April 2014 - tor-commits - lists.torproject.org

[tor/master] Close orconns correctly through channels when setting DisableNetwork to 1
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit a5544e589d1724fc2765b277da736bbb2a9a8299 Author: Andrea Shepard <andrea(a)torproject.org> Date: Tue Apr 15 20:19:39 2014 -0700 Close orconns correctly through channels when setting DisableNetwork to 1 --- changes/bug11306 | 4 ++++ src/or/connection.c | 14 ++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/changes/bug11306 b/changes/bug11306 new file mode 100644 index 0000000..bf8ea40 --- /dev/null +++ b/changes/bug11306 @@ -0,0 +1,4 @@ + o Bugfixes: + - When closing all connections on setting DisableNetwork to 1, use + connection_or_close_normally() rather than closing orconns out from + under the channel layer. Fixes bug #11306. diff --git a/src/or/connection.c b/src/or/connection.c index 1be4c45..0c61b0d 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -2359,6 +2359,20 @@ connection_mark_all_noncontrol_connections(void) connection_mark_unattached_ap(TO_ENTRY_CONN(conn), END_STREAM_REASON_HIBERNATING); break; + case CONN_TYPE_OR: + { + or_connection_t *orconn = TO_OR_CONN(conn); + if (orconn->chan) { + connection_or_close_normally(orconn, 0); + } else { + /* + * There should have been one, but mark for close and hope + * for the best.. + */ + connection_mark_for_close(conn); + } + } + break; default: connection_mark_for_close(conn); break;

1 0

[tor/master] Call connection_or_close_for_error() properly if write_to_buf() ever fails on an orconn
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 6ee9138576ae289c4ed726ddbb7b3f547f111f70 Author: Andrea Shepard <andrea(a)torproject.org> Date: Tue Apr 15 21:25:49 2014 -0700 Call connection_or_close_for_error() properly if write_to_buf() ever fails on an orconn --- changes/bug11304 | 5 +++++ src/or/connection.c | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/changes/bug11304 b/changes/bug11304 new file mode 100644 index 0000000..2ea165f --- /dev/null +++ b/changes/bug11304 @@ -0,0 +1,5 @@ + o Bugfixes: + - If write_to_buf() in connection_write_to_buf_impl_() ever fails, + check if it's an or_connection_t and correctly call + connection_or_close_for_error() rather than connection_mark_for_close() + directly. Fixes bug #11304. diff --git a/src/or/connection.c b/src/or/connection.c index 1be4c45..5f9eecb 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -4009,6 +4009,12 @@ connection_write_to_buf_impl_,(const char *string, size_t len, "write_to_buf failed. Closing circuit (fd %d).", (int)conn->s); circuit_mark_for_close(circuit_get_by_edge_conn(TO_EDGE_CONN(conn)), END_CIRC_REASON_INTERNAL); + } else if (conn->type == CONN_TYPE_OR) { + or_connection_t *orconn = TO_OR_CONN(conn); + log_warn(LD_NET, + "write_to_buf failed on an orconn; notifying of error " + "(fd %d)", (int)(conn->s)); + connection_or_close_for_error(orconn, 0); } else { log_warn(LD_NET, "write_to_buf failed. Closing connection (fd %d).",

1 0

[tor/master] Avoid redundant calls to connection_mark_for_close() on listeners when setting DisableNetwork to 1
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit f36e93206a20b37321b372802032d3dec481856d Author: Andrea Shepard <andrea(a)torproject.org> Date: Tue Apr 15 20:35:31 2014 -0700 Avoid redundant calls to connection_mark_for_close() on listeners when setting DisableNetwork to 1 --- src/or/config.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/or/config.c b/src/or/config.c index ca99d01..3089c6f 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1178,10 +1178,13 @@ options_act_reversible(const or_options_t *old_options, char **msg) SMARTLIST_FOREACH(replaced_listeners, connection_t *, conn, { + int marked = conn->marked_for_close; log_notice(LD_NET, "Closing old %s on %s:%d", conn_type_to_string(conn->type), conn->address, conn->port); connection_close_immediate(conn); - connection_mark_for_close(conn); + if (!marked) { + connection_mark_for_close(conn); + } }); goto done;

1 0

[tor/master] Merge remote-tracking branch 'andrea/bug11306'
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 74ddd5f739696749409c933f82cf3a93152da6cc Merge: 10174b0 f36e932 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 23:13:27 2014 -0400 Merge remote-tracking branch 'andrea/bug11306' changes/bug11306 | 4 ++++ src/or/config.c | 5 ++++- src/or/connection.c | 14 ++++++++++++++ 3 files changed, 22 insertions(+), 1 deletion(-)

1 0

[tor/master] New --enable-expensive-hardening option
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 64f62881d8578ebf98d35d2731f7e6b51a565a09 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Apr 14 17:10:34 2014 -0400 New --enable-expensive-hardening option It turns on -fsanitize=address and -fsanitize=ubsan if they work. Most relays won't want this. Some clients may. Ticket 11477. --- changes/bug11477 | 4 ++++ configure.ac | 19 +++++++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/changes/bug11477 b/changes/bug11477 new file mode 100644 index 0000000..44bdba9 --- /dev/null +++ b/changes/bug11477 @@ -0,0 +1,4 @@ + o Minor features: + - New --enable-expensive-hardening option to turn on security hardening + options that consume nontrivial amounts of CPU and memory. Right now, + this includes AddressSanitizer and UbSan. Closes ticket 11477. diff --git a/configure.ac b/configure.ac index 6e41041..1f06755 100644 --- a/configure.ac +++ b/configure.ac @@ -129,13 +129,13 @@ AC_ARG_ENABLE(gcc-warnings, AC_ARG_ENABLE(gcc-warnings-advisory, AS_HELP_STRING(--enable-gcc-warnings-advisory, [enable verbose warnings, excluding -Werror])) -dnl Adam shostack suggests the following for Windows: -dnl -D_FORTIFY_SOURCE=2 -fstack-protector-all dnl Others suggest '/gs /safeseh /nxcompat /dynamicbase' for non-gcc on Windows -dnl This requires that we use gcc and that we add -O2 to the CFLAGS. AC_ARG_ENABLE(gcc-hardening, AS_HELP_STRING(--disable-gcc-hardening, disable compiler security checks)) +AC_ARG_ENABLE(expensive-hardening, + AS_HELP_STRING(--enable-expensive-hardening, enable more expensive compiler hardening; makes Tor slower)) + dnl Linker hardening options dnl Currently these options are ELF specific - you can't use this with MacOSX AC_ARG_ENABLE(linker-hardening, @@ -628,6 +628,12 @@ if test x$enable_gcc_hardening != xno; then fi fi +if test x$enable_expensive_hardening = xyes ; then + TOR_CHECK_CFLAGS([-fsanitize=address]) + TOR_CHECK_CFLAGS([-fsanitize=undefined]) + TOR_CHECK_CFLAGS([-fno-omit-frame-pointer]) +fi + if test x$enable_linker_hardening != xno; then TOR_CHECK_LDFLAGS(-z relro -z now, "$all_ldflags_for_check", "$all_libs_for_check") fi @@ -640,10 +646,11 @@ dnl Now see if we have a -fomit-frame-pointer compiler option. saved_CFLAGS="$CFLAGS" TOR_CHECK_CFLAGS(-fomit-frame-pointer) +F_OMIT_FRAME_POINTER='' if test "$saved_CFLAGS" != "$CFLAGS"; then - F_OMIT_FRAME_POINTER='-fomit-frame-pointer' -else - F_OMIT_FRAME_POINTER='' + if test x$enable_expensive_hardening != xyes ; then + F_OMIT_FRAME_POINTER='-fomit-frame-pointer' + fi fi CFLAGS="$saved_CFLAGS" AC_SUBST(F_OMIT_FRAME_POINTER)

1 0

[tor/master] Merge remote-tracking branch 'public/bug11477'
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 10174b00e7258cc8184e85c37a2a39b04a0df92e Merge: 9736613 64f6288 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 23:06:39 2014 -0400 Merge remote-tracking branch 'public/bug11477' changes/bug11477 | 4 ++++ configure.ac | 19 +++++++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-)

1 0

[tor/master] Educate tor on OpenBSD's use of divert-to rules with the pf firewall.
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit f680d0fdd2e42bce109219ed78d0527d16995415 Author: dana koch <dsk(a)google.com> Date: Mon Feb 10 21:23:51 2014 +1100 Educate tor on OpenBSD's use of divert-to rules with the pf firewall. This means that tor can run without needing to communicate with ioctls to the firewall, and therefore doesn't need to run with privileges to open the /dev/pf device node. A new TransProxyType is added for this purpose, "pf-divert"; if the user specifies this TransProxyType in their torrc, then the pf device node is never opened and the connection destination is determined with getsockname (as per pf(4)). The default behaviour (ie., when TransProxyType is "default" when using the pf firewall) is still to assume that pf is configured with rdr-to rules. --- doc/tor.1.txt | 17 ++++++++---- src/or/config.c | 8 +++++- src/or/connection_edge.c | 64 ++++++++++++++++++++++++++++++++++++---------- src/or/or.h | 7 ++++- 4 files changed, 76 insertions(+), 20 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 1a5ced8..d1556a5 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1196,12 +1196,12 @@ The following options are useful only for clients (that is, if compatibility, TransListenAddress is only allowed when TransPort is just a port number.) -[[TransProxyType]] **TransProxyTYpe** **default**|**TPROXY**|**ipfw**:: +[[TransProxyType]] **TransProxyTYpe** **default**|**TPROXY**|**ipfw**|**pf-divert**:: TransProxyType may only be enabled when there is transparent proxy listener enabled. + - Set this to TPROXY if you wish to be able to use the TPROXY Linux module to - transparently proxy connections that are configured using the TransPort + Set this to "TPROXY" if you wish to be able to use the TPROXY Linux module + to transparently proxy connections that are configured using the TransPort option. This setting lets the listener on the TransPort accept connections for all addresses, even when the TransListenAddress is configured for an internal address. Detailed information on how to configure the TPROXY @@ -1210,8 +1210,15 @@ The following options are useful only for clients (that is, if + Set this option to "ipfw" to use the FreeBSD ipfw interface. + - Set this option to "default", or leave it unconfigured, to use regular - IPTables on Linux, or to use pf on the *BSD operating systems. + On *BSD operating systems when using pf, set this to "pf-divert" to take + advantage of +divert-to+ rules, which do not modify the packets like + +rdr-to+ rules do. Detailed information on how to configure pf to use + +divert-to+ rules can be found in the pf.conf(5) manual page. On OpenBSD, + +divert-to+ is available to use on versions greater than or equal to + OpenBSD 4.4. + + + Set this to "default", or leave it unconfigured, to use regular IPTables + on Linux, or to use pf +rdr-to+ rules on *BSD systems. + (Default: "default".) diff --git a/src/or/config.c b/src/or/config.c index 55a23b1..e22d3b8 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1089,7 +1089,7 @@ options_act_reversible(const or_options_t *old_options, char **msg) #if defined(HAVE_NET_IF_H) && defined(HAVE_NET_PFVAR_H) /* Open /dev/pf before dropping privileges. */ - if (options->TransPort_set && options->TransProxyType_parsed != TPT_IPFW) { + if (options->TransPort_set && options->TransProxyType_parsed == TPT_DEFAULT) { if (get_pf_socket() < 0) { *msg = tor_strdup("Unable to open /dev/pf for transparent proxy."); goto rollback; @@ -2553,6 +2553,12 @@ options_validate(or_options_t *old_options, or_options_t *options, if (options->TransProxyType) { if (!strcasecmp(options->TransProxyType, "default")) { options->TransProxyType_parsed = TPT_DEFAULT; + } else if (!strcasecmp(options->TransProxyType, "pf-divert")) { +#ifdef __linux__ + REJECT("pf is a BSD-specific feature."); +#else + options->TransProxyType_parsed = TPT_PF_DIVERT; +#endif } else if (!strcasecmp(options->TransProxyType, "tproxy")) { #ifndef __linux__ REJECT("TPROXY is a Linux-specific feature."); diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 2ece2e4..04e60b9 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1391,35 +1391,43 @@ get_pf_socket(void) } #endif -/** Fetch the original destination address and port from a - * system-specific interface and put them into a - * socks_request_t as if they came from a socks request. - * - * Return -1 if an error prevents fetching the destination, - * else return 0. - */ -static int -connection_ap_get_original_destination(entry_connection_t *conn, - socks_request_t *req) +static int +destination_from_socket(entry_connection_t *conn, socks_request_t *req) { -#ifdef TRANS_NETFILTER - /* Linux 2.4+ */ struct sockaddr_storage orig_dst; socklen_t orig_dst_len = sizeof(orig_dst); tor_addr_t addr; +#ifdef TRANS_NETFILTER if (getsockopt(ENTRY_TO_CONN(conn)->s, SOL_IP, SO_ORIGINAL_DST, (struct sockaddr*)&orig_dst, &orig_dst_len) < 0) { int e = tor_socket_errno(ENTRY_TO_CONN(conn)->s); log_warn(LD_NET, "getsockopt() failed: %s", tor_socket_strerror(e)); return -1; } +#elif defined(TRANS_PF) + if (getsockname(ENTRY_TO_CONN(conn)->s, (struct sockaddr*)&orig_dst, + &orig_dst_len) < 0) { + int e = tor_socket_errno(ENTRY_TO_CONN(conn)->s); + log_warn(LD_NET, "getsockname() failed: %s", tor_socket_strerror(e)); + return -1; + } +#else + (void)conn; + (void)req; + log_warn(LD_BUG, "Unable to determine destination from socket."); + return -1; +#endif tor_addr_from_sockaddr(&addr, (struct sockaddr*)&orig_dst, &req->port); tor_addr_to_str(req->address, &addr, sizeof(req->address), 1); return 0; -#elif defined(TRANS_PF) +} + +static int +destination_from_pf(entry_connection_t *conn, socks_request_t *req) +{ struct sockaddr_storage proxy_addr; socklen_t proxy_addr_len = sizeof(proxy_addr); struct sockaddr *proxy_sa = (struct sockaddr*) &proxy_addr; @@ -1496,6 +1504,36 @@ connection_ap_get_original_destination(entry_connection_t *conn, req->port = ntohs(pnl.rdport); return 0; +} + + +/** Fetch the original destination address and port from a + * system-specific interface and put them into a + * socks_request_t as if they came from a socks request. + * + * Return -1 if an error prevents fetching the destination, + * else return 0. + */ +static int +connection_ap_get_original_destination(entry_connection_t *conn, + socks_request_t *req) +{ +#ifdef TRANS_NETFILTER + return destination_from_socket(conn, req); +#elif defined(TRANS_PF) + const or_options_t *options = get_options(); + + if (options->TransProxyType_parsed == TPT_PF_DIVERT) + return destination_from_socket(conn, req); + + if (options->TransProxyType_parsed == TPT_DEFAULT) + return destination_from_pf(conn, req); + + (void)conn; + (void)req; + log_warn(LD_BUG, "Proxy destination determination mechanism %s unknown.", + options->TransProxyType); + return -1; #else (void)conn; (void)req; diff --git a/src/or/or.h b/src/or/or.h index a5e2e70..5510af7 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3461,7 +3461,12 @@ typedef struct { const char *TransProxyType; /**< What kind of transparent proxy * implementation are we using? */ /** Parsed value of TransProxyType. */ - enum { TPT_DEFAULT, TPT_TPROXY, TPT_IPFW } TransProxyType_parsed; + enum { + TPT_DEFAULT, + TPT_PF_DIVERT, + TPT_IPFW, + TPT_TPROXY, + } TransProxyType_parsed; config_line_t *NATDPort_lines; /**< Ports to listen on for transparent natd * connections. */ config_line_t *ControlPort_lines; /**< Ports to listen on for control

1 0

[tor/master] tor_addr_from_sockaddr() is applicable in ipfw code, so use it.
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 08ef8c0958ebeb134e4f29d1738c85c0ac81e71d Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 3 14:13:08 2014 -0500 tor_addr_from_sockaddr() is applicable in ipfw code, so use it. --- src/or/connection_edge.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index ddeac10..2ece2e4 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1439,15 +1439,7 @@ connection_ap_get_original_destination(entry_connection_t *conn, if (get_options()->TransProxyType_parsed == TPT_IPFW) { /* ipfw(8) is used and in this case getsockname returned the original destination */ - if (proxy_sa->sa_family == AF_INET) { - struct sockaddr_in *dest_addr4 = (struct sockaddr_in *)proxy_sa; - tor_addr_from_ipv4n(&addr, dest_addr4->sin_addr.s_addr); - req->port = ntohs(dest_addr4->sin_port); - } else if (proxy_sa->sa_family == AF_INET6) { - struct sockaddr_in6 *dest_addr6 = (struct sockaddr_in6 *)proxy_sa; - tor_addr_from_in6(&addr, &dest_addr6->sin6_addr); - req->port = ntohs(dest_addr6->sin6_port); - } else { + if (tor_addr_from_sockaddr(&addr, proxy_sa, &req->port) < 0) { tor_fragile_assert(); return -1; }

1 0

[tor/master] Whitespace, doc fixes
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit db8259c23035a802610ece3dd437cd3ccc32ac9d Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Apr 3 16:41:54 2014 -0400 Whitespace, doc fixes --- src/or/config.c | 3 ++- src/or/connection_edge.c | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index e22d3b8..f0ee322 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1089,7 +1089,8 @@ options_act_reversible(const or_options_t *old_options, char **msg) #if defined(HAVE_NET_IF_H) && defined(HAVE_NET_PFVAR_H) /* Open /dev/pf before dropping privileges. */ - if (options->TransPort_set && options->TransProxyType_parsed == TPT_DEFAULT) { + if (options->TransPort_set && + options->TransProxyType_parsed == TPT_DEFAULT) { if (get_pf_socket() < 0) { *msg = tor_strdup("Unable to open /dev/pf for transparent proxy."); goto rollback; diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 04e60b9..f294842 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1391,7 +1391,9 @@ get_pf_socket(void) } #endif -static int +/** Try fill in the address of req from the socket configured + * with conn. */ +static int destination_from_socket(entry_connection_t *conn, socks_request_t *req) { struct sockaddr_storage orig_dst; @@ -1506,7 +1508,6 @@ destination_from_pf(entry_connection_t *conn, socks_request_t *req) return 0; } - /** Fetch the original destination address and port from a * system-specific interface and put them into a * socks_request_t as if they came from a socks request.

1 0

[tor/master] Fix OSX compilation.
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit c00c45fee133cbb21f69321fa7715a9f7d91164d Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Apr 3 16:54:31 2014 -0400 Fix OSX compilation. --- src/or/connection_edge.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index f294842..a8ad9ec 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1391,6 +1391,7 @@ get_pf_socket(void) } #endif +#if defined(TRANS_NETFILTER) || defined(TRANS_PF) /** Try fill in the address of req from the socket configured * with conn. */ static int @@ -1426,7 +1427,9 @@ destination_from_socket(entry_connection_t *conn, socks_request_t *req) return 0; } +#endif +#ifdef TRANS_PF static int destination_from_pf(entry_connection_t *conn, socks_request_t *req) { @@ -1507,6 +1510,7 @@ destination_from_pf(entry_connection_t *conn, socks_request_t *req) return 0; } +#endif /** Fetch the original destination address and port from a * system-specific interface and put them into a

1 0