debian-master] Add note about new DragonFly BSD build support; tests pass - users needed for real testing
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 72940d794bf118fe60618c5cd75a45a8bf2d3e3e Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Thu Apr 18 20:46:34 2013 -0700 Add note about new DragonFly BSD build support; tests pass - users needed for real testing --- CHANGELOG | 1 + INSTALL | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG b/CHANGELOG index f35aefe..fbe7a83 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -14,6 +14,7 @@ and Arch GNU/Linux distros. Add Mac OS X 10.8.3 support Extensive setup/install documentation is now present in INSTALL for most OSes + Add DragonFly BSD 3.3 support 0.0.6 Mon 18 Feb, 2013 Ensure that tlsdate compiles with g++ by explicit casting rather than implicit casting by whatever compiler is compiling tlsdate. diff --git a/INSTALL b/INSTALL index 5ac7418..2b01a65 100644 --- a/INSTALL +++ b/INSTALL @@ -14,6 +14,7 @@ tlsdate should build and work on the following Operating Systems: NetBSD 6.0.1 OpenBSD 5.2 Gentoo 20130413 + DragonFly BSD 3.3-DEVELOPMENT Please file a bug or email the tlsdate team if you have successfully built or use tlsdate on a platform that is not listed. We are specifically looking for @@ -22,7 +23,6 @@ ports of tlsdate or for tlsdate integration on the following Operating Systems: Win32 (MinGW or otherwise) OpenWRT pfsense - DragonFly BSD OpenVMS Currently porting is in progress or partially documented for:

1 0

[tlsdate/debian-master] Add another obscure platform
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 6512bffb2657d6ba6722d19408514a9864af2655 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Thu Apr 18 23:06:04 2013 -0700 Add another obscure platform --- INSTALL | 1 + 1 file changed, 1 insertion(+) diff --git a/INSTALL b/INSTALL index 8a13454..f16e132 100644 --- a/INSTALL +++ b/INSTALL @@ -24,6 +24,7 @@ ports of tlsdate or for tlsdate integration on the following Operating Systems: OpenWRT pfsense OpenVMS + Irix Any of the classic unix systems Currently porting is in progress or partially documented for:

1 0

[tlsdate/debian-master] Add note about GNU/Hurd desired support
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 578869a0e15b82a5f3d4f1a85cd3ffe8cde32e41 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Thu Apr 18 23:38:53 2013 -0700 Add note about GNU/Hurd desired support --- INSTALL | 1 + 1 file changed, 1 insertion(+) diff --git a/INSTALL b/INSTALL index f16e132..d4a78a7 100644 --- a/INSTALL +++ b/INSTALL @@ -25,6 +25,7 @@ ports of tlsdate or for tlsdate integration on the following Operating Systems: pfsense OpenVMS Irix + GNU/Hurd Any of the classic unix systems Currently porting is in progress or partially documented for:

1 0

[tlsdate/debian-master] Add first draft of notes on how we harden and how we plan to evolve
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit b53ea90001a5a89c6839bdf220e857a3e936ef73 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Thu Apr 18 23:41:35 2013 -0700 Add first draft of notes on how we harden and how we plan to evolve --- HARDENING | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) diff --git a/HARDENING b/HARDENING new file mode 100644 index 0000000..479b355 --- /dev/null +++ b/HARDENING @@ -0,0 +1,59 @@ +Platforms offer varying security features; we'd like to support the best. + +This is a document that notes which security hardening we have implemented and +which things we'd like to see implemented for various platforms. We +specifically address exploitation mitigation and containment; security issues +such as x509 certification validation are not addressed here. Patches, +suggestions and improvements are welcome! We always want the strongest set of +options by default on each supported platform. + +On all platforms we attempt to support available compiler hardening and linking +options. Please do not disable these options. Additional compiler and linker +hardening options are welcome and the current options are implemented in the +following file: + + configure.ac + +On all platforms, we attempt to switch from the administrative user to an +unimportant role account which shares data with no other processes. If we start +as any user other than an administrative user, we will likely be unable to +switch to our normal unprivileged account. These users are defined at +`configure` time. + +In addition to the above hardening options, we have tried to extend our +hardening when the platform supports it. Each additional security measure that +we take is documented as well as planned or desired improvements. + +We do not currently support or set ulimits, we should do so where possible. + +On Debian Gnu/Linux platforms, we ship with a minimal AppArmor profile, see +the policy for details: + + apparmor-profile + +We'd like to have an SELinux policy specifically for tlsdate. +We'd like to support capability dropping with libcap or libcap-ng. +We'd like to support libseccomp2 filters. +Other kernel hardening suggestions are welcome. + +On ChromeOS we use minijail and seccomp filters, see the following policies for +details: + + tlsdate-seccomp-amd64.policy + tlsdate-seccomp-arm.policy + tlsdate-seccomp-x86.policy + +These are enabled by default in ChromeOS. + +On FreeBSD, we'd like to support jails, chroot, and Capsicum. + +On OpenBSD, we'd like to support chroot and systrace. + +On NetBSD and DragonFly BSD, we'd like to chroot. + +On Mac OS X, we'd like to support chroot and seatbelt. + +On Plan9, we'd like to chroot. + +On other platforms, we'll try to run correctly with the understanding that any +bug is likely a much more serious problem.

1 0

[tlsdate/debian-master] I do not actually support jails but political language is complicated by technical details
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit d2f78d72373fe720d4c4c0033837e540098d0c46 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Thu Apr 18 23:50:58 2013 -0700 I do not actually support jails but political language is complicated by technical details --- HARDENING | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/HARDENING b/HARDENING index 479b355..7d623e7 100644 --- a/HARDENING +++ b/HARDENING @@ -49,7 +49,9 @@ On FreeBSD, we'd like to support jails, chroot, and Capsicum. On OpenBSD, we'd like to support chroot and systrace. -On NetBSD and DragonFly BSD, we'd like to chroot. +On NetBSD, we'd like to chroot. + +On DragonFly BSD, we'd like to support chroot and jails. On Mac OS X, we'd like to support chroot and seatbelt.

1 0

[tlsdate/debian-master] Add note on hardening
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 1f379d4ccac0cb0928941c83180d78ff9c72867f Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Fri Apr 19 14:48:09 2013 -0700 Add note on hardening --- HARDENING | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/HARDENING b/HARDENING index 7d623e7..67b762c 100644 --- a/HARDENING +++ b/HARDENING @@ -3,10 +3,22 @@ Platforms offer varying security features; we'd like to support the best. This is a document that notes which security hardening we have implemented and which things we'd like to see implemented for various platforms. We specifically address exploitation mitigation and containment; security issues -such as x509 certification validation are not addressed here. Patches, +such as x509 certification validation are not addressed here, yet. Patches, suggestions and improvements are welcome! We always want the strongest set of options by default on each supported platform. +We attempt to use the C programming language correctly and in a standard way. +We do however use some compiler specific options such as defining integer +wrapping because we believe the practical benefit outweights the implied risks. +As such, we prefer to be explicit rather than implicit in our casting or other +possible ambiguity. + +We should treat all compiler and linker warnings as fatal errors. Currently, +consider autotools warnings to be an exception as we would like to support +platforms imperfectly rather than not at all. We generally wish to support +autotools bootstrapping on all of our supported platforms. This is not possible +on Plan 9. Currently autotools will complain on the BSD systems. + On all platforms we attempt to support available compiler hardening and linking options. Please do not disable these options. Additional compiler and linker hardening options are welcome and the current options are implemented in the @@ -18,7 +30,8 @@ On all platforms, we attempt to switch from the administrative user to an unimportant role account which shares data with no other processes. If we start as any user other than an administrative user, we will likely be unable to switch to our normal unprivileged account. These users are defined at -`configure` time. +`configure` time. It is most effective if such a user is not the traditional +'nobody' or group 'nogroup' as is often the tradition. In addition to the above hardening options, we have tried to extend our hardening when the platform supports it. Each additional security measure that

1 0

[tlsdate/debian-master] move note to INSTALL
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 6d57ace95ba4a9e3cf8d3a575853dae1c0525687 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Fri Apr 19 17:55:00 2013 -0700 move note to INSTALL --- INSTALL | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/INSTALL b/INSTALL index d4a78a7..5f34cd4 100644 --- a/INSTALL +++ b/INSTALL @@ -47,6 +47,12 @@ On Debian Gnu/Linux sid/unstable: apt-get install tlsdate +On Debian GNU/Linux and related systems, we provide an init.d script that +controls the tlsdated daemon. It will notice network changes and regularly +invoke tlsdate to keep the clock in sync. Start it like so: + + /etc/init.d/tlsdate start + On ChromeOS: tlsdate is part of the ChromeOS TCB; no install needed

1 0

[tlsdate/debian-master] Lets integrate an image that shows build status
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit be0d8e4042e96ec0e5a1dd851ecdc9c7e58c0acf Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Fri Apr 19 17:42:17 2013 -0700 Lets integrate an image that shows build status --- HACKING | 104 --------------------------------------------------------- HACKING.md | 108 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 108 insertions(+), 104 deletions(-) diff --git a/HACKING b/HACKING deleted file mode 100644 index b11ce31..0000000 --- a/HACKING +++ /dev/null @@ -1,104 +0,0 @@ -Please feel free to contribute patches; here are the basic guidelines to hack -along with us! - -Please work from a git tree by cloning the repo: - - git clone https://github.com/ioerror/tlsdate.git - -Please file bugs on the tlsdate issue tracker: - - https://github.com/ioerror/tlsdate/issues - -Please use the github pull request feature when possible. - -Continuous integration is available for a number of platforms: - - https://jenkins.torproject.org/job/tlsdate-ci-linux/ - https://travis-ci.org/ioerror/tlsdate - http://build.chromium.org/p/chromiumos/waterfall - -White Space: - - Spaces only, no tabs; all tabs must die - No stray spaces at the end of lines - Generally try not to add excessive empty white space - -Documentation: - - Document all functions with doxygen style comments - -Ensuring Correctness: - - Test your patches and ensure: - - No compiler warnings or errors - No linker warnings or errors - - Test your improved copy of tlsdate extensively - -Security: - - tlsdate is security sensitive - please consider where you add code and in - what context it will run. When possible, run with the least privilege as is - possible. - -Proactively find bugs: - - Run your copy of tlsdate under valgrind - -Weird but meaningful conventions are prefered in tlsdate. We prefer attention -to detail: - - if ( NULL == foo (void) ) - { - bar (void); - } - -Over quick, hard to read and potentilly incorrect: - - if (foo(void)==NULL)) - bar(); - -Define magic numbers and explain their origin: - - // As taken from RFC 3.14 - #define MAGIC_NUMBER 23 // This goes in foo.h - ptr = malloc (MAGIC_NUMBER); - -Rather than just throwing them about in code: - - ptr = malloc (23); - -It is almost always prefered to use dynamically allocated memory: - - widget_ptr = malloc (WIDGET_SIZE); - -Try to avoid static allocations like the following: - - char widget[WIDGET_SIZE]; - -Try to use unsigned values unless an API requires signed values: - - uint32_t server_time_s; - -Please provide relevant CHANGELOG entries for all changes. -Please remove items from the TODO file as they are completed. -Please provide unittest cases. - -When submitting patches via email, please use `git format-patch` to format -patches: - - git format-patch 9a61fcba9bebc3fa2d91c9f79306bf316c59cbcc - -Email patches with a GnuPG signature whenever possible. - -When applying patches, please use `git am` to apply patches: - - git am -i 0001-add-TODO-item.patch - -If `git format-patch` is not possible, please send a unified diff. - -When in doubt, please consult the Tor HACKING guide: - - https://gitweb.torproject.org/tor.git/blob/HEAD:/doc/HACKING - diff --git a/HACKING.md b/HACKING.md new file mode 100644 index 0000000..b069e07 --- /dev/null +++ b/HACKING.md @@ -0,0 +1,108 @@ +Please feel free to contribute patches; here are the basic guidelines to hack +along with us! + +Please work from a git tree by cloning the repo: + + git clone https://github.com/ioerror/tlsdate.git + +Please file bugs on the tlsdate issue tracker: + + https://github.com/ioerror/tlsdate/issues + +Please use the github pull request feature when possible. + +The current build status is available as a handy image: + +[![Build Status](https://secure.travis-ci.org/ioerror/tlsdate.png?branch=master)](ht… + +Continuous integration is available for a number of platforms: + + https://jenkins.torproject.org/job/tlsdate-ci-linux/ + https://travis-ci.org/ioerror/tlsdate + http://build.chromium.org/p/chromiumos/waterfall + +White Space: + + Spaces only, no tabs; all tabs must die + No stray spaces at the end of lines + Generally try not to add excessive empty white space + +Documentation: + + Document all functions with doxygen style comments + +Ensuring Correctness: + + Test your patches and ensure: + + No compiler warnings or errors + No linker warnings or errors + + Test your improved copy of tlsdate extensively + +Security: + + tlsdate is security sensitive - please consider where you add code and in + what context it will run. When possible, run with the least privilege as is + possible. + +Proactively find bugs: + + Run your copy of tlsdate under valgrind + +Weird but meaningful conventions are prefered in tlsdate. We prefer attention +to detail: + + if ( NULL == foo (void) ) + { + bar (void); + } + +Over quick, hard to read and potentilly incorrect: + + if (foo(void)==NULL)) + bar(); + +Define magic numbers and explain their origin: + + // As taken from RFC 3.14 + #define MAGIC_NUMBER 23 // This goes in foo.h + ptr = malloc (MAGIC_NUMBER); + +Rather than just throwing them about in code: + + ptr = malloc (23); + +It is almost always prefered to use dynamically allocated memory: + + widget_ptr = malloc (WIDGET_SIZE); + +Try to avoid static allocations like the following: + + char widget[WIDGET_SIZE]; + +Try to use unsigned values unless an API requires signed values: + + uint32_t server_time_s; + +Please provide relevant CHANGELOG entries for all changes. +Please remove items from the TODO file as they are completed. +Please provide unittest cases. + +When submitting patches via email, please use `git format-patch` to format +patches: + + git format-patch 9a61fcba9bebc3fa2d91c9f79306bf316c59cbcc + +Email patches with a GnuPG signature whenever possible. + +When applying patches, please use `git am` to apply patches: + + git am -i 0001-add-TODO-item.patch + +If `git format-patch` is not possible, please send a unified diff. + +When in doubt, please consult the Tor HACKING guide: + + https://gitweb.torproject.org/tor.git/blob/HEAD:/doc/HACKING +

1 0

[tlsdate/debian-master] Add libtool to .travis.yml
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit c68c5dc9365665ffd14463cae5f424e1c99cb885 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Fri Apr 19 10:24:51 2013 -0700 Add libtool to .travis.yml --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index fd9d2fa..57e3045 100644 --- a/.travis.yml +++ b/.travis.yml @@ -8,5 +8,5 @@ branches: - master before_install: - sudo apt-get update -qq - - sudo apt-get install -qq autotools-dev dh-apparmor hardening-wrapper libssl-dev autoconf automake pkg-config + - sudo apt-get install -qq autotools-dev dh-apparmor hardening-wrapper libssl-dev autoconf automake pkg-config libtool script: ./configure && make && make test

1 0

[tlsdate/debian-master] Paul Wouters suggests tlsdated.1 belongs in .8
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit f7a1d56b9a4b985306306e9ac47cf5687372984d Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Sat Apr 20 22:21:15 2013 -0700 Paul Wouters suggests tlsdated.1 belongs in .8 --- man/tlsdated.1 | 70 -------------------------------------------------------- man/tlsdated.8 | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 70 insertions(+), 70 deletions(-) diff --git a/man/tlsdated.1 b/man/tlsdated.1 deleted file mode 100644 index b40bfc6..0000000 --- a/man/tlsdated.1 +++ /dev/null @@ -1,70 +0,0 @@ -.\" Process this file with -.\" groff -man -Tascii foo.1 -.\" -.TH TLSDATED 1 "OCTOBER 2012" Linux "User Manuals" -.SH NAME -tlsdated \- secure parasitic rdate replacement daemon -.SH SYNOPSIS -.B tlsdated [\-wprlsvh] \ -[\-t <n>] \ -[\-d <n>] \ -[\-T <n>] \ -[\-D <n>] \ -[\-c /path/to ] \ -[\-a seconds ] \ -[\-\-] \ -[commands to be passed to tlsdate] -.SH DESCRIPTION -.B tlsdated -is a daemon that runs tlsdate. It must be run as root or otherwise have the -proper caps; it will not be able to set the system time without running as root -or another privileged user. -.SH OPTIONS -.IP "\-w" -don't set hwclock -.IP "\-p" -dry run (don't really set time) -.IP "\-r" -use stdin instead of netlink for routes -.IP "\-t [n]" -try [n] times when a new route appears -.IP "\-d [n]" -delay n seconds between tries -.IP "\-T [n]" -give subprocess n chances to exit -.IP "\-D [n]" -delay n seconds between wait attempts -.IP "\-c [/path/to/cache/directory/]" -set the cache directory -.IP "\-a [n]" -run at most every n seconds in steady state -.IP "\-l" -don't load disk timestamps -.IP "\-s" -don't save disk timestamp -.IP "\-j [n]" -add up to n seconds of jitter to steady-state fetches -.IP "\-v" -be verbose -.IP "\-h" -print help message -.IP "\-f [/path/to/config/file]" -use alternate config file -.IP "\-x [proxy]" -override the proxy supplied to sources in the config file -.IP "[tlsdate command arguments]" -arguments to be passed to tlsdate at launch time - -.SH BUGS -It's likely! Let us know by contacting jacob(a)appelbaum.net - -Note that -.B tlsdate(1) -is still in Alpha, and may not work as expected. -.SH AUTHOR -Jacob Appelbaum <jacob at appelbaum dot net> -.SH "SEE ALSO" -.B tlsdate(1), -.B tlsdate-helper(1) -.B tlsdate-routeup(1) -.B tlsdate-dbus-announce(1) diff --git a/man/tlsdated.8 b/man/tlsdated.8 new file mode 100644 index 0000000..b40bfc6 --- /dev/null +++ b/man/tlsdated.8 @@ -0,0 +1,70 @@ +.\" Process this file with +.\" groff -man -Tascii foo.1 +.\" +.TH TLSDATED 1 "OCTOBER 2012" Linux "User Manuals" +.SH NAME +tlsdated \- secure parasitic rdate replacement daemon +.SH SYNOPSIS +.B tlsdated [\-wprlsvh] \ +[\-t <n>] \ +[\-d <n>] \ +[\-T <n>] \ +[\-D <n>] \ +[\-c /path/to ] \ +[\-a seconds ] \ +[\-\-] \ +[commands to be passed to tlsdate] +.SH DESCRIPTION +.B tlsdated +is a daemon that runs tlsdate. It must be run as root or otherwise have the +proper caps; it will not be able to set the system time without running as root +or another privileged user. +.SH OPTIONS +.IP "\-w" +don't set hwclock +.IP "\-p" +dry run (don't really set time) +.IP "\-r" +use stdin instead of netlink for routes +.IP "\-t [n]" +try [n] times when a new route appears +.IP "\-d [n]" +delay n seconds between tries +.IP "\-T [n]" +give subprocess n chances to exit +.IP "\-D [n]" +delay n seconds between wait attempts +.IP "\-c [/path/to/cache/directory/]" +set the cache directory +.IP "\-a [n]" +run at most every n seconds in steady state +.IP "\-l" +don't load disk timestamps +.IP "\-s" +don't save disk timestamp +.IP "\-j [n]" +add up to n seconds of jitter to steady-state fetches +.IP "\-v" +be verbose +.IP "\-h" +print help message +.IP "\-f [/path/to/config/file]" +use alternate config file +.IP "\-x [proxy]" +override the proxy supplied to sources in the config file +.IP "[tlsdate command arguments]" +arguments to be passed to tlsdate at launch time + +.SH BUGS +It's likely! Let us know by contacting jacob(a)appelbaum.net + +Note that +.B tlsdate(1) +is still in Alpha, and may not work as expected. +.SH AUTHOR +Jacob Appelbaum <jacob at appelbaum dot net> +.SH "SEE ALSO" +.B tlsdate(1), +.B tlsdate-helper(1) +.B tlsdate-routeup(1) +.B tlsdate-dbus-announce(1)

1 0