April 2013 - tor-commits - lists.torproject.org

[tlsdate/master] Add another obscure platform
by ioerror＠torproject.org 19 Apr '13

19 Apr '13

commit 6512bffb2657d6ba6722d19408514a9864af2655 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Thu Apr 18 23:06:04 2013 -0700 Add another obscure platform --- INSTALL | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/INSTALL b/INSTALL index 8a13454..f16e132 100644 --- a/INSTALL +++ b/INSTALL @@ -24,6 +24,7 @@ ports of tlsdate or for tlsdate integration on the following Operating Systems: OpenWRT pfsense OpenVMS + Irix Any of the classic unix systems Currently porting is in progress or partially documented for:

1 0

[tlsdate/master] Add note about GNU/Hurd desired support
by ioerror＠torproject.org 19 Apr '13

19 Apr '13

commit 578869a0e15b82a5f3d4f1a85cd3ffe8cde32e41 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Thu Apr 18 23:38:53 2013 -0700 Add note about GNU/Hurd desired support --- INSTALL | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/INSTALL b/INSTALL index f16e132..d4a78a7 100644 --- a/INSTALL +++ b/INSTALL @@ -25,6 +25,7 @@ ports of tlsdate or for tlsdate integration on the following Operating Systems: pfsense OpenVMS Irix + GNU/Hurd Any of the classic unix systems Currently porting is in progress or partially documented for:

1 0

[tlsdate/master] Add first draft of notes on how we harden and how we plan to evolve
by ioerror＠torproject.org 19 Apr '13

19 Apr '13

commit b53ea90001a5a89c6839bdf220e857a3e936ef73 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Thu Apr 18 23:41:35 2013 -0700 Add first draft of notes on how we harden and how we plan to evolve --- HARDENING | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 59 insertions(+), 0 deletions(-) diff --git a/HARDENING b/HARDENING new file mode 100644 index 0000000..479b355 --- /dev/null +++ b/HARDENING @@ -0,0 +1,59 @@ +Platforms offer varying security features; we'd like to support the best. + +This is a document that notes which security hardening we have implemented and +which things we'd like to see implemented for various platforms. We +specifically address exploitation mitigation and containment; security issues +such as x509 certification validation are not addressed here. Patches, +suggestions and improvements are welcome! We always want the strongest set of +options by default on each supported platform. + +On all platforms we attempt to support available compiler hardening and linking +options. Please do not disable these options. Additional compiler and linker +hardening options are welcome and the current options are implemented in the +following file: + + configure.ac + +On all platforms, we attempt to switch from the administrative user to an +unimportant role account which shares data with no other processes. If we start +as any user other than an administrative user, we will likely be unable to +switch to our normal unprivileged account. These users are defined at +`configure` time. + +In addition to the above hardening options, we have tried to extend our +hardening when the platform supports it. Each additional security measure that +we take is documented as well as planned or desired improvements. + +We do not currently support or set ulimits, we should do so where possible. + +On Debian Gnu/Linux platforms, we ship with a minimal AppArmor profile, see +the policy for details: + + apparmor-profile + +We'd like to have an SELinux policy specifically for tlsdate. +We'd like to support capability dropping with libcap or libcap-ng. +We'd like to support libseccomp2 filters. +Other kernel hardening suggestions are welcome. + +On ChromeOS we use minijail and seccomp filters, see the following policies for +details: + + tlsdate-seccomp-amd64.policy + tlsdate-seccomp-arm.policy + tlsdate-seccomp-x86.policy + +These are enabled by default in ChromeOS. + +On FreeBSD, we'd like to support jails, chroot, and Capsicum. + +On OpenBSD, we'd like to support chroot and systrace. + +On NetBSD and DragonFly BSD, we'd like to chroot. + +On Mac OS X, we'd like to support chroot and seatbelt. + +On Plan9, we'd like to chroot. + +On other platforms, we'll try to run correctly with the understanding that any +bug is likely a much more serious problem.

1 0

[tlsdate/master] Add note in INSTALL about a wishlist item
by ioerror＠torproject.org 19 Apr '13

19 Apr '13

commit d8b01015907dc362aad84985720b729f775f0e36 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Thu Apr 18 22:16:20 2013 -0700 Add note in INSTALL about a wishlist item --- INSTALL | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/INSTALL b/INSTALL index 2b01a65..8a13454 100644 --- a/INSTALL +++ b/INSTALL @@ -24,6 +24,7 @@ ports of tlsdate or for tlsdate integration on the following Operating Systems: OpenWRT pfsense OpenVMS + Any of the classic unix systems Currently porting is in progress or partially documented for:

1 0

[tlsdate/master] Check for <sys/socket.h> in configure.
by ioerror＠torproject.org 19 Apr '13

19 Apr '13

commit e707c0112e548e002db7f827a0c1686d8d97a868 Author: Taylor R Campbell <campbell(a)mumble.net> Date: Thu Apr 18 00:06:19 2013 +0000 Check for <sys/socket.h> in configure. Avoids redefinition of SHUT_* constants in config.h fragment provided by AX_PLATFORM. --- configure.ac | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/configure.ac b/configure.ac index d1649da..7f9a926 100644 --- a/configure.ac +++ b/configure.ac @@ -136,6 +136,7 @@ AC_CHECK_HEADERS([stdint.h], ,[AC_MSG_ERROR([Required headers missing; compilati AC_CHECK_HEADERS([stdio.h], ,[AC_MSG_ERROR([Required headers missing; compilation will not succeed])]) AC_CHECK_HEADERS([stdlib.h], ,[AC_MSG_ERROR([Required headers missing; compilation will not succeed])]) AC_CHECK_HEADERS([sys/mman.h], ,[AC_MSG_ERROR([Required headers missing; compilation will not succeed])]) +AC_CHECK_HEADERS([sys/socket.h], ,[AC_MSG_ERROR([Required headers missing; compilation will not succeed])]) AC_CHECK_HEADERS([sys/time.h], ,[AC_MSG_ERROR([Required headers missing; compilation will not succeed])]) AC_CHECK_HEADERS([sys/types.h], ,[AC_MSG_ERROR([Required headers missing; compilation will not succeed])]) AC_CHECK_HEADERS([sys/wait.h], ,[AC_MSG_ERROR([Required headers missing; compilation will not succeed])])

1 0

[tlsdate/master] Don't clear CFLAGS and LIBS; let user pass them to configure.
by ioerror＠torproject.org 19 Apr '13

19 Apr '13

commit 5617dda6eef9e85cd5e5e228f1ad4bf450f8cff4 Author: Taylor R Campbell <campbell(a)mumble.net> Date: Thu Apr 18 00:03:49 2013 +0000 Don't clear CFLAGS and LIBS; let user pass them to configure. --- configure.ac | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index d1649da..cec02f5 100644 --- a/configure.ac +++ b/configure.ac @@ -313,8 +313,6 @@ AC_DEFUN([LOCAL_CHECK_FLAGS],[ AC_REQUIRE([AX_APPEND_COMPILE_FLAGS]) AC_LANG_PUSH([C]) AS_IF([test "x$enable_hardened_checks" != xno], [ - CFLAGS= - LIBS= AX_APPEND_COMPILE_FLAGS([-g -O1]) ], [ AC_MSG_WARN([using hardened flags is HIGHLY RECOMMENDED and disabling them is a BAD IDEA])

1 0

[tlsdate/master] Implement fmemopen in terms of funopen where needed and possible.
by ioerror＠torproject.org 19 Apr '13

19 Apr '13

commit 07337c5255e6001031d456660174a39a1c73a11d Author: Taylor R Campbell <campbell(a)mumble.net> Date: Wed Apr 17 21:13:30 2013 +0000 Implement fmemopen in terms of funopen where needed and possible. Currently done only on NetBSD 5, but this should work for other BSDs and probably Android as well, instead of the libc-internal hacks that tlsdate currently uses for fmemopen on Android. --- configure.ac | 13 ++-- src/common/fmemopen-funopen.c | 158 +++++++++++++++++++++++++++++++++++++++++ src/common/fmemopen.h | 8 ++ src/conf-unittest.c | 6 ++ src/include.am | 9 +++ 5 files changed, 189 insertions(+), 5 deletions(-) diff --git a/configure.ac b/configure.ac index d1649da..a4f2eb3 100644 --- a/configure.ac +++ b/configure.ac @@ -145,6 +145,9 @@ AC_CHECK_HEADERS([unistd.h], ,[AC_MSG_ERROR([Required headers missing; compilati AC_CHECK_FUNCS([setresuid]) AC_CHECK_FUNCS([gettimeofday]) +AC_CHECK_FUNCS([fmemopen funopen]) +AM_CONDITIONAL(HAVE_FMEMOPEN, [test "x${ac_cv_func_fmemopen}" = xyes]) +AM_CONDITIONAL(HAVE_FUNOPEN, [test "x${ac_cv_func_funopen}" = xyes]) case "$host" in *-darwin*) @@ -182,11 +185,11 @@ case "$host" in dnl clock_gettime is either part of libc or unavailable. AC_CHECK_FUNC([clock_gettime], , [AC_MSG_ERROR([Your system lacks clock_gettime])]) - dnl If the autoconf goo picks up a compiler that runs in pre-POSIX mode, - dnl the fmemopen prototype is hidden causing the unit tests to segfault. - dnl This can happen if gcc is a symlink to gcc46 and is preferred to clang. - AC_CHECK_FUNC([fmemopen], , - [AC_MSG_WARN([Missing fmemopen, unit tests are likely to segfault. Try CC=clang.])]) + if test "x${ac_cv_func_fmemopen}" != xyes; then + if test "x${ac_cv_func_funopen}" != xyes; then + AC_MSG_ERROR([We need fmemopen or funopen for unit tests.]) + fi + fi AC_ARG_WITH([unpriv-group], [AS_HELP_STRING([--with-unpriv-group=<group>], [Group to drop privs to @<:@default: nobody@:>@])]) diff --git a/src/common/fmemopen-funopen.c b/src/common/fmemopen-funopen.c new file mode 100644 index 0000000..87c8675 --- /dev/null +++ b/src/common/fmemopen-funopen.c @@ -0,0 +1,158 @@ +/* + * POSIX 2008 fmemopen(3) implemented in terms of BSD funopen(3) + */ + +/* + * Copyright (c) 2013 Taylor R. Campbell + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#define _BSD_SOURCE +#define _NETBSD_SOURCE + +#include <errno.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> + +#include "fmemopen.h" + +struct fmem_cookie { + void *fmc_buffer; + size_t fmc_index; + size_t fmc_limit; +}; + +static int +fmem_read(void *cookie, char *buffer, int n) +{ + struct fmem_cookie *const fmc = cookie; + + if (n < 0) { /* paranoia */ + errno = EINVAL; + return -1; + } + + if (n > (fmc->fmc_limit - fmc->fmc_index)) + n = (fmc->fmc_limit - fmc->fmc_index); + + (void)memcpy(buffer, (char *)fmc->fmc_buffer + fmc->fmc_index, n); + fmc->fmc_index += n; + return n; +} + +static int +fmem_write(void *cookie, const char *buffer, int n) +{ + struct fmem_cookie *const fmc = cookie; + + if (n < 0) { /* paranoia */ + errno = EINVAL; + return -1; + } + + if (n > (fmc->fmc_limit - fmc->fmc_index)) + n = (fmc->fmc_limit - fmc->fmc_index); + + (void)memcpy((char *)fmc->fmc_buffer + fmc->fmc_index, buffer, n); + fmc->fmc_index += n; + return n; +} + +static fpos_t +fmem_seek(void *cookie, fpos_t offset, int cmd) +{ + struct fmem_cookie *const fmc = cookie; + + switch (cmd) { + case SEEK_SET: + if ((offset < 0) || (fmc->fmc_limit < offset)) + goto einval; + fmc->fmc_index = offset; + return 0; + + case SEEK_CUR: + if (offset < 0) { + /* Assume two's-complement arithmetic. */ + if ((offset == ~(fpos_t)0) || (-offset > fmc->fmc_index)) + goto einval; + } else { + if (offset > (fmc->fmc_limit - fmc->fmc_index)) + goto einval; + } + fmc->fmc_index += offset; + return 0; + + case SEEK_END: + /* Assume two's-complement arithmetic. */ + if ((offset >= 0) || (offset == ~(fpos_t)0) || (fmc->fmc_limit < -offset)) + goto einval; + fmc->fmc_index = (fmc->fmc_limit + offset); + return 0; + + default: + goto einval; + } + +einval: + errno = EINVAL; + return -1; +} + +static int +fmem_close(void *cookie) +{ + struct fmem_cookie *const fmc = cookie; + + free(fmc); + + return 0; +} + +FILE * +fmemopen(void *buffer, size_t len, const char *mode) +{ + struct fmem_cookie *fmc; + FILE *file; + + fmc = malloc(sizeof(*fmc)); + if (fmc == NULL) + goto fail0; + + (void)memset(fmc, 0, sizeof(*fmc)); + fmc->fmc_buffer = buffer; + fmc->fmc_index = 0; + fmc->fmc_limit = len; + + file = funopen(fmc, &fmem_read, &fmem_write, &fmem_seek, &fmem_close); + if (file == NULL) + goto fail1; + + return file; + +fail1: + free(fmc); +fail0: + return NULL; +} diff --git a/src/common/fmemopen.h b/src/common/fmemopen.h new file mode 100644 index 0000000..28a2500 --- /dev/null +++ b/src/common/fmemopen.h @@ -0,0 +1,8 @@ +#ifndef TLSDATE_FMEMOPEN_H +#define TLSDATE_FMEMOPEN_H + +#include <stdio.h> + +FILE *fmemopen(void *, size_t, const char *); + +#endif /* TLSDATE_FMEMOPEN_H */ diff --git a/src/conf-unittest.c b/src/conf-unittest.c index 7a371ac..e883ac7 100644 --- a/src/conf-unittest.c +++ b/src/conf-unittest.c @@ -5,6 +5,8 @@ * found in the LICENSE file. */ +#include "config.h" + #include <errno.h> #include <stdio.h> #include <stdlib.h> @@ -17,6 +19,10 @@ #include "src/common/fmemopen.h" #endif +#ifndef HAVE_FMEMOPEN +#include "src/common/fmemopen.h" +#endif + FILE *fopenstr(const char *str) { /* strlen(str) instead of strlen(str) + 1 because files shouldn't appear * null-terminated. Cast away constness because we're in read mode, but the diff --git a/src/include.am b/src/include.am index 8d3a25c..76c916b 100644 --- a/src/include.am +++ b/src/include.am @@ -45,6 +45,15 @@ bin_PROGRAMS+= src/tlsdate-helper src_conf_unittest_SOURCES = src/conf.c src_conf_unittest_SOURCES+= src/conf-unittest.c src_conf_unittest_SOURCES+= src/common/android.c + +# XXX This conditional should apply for any system where we're building +# conf_unittest, but I don't know how to tell that to automake. +if !HAVE_FMEMOPEN +if HAVE_FUNOPEN +src_conf_unittest_SOURCES+= src/common/fmemopen-funopen.c +endif +endif + check_PROGRAMS+= src/conf_unittest noinst_PROGRAMS+= src/conf_unittest endif

1 0

[tlsdate/master] Merge pull request #93 from riastradh/dont-clear-cflags
by ioerror＠torproject.org 19 Apr '13

19 Apr '13

commit bfd616ee190375758e7b5b16aa252564b79f251e Merge: f4953f1 5617dda Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Wed Apr 17 18:56:12 2013 -0700 Merge pull request #93 from riastradh/dont-clear-cflags Don't clear CFLAGS and LIBS; let user pass them to configure. configure.ac | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-)

1 0

[tlsdate/master] Merge pull request #92 from riastradh/check-for-syssocketh
by ioerror＠torproject.org 19 Apr '13

19 Apr '13

commit f4953f18d7f3a95b2ac76ebc6365edceaa08b840 Merge: 90dba9e e707c01 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Wed Apr 17 18:42:14 2013 -0700 Merge pull request #92 from riastradh/check-for-syssocketh Check for <sys/socket.h> in configure. configure.ac | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)

1 0

[tlsdate/master] Merge pull request #94 from riastradh/fix-ctype-casts
by ioerror＠torproject.org 19 Apr '13

19 Apr '13

commit a52417b563f47a6b590022d8dff1a3857599305b Merge: bfd616e 6b7041d Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Wed Apr 17 18:56:26 2013 -0700 Merge pull request #94 from riastradh/fix-ctype-casts Cast char to unsigned char before passing to ctype(3) isXYZ. src/conf.c | 2 +- src/tlsdate-helper.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)

1 0