tor-commits April 2014

tor-commits@lists.torproject.org

22 participants
2020 discussions

[bridgedb/develop] PEP8; change template_root → TEMPLATE_DIR.
by isis＠torproject.org 17 Apr '14

17 Apr '14

commit 4a9eb669830ae8a3d12335227cce7c34b5002193 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Apr 16 19:38:44 2014 +0000 PEP8; change template_root → TEMPLATE_DIR. --- lib/bridgedb/HTTPServer.py | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/lib/bridgedb/HTTPServer.py b/lib/bridgedb/HTTPServer.py index 5e3ba37..1d4cdf9 100644 --- a/lib/bridgedb/HTTPServer.py +++ b/lib/bridgedb/HTTPServer.py @@ -44,10 +44,7 @@ from bridgedb.parse import headers from bridgedb.safelog import logSafely - -template_root = os.path.join(os.path.dirname(__file__),'templates') -logging.debug("Set template root to %s" % template_root) - +TEMPLATE_DIR = os.path.join(os.path.dirname(__file__),'templates') rtl_langs = ('ar', 'he', 'fa', 'gu_IN', 'ku') # Setting `filesystem_checks` to False is recommended for production servers, @@ -57,13 +54,14 @@ rtl_langs = ('ar', 'he', 'fa', 'gu_IN', 'ku') # recompiled). `collection_size` sets the number of compiled templates which # are cached before the least recently used ones are removed. See: # http://docs.makotemplates.org/en/latest/usage.html#using-templatelookup -lookup = TemplateLookup(directories=[template_root], +lookup = TemplateLookup(directories=[TEMPLATE_DIR], output_encoding='utf-8', filesystem_checks=False, collection_size=500) _geoipdb = '/usr/share/GeoIP/GeoIP.dat' +logging.debug("Set template root to %s" % TEMPLATE_DIR) try: # Make sure we have the database before trying to import the module: @@ -822,9 +820,9 @@ def addWebServer(cfg, dist, sched): httpdist = resource.Resource() httpdist.putChild('', WebRoot()) httpdist.putChild('robots.txt', - static.File(os.path.join(template_root, 'robots.txt'))) + static.File(os.path.join(TEMPLATE_DIR, 'robots.txt'))) httpdist.putChild('assets', - static.File(os.path.join(template_root, 'assets/'))) + static.File(os.path.join(TEMPLATE_DIR, 'assets/'))) httpdist.putChild('options', WebResourceOptions()) httpdist.putChild('howto', WebResourceHowto())

1 0

[bridgedb/develop] Split unittests for EmailServer.getMailResponse() into smaller tests.
by isis＠torproject.org 17 Apr '14

17 Apr '14

commit 8274af32008893b461f81e96c2a037fe5a96b996 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Apr 8 18:34:12 2014 +0000 Split unittests for EmailServer.getMailResponse() into smaller tests. --- lib/bridgedb/test/test_EmailServer.py | 58 +++++++++++++++++++++++++-------- 1 file changed, 44 insertions(+), 14 deletions(-) diff --git a/lib/bridgedb/test/test_EmailServer.py b/lib/bridgedb/test/test_EmailServer.py index e8b9360..13f018c 100644 --- a/lib/bridgedb/test/test_EmailServer.py +++ b/lib/bridgedb/test/test_EmailServer.py @@ -134,7 +134,7 @@ class EmailCompositionTests(unittest.TestCase): """Tests for :func:`bridgedb.EmailServer.getMailResponse`.""" def setUp(self): - """Create fake email and associated data""" + """Create fake email, distributor, and associated context data.""" configuration = {} TEST_CONFIG_FILE.seek(0) compiled = compile(TEST_CONFIG_FILE.read(), '<string>', 'exec') @@ -142,40 +142,45 @@ class EmailCompositionTests(unittest.TestCase): self.config = Conf(**configuration) # TODO: Add headers if we start validating them - self.lines = ["From: %s(a)%s.com", "To: %s(a)example.net", - "Subject: testing", "\n", "get bridges"] + self.lines = ["From: %s(a)%s.com", + "To: bridges(a)example.net", + "Subject: testing", + "\n", + "get bridges"] self.distributor = FakeDistributor('key', {}, {}, []) self.ctx = MailContext(self.config, self.distributor, NoSchedule()) - def test_getMailResponseNoFrom(self): + def test_getMailResponse_noFrom(self): + """A received email without a "From:" or "Sender:" header shouldn't + receive a response. + """ lines = self.lines lines[0] = "" - lines[1] = self.lines[1] % "bridges" ret = EmailServer.getMailResponse(lines, self.ctx) self.assertIsInstance(ret, tuple) self.assertEqual(len(ret), 2) self.assertEqual(ret[0], None) self.assertEqual(ret[1], None) - def test_getMailResponseBadAddress(self): + def test_getMailResponse_badAddress(self): lines = copy.copy(self.lines) - lines[0] = self.lines[0] % ("testing?", "example") - lines[1] = self.lines[1] % "bridges" - lines[2] = "" + lines[0] = self.lines[0] % ("testing*.?\"", "example") ret = EmailServer.getMailResponse(lines, self.ctx) self.assertIsInstance(ret, tuple) self.assertEqual(len(ret), 2) self.assertEqual(ret[0], None) self.assertEqual(ret[1], None) - #lines[0] = self.lines[0] % ("<>>", "example") - lines[0] = "From: %s(a)%s.com" % ("<>>", "example") + + def test_getMailResponse_anotherBadAddress(self): + lines = copy.copy(self.lines) + lines[0] = "From: Mallory %s(a)%s.com" % ("<>>", "example") ret = EmailServer.getMailResponse(lines, self.ctx) self.assertIsInstance(ret, tuple) self.assertEqual(len(ret), 2) self.assertEqual(ret[0], None) self.assertEqual(ret[1], None) - def test_getMailResponseInvalidDomain(self): + def test_getMailResponse_invalidDomain(self): lines = copy.copy(self.lines) lines[0] = self.lines[0] % ("testing", "exa#mple") ret = EmailServer.getMailResponse(lines, self.ctx) @@ -183,6 +188,9 @@ class EmailCompositionTests(unittest.TestCase): self.assertEqual(len(ret), 2) self.assertEqual(ret[0], None) self.assertEqual(ret[1], None) + + def test_getMailResponse_anotherInvalidDomain(self): + lines = copy.copy(self.lines) lines[0] = self.lines[0] % ("testing", "exam+ple") ret = EmailServer.getMailResponse(lines, self.ctx) self.assertIsInstance(ret, tuple) @@ -190,7 +198,10 @@ class EmailCompositionTests(unittest.TestCase): self.assertEqual(ret[0], None) self.assertEqual(ret[1], None) - def test_getMailResponseDKIM(self): + def test_getMailResponse_DKIM_badDKIMheader(self): + """An email with an appended 'X-DKIM-Authentication-Result:' header should not + receive a response. + """ lines = copy.copy(self.lines) lines[0] = self.lines[0] % ("testing", "gmail") lines.append("X-DKIM-Authentication-Result: ") @@ -199,7 +210,11 @@ class EmailCompositionTests(unittest.TestCase): self.assertEqual(len(ret), 2) self.assertEqual(ret[0], None) self.assertEqual(ret[1], None) + + def test_getMailResponse_DKIM(self): + lines = copy.copy(self.lines) lines[0] = self.lines[0] % ("testing", "example") + lines.append("X-DKIM-Authentication-Result: ") ret = EmailServer.getMailResponse(lines, self.ctx) self.assertIsInstance(ret, tuple) self.assertEqual(len(ret), 2) @@ -208,7 +223,8 @@ class EmailCompositionTests(unittest.TestCase): mail = ret[1].getvalue() self.assertNotEqual(mail.find("no bridges currently"), -1) - def test_getMailResponseMailContent(self): + def test_getMailResponse_bridges_obfs(self): + """A request for 'transport obfs' should receive a response.""" lines = copy.copy(self.lines) lines[0] = self.lines[0] % ("testing", "example") lines.append("transport obfs") @@ -219,6 +235,12 @@ class EmailCompositionTests(unittest.TestCase): self.assertIsInstance(ret[1], StringIO) mail = ret[1].getvalue() self.assertNotEqual(mail.find("no bridges currently"), -1) + + def test_getMailResponse_bridges_obfsobfswebz(self): + """We should only pay attention to the first in a crazy request.""" + lines = copy.copy(self.lines) + lines[0] = self.lines[0] % ("testing", "example") + lines.append("transport obfs") lines.append("transport obfs") lines.append("unblocked webz") ret = EmailServer.getMailResponse(lines, self.ctx) @@ -228,6 +250,14 @@ class EmailCompositionTests(unittest.TestCase): self.assertIsInstance(ret[1], StringIO) mail = ret[1].getvalue() self.assertNotEqual(mail.find("no bridges currently"), -1) + + def test_getMailResponse_bridges_obfsobfswebzipv6(self): + """We should *still* only pay attention to the first request.""" + lines = copy.copy(self.lines) + lines[0] = self.lines[0] % ("testing", "example") + lines.append("transport obfs") + lines.append("transport obfs") + lines.append("unblocked webz") lines.append("ipv6") ret = EmailServer.getMailResponse(lines, self.ctx) self.assertIsInstance(ret, tuple)

1 0

[bridgedb/develop] Update docstring for I18n._().
by isis＠torproject.org 17 Apr '14

17 Apr '14

commit 09a49cd22939986a4b038c7e48f75c7a44853312 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Apr 16 19:44:47 2014 +0000 Update docstring for I18n._(). --- lib/bridgedb/I18n.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/bridgedb/I18n.py b/lib/bridgedb/I18n.py index 112b8ae..c6fbf3f 100644 --- a/lib/bridgedb/I18n.py +++ b/lib/bridgedb/I18n.py @@ -12,8 +12,10 @@ def getLang(lang, localedir=os.path.expanduser("~") + "/share/locale"): def _(text): """This is necessary because strings are translated when they're imported. - Otherwise this would make it impossible to switch languages more than - once + Otherwise this would make it impossible to switch languages more than + once. + + :returns: The **text**. """ return text

1 0

[tor/master] Fix uninitialized-ram free in unit tests
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 0175fcaf7c6284f8961e112fab80beb4257f0faf Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Apr 17 01:03:10 2014 -0400 Fix uninitialized-ram free in unit tests Fix on fb595922; bug not in any released Tor. Found with --enable-expensive-hardening. --- src/test/test_circuitlist.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/test/test_circuitlist.c b/src/test/test_circuitlist.c index 53cd415..ad8d0ac 100644 --- a/src/test/test_circuitlist.c +++ b/src/test/test_circuitlist.c @@ -247,10 +247,14 @@ test_rend_token_maps(void *arg) tt_ptr_op(NULL, ==, circuit_get_intro_point(tok3)); done: - circuit_free(TO_CIRCUIT(c1)); - circuit_free(TO_CIRCUIT(c2)); - circuit_free(TO_CIRCUIT(c3)); - circuit_free(TO_CIRCUIT(c4)); + if (c1) + circuit_free(TO_CIRCUIT(c1)); + if (c2) + circuit_free(TO_CIRCUIT(c2)); + if (c3) + circuit_free(TO_CIRCUIT(c3)); + if (c4) + circuit_free(TO_CIRCUIT(c4)); } struct testcase_t circuitlist_tests[] = {

1 0

[tor/master] Merge more changes files (verbatim) into the changelog
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit ab83a27450fc3afb57874ca202dcee570607a1ff Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Apr 17 00:13:11 2014 -0400 Merge more changes files (verbatim) into the changelog --- ChangeLog | 87 ++++++++++++++++++++++++++++++++++++++++++- changes/10267_tproxy | 4 -- changes/10896 | 8 ---- changes/11507 | 7 ---- changes/bug10431 | 5 --- changes/bug11304 | 5 --- changes/bug11306 | 4 -- changes/bug11464_023 | 5 --- changes/bug11465 | 9 ----- changes/bug11477 | 4 -- changes/bug11513 | 12 ------ changes/bug11519 | 3 -- changes/bug5286 | 4 -- changes/ff28_ciphers | 6 --- changes/sandbox_fixes_11351 | 13 ------- 15 files changed, 86 insertions(+), 90 deletions(-) diff --git a/ChangeLog b/ChangeLog index 8f2244e..790d1d4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,11 @@ Changes in version 0.2.5.4-alpha - 2014-04-?? + o Major features (security): + - Block authority signing keys that were used on an authorities + vulnerable to the "heartbleed" bug in openssl (CVE-2014-0160). + (We don't have any evidence that these keys _were_ compromised; + we're doing this to be prudent.) Resolves ticket 11464. + o Deprecated versions: - Tor 0.2.2.x has reached end-of-life; it has received no patches or attention for some while. Directory authorities no longer accept @@ -12,6 +18,32 @@ Changes in version 0.2.5.4-alpha - 2014-04-?? the circuits. These functions previously accounted between 3 and 7% of CPU usage on some busy relays. + o Major features (seccomp2 sandbox): + - Refinements and improvements to the Linux seccomp2 sandbox code: + the sandbox can now run a test network for multiple hours without + crashing. (Previous crash reasons included: reseeding the OpenSSL PRNG, + seeding the Libevent PRNG, using the wrong combination of CLOEXEC and + NONBLOCK at the same place and time, having server keys, being an + authority, receiving a HUP, or using IPv6.) The sandbox is still + experimental, and more bugs will probably turn up. To try it, + enable "Sandbox 1" on a Linux host. + - Strengthen the Linux seccomp2 sandbox code: the sandbox can now + test the arguments for rename(), and blocks _sysctl() entirely. + - When the Linux syscall sandbox finds an illegal system call, it + now tries to log a stack trace before exiting. Resolves ticket + 11465. + + o Major bugfixes (TLS cipher selection): + - Generate the server's preference list for ciphersuites + automatically based on uniform criteria, and considering all + OpenSSL ciphersuites with acceptable strength and forward + secrecy. (The sort order is: prefer AES to 3DES; break ties by + preferring ECDHE to DHE; break ties by preferring GCM to CBC; + break ties by preferring SHA384 to SHA256 to SHA1; and finally, + break ties by preferring AES256 to AES128.) This resolves bugs + #11513, #11492, #11498, #11499. Bugs reported by 'cypherpunks'. + Bugfix on 0.2.4.8-alpha. + o Major bugfixes (undefined behavior): - Fix two instances of possible undefined behavior in channeltls.c that could, under unlucky circumstances, have led to a pointer @@ -31,6 +63,26 @@ Changes in version 0.2.5.4-alpha - 2014-04-?? - Log only one message when we start logging in an unsafe way. Previously, we would log as many messages as we had problems. Fix for #9870; bugfix on 0.2.5.1-alpha. + - Using the Linux syscall sandbox no longer prevents stack-trace + logging on crashes or errors. Fixes part 11465; bugfix on + 0.2.5.1-alpha. + - Only report the first fatal boostrap error on a given OR + connection. This prevents controllers from declaring that a + connection has failed because of "DONE" or other junk reasons. + Fixes bug 10431; bugfix on 0.2.1.1-alpha. + + o Minor bugfixes (closing channels): + - If write_to_buf() in connection_write_to_buf_impl_() ever fails, + check if it's an or_connection_t and correctly call + connection_or_close_for_error() rather than connection_mark_for_close() + directly. Fixes bug #11304; bugfix on 0.2.4.4-alpha. + - When closing all connections on setting DisableNetwork to 1, use + connection_or_close_normally() rather than closing orconns out from + under the channel layer. Fixes bug #11306; bugfix on 0.2.4.4-alpha. + + o Minor bugfixes (controller): + - Avoid sending an garbage value to the controller when a circuit is + cannibalized. Fixes bug 11519; bugfix on 0.2.3.11-alpha. o Minor bugfixes (tor-fw-helper): - Allow tor-fw-helper to build again by adding src/ext to its @@ -80,7 +132,34 @@ Changes in version 0.2.5.4-alpha - 2014-04-?? - Stop leaking memory when we successfully resolve a PTR record. Fixes bug 11437; bugfix on 0.2.4.7-alpha. - o Minor bugfixes (windows): + o Minor features (Transparent proxy): + - Support the ipfw firewall interface for transparent proxy support on + FreeBSD. To enable it, set "TransProxyType ipfw" in your torrc. + Resolves ticket 10267; patch from "yurivict". + - Support OpenBSD's divert-to rules with the pf firewall, when + "TransProxyType pf-divert" is specified. This allows Tor to run a + TransPort transparent proxy port on OpenBSD 4.4 or later without + root privileges. See the pf.conf(5) manual page for information on + configuring pf to use divert-to rules. Closes ticket 10896; patch + from Dana Koch. + + o Minor features (security): + - New --enable-expensive-hardening option to turn on security hardening + options that consume nontrivial amounts of CPU and memory. Right now, + this includes AddressSanitizer and UbSan. Closes ticket 11477. + + o Minor features (usability): + - Demote the message that we give when a flushing connection times + out for too long from NOTICE to INFO. It was usually meaningless. + Resolves ticket 5286. + + o Minor features (performance, compatibility): + - Update the list of TLS cipehrsuites that a client advertises + to match those advertised by Firefox 28. This enables selection of + (fast) GCM ciphersuites, disables some strange old ciphers, and + disables the ECDH (not to be confused with ECDHE) ciphersuites. + Resolves ticket 11438. + o Minor bugfixes (IPv6): - When using DNSPort and AutomapHostsOnResolve, respond to AAAA @@ -137,6 +216,12 @@ Changes in version 0.2.5.4-alpha - 2014-04-?? - Change our use of the ENUM_BF macro to avoid declarations that confuse Doxygen. + o Testing: + - New macros in test.h to simplify writting mock-functions for unit + tests. Part of ticket 11507. Patch from Dana Koch. + - Complete tests for the status.c module. Resolves ticket 11507. + Patch from Dana Koch. + o Removed code: - Remove all code for the long unused v1 directory protocol. Resolves ticket 11070. diff --git a/changes/10267_tproxy b/changes/10267_tproxy deleted file mode 100644 index f65e4a2..0000000 --- a/changes/10267_tproxy +++ /dev/null @@ -1,4 +0,0 @@ - o Minor features: - - Support the ipfw firewall interface for transparent proxy support on - FreeBSD. To enable it, set "TransProxyType ipfw" in your torrc. - Resolves ticket 10267; patch from "yurivict". diff --git a/changes/10896 b/changes/10896 deleted file mode 100644 index 278815e..0000000 --- a/changes/10896 +++ /dev/null @@ -1,8 +0,0 @@ - o Minor features: - - Support OpenBSD's divert-to rules with the pf firewall, when - "TransProxyType pf-divert" is specified. This allows Tor to run a - TransPort transparent proxy port on OpenBSD 4.4 or later without - root privileges. See the pf.conf(5) manual page for information on - configuring pf to use divert-to rules. Closes ticket 10896; patch - from Dana Koch. - diff --git a/changes/11507 b/changes/11507 deleted file mode 100644 index f656d90..0000000 --- a/changes/11507 +++ /dev/null @@ -1,7 +0,0 @@ - o Testing support: - - New macros in test.h to simplify writting mock-functions for unit - tests. Part of ticket 11507. Patch from Dana Koch. - - o Testing: - - Complete tests for the status.c module. Resolves ticket 11507. - Patch from Dana Koch. diff --git a/changes/bug10431 b/changes/bug10431 deleted file mode 100644 index 39353a2..0000000 --- a/changes/bug10431 +++ /dev/null @@ -1,5 +0,0 @@ - o Minor bugfixes: - - Only report the first fatal boostrap error on a given OR - connection. This prevents controllers from declaring that a - connection has failed because of "DONE" or other junk reasons. - Fixes bug 10431; bugfix on 0.2.1.1-alpha. diff --git a/changes/bug11304 b/changes/bug11304 deleted file mode 100644 index 4930dd6..0000000 --- a/changes/bug11304 +++ /dev/null @@ -1,5 +0,0 @@ - o Bugfixes: - - If write_to_buf() in connection_write_to_buf_impl_() ever fails, - check if it's an or_connection_t and correctly call - connection_or_close_for_error() rather than connection_mark_for_close() - directly. Fixes bug #11304; bugfix on 0.2.4.4-alpha. diff --git a/changes/bug11306 b/changes/bug11306 deleted file mode 100644 index 5937938..0000000 --- a/changes/bug11306 +++ /dev/null @@ -1,4 +0,0 @@ - o Bugfixes: - - When closing all connections on setting DisableNetwork to 1, use - connection_or_close_normally() rather than closing orconns out from - under the channel layer. Fixes bug #11306; bugfix on 0.2.4.4-alpha. diff --git a/changes/bug11464_023 b/changes/bug11464_023 deleted file mode 100644 index 80c04b2..0000000 --- a/changes/bug11464_023 +++ /dev/null @@ -1,5 +0,0 @@ - o Major features (security): - - Block authority signing keys that were used on an authorities - vulnerable to the "heartbleed" bug in openssl (CVE-2014-0160). - (We don't have any evidence that these keys _were_ compromised; - we're doing this to be prudent.) Resolves ticket 11464. diff --git a/changes/bug11465 b/changes/bug11465 deleted file mode 100644 index 2425299..0000000 --- a/changes/bug11465 +++ /dev/null @@ -1,9 +0,0 @@ - o Minor features: - - When the Linux syscall sandbox finds an illegal system call, it - now tries to log a stack trace before exiting. Resolves ticket - 11465. - - o Minor bugfixes: - - Using the Linux syscall sandbox no longer prevents stack-trace - logging on crashes or errors. Fixes part 11465; bugfix on - 0.2.5.1-alpha. diff --git a/changes/bug11477 b/changes/bug11477 deleted file mode 100644 index 44bdba9..0000000 --- a/changes/bug11477 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor features: - - New --enable-expensive-hardening option to turn on security hardening - options that consume nontrivial amounts of CPU and memory. Right now, - this includes AddressSanitizer and UbSan. Closes ticket 11477. diff --git a/changes/bug11513 b/changes/bug11513 deleted file mode 100644 index 820c026..0000000 --- a/changes/bug11513 +++ /dev/null @@ -1,12 +0,0 @@ - o Major bugfixes: - - Generate the server's preference list for ciphersuites - automatically based on uniform criteria, and considering all - OpenSSL ciphersuites with acceptable strength and forward - secrecy. (The sort order is: prefer AES to 3DES; break ties by - preferring ECDHE to DHE; break ties by preferring GCM to CBC; - break ties by preferring SHA384 to SHA256 to SHA1; and finally, - break ties by preferring AES256 to AES128.) This resolves bugs - #11513, #11492, #11498, #11499. Bugs reported by 'cypherpunks'. - Bugfix on 0.2.4.8-alpha. - - diff --git a/changes/bug11519 b/changes/bug11519 deleted file mode 100644 index 5c1e6af..0000000 --- a/changes/bug11519 +++ /dev/null @@ -1,3 +0,0 @@ - o Minor bugfixes: - - Avoid sending an garbage value to the controller when a circuit is - cannibalized. Fixes bug 11519; bugfix on 0.2.3.11-alpha. diff --git a/changes/bug5286 b/changes/bug5286 deleted file mode 100644 index de02a9a..0000000 --- a/changes/bug5286 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor features: - - Demote the message that we give when a flushing connection times - out for too long from NOTICE to INFO. It was usually meaningless. - Resolves ticket 5286. diff --git a/changes/ff28_ciphers b/changes/ff28_ciphers deleted file mode 100644 index 05eb4e9..0000000 --- a/changes/ff28_ciphers +++ /dev/null @@ -1,6 +0,0 @@ - o Minor features (performance, compatibility): - - Update the list of TLS cipehrsuites that a client advertises - to match those advertised by Firefox 28. This enables selection of - (fast) GCM ciphersuites, disables some strange old ciphers, and - disables the ECDH (not to be confused with ECDHE) ciphersuites. - Resolves ticket 11438. diff --git a/changes/sandbox_fixes_11351 b/changes/sandbox_fixes_11351 deleted file mode 100644 index 2fe2173..0000000 --- a/changes/sandbox_fixes_11351 +++ /dev/null @@ -1,13 +0,0 @@ - o Major features: - - Refinements and improvements to the Linux seccomp2 sandbox code: - the sandbox can now run a test network for multiple hours without - crashing. (Previous crash reasons included: reseeding the OpenSSL PRNG, - seeding the Libevent PRNG, using the wrong combination of CLOEXEC and - NONBLOCK at the same place and time, having server keys, being an - authority, receiving a HUP, or using IPv6.) The sandbox is still - experimental, and more bugs will probably turn up. To try it, - enable "Sandbox 1" on a Linux host. - - - Strengthen the Linux seccomp2 sandbox code: the sandbox can now - test the arguments for rename(), and blocks _sysctl() entirely. -

1 0

[tor/master] Block certain option transitions while sandbox enabled
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 2ae47d3c3ad7121b3ebfa8aa47cd67336218163e Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 21:57:45 2014 -0400 Block certain option transitions while sandbox enabled --- src/or/config.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/src/or/config.c b/src/or/config.c index 77dcd16..b686b66 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -3584,6 +3584,12 @@ options_transition_allowed(const or_options_t *old, return -1; } + if (old->Sandbox != new_val->Sandbox) { + *msg = tor_strdup("While Tor is running, changing Sandbox " + "is not allowed."); + return -1; + } + if (strcmp(old->DataDirectory,new_val->DataDirectory)!=0) { tor_asprintf(msg, "While Tor is running, changing DataDirectory " @@ -3636,6 +3642,32 @@ options_transition_allowed(const or_options_t *old, return -1; } + if (sandbox_is_active()) { + if (! opt_streq(old->PidFile, new_val->PidFile)) { + *msg = tor_strdup("Can't change PidFile while Sandbox is active"); + return -1; + } + if (! config_lines_eq(old->Logs, new_val->Logs)) { + *msg = tor_strdup("Can't change Logs while Sandbox is active"); + return -1; + } + if (old->ConnLimit != new_val->ConnLimit) { + *msg = tor_strdup("Can't change ConnLimit while Sandbox is active"); + return -1; + } + if (! opt_streq(old->ServerDNSResolvConfFile, + new_val->ServerDNSResolvConfFile)) { + *msg = tor_strdup("Can't change ServerDNSResolvConfFile" + " while Sandbox is active"); + return -1; + } + if (server_mode(old) != server_mode(new_val)) { + *msg = tor_strdup("Can't start/stop being a server while " + "Sandbox is active"); + return -1; + } + } + return 0; }

1 0

[tor/master] add a changes file for the sandbox fixes series
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 506c8904402907f84f8c5ddcd6ecf15bb66d4030 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 22:45:27 2014 -0400 add a changes file for the sandbox fixes series --- changes/sandbox_fixes_11351 | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/changes/sandbox_fixes_11351 b/changes/sandbox_fixes_11351 new file mode 100644 index 0000000..2fe2173 --- /dev/null +++ b/changes/sandbox_fixes_11351 @@ -0,0 +1,13 @@ + o Major features: + - Refinements and improvements to the Linux seccomp2 sandbox code: + the sandbox can now run a test network for multiple hours without + crashing. (Previous crash reasons included: reseeding the OpenSSL PRNG, + seeding the Libevent PRNG, using the wrong combination of CLOEXEC and + NONBLOCK at the same place and time, having server keys, being an + authority, receiving a HUP, or using IPv6.) The sandbox is still + experimental, and more bugs will probably turn up. To try it, + enable "Sandbox 1" on a Linux host. + + - Strengthen the Linux seccomp2 sandbox code: the sandbox can now + test the arguments for rename(), and blocks _sysctl() entirely. +

1 0

[tor/master] Log the name of the failing syscall on failure
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit f41491816ca1ac8dc39c4da0f6b9fe1065c5228a Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 22:22:47 2014 -0400 Log the name of the failing syscall on failure --- src/common/gen_linux_syscalls.pl | 37 ++ src/common/include.am | 1 + src/common/linux_syscalls.inc | 1153 ++++++++++++++++++++++++++++++++++++++ src/common/sandbox.c | 25 +- 4 files changed, 1213 insertions(+), 3 deletions(-) diff --git a/src/common/gen_linux_syscalls.pl b/src/common/gen_linux_syscalls.pl new file mode 100755 index 0000000..3c64098 --- /dev/null +++ b/src/common/gen_linux_syscalls.pl @@ -0,0 +1,37 @@ +#!/usr/bin/perl -w + +use strict; +my %syscalls = (); + +while (<>) { + if (/^#define (__NR_\w+) /) { + $syscalls{$1} = 1; + } +} + +print <<EOL; +/* Automatically generated with + gen_sandbox_syscalls.pl /usr/include/asm/unistd*.h + Do not edit. + */ +static const struct { + int syscall_num; const char *syscall_name; +} SYSCALLS_BY_NUMBER[] = { +EOL + +for my $k (sort keys %syscalls) { + my $name = $k; + $name =~ s/^__NR_//; + print <<EOL; +#ifdef $k + { $k, "$name" }, +#endif +EOL + +} + +print <<EOL + {0, NULL} +}; + +EOL diff --git a/src/common/include.am b/src/common/include.am index d0ea40e..7b2465c 100644 --- a/src/common/include.am +++ b/src/common/include.am @@ -103,6 +103,7 @@ COMMONHEADERS = \ src/common/di_ops.h \ src/common/memarea.h \ src/common/mempool.h \ + src/common/linux_syscalls.inc \ src/common/procmon.h \ src/common/sandbox.h \ src/common/testsupport.h \ diff --git a/src/common/linux_syscalls.inc b/src/common/linux_syscalls.inc new file mode 100644 index 0000000..9127356 --- /dev/null +++ b/src/common/linux_syscalls.inc @@ -0,0 +1,1153 @@ +/* Automatically generated with + gen_sandbox_syscalls.pl /usr/include/asm/unistd*.h + Do not edit. + */ +static const struct { + int syscall_num; const char *syscall_name; +} SYSCALLS_BY_NUMBER[] = { +#ifdef __NR__llseek + { __NR__llseek, "_llseek" }, +#endif +#ifdef __NR__newselect + { __NR__newselect, "_newselect" }, +#endif +#ifdef __NR__sysctl + { __NR__sysctl, "_sysctl" }, +#endif +#ifdef __NR_accept + { __NR_accept, "accept" }, +#endif +#ifdef __NR_accept4 + { __NR_accept4, "accept4" }, +#endif +#ifdef __NR_access + { __NR_access, "access" }, +#endif +#ifdef __NR_acct + { __NR_acct, "acct" }, +#endif +#ifdef __NR_add_key + { __NR_add_key, "add_key" }, +#endif +#ifdef __NR_adjtimex + { __NR_adjtimex, "adjtimex" }, +#endif +#ifdef __NR_afs_syscall + { __NR_afs_syscall, "afs_syscall" }, +#endif +#ifdef __NR_alarm + { __NR_alarm, "alarm" }, +#endif +#ifdef __NR_arch_prctl + { __NR_arch_prctl, "arch_prctl" }, +#endif +#ifdef __NR_bdflush + { __NR_bdflush, "bdflush" }, +#endif +#ifdef __NR_bind + { __NR_bind, "bind" }, +#endif +#ifdef __NR_break + { __NR_break, "break" }, +#endif +#ifdef __NR_brk + { __NR_brk, "brk" }, +#endif +#ifdef __NR_capget + { __NR_capget, "capget" }, +#endif +#ifdef __NR_capset + { __NR_capset, "capset" }, +#endif +#ifdef __NR_chdir + { __NR_chdir, "chdir" }, +#endif +#ifdef __NR_chmod + { __NR_chmod, "chmod" }, +#endif +#ifdef __NR_chown + { __NR_chown, "chown" }, +#endif +#ifdef __NR_chown32 + { __NR_chown32, "chown32" }, +#endif +#ifdef __NR_chroot + { __NR_chroot, "chroot" }, +#endif +#ifdef __NR_clock_adjtime + { __NR_clock_adjtime, "clock_adjtime" }, +#endif +#ifdef __NR_clock_getres + { __NR_clock_getres, "clock_getres" }, +#endif +#ifdef __NR_clock_gettime + { __NR_clock_gettime, "clock_gettime" }, +#endif +#ifdef __NR_clock_nanosleep + { __NR_clock_nanosleep, "clock_nanosleep" }, +#endif +#ifdef __NR_clock_settime + { __NR_clock_settime, "clock_settime" }, +#endif +#ifdef __NR_clone + { __NR_clone, "clone" }, +#endif +#ifdef __NR_close + { __NR_close, "close" }, +#endif +#ifdef __NR_connect + { __NR_connect, "connect" }, +#endif +#ifdef __NR_creat + { __NR_creat, "creat" }, +#endif +#ifdef __NR_create_module + { __NR_create_module, "create_module" }, +#endif +#ifdef __NR_delete_module + { __NR_delete_module, "delete_module" }, +#endif +#ifdef __NR_dup + { __NR_dup, "dup" }, +#endif +#ifdef __NR_dup2 + { __NR_dup2, "dup2" }, +#endif +#ifdef __NR_dup3 + { __NR_dup3, "dup3" }, +#endif +#ifdef __NR_epoll_create + { __NR_epoll_create, "epoll_create" }, +#endif +#ifdef __NR_epoll_create1 + { __NR_epoll_create1, "epoll_create1" }, +#endif +#ifdef __NR_epoll_ctl + { __NR_epoll_ctl, "epoll_ctl" }, +#endif +#ifdef __NR_epoll_ctl_old + { __NR_epoll_ctl_old, "epoll_ctl_old" }, +#endif +#ifdef __NR_epoll_pwait + { __NR_epoll_pwait, "epoll_pwait" }, +#endif +#ifdef __NR_epoll_wait + { __NR_epoll_wait, "epoll_wait" }, +#endif +#ifdef __NR_epoll_wait_old + { __NR_epoll_wait_old, "epoll_wait_old" }, +#endif +#ifdef __NR_eventfd + { __NR_eventfd, "eventfd" }, +#endif +#ifdef __NR_eventfd2 + { __NR_eventfd2, "eventfd2" }, +#endif +#ifdef __NR_execve + { __NR_execve, "execve" }, +#endif +#ifdef __NR_exit + { __NR_exit, "exit" }, +#endif +#ifdef __NR_exit_group + { __NR_exit_group, "exit_group" }, +#endif +#ifdef __NR_faccessat + { __NR_faccessat, "faccessat" }, +#endif +#ifdef __NR_fadvise64 + { __NR_fadvise64, "fadvise64" }, +#endif +#ifdef __NR_fadvise64_64 + { __NR_fadvise64_64, "fadvise64_64" }, +#endif +#ifdef __NR_fallocate + { __NR_fallocate, "fallocate" }, +#endif +#ifdef __NR_fanotify_init + { __NR_fanotify_init, "fanotify_init" }, +#endif +#ifdef __NR_fanotify_mark + { __NR_fanotify_mark, "fanotify_mark" }, +#endif +#ifdef __NR_fchdir + { __NR_fchdir, "fchdir" }, +#endif +#ifdef __NR_fchmod + { __NR_fchmod, "fchmod" }, +#endif +#ifdef __NR_fchmodat + { __NR_fchmodat, "fchmodat" }, +#endif +#ifdef __NR_fchown + { __NR_fchown, "fchown" }, +#endif +#ifdef __NR_fchown32 + { __NR_fchown32, "fchown32" }, +#endif +#ifdef __NR_fchownat + { __NR_fchownat, "fchownat" }, +#endif +#ifdef __NR_fcntl + { __NR_fcntl, "fcntl" }, +#endif +#ifdef __NR_fcntl64 + { __NR_fcntl64, "fcntl64" }, +#endif +#ifdef __NR_fdatasync + { __NR_fdatasync, "fdatasync" }, +#endif +#ifdef __NR_fgetxattr + { __NR_fgetxattr, "fgetxattr" }, +#endif +#ifdef __NR_finit_module + { __NR_finit_module, "finit_module" }, +#endif +#ifdef __NR_flistxattr + { __NR_flistxattr, "flistxattr" }, +#endif +#ifdef __NR_flock + { __NR_flock, "flock" }, +#endif +#ifdef __NR_fork + { __NR_fork, "fork" }, +#endif +#ifdef __NR_fremovexattr + { __NR_fremovexattr, "fremovexattr" }, +#endif +#ifdef __NR_fsetxattr + { __NR_fsetxattr, "fsetxattr" }, +#endif +#ifdef __NR_fstat + { __NR_fstat, "fstat" }, +#endif +#ifdef __NR_fstat64 + { __NR_fstat64, "fstat64" }, +#endif +#ifdef __NR_fstatat64 + { __NR_fstatat64, "fstatat64" }, +#endif +#ifdef __NR_fstatfs + { __NR_fstatfs, "fstatfs" }, +#endif +#ifdef __NR_fstatfs64 + { __NR_fstatfs64, "fstatfs64" }, +#endif +#ifdef __NR_fsync + { __NR_fsync, "fsync" }, +#endif +#ifdef __NR_ftime + { __NR_ftime, "ftime" }, +#endif +#ifdef __NR_ftruncate + { __NR_ftruncate, "ftruncate" }, +#endif +#ifdef __NR_ftruncate64 + { __NR_ftruncate64, "ftruncate64" }, +#endif +#ifdef __NR_futex + { __NR_futex, "futex" }, +#endif +#ifdef __NR_futimesat + { __NR_futimesat, "futimesat" }, +#endif +#ifdef __NR_get_kernel_syms + { __NR_get_kernel_syms, "get_kernel_syms" }, +#endif +#ifdef __NR_get_mempolicy + { __NR_get_mempolicy, "get_mempolicy" }, +#endif +#ifdef __NR_get_robust_list + { __NR_get_robust_list, "get_robust_list" }, +#endif +#ifdef __NR_get_thread_area + { __NR_get_thread_area, "get_thread_area" }, +#endif +#ifdef __NR_getcpu + { __NR_getcpu, "getcpu" }, +#endif +#ifdef __NR_getcwd + { __NR_getcwd, "getcwd" }, +#endif +#ifdef __NR_getdents + { __NR_getdents, "getdents" }, +#endif +#ifdef __NR_getdents64 + { __NR_getdents64, "getdents64" }, +#endif +#ifdef __NR_getegid + { __NR_getegid, "getegid" }, +#endif +#ifdef __NR_getegid32 + { __NR_getegid32, "getegid32" }, +#endif +#ifdef __NR_geteuid + { __NR_geteuid, "geteuid" }, +#endif +#ifdef __NR_geteuid32 + { __NR_geteuid32, "geteuid32" }, +#endif +#ifdef __NR_getgid + { __NR_getgid, "getgid" }, +#endif +#ifdef __NR_getgid32 + { __NR_getgid32, "getgid32" }, +#endif +#ifdef __NR_getgroups + { __NR_getgroups, "getgroups" }, +#endif +#ifdef __NR_getgroups32 + { __NR_getgroups32, "getgroups32" }, +#endif +#ifdef __NR_getitimer + { __NR_getitimer, "getitimer" }, +#endif +#ifdef __NR_getpeername + { __NR_getpeername, "getpeername" }, +#endif +#ifdef __NR_getpgid + { __NR_getpgid, "getpgid" }, +#endif +#ifdef __NR_getpgrp + { __NR_getpgrp, "getpgrp" }, +#endif +#ifdef __NR_getpid + { __NR_getpid, "getpid" }, +#endif +#ifdef __NR_getpmsg + { __NR_getpmsg, "getpmsg" }, +#endif +#ifdef __NR_getppid + { __NR_getppid, "getppid" }, +#endif +#ifdef __NR_getpriority + { __NR_getpriority, "getpriority" }, +#endif +#ifdef __NR_getresgid + { __NR_getresgid, "getresgid" }, +#endif +#ifdef __NR_getresgid32 + { __NR_getresgid32, "getresgid32" }, +#endif +#ifdef __NR_getresuid + { __NR_getresuid, "getresuid" }, +#endif +#ifdef __NR_getresuid32 + { __NR_getresuid32, "getresuid32" }, +#endif +#ifdef __NR_getrlimit + { __NR_getrlimit, "getrlimit" }, +#endif +#ifdef __NR_getrusage + { __NR_getrusage, "getrusage" }, +#endif +#ifdef __NR_getsid + { __NR_getsid, "getsid" }, +#endif +#ifdef __NR_getsockname + { __NR_getsockname, "getsockname" }, +#endif +#ifdef __NR_getsockopt + { __NR_getsockopt, "getsockopt" }, +#endif +#ifdef __NR_gettid + { __NR_gettid, "gettid" }, +#endif +#ifdef __NR_gettimeofday + { __NR_gettimeofday, "gettimeofday" }, +#endif +#ifdef __NR_getuid + { __NR_getuid, "getuid" }, +#endif +#ifdef __NR_getuid32 + { __NR_getuid32, "getuid32" }, +#endif +#ifdef __NR_getxattr + { __NR_getxattr, "getxattr" }, +#endif +#ifdef __NR_gtty + { __NR_gtty, "gtty" }, +#endif +#ifdef __NR_idle + { __NR_idle, "idle" }, +#endif +#ifdef __NR_init_module + { __NR_init_module, "init_module" }, +#endif +#ifdef __NR_inotify_add_watch + { __NR_inotify_add_watch, "inotify_add_watch" }, +#endif +#ifdef __NR_inotify_init + { __NR_inotify_init, "inotify_init" }, +#endif +#ifdef __NR_inotify_init1 + { __NR_inotify_init1, "inotify_init1" }, +#endif +#ifdef __NR_inotify_rm_watch + { __NR_inotify_rm_watch, "inotify_rm_watch" }, +#endif +#ifdef __NR_io_cancel + { __NR_io_cancel, "io_cancel" }, +#endif +#ifdef __NR_io_destroy + { __NR_io_destroy, "io_destroy" }, +#endif +#ifdef __NR_io_getevents + { __NR_io_getevents, "io_getevents" }, +#endif +#ifdef __NR_io_setup + { __NR_io_setup, "io_setup" }, +#endif +#ifdef __NR_io_submit + { __NR_io_submit, "io_submit" }, +#endif +#ifdef __NR_ioctl + { __NR_ioctl, "ioctl" }, +#endif +#ifdef __NR_ioperm + { __NR_ioperm, "ioperm" }, +#endif +#ifdef __NR_iopl + { __NR_iopl, "iopl" }, +#endif +#ifdef __NR_ioprio_get + { __NR_ioprio_get, "ioprio_get" }, +#endif +#ifdef __NR_ioprio_set + { __NR_ioprio_set, "ioprio_set" }, +#endif +#ifdef __NR_ipc + { __NR_ipc, "ipc" }, +#endif +#ifdef __NR_kcmp + { __NR_kcmp, "kcmp" }, +#endif +#ifdef __NR_kexec_load + { __NR_kexec_load, "kexec_load" }, +#endif +#ifdef __NR_keyctl + { __NR_keyctl, "keyctl" }, +#endif +#ifdef __NR_kill + { __NR_kill, "kill" }, +#endif +#ifdef __NR_lchown + { __NR_lchown, "lchown" }, +#endif +#ifdef __NR_lchown32 + { __NR_lchown32, "lchown32" }, +#endif +#ifdef __NR_lgetxattr + { __NR_lgetxattr, "lgetxattr" }, +#endif +#ifdef __NR_link + { __NR_link, "link" }, +#endif +#ifdef __NR_linkat + { __NR_linkat, "linkat" }, +#endif +#ifdef __NR_listen + { __NR_listen, "listen" }, +#endif +#ifdef __NR_listxattr + { __NR_listxattr, "listxattr" }, +#endif +#ifdef __NR_llistxattr + { __NR_llistxattr, "llistxattr" }, +#endif +#ifdef __NR_lock + { __NR_lock, "lock" }, +#endif +#ifdef __NR_lookup_dcookie + { __NR_lookup_dcookie, "lookup_dcookie" }, +#endif +#ifdef __NR_lremovexattr + { __NR_lremovexattr, "lremovexattr" }, +#endif +#ifdef __NR_lseek + { __NR_lseek, "lseek" }, +#endif +#ifdef __NR_lsetxattr + { __NR_lsetxattr, "lsetxattr" }, +#endif +#ifdef __NR_lstat + { __NR_lstat, "lstat" }, +#endif +#ifdef __NR_lstat64 + { __NR_lstat64, "lstat64" }, +#endif +#ifdef __NR_madvise + { __NR_madvise, "madvise" }, +#endif +#ifdef __NR_mbind + { __NR_mbind, "mbind" }, +#endif +#ifdef __NR_migrate_pages + { __NR_migrate_pages, "migrate_pages" }, +#endif +#ifdef __NR_mincore + { __NR_mincore, "mincore" }, +#endif +#ifdef __NR_mkdir + { __NR_mkdir, "mkdir" }, +#endif +#ifdef __NR_mkdirat + { __NR_mkdirat, "mkdirat" }, +#endif +#ifdef __NR_mknod + { __NR_mknod, "mknod" }, +#endif +#ifdef __NR_mknodat + { __NR_mknodat, "mknodat" }, +#endif +#ifdef __NR_mlock + { __NR_mlock, "mlock" }, +#endif +#ifdef __NR_mlockall + { __NR_mlockall, "mlockall" }, +#endif +#ifdef __NR_mmap + { __NR_mmap, "mmap" }, +#endif +#ifdef __NR_mmap2 + { __NR_mmap2, "mmap2" }, +#endif +#ifdef __NR_modify_ldt + { __NR_modify_ldt, "modify_ldt" }, +#endif +#ifdef __NR_mount + { __NR_mount, "mount" }, +#endif +#ifdef __NR_move_pages + { __NR_move_pages, "move_pages" }, +#endif +#ifdef __NR_mprotect + { __NR_mprotect, "mprotect" }, +#endif +#ifdef __NR_mpx + { __NR_mpx, "mpx" }, +#endif +#ifdef __NR_mq_getsetattr + { __NR_mq_getsetattr, "mq_getsetattr" }, +#endif +#ifdef __NR_mq_notify + { __NR_mq_notify, "mq_notify" }, +#endif +#ifdef __NR_mq_open + { __NR_mq_open, "mq_open" }, +#endif +#ifdef __NR_mq_timedreceive + { __NR_mq_timedreceive, "mq_timedreceive" }, +#endif +#ifdef __NR_mq_timedsend + { __NR_mq_timedsend, "mq_timedsend" }, +#endif +#ifdef __NR_mq_unlink + { __NR_mq_unlink, "mq_unlink" }, +#endif +#ifdef __NR_mremap + { __NR_mremap, "mremap" }, +#endif +#ifdef __NR_msgctl + { __NR_msgctl, "msgctl" }, +#endif +#ifdef __NR_msgget + { __NR_msgget, "msgget" }, +#endif +#ifdef __NR_msgrcv + { __NR_msgrcv, "msgrcv" }, +#endif +#ifdef __NR_msgsnd + { __NR_msgsnd, "msgsnd" }, +#endif +#ifdef __NR_msync + { __NR_msync, "msync" }, +#endif +#ifdef __NR_munlock + { __NR_munlock, "munlock" }, +#endif +#ifdef __NR_munlockall + { __NR_munlockall, "munlockall" }, +#endif +#ifdef __NR_munmap + { __NR_munmap, "munmap" }, +#endif +#ifdef __NR_name_to_handle_at + { __NR_name_to_handle_at, "name_to_handle_at" }, +#endif +#ifdef __NR_nanosleep + { __NR_nanosleep, "nanosleep" }, +#endif +#ifdef __NR_newfstatat + { __NR_newfstatat, "newfstatat" }, +#endif +#ifdef __NR_nfsservctl + { __NR_nfsservctl, "nfsservctl" }, +#endif +#ifdef __NR_nice + { __NR_nice, "nice" }, +#endif +#ifdef __NR_oldfstat + { __NR_oldfstat, "oldfstat" }, +#endif +#ifdef __NR_oldlstat + { __NR_oldlstat, "oldlstat" }, +#endif +#ifdef __NR_oldolduname + { __NR_oldolduname, "oldolduname" }, +#endif +#ifdef __NR_oldstat + { __NR_oldstat, "oldstat" }, +#endif +#ifdef __NR_olduname + { __NR_olduname, "olduname" }, +#endif +#ifdef __NR_open + { __NR_open, "open" }, +#endif +#ifdef __NR_open_by_handle_at + { __NR_open_by_handle_at, "open_by_handle_at" }, +#endif +#ifdef __NR_openat + { __NR_openat, "openat" }, +#endif +#ifdef __NR_pause + { __NR_pause, "pause" }, +#endif +#ifdef __NR_perf_event_open + { __NR_perf_event_open, "perf_event_open" }, +#endif +#ifdef __NR_personality + { __NR_personality, "personality" }, +#endif +#ifdef __NR_pipe + { __NR_pipe, "pipe" }, +#endif +#ifdef __NR_pipe2 + { __NR_pipe2, "pipe2" }, +#endif +#ifdef __NR_pivot_root + { __NR_pivot_root, "pivot_root" }, +#endif +#ifdef __NR_poll + { __NR_poll, "poll" }, +#endif +#ifdef __NR_ppoll + { __NR_ppoll, "ppoll" }, +#endif +#ifdef __NR_prctl + { __NR_prctl, "prctl" }, +#endif +#ifdef __NR_pread64 + { __NR_pread64, "pread64" }, +#endif +#ifdef __NR_preadv + { __NR_preadv, "preadv" }, +#endif +#ifdef __NR_prlimit64 + { __NR_prlimit64, "prlimit64" }, +#endif +#ifdef __NR_process_vm_readv + { __NR_process_vm_readv, "process_vm_readv" }, +#endif +#ifdef __NR_process_vm_writev + { __NR_process_vm_writev, "process_vm_writev" }, +#endif +#ifdef __NR_prof + { __NR_prof, "prof" }, +#endif +#ifdef __NR_profil + { __NR_profil, "profil" }, +#endif +#ifdef __NR_pselect6 + { __NR_pselect6, "pselect6" }, +#endif +#ifdef __NR_ptrace + { __NR_ptrace, "ptrace" }, +#endif +#ifdef __NR_putpmsg + { __NR_putpmsg, "putpmsg" }, +#endif +#ifdef __NR_pwrite64 + { __NR_pwrite64, "pwrite64" }, +#endif +#ifdef __NR_pwritev + { __NR_pwritev, "pwritev" }, +#endif +#ifdef __NR_query_module + { __NR_query_module, "query_module" }, +#endif +#ifdef __NR_quotactl + { __NR_quotactl, "quotactl" }, +#endif +#ifdef __NR_read + { __NR_read, "read" }, +#endif +#ifdef __NR_readahead + { __NR_readahead, "readahead" }, +#endif +#ifdef __NR_readdir + { __NR_readdir, "readdir" }, +#endif +#ifdef __NR_readlink + { __NR_readlink, "readlink" }, +#endif +#ifdef __NR_readlinkat + { __NR_readlinkat, "readlinkat" }, +#endif +#ifdef __NR_readv + { __NR_readv, "readv" }, +#endif +#ifdef __NR_reboot + { __NR_reboot, "reboot" }, +#endif +#ifdef __NR_recvfrom + { __NR_recvfrom, "recvfrom" }, +#endif +#ifdef __NR_recvmmsg + { __NR_recvmmsg, "recvmmsg" }, +#endif +#ifdef __NR_recvmsg + { __NR_recvmsg, "recvmsg" }, +#endif +#ifdef __NR_remap_file_pages + { __NR_remap_file_pages, "remap_file_pages" }, +#endif +#ifdef __NR_removexattr + { __NR_removexattr, "removexattr" }, +#endif +#ifdef __NR_rename + { __NR_rename, "rename" }, +#endif +#ifdef __NR_renameat + { __NR_renameat, "renameat" }, +#endif +#ifdef __NR_request_key + { __NR_request_key, "request_key" }, +#endif +#ifdef __NR_restart_syscall + { __NR_restart_syscall, "restart_syscall" }, +#endif +#ifdef __NR_rmdir + { __NR_rmdir, "rmdir" }, +#endif +#ifdef __NR_rt_sigaction + { __NR_rt_sigaction, "rt_sigaction" }, +#endif +#ifdef __NR_rt_sigpending + { __NR_rt_sigpending, "rt_sigpending" }, +#endif +#ifdef __NR_rt_sigprocmask + { __NR_rt_sigprocmask, "rt_sigprocmask" }, +#endif +#ifdef __NR_rt_sigqueueinfo + { __NR_rt_sigqueueinfo, "rt_sigqueueinfo" }, +#endif +#ifdef __NR_rt_sigreturn + { __NR_rt_sigreturn, "rt_sigreturn" }, +#endif +#ifdef __NR_rt_sigsuspend + { __NR_rt_sigsuspend, "rt_sigsuspend" }, +#endif +#ifdef __NR_rt_sigtimedwait + { __NR_rt_sigtimedwait, "rt_sigtimedwait" }, +#endif +#ifdef __NR_rt_tgsigqueueinfo + { __NR_rt_tgsigqueueinfo, "rt_tgsigqueueinfo" }, +#endif +#ifdef __NR_sched_get_priority_max + { __NR_sched_get_priority_max, "sched_get_priority_max" }, +#endif +#ifdef __NR_sched_get_priority_min + { __NR_sched_get_priority_min, "sched_get_priority_min" }, +#endif +#ifdef __NR_sched_getaffinity + { __NR_sched_getaffinity, "sched_getaffinity" }, +#endif +#ifdef __NR_sched_getparam + { __NR_sched_getparam, "sched_getparam" }, +#endif +#ifdef __NR_sched_getscheduler + { __NR_sched_getscheduler, "sched_getscheduler" }, +#endif +#ifdef __NR_sched_rr_get_interval + { __NR_sched_rr_get_interval, "sched_rr_get_interval" }, +#endif +#ifdef __NR_sched_setaffinity + { __NR_sched_setaffinity, "sched_setaffinity" }, +#endif +#ifdef __NR_sched_setparam + { __NR_sched_setparam, "sched_setparam" }, +#endif +#ifdef __NR_sched_setscheduler + { __NR_sched_setscheduler, "sched_setscheduler" }, +#endif +#ifdef __NR_sched_yield + { __NR_sched_yield, "sched_yield" }, +#endif +#ifdef __NR_security + { __NR_security, "security" }, +#endif +#ifdef __NR_select + { __NR_select, "select" }, +#endif +#ifdef __NR_semctl + { __NR_semctl, "semctl" }, +#endif +#ifdef __NR_semget + { __NR_semget, "semget" }, +#endif +#ifdef __NR_semop + { __NR_semop, "semop" }, +#endif +#ifdef __NR_semtimedop + { __NR_semtimedop, "semtimedop" }, +#endif +#ifdef __NR_sendfile + { __NR_sendfile, "sendfile" }, +#endif +#ifdef __NR_sendfile64 + { __NR_sendfile64, "sendfile64" }, +#endif +#ifdef __NR_sendmmsg + { __NR_sendmmsg, "sendmmsg" }, +#endif +#ifdef __NR_sendmsg + { __NR_sendmsg, "sendmsg" }, +#endif +#ifdef __NR_sendto + { __NR_sendto, "sendto" }, +#endif +#ifdef __NR_set_mempolicy + { __NR_set_mempolicy, "set_mempolicy" }, +#endif +#ifdef __NR_set_robust_list + { __NR_set_robust_list, "set_robust_list" }, +#endif +#ifdef __NR_set_thread_area + { __NR_set_thread_area, "set_thread_area" }, +#endif +#ifdef __NR_set_tid_address + { __NR_set_tid_address, "set_tid_address" }, +#endif +#ifdef __NR_setdomainname + { __NR_setdomainname, "setdomainname" }, +#endif +#ifdef __NR_setfsgid + { __NR_setfsgid, "setfsgid" }, +#endif +#ifdef __NR_setfsgid32 + { __NR_setfsgid32, "setfsgid32" }, +#endif +#ifdef __NR_setfsuid + { __NR_setfsuid, "setfsuid" }, +#endif +#ifdef __NR_setfsuid32 + { __NR_setfsuid32, "setfsuid32" }, +#endif +#ifdef __NR_setgid + { __NR_setgid, "setgid" }, +#endif +#ifdef __NR_setgid32 + { __NR_setgid32, "setgid32" }, +#endif +#ifdef __NR_setgroups + { __NR_setgroups, "setgroups" }, +#endif +#ifdef __NR_setgroups32 + { __NR_setgroups32, "setgroups32" }, +#endif +#ifdef __NR_sethostname + { __NR_sethostname, "sethostname" }, +#endif +#ifdef __NR_setitimer + { __NR_setitimer, "setitimer" }, +#endif +#ifdef __NR_setns + { __NR_setns, "setns" }, +#endif +#ifdef __NR_setpgid + { __NR_setpgid, "setpgid" }, +#endif +#ifdef __NR_setpriority + { __NR_setpriority, "setpriority" }, +#endif +#ifdef __NR_setregid + { __NR_setregid, "setregid" }, +#endif +#ifdef __NR_setregid32 + { __NR_setregid32, "setregid32" }, +#endif +#ifdef __NR_setresgid + { __NR_setresgid, "setresgid" }, +#endif +#ifdef __NR_setresgid32 + { __NR_setresgid32, "setresgid32" }, +#endif +#ifdef __NR_setresuid + { __NR_setresuid, "setresuid" }, +#endif +#ifdef __NR_setresuid32 + { __NR_setresuid32, "setresuid32" }, +#endif +#ifdef __NR_setreuid + { __NR_setreuid, "setreuid" }, +#endif +#ifdef __NR_setreuid32 + { __NR_setreuid32, "setreuid32" }, +#endif +#ifdef __NR_setrlimit + { __NR_setrlimit, "setrlimit" }, +#endif +#ifdef __NR_setsid + { __NR_setsid, "setsid" }, +#endif +#ifdef __NR_setsockopt + { __NR_setsockopt, "setsockopt" }, +#endif +#ifdef __NR_settimeofday + { __NR_settimeofday, "settimeofday" }, +#endif +#ifdef __NR_setuid + { __NR_setuid, "setuid" }, +#endif +#ifdef __NR_setuid32 + { __NR_setuid32, "setuid32" }, +#endif +#ifdef __NR_setxattr + { __NR_setxattr, "setxattr" }, +#endif +#ifdef __NR_sgetmask + { __NR_sgetmask, "sgetmask" }, +#endif +#ifdef __NR_shmat + { __NR_shmat, "shmat" }, +#endif +#ifdef __NR_shmctl + { __NR_shmctl, "shmctl" }, +#endif +#ifdef __NR_shmdt + { __NR_shmdt, "shmdt" }, +#endif +#ifdef __NR_shmget + { __NR_shmget, "shmget" }, +#endif +#ifdef __NR_shutdown + { __NR_shutdown, "shutdown" }, +#endif +#ifdef __NR_sigaction + { __NR_sigaction, "sigaction" }, +#endif +#ifdef __NR_sigaltstack + { __NR_sigaltstack, "sigaltstack" }, +#endif +#ifdef __NR_signal + { __NR_signal, "signal" }, +#endif +#ifdef __NR_signalfd + { __NR_signalfd, "signalfd" }, +#endif +#ifdef __NR_signalfd4 + { __NR_signalfd4, "signalfd4" }, +#endif +#ifdef __NR_sigpending + { __NR_sigpending, "sigpending" }, +#endif +#ifdef __NR_sigprocmask + { __NR_sigprocmask, "sigprocmask" }, +#endif +#ifdef __NR_sigreturn + { __NR_sigreturn, "sigreturn" }, +#endif +#ifdef __NR_sigsuspend + { __NR_sigsuspend, "sigsuspend" }, +#endif +#ifdef __NR_socket + { __NR_socket, "socket" }, +#endif +#ifdef __NR_socketcall + { __NR_socketcall, "socketcall" }, +#endif +#ifdef __NR_socketpair + { __NR_socketpair, "socketpair" }, +#endif +#ifdef __NR_splice + { __NR_splice, "splice" }, +#endif +#ifdef __NR_ssetmask + { __NR_ssetmask, "ssetmask" }, +#endif +#ifdef __NR_stat + { __NR_stat, "stat" }, +#endif +#ifdef __NR_stat64 + { __NR_stat64, "stat64" }, +#endif +#ifdef __NR_statfs + { __NR_statfs, "statfs" }, +#endif +#ifdef __NR_statfs64 + { __NR_statfs64, "statfs64" }, +#endif +#ifdef __NR_stime + { __NR_stime, "stime" }, +#endif +#ifdef __NR_stty + { __NR_stty, "stty" }, +#endif +#ifdef __NR_swapoff + { __NR_swapoff, "swapoff" }, +#endif +#ifdef __NR_swapon + { __NR_swapon, "swapon" }, +#endif +#ifdef __NR_symlink + { __NR_symlink, "symlink" }, +#endif +#ifdef __NR_symlinkat + { __NR_symlinkat, "symlinkat" }, +#endif +#ifdef __NR_sync + { __NR_sync, "sync" }, +#endif +#ifdef __NR_sync_file_range + { __NR_sync_file_range, "sync_file_range" }, +#endif +#ifdef __NR_syncfs + { __NR_syncfs, "syncfs" }, +#endif +#ifdef __NR_sysfs + { __NR_sysfs, "sysfs" }, +#endif +#ifdef __NR_sysinfo + { __NR_sysinfo, "sysinfo" }, +#endif +#ifdef __NR_syslog + { __NR_syslog, "syslog" }, +#endif +#ifdef __NR_tee + { __NR_tee, "tee" }, +#endif +#ifdef __NR_tgkill + { __NR_tgkill, "tgkill" }, +#endif +#ifdef __NR_time + { __NR_time, "time" }, +#endif +#ifdef __NR_timer_create + { __NR_timer_create, "timer_create" }, +#endif +#ifdef __NR_timer_delete + { __NR_timer_delete, "timer_delete" }, +#endif +#ifdef __NR_timer_getoverrun + { __NR_timer_getoverrun, "timer_getoverrun" }, +#endif +#ifdef __NR_timer_gettime + { __NR_timer_gettime, "timer_gettime" }, +#endif +#ifdef __NR_timer_settime + { __NR_timer_settime, "timer_settime" }, +#endif +#ifdef __NR_timerfd_create + { __NR_timerfd_create, "timerfd_create" }, +#endif +#ifdef __NR_timerfd_gettime + { __NR_timerfd_gettime, "timerfd_gettime" }, +#endif +#ifdef __NR_timerfd_settime + { __NR_timerfd_settime, "timerfd_settime" }, +#endif +#ifdef __NR_times + { __NR_times, "times" }, +#endif +#ifdef __NR_tkill + { __NR_tkill, "tkill" }, +#endif +#ifdef __NR_truncate + { __NR_truncate, "truncate" }, +#endif +#ifdef __NR_truncate64 + { __NR_truncate64, "truncate64" }, +#endif +#ifdef __NR_tuxcall + { __NR_tuxcall, "tuxcall" }, +#endif +#ifdef __NR_ugetrlimit + { __NR_ugetrlimit, "ugetrlimit" }, +#endif +#ifdef __NR_ulimit + { __NR_ulimit, "ulimit" }, +#endif +#ifdef __NR_umask + { __NR_umask, "umask" }, +#endif +#ifdef __NR_umount + { __NR_umount, "umount" }, +#endif +#ifdef __NR_umount2 + { __NR_umount2, "umount2" }, +#endif +#ifdef __NR_uname + { __NR_uname, "uname" }, +#endif +#ifdef __NR_unlink + { __NR_unlink, "unlink" }, +#endif +#ifdef __NR_unlinkat + { __NR_unlinkat, "unlinkat" }, +#endif +#ifdef __NR_unshare + { __NR_unshare, "unshare" }, +#endif +#ifdef __NR_uselib + { __NR_uselib, "uselib" }, +#endif +#ifdef __NR_ustat + { __NR_ustat, "ustat" }, +#endif +#ifdef __NR_utime + { __NR_utime, "utime" }, +#endif +#ifdef __NR_utimensat + { __NR_utimensat, "utimensat" }, +#endif +#ifdef __NR_utimes + { __NR_utimes, "utimes" }, +#endif +#ifdef __NR_vfork + { __NR_vfork, "vfork" }, +#endif +#ifdef __NR_vhangup + { __NR_vhangup, "vhangup" }, +#endif +#ifdef __NR_vm86 + { __NR_vm86, "vm86" }, +#endif +#ifdef __NR_vm86old + { __NR_vm86old, "vm86old" }, +#endif +#ifdef __NR_vmsplice + { __NR_vmsplice, "vmsplice" }, +#endif +#ifdef __NR_vserver + { __NR_vserver, "vserver" }, +#endif +#ifdef __NR_wait4 + { __NR_wait4, "wait4" }, +#endif +#ifdef __NR_waitid + { __NR_waitid, "waitid" }, +#endif +#ifdef __NR_waitpid + { __NR_waitpid, "waitpid" }, +#endif +#ifdef __NR_write + { __NR_write, "write" }, +#endif +#ifdef __NR_writev + { __NR_writev, "writev" }, +#endif + {0, NULL} +}; + diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 7067a72..743d79d 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -1444,6 +1444,24 @@ install_syscall_filter(sandbox_cfg_t* cfg) return (rc < 0 ? -rc : rc); } +#include "linux_syscalls.inc" +static const char * +get_syscall_name(int syscall_num) +{ + int i; + for (i = 0; SYSCALLS_BY_NUMBER[i].syscall_name; ++i) { + if (SYSCALLS_BY_NUMBER[i].syscall_num == syscall_num) + return SYSCALLS_BY_NUMBER[i].syscall_name; + } + + { + static char syscall_name_buf[64]; + format_dec_number_sigsafe(syscall_num, + syscall_name_buf, sizeof(syscall_name_buf)); + return syscall_name_buf; + } +} + #ifdef USE_BACKTRACE #define MAX_DEPTH 256 static void *syscall_cb_buf[MAX_DEPTH]; @@ -1458,7 +1476,7 @@ static void sigsys_debugging(int nr, siginfo_t *info, void *void_context) { ucontext_t *ctx = (ucontext_t *) (void_context); - char number[32]; + const char *syscall_name; int syscall; #ifdef USE_BACKTRACE int depth; @@ -1483,9 +1501,10 @@ sigsys_debugging(int nr, siginfo_t *info, void *void_context) clean_backtrace(syscall_cb_buf, depth, ctx); #endif - format_dec_number_sigsafe(syscall, number, sizeof(number)); + syscall_name = get_syscall_name(syscall); + tor_log_err_sigsafe("(Sandbox) Caught a bad syscall attempt (syscall ", - number, + syscall_name, ")\n", NULL);

1 0

[tor/master] Merge remote-tracking branch 'public/sandbox_fixes_rebased_2'
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 4367cbd71b7a7b53e191b54a67ee6cbc00651024 Merge: 250b84b 506c890 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 23:45:55 2014 -0400 Merge remote-tracking branch 'public/sandbox_fixes_rebased_2' changes/sandbox_fixes_11351 | 13 + configure.ac | 1 + src/common/compat.c | 14 +- src/common/compat.h | 1 + src/common/compat_libevent.c | 19 + src/common/compat_libevent.h | 2 + src/common/crypto.c | 1 + src/common/gen_linux_syscalls.pl | 37 ++ src/common/include.am | 1 + src/common/linux_syscalls.inc | 1153 ++++++++++++++++++++++++++++++++++++++ src/common/sandbox.c | 434 +++++++++----- src/common/sandbox.h | 65 +-- src/common/util.c | 2 + src/or/config.c | 68 ++- src/or/dns.c | 2 + src/or/main.c | 167 ++++-- src/or/statefile.c | 3 +- 17 files changed, 1742 insertions(+), 241 deletions(-)

1 0

[tor/master] Fix some initial sandbox issues.
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit ae9d6d73f50f6205f0651a627d3bf7b0d99273f1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 28 01:52:08 2014 -0400 Fix some initial sandbox issues. Allow files that weren't in the list; Allow the _sysctl syscall; allow accept4 with CLOEXEC and NONBLOCK. --- src/common/sandbox.c | 6 ++++++ src/or/main.c | 9 +++++++++ 2 files changed, 15 insertions(+) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 0548f3e..299c6f2 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -124,6 +124,7 @@ static int filter_nopar_gen[] = { SCMP_SYS(rename), SCMP_SYS(rt_sigreturn), SCMP_SYS(set_robust_list), + SCMP_SYS(_sysctl), #ifdef __NR_sigreturn SCMP_SYS(sigreturn), #endif @@ -249,6 +250,11 @@ sb_accept4(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (rc) { return rc; } + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(accept4), 1, + SCMP_CMP(3, SCMP_CMP_EQ, SOCK_CLOEXEC|SOCK_NONBLOCK)); + if (rc) { + return rc; + } return 0; } diff --git a/src/or/main.c b/src/or/main.c index 0264064..1614954 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2732,8 +2732,11 @@ sandbox_init_filter(void) get_datadir_fname("cached-certs"), 1, get_datadir_fname("cached-certs.tmp"), 1, get_datadir_fname("cached-consensus"), 1, + get_datadir_fname("cached-consensus.tmp"), 1, get_datadir_fname("unverified-consensus"), 1, get_datadir_fname("unverified-consensus.tmp"), 1, + get_datadir_fname("unverified-microdesc-consensus"), 1, + get_datadir_fname("unverified-microdesc-consensus.tmp"), 1, get_datadir_fname("cached-microdesc-consensus"), 1, get_datadir_fname("cached-microdesc-consensus.tmp"), 1, get_datadir_fname("cached-microdescs"), 1, @@ -2747,9 +2750,15 @@ sandbox_init_filter(void) get_datadir_fname("cached-descriptors.new.tmp"), 1, get_datadir_fname("cached-descriptors.tmp.tmp"), 1, get_datadir_fname("cached-extrainfo"), 1, + get_datadir_fname("cached-extrainfo.new"), 1, + get_datadir_fname("cached-extrainfo.tmp"), 1, + get_datadir_fname("cached-extrainfo.new.tmp"), 1, + get_datadir_fname("cached-extrainfo.tmp.tmp"), 1, get_datadir_fname("state.tmp"), 1, get_datadir_fname("unparseable-desc.tmp"), 1, get_datadir_fname("unparseable-desc"), 1, + get_datadir_fname("v3-status-votes"), 1, + get_datadir_fname("v3-status-votes.tmp"), 1, "/dev/srandom", 0, "/dev/urandom", 0, "/dev/random", 0,

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits April 2014