April 2014 - tor-commits - lists.torproject.org

[tor/master] Merge branch '10267_plus_10896_rebased_twice'
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 973661394abc393e3dfd5b82de86659ecadc72a4 Merge: 211b8cc f9719b0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 23:03:41 2014 -0400 Merge branch '10267_plus_10896_rebased_twice' changes/10267_tproxy | 4 +++ changes/10896 | 8 +++++ doc/tor.1.txt | 17 +++++++--- src/or/config.c | 15 ++++++++- src/or/connection_edge.c | 82 +++++++++++++++++++++++++++++++++++++++------- src/or/or.h | 7 +++- 6 files changed, 115 insertions(+), 18 deletions(-)

1 0

[tor/master] Call pf-divert openbsd-specific, not no-linux
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 89e520e2a710267c32b5afa03d32924646f78b28 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Apr 3 17:00:22 2014 -0400 Call pf-divert openbsd-specific, not no-linux --- src/or/config.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index f0ee322..3179018 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -2555,8 +2555,8 @@ options_validate(or_options_t *old_options, or_options_t *options, if (!strcasecmp(options->TransProxyType, "default")) { options->TransProxyType_parsed = TPT_DEFAULT; } else if (!strcasecmp(options->TransProxyType, "pf-divert")) { -#ifdef __linux__ - REJECT("pf is a BSD-specific feature."); +#ifndef __OpenBSD__ + REJECT("pf-divert is a OpenBSD-specific feature."); #else options->TransProxyType_parsed = TPT_PF_DIVERT; #endif

1 0

[tor/master] Changes file for 10896
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit f9719b078141fb1a4a0eee281031c73cffde7c30 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Apr 3 17:05:31 2014 -0400 Changes file for 10896 --- changes/10896 | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/changes/10896 b/changes/10896 new file mode 100644 index 0000000..278815e --- /dev/null +++ b/changes/10896 @@ -0,0 +1,8 @@ + o Minor features: + - Support OpenBSD's divert-to rules with the pf firewall, when + "TransProxyType pf-divert" is specified. This allows Tor to run a + TransPort transparent proxy port on OpenBSD 4.4 or later without + root privileges. See the pf.conf(5) manual page for information on + configuring pf to use divert-to rules. Closes ticket 10896; patch + from Dana Koch. +

1 0

[tor/master] ipfw TransPort support on FreeBSD (10267)
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 3e4680f3126c2a06358535b08bf267dca1bb90a7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 3 14:09:07 2014 -0500 ipfw TransPort support on FreeBSD (10267) This isn't on by default; to get it, you need to set "TransProxyType ipfw". (The original patch had automatic detection for whether /dev/pf is present and openable, but that seems marginally fragile.) --- changes/10267_tproxy | 4 ++++ doc/tor.1.txt | 8 +++++--- src/or/config.c | 8 +++++++- src/or/connection_edge.c | 23 +++++++++++++++++++++++ src/or/or.h | 2 +- 5 files changed, 40 insertions(+), 5 deletions(-) diff --git a/changes/10267_tproxy b/changes/10267_tproxy new file mode 100644 index 0000000..f65e4a2 --- /dev/null +++ b/changes/10267_tproxy @@ -0,0 +1,4 @@ + o Minor features: + - Support the ipfw firewall interface for transparent proxy support on + FreeBSD. To enable it, set "TransProxyType ipfw" in your torrc. + Resolves ticket 10267; patch from "yurivict". diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 1cc8f84..1a5ced8 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1196,7 +1196,7 @@ The following options are useful only for clients (that is, if compatibility, TransListenAddress is only allowed when TransPort is just a port number.) -[[TransProxyType]] **TransProxyTYpe** **default**|**TPROXY**:: +[[TransProxyType]] **TransProxyTYpe** **default**|**TPROXY**|**ipfw**:: TransProxyType may only be enabled when there is transparent proxy listener enabled. + @@ -1208,8 +1208,10 @@ The following options are useful only for clients (that is, if feature can be found in the Linux kernel source tree in the file Documentation/networking/tproxy.txt. + - Set this to "default", or leave it unconfigured, to use regular IPTables - on Linux, or to use pf on the *BSD operating systems. + Set this option to "ipfw" to use the FreeBSD ipfw interface. + + + Set this option to "default", or leave it unconfigured, to use regular + IPTables on Linux, or to use pf on the *BSD operating systems. + (Default: "default".) diff --git a/src/or/config.c b/src/or/config.c index 4a6b301..55a23b1 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1089,7 +1089,7 @@ options_act_reversible(const or_options_t *old_options, char **msg) #if defined(HAVE_NET_IF_H) && defined(HAVE_NET_PFVAR_H) /* Open /dev/pf before dropping privileges. */ - if (options->TransPort_set) { + if (options->TransPort_set && options->TransProxyType_parsed != TPT_IPFW) { if (get_pf_socket() < 0) { *msg = tor_strdup("Unable to open /dev/pf for transparent proxy."); goto rollback; @@ -2559,6 +2559,12 @@ options_validate(or_options_t *old_options, or_options_t *options, #else options->TransProxyType_parsed = TPT_TPROXY; #endif + } else if (!strcasecmp(options->TransProxyType, "ipfw")) { +#ifndef __FreeBSD__ + REJECT("ipfw is a FreeBSD-specific feature."); +#else + options->TransProxyType_parsed = TPT_IPFW; +#endif } else { REJECT("Unrecognized value for TransProxyType"); } diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 41ca611..ddeac10 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1435,6 +1435,29 @@ connection_ap_get_original_destination(entry_connection_t *conn, return -1; } +#ifdef __FreeBSD__ + if (get_options()->TransProxyType_parsed == TPT_IPFW) { + /* ipfw(8) is used and in this case getsockname returned the original + destination */ + if (proxy_sa->sa_family == AF_INET) { + struct sockaddr_in *dest_addr4 = (struct sockaddr_in *)proxy_sa; + tor_addr_from_ipv4n(&addr, dest_addr4->sin_addr.s_addr); + req->port = ntohs(dest_addr4->sin_port); + } else if (proxy_sa->sa_family == AF_INET6) { + struct sockaddr_in6 *dest_addr6 = (struct sockaddr_in6 *)proxy_sa; + tor_addr_from_in6(&addr, &dest_addr6->sin6_addr); + req->port = ntohs(dest_addr6->sin6_port); + } else { + tor_fragile_assert(); + return -1; + } + + tor_addr_to_str(req->address, &addr, sizeof(req->address), 0); + + return 0; + } +#endif + memset(&pnl, 0, sizeof(pnl)); pnl.proto = IPPROTO_TCP; pnl.direction = PF_OUT; diff --git a/src/or/or.h b/src/or/or.h index 38ab176..a5e2e70 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3461,7 +3461,7 @@ typedef struct { const char *TransProxyType; /**< What kind of transparent proxy * implementation are we using? */ /** Parsed value of TransProxyType. */ - enum { TPT_DEFAULT, TPT_TPROXY } TransProxyType_parsed; + enum { TPT_DEFAULT, TPT_TPROXY, TPT_IPFW } TransProxyType_parsed; config_line_t *NATDPort_lines; /**< Ports to listen on for transparent natd * connections. */ config_line_t *ControlPort_lines; /**< Ports to listen on for control

1 0

[tor/master] Only expose clean_backtrace() if we'll implement it
by nickm＠torproject.org 17 Apr '14

17 Apr '14

commit 211b8cc31846e2d2ba75f19ab9f319f18cb70cfb Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 22:00:13 2014 -0400 Only expose clean_backtrace() if we'll implement it Fixes windows compilation; bug not in any released Tor. Bugfix on cc9e86db. --- src/common/backtrace.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/common/backtrace.h b/src/common/backtrace.h index b1df281..1f4d733 100644 --- a/src/common/backtrace.h +++ b/src/common/backtrace.h @@ -11,8 +11,11 @@ int configure_backtrace_handler(const char *tor_version); void clean_up_backtrace_handler(void); #ifdef EXPOSE_CLEAN_BACKTRACE +#if defined(HAVE_EXECINFO_H) && defined(HAVE_BACKTRACE) && \ + defined(HAVE_BACKTRACE_SYMBOLS_FD) && defined(HAVE_SIGACTION) void clean_backtrace(void **stack, int depth, const ucontext_t *ctx); #endif +#endif #endif

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.4'
by nickm＠torproject.org 16 Apr '14

16 Apr '14

commit 438a03ef7c1aec6a9a92a74dafe127fa3f52a4e6 Merge: 125c8e5 3fc0f9e Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 15:37:19 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' src/or/routerlist.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 16 Apr '14

16 Apr '14

commit 3fc0f9efb8b0030bab2574e5998a964adc93ebaa Merge: f050cf7 ef3d7f2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 14:57:14 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 src/or/routerlist.c | 1 - 1 file changed, 1 deletion(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 16 Apr '14

16 Apr '14

commit f050cf75b0d963be1aa2840bcef60c8b1e96d3b6 Merge: f3c20a2 2ce0750 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 13:32:20 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 src/or/routerlist.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)

1 0

[tor/master] Update the authority signing key blacklist
by nickm＠torproject.org 16 Apr '14

16 Apr '14

commit 2ce0750d21d04c39a5a948b3d96203d8f68ae7ad Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 13:31:40 2014 -0400 Update the authority signing key blacklist Now it only has dannenberg --- src/or/routerlist.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/or/routerlist.c b/src/or/routerlist.c index a7968be..afa5861 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -460,10 +460,9 @@ authority_cert_dl_failed(const char *id_digest, int status) static const char *BAD_SIGNING_KEYS[] = { "09CD84F751FD6E955E0F8ADB497D5401470D697E", // Expires 2015-01-11 16:26:31 -// dizum still needs to rotate as of 2014-04-14 -//"0E7E9C07F0969D0468AD741E172A6109DC289F3C", // Expires 2014-08-12 10:18:26 -// dannenberg still needs to rotate as of 2014-04-14 -//"57B85409891D3FB32137F642FDEDF8B7F8CDFDCD", // Expires 2015-02-11 17:19:09 + "0E7E9C07F0969D0468AD741E172A6109DC289F3C", // Expires 2014-08-12 10:18:26 + "57B85409891D3FB32137F642FDEDF8B7F8CDFDCD", // Expires 2015-02-11 17:19:09 +// dannenberg still needs to rotate as of 2014-04-16 "87326329007AF781F587AF5B594E540B2B6C7630", // Expires 2014-07-17 11:10:09 "98CC82342DE8D298CF99D3F1A396475901E0D38E", // Expires 2014-11-10 13:18:56 "9904B52336713A5ADCB13E4FB14DC919E0D45571", // Expires 2014-04-20 20:01:01

1 0

[tor/master] remove note about dannenberg; it has upgraded.
by nickm＠torproject.org 16 Apr '14

16 Apr '14

commit ef3d7f2f97caf961effd7935dd3231e6bba62ca5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 16 14:56:49 2014 -0400 remove note about dannenberg; it has upgraded. --- src/or/routerlist.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/or/routerlist.c b/src/or/routerlist.c index afa5861..9e59c33 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -462,7 +462,6 @@ static const char *BAD_SIGNING_KEYS[] = { "09CD84F751FD6E955E0F8ADB497D5401470D697E", // Expires 2015-01-11 16:26:31 "0E7E9C07F0969D0468AD741E172A6109DC289F3C", // Expires 2014-08-12 10:18:26 "57B85409891D3FB32137F642FDEDF8B7F8CDFDCD", // Expires 2015-02-11 17:19:09 -// dannenberg still needs to rotate as of 2014-04-16 "87326329007AF781F587AF5B594E540B2B6C7630", // Expires 2014-07-17 11:10:09 "98CC82342DE8D298CF99D3F1A396475901E0D38E", // Expires 2014-11-10 13:18:56 "9904B52336713A5ADCB13E4FB14DC919E0D45571", // Expires 2014-04-20 20:01:01

1 0