April 2014 - tor-commits - lists.torproject.org

[torsocks/master] Fix: deny connection to ANY address
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit ebbcae0c5f6ad4772e459a80e6d99cacb731fb1f Author: David Goulet <dgoulet(a)ev0ke.net> Date: Thu Feb 20 10:59:10 2014 +0000 Fix: deny connection to ANY address It's possible to connect to 0.0.0.0/:: which are addresses that Tor can't of course handle thus deny the call and send back EINVAL. Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/common/compat.h | 2 ++ src/common/utils.c | 30 ++++++++++++++++++++++++++++++ src/common/utils.h | 1 + src/lib/connect.c | 9 +++++++++ tests/unit/test_utils.c | 38 +++++++++++++++++++++++++++++++++++++- 5 files changed, 79 insertions(+), 1 deletion(-) diff --git a/src/common/compat.h b/src/common/compat.h index ee8263f..e977b41 100644 --- a/src/common/compat.h +++ b/src/common/compat.h @@ -104,5 +104,7 @@ void tsocks_mutex_unlock(tsocks_mutex_t *m); /* Loopback address in network byte order. */ #define TSOCKS_LOOPBACK 0x0100007f #define TSOCKS_LOOPBACK6 { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1 } +#define TSOCKS_ANY ((unsigned long int) 0x00000000) +#define TSOCKS_ANY6 { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 } #endif /* TORSOCKS_COMPAT_H */ diff --git a/src/common/utils.c b/src/common/utils.c index e526ce7..578d290 100644 --- a/src/common/utils.c +++ b/src/common/utils.c @@ -306,3 +306,33 @@ match: error: return -EINVAL; } + +/* + * For a given sockaddr, check if the IP address is ANY which is 0.0.0.0 for + * IPv4 and :: for IPv6. + * + * Return 1 if it is else 0. + */ +ATTR_HIDDEN +int utils_is_addr_any(const struct sockaddr *sa) +{ + int ret; + + assert(sa); + + if (sa->sa_family == AF_INET) { + const struct sockaddr_in *sin = (const struct sockaddr_in *) sa; + ret = (sin->sin_addr.s_addr == TSOCKS_ANY); + } else if (sa->sa_family == AF_INET6) { + const struct sockaddr_in6 *sin6 = (const struct sockaddr_in6 *) sa; + const uint8_t addr[] = TSOCKS_ANY6; + ret = !memcmp(sin6->sin6_addr.s6_addr, addr, + sizeof(sin6->sin6_addr.s6_addr)); + } else { + ret = 0; + goto end; + } + +end: + return ret; +} diff --git a/src/common/utils.h b/src/common/utils.h index b0281eb..2f950aa 100644 --- a/src/common/utils.h +++ b/src/common/utils.h @@ -32,5 +32,6 @@ int utils_is_address_ipv4(const char *ip); int utils_is_address_ipv6(const char *ip); int utils_sockaddr_is_localhost(const struct sockaddr *sa); int utils_localhost_resolve(const char *name, int af, void *buf, size_t len); +int utils_is_addr_any(const struct sockaddr *sa); #endif /* TORSOCKS_UTILS_H */ diff --git a/src/lib/connect.c b/src/lib/connect.c index bb15882..e47ab38 100644 --- a/src/lib/connect.c +++ b/src/lib/connect.c @@ -65,6 +65,15 @@ LIBC_CONNECT_RET_TYPE tsocks_connect(LIBC_CONNECT_SIG) goto error; } + /* + * Trying to connect to ANY address will evidently not work for Tor thus we + * deny the call. + */ + if (utils_is_addr_any(addr)) { + errno = EINVAL; + goto error; + } + DBG("[connect] Socket family %s and type %d", addr->sa_family == AF_INET ? "AF_INET" : "AF_INET6", sock_type); diff --git a/tests/unit/test_utils.c b/tests/unit/test_utils.c index 2db255b..8efa19a 100644 --- a/tests/unit/test_utils.c +++ b/tests/unit/test_utils.c @@ -24,7 +24,7 @@ #include <tap/tap.h> -#define NUM_TESTS 26 +#define NUM_TESTS 30 static void test_is_address_ipv4(void) { @@ -178,6 +178,41 @@ static void test_utils_tokenize_ignore_comments(void) ok(nb_token == 0, "Returns 0 tokens for comment"); } +static void test_is_addr_any(void) +{ + int ret; + struct sockaddr_in sin; + struct sockaddr_in6 sin6; + + sin.sin_family = AF_INET; + sin.sin_port = htons(42); + inet_pton(sin.sin_family, "0.0.0.0", &sin.sin_addr); + + ret = utils_is_addr_any((const struct sockaddr *) &sin); + ok(ret == 1, "This address is 0.0.0.0"); + + sin.sin_family = AF_INET; + sin.sin_port = htons(42); + inet_pton(sin.sin_family, "1.0.0.0", &sin.sin_addr); + + ret = utils_is_addr_any((const struct sockaddr *) &sin); + ok(ret == 0, "This address is NOT 0.0.0.0"); + + sin6.sin6_family = AF_INET6; + sin6.sin6_port = htons(42); + inet_pton(sin6.sin6_family, "::", &sin6.sin6_addr); + + ret = utils_is_addr_any((const struct sockaddr *) &sin6); + ok(ret == 1, "This address is ::"); + + sin6.sin6_family = AF_INET6; + sin6.sin6_port = htons(42); + inet_pton(sin6.sin6_family, "fe80::1", &sin6.sin6_addr); + + ret = utils_is_addr_any((const struct sockaddr *) &sin6); + ok(ret == 0, "This address is NOT ::"); +} + int main(int argc, char **argv) { /* Libtap call for the number of tests planned. */ @@ -188,6 +223,7 @@ int main(int argc, char **argv) test_localhost_resolve(); test_sockaddr_is_localhost(); test_utils_tokenize_ignore_comments(); + test_is_addr_any(); return exit_status(); }

1 0

[torsocks/master] Fix: handle hints being NULL in getaddrinfo
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit ec15af6e76a541caaf69ffdbae248d1712f69d31 Author: David Goulet <dgoulet(a)ev0ke.net> Date: Thu Feb 20 11:41:34 2014 +0000 Fix: handle hints being NULL in getaddrinfo Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/lib/getaddrinfo.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/lib/getaddrinfo.c b/src/lib/getaddrinfo.c index a0f5595..da9d4ed 100644 --- a/src/lib/getaddrinfo.c +++ b/src/lib/getaddrinfo.c @@ -48,6 +48,22 @@ LIBC_GETADDRINFO_RET_TYPE tsocks_getaddrinfo(LIBC_GETADDRINFO_SIG) goto error; } + /* + * Quoting the getaddrinfo(3) man page: + * + * All the other fields in the structure pointed to by hints must + * contain either 0 or a NULL pointer, as appropriate. Specifying hints + * as NULL is equivalent to setting ai_socktype and ai_protocol to + * 0; ai_family to AF_UNSPEC; and ai_flags to (AI_V4MAPPED | + * AI_ADDRCONFIG). + * + * This means that for sure the ai_family will be treated as AF_UNSPEC. + */ + if (!hints) { + tmp_node = node; + goto libc_call; + } + /* Use right domain for the next step. */ switch (hints->ai_family) { default: @@ -83,6 +99,7 @@ LIBC_GETADDRINFO_RET_TYPE tsocks_getaddrinfo(LIBC_GETADDRINFO_SIG) DBG("[getaddrinfo] Node %s will be passed to the libc call", tmp_node); } +libc_call: ret = tsocks_libc_getaddrinfo(tmp_node, service, hints, res); if (ret) { goto error;

1 0

[torsocks/master] Deny libc function accept()/accept4()
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit 3c5ba7b51aafe3e590a4383116477d9b4d40875c Author: David Goulet <dgoulet(a)ev0ke.net> Date: Thu Feb 20 12:00:19 2014 +0000 Deny libc function accept()/accept4() Inbound connection to an application handled by torsocks should not be allowed since we can't make them nor make sure that it goes/come through the Tor network. Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/lib/Makefile.am | 2 +- src/lib/accept.c | 75 +++++++++++++++++++++++++++++++++++++++++++++++++++ src/lib/torsocks.h | 28 +++++++++++++++++++ 3 files changed, 104 insertions(+), 1 deletion(-) diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am index ad25f8c..c508733 100644 --- a/src/lib/Makefile.am +++ b/src/lib/Makefile.am @@ -9,6 +9,6 @@ lib_LTLIBRARIES = libtorsocks.la libtorsocks_la_SOURCES = torsocks.c torsocks.h \ connect.c gethostbyname.c getaddrinfo.c close.c \ getpeername.c socket.c syscall.c socketpair.c recv.c \ - exit.c + exit.c accept.c libtorsocks_la_LIBADD = $(top_builddir)/src/common/libcommon.la diff --git a/src/lib/accept.c b/src/lib/accept.c new file mode 100644 index 0000000..3dd7617 --- /dev/null +++ b/src/lib/accept.c @@ -0,0 +1,75 @@ +/* + * Copyright (C) 2014 - David Goulet <dgoulet(a)ev0ke.net> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License, version 2 only, as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along with + * this program; if not, write to the Free Software Foundation, Inc., 51 + * Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include <assert.h> + +#include "torsocks.h" + +TSOCKS_LIBC_DECL(accept, LIBC_ACCEPT_RET_TYPE, LIBC_ACCEPT_SIG) + +/* + * Torsocks call for accept(2). + */ +LIBC_ACCEPT_RET_TYPE tsocks_accept(LIBC_ACCEPT_SIG) +{ + DBG("[accept] Syscall denied since inbound connection are not allowed."); + + /* + * Accept is completely denied here since this means that the application + * can accept inbound connections that are obviously NOT handled by the Tor + * network thus reject this call. + */ + errno = EPERM; + return -1; +} + +/* + * Libc hijacked symbol accept(2). + */ +LIBC_ACCEPT_DECL +{ + return tsocks_accept(LIBC_ACCEPT_ARGS); +} + +#if (defined(__linux__)) + +TSOCKS_LIBC_DECL(accept4, LIBC_ACCEPT4_RET_TYPE, LIBC_ACCEPT4_SIG) + +/* + * Torsocks call for accept4(2). + */ +LIBC_ACCEPT4_RET_TYPE tsocks_accept4(LIBC_ACCEPT4_SIG) +{ + DBG("[accept] Syscall denied since inbound connection are not allowed."); + + /* + * Accept is completely denied here since this means that the application + * can accept inbound connections that are obviously NOT handled by the Tor + * network thus reject this call. + */ + errno = EPERM; + return -1; +} + +/* + * Libc hijacked symbol accept4(2). + */ +LIBC_ACCEPT4_DECL +{ + return tsocks_accept4(LIBC_ACCEPT4_ARGS); +} +#endif diff --git a/src/lib/torsocks.h b/src/lib/torsocks.h index 454ad1c..369652c 100644 --- a/src/lib/torsocks.h +++ b/src/lib/torsocks.h @@ -169,6 +169,14 @@ struct hostent **result, int *h_errnop #define LIBC_RECVMSG_ARGS \ sockfd, msg, flags +/* accept(2) */ +#define LIBC_ACCEPT_NAME accept +#define LIBC_ACCEPT_NAME_STR XSTR(LIBC_ACCEPT_NAME) +#define LIBC_ACCEPT_RET_TYPE int +#define LIBC_ACCEPT_SIG \ + int sockfd, struct sockaddr *addr, socklen_t *addrlen +#define LIBC_ACCEPT_ARGS sockfd, addr, addrlen + #else #error "OS not supported." #endif /* __GLIBC__ , __FreeBSD__, __darwin__, __NetBSD__ */ @@ -184,6 +192,14 @@ struct hostent **result, int *h_errnop #define LIBC_SYSCALL_SIG long int number, ... #define LIBC_SYSCALL_ARGS number +/* accept4(2) */ +#define LIBC_ACCEPT4_NAME accept4 +#define LIBC_ACCEPT4_NAME_STR XSTR(LIBC_ACCEPT4_NAME) +#define LIBC_ACCEPT4_RET_TYPE int +#define LIBC_ACCEPT4_SIG \ + int sockfd, struct sockaddr *addr, socklen_t *addrlen, int flags +#define LIBC_ACCEPT4_ARGS sockfd, addr, addrlen, flags + #endif /* __linux__ */ #if (defined(__FreeBSD__) || defined(__darwin__) || defined(__NetBSD__)) @@ -321,6 +337,18 @@ extern TSOCKS_LIBC_DECL(getpeername, LIBC_GETPEERNAME_RET_TYPE, #define LIBC_GETPEERNAME_DECL LIBC_GETPEERNAME_RET_TYPE \ LIBC_GETPEERNAME_NAME(LIBC_GETPEERNAME_SIG) +/* accept(2) */ +extern TSOCKS_LIBC_DECL(accept, LIBC_ACCEPT_RET_TYPE, LIBC_ACCEPT_SIG) +#define LIBC_ACCEPT_DECL LIBC_ACCEPT_RET_TYPE \ + LIBC_ACCEPT_NAME(LIBC_ACCEPT_SIG) + +/* accept4(2) */ +#if (defined(__linux__)) +extern TSOCKS_LIBC_DECL(accept4, LIBC_ACCEPT4_RET_TYPE, LIBC_ACCEPT4_SIG) +#define LIBC_ACCEPT4_DECL LIBC_ACCEPT4_RET_TYPE \ + LIBC_ACCEPT4_NAME(LIBC_ACCEPT4_SIG) +#endif + /* * Those are actions to do during the lookup process of libc symbols. For * instance the connect(2) syscall is essential to Torsocks so the function

1 0

[torsocks/master] Deny libc function bind()
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit 554bb9d31e23cb274369a493555623da84a8de79 Author: David Goulet <dgoulet(a)ev0ke.net> Date: Thu Feb 20 12:16:11 2014 +0000 Deny libc function bind() Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/lib/Makefile.am | 2 +- src/lib/bind.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++ src/lib/torsocks.h | 13 +++++++++++++ 3 files changed, 60 insertions(+), 1 deletion(-) diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am index c508733..403fab3 100644 --- a/src/lib/Makefile.am +++ b/src/lib/Makefile.am @@ -9,6 +9,6 @@ lib_LTLIBRARIES = libtorsocks.la libtorsocks_la_SOURCES = torsocks.c torsocks.h \ connect.c gethostbyname.c getaddrinfo.c close.c \ getpeername.c socket.c syscall.c socketpair.c recv.c \ - exit.c accept.c + exit.c accept.c bind.c libtorsocks_la_LIBADD = $(top_builddir)/src/common/libcommon.la diff --git a/src/lib/bind.c b/src/lib/bind.c new file mode 100644 index 0000000..3b1ba91 --- /dev/null +++ b/src/lib/bind.c @@ -0,0 +1,46 @@ +/* + * Copyright (C) 2014 - David Goulet <dgoulet(a)ev0ke.net> + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License, version 2 only, as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along with + * this program; if not, write to the Free Software Foundation, Inc., 51 + * Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include <assert.h> + +#include "torsocks.h" + +TSOCKS_LIBC_DECL(bind, LIBC_BIND_RET_TYPE, LIBC_BIND_SIG) + +/* + * Torsocks call for bind(2). + */ +LIBC_BIND_RET_TYPE tsocks_bind(LIBC_BIND_SIG) +{ + DBG("[accept] Syscall denied since inbound connection are not allowed."); + + /* + * Bind is completely denied here since this means that the application + * can accept inbound connections that are obviously NOT handled by the Tor + * network thus reject this call. + */ + errno = EPERM; + return -1; +} + +/* + * Libc hijacked symbol bind(2). + */ +LIBC_BIND_DECL +{ + return tsocks_bind(LIBC_BIND_ARGS); +} diff --git a/src/lib/torsocks.h b/src/lib/torsocks.h index 369652c..4dd0281 100644 --- a/src/lib/torsocks.h +++ b/src/lib/torsocks.h @@ -177,6 +177,14 @@ struct hostent **result, int *h_errnop int sockfd, struct sockaddr *addr, socklen_t *addrlen #define LIBC_ACCEPT_ARGS sockfd, addr, addrlen +/* bind(2) */ +#define LIBC_BIND_NAME bind +#define LIBC_BIND_NAME_STR XSTR(LIBC_BIND_NAME) +#define LIBC_BIND_RET_TYPE int +#define LIBC_BIND_SIG \ + int sockfd, const struct sockaddr *addr, socklen_t addrlen +#define LIBC_BIND_ARGS sockfd, addr, addrlen + #else #error "OS not supported." #endif /* __GLIBC__ , __FreeBSD__, __darwin__, __NetBSD__ */ @@ -349,6 +357,11 @@ extern TSOCKS_LIBC_DECL(accept4, LIBC_ACCEPT4_RET_TYPE, LIBC_ACCEPT4_SIG) LIBC_ACCEPT4_NAME(LIBC_ACCEPT4_SIG) #endif +/* bind(2) */ +extern TSOCKS_LIBC_DECL(bind, LIBC_BIND_RET_TYPE, LIBC_BIND_SIG) +#define LIBC_BIND_DECL LIBC_BIND_RET_TYPE \ + LIBC_BIND_NAME(LIBC_BIND_SIG) + /* * Those are actions to do during the lookup process of libc symbols. For * instance the connect(2) syscall is essential to Torsocks so the function

1 0

[torsocks/master] Fix: check is_suid flag before each getenv()
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit b5adeb2da07a3135a989e5e59d003d4c2591c49e Author: David Goulet <dgoulet(a)ev0ke.net> Date: Thu Feb 20 12:20:57 2014 +0000 Fix: check is_suid flag before each getenv() Reported-by: Nick Mathewson <nickm(a)torproject.org> Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/lib/torsocks.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/lib/torsocks.c b/src/lib/torsocks.c index 654f825..bb7773c 100644 --- a/src/lib/torsocks.c +++ b/src/lib/torsocks.c @@ -168,11 +168,13 @@ error: static void init_logging(void) { int level; - const char *filepath = NULL, *level_str, *time_status_str; + const char *filepath = NULL, *level_str = NULL, *time_status_str = NULL; enum log_time_status t_status; /* Get log level from user or use default. */ - level_str = getenv(DEFAULT_LOG_LEVEL_ENV); + if (!is_suid) { + level_str = getenv(DEFAULT_LOG_LEVEL_ENV); + } if (level_str) { level = atoi(level_str); } else { @@ -181,7 +183,9 @@ static void init_logging(void) } /* Get time status from user or use default. */ - time_status_str = getenv(DEFAULT_LOG_TIME_ENV); + if (!is_suid) { + time_status_str = getenv(DEFAULT_LOG_TIME_ENV); + } if (time_status_str) { t_status = atoi(time_status_str); } else {

1 0

[torsocks/master] Fix: use strtok_r reentrant instead of strtok
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit 6f4b45b91f75dadfdc4dad967e47c4cd1b2ce036 Author: David Goulet <dgoulet(a)ev0ke.net> Date: Thu Feb 20 12:37:40 2014 +0000 Fix: use strtok_r reentrant instead of strtok Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/common/utils.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/common/utils.c b/src/common/utils.c index 3a62f6c..ba34e33 100644 --- a/src/common/utils.c +++ b/src/common/utils.c @@ -119,7 +119,7 @@ ATTR_HIDDEN int utils_tokenize_ignore_comments(const char *_line, size_t size, char **tokens) { int ret, i = 0, argc = 0; - char *c, *line = NULL; + char *c, *line = NULL, *saveptr; assert(_line); assert(tokens); @@ -150,14 +150,14 @@ int utils_tokenize_ignore_comments(const char *_line, size_t size, char **tokens goto error; } - c = strtok(line, " \t"); + c = strtok_r(line, " \t", &saveptr); while (c != NULL) { tokens[i] = strdup(c); if (!tokens[i]) { ret = -ENOMEM; goto error; } - c = strtok(NULL, " \t"); + c = strtok_r(NULL, " \t", &saveptr); i++; }

1 0

[torsocks/master] Fix: use unsigned char for socks5 ABI
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit 906f5fefa855abbb48d1ea2496450ceb0f9d688e Author: David Goulet <dgoulet(a)ev0ke.net> Date: Thu Feb 20 13:02:14 2014 +0000 Fix: use unsigned char for socks5 ABI Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/common/socks5.c | 8 ++++---- src/common/socks5.h | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/common/socks5.c b/src/common/socks5.c index fb0dc9c..9525d04 100644 --- a/src/common/socks5.c +++ b/src/common/socks5.c @@ -250,7 +250,7 @@ int socks5_send_connect_request(struct connection *conn) { int ret; /* Buffer to send won't go over a full TCP size. */ - char buffer[1500]; + unsigned char buffer[1500]; ssize_t buf_len, ret_send; struct socks5_request msg; @@ -355,7 +355,7 @@ int socks5_recv_connect_reply(struct connection *conn) { int ret; ssize_t ret_recv; - char buffer[22]; /* Maximum size possible (with IPv6). */ + unsigned char buffer[22]; /* Maximum size possible (with IPv6). */ struct socks5_reply msg; size_t recv_len; @@ -453,7 +453,7 @@ int socks5_send_resolve_request(const char *hostname, struct connection *conn) * Can't go bigger than that. 4 bytes for the header, 1 for the name len * and 255 for the name. */ - char buffer[260]; + unsigned char buffer[260]; size_t name_len, msg_len, data_len; struct socks5_request msg; struct socks5_request_resolve req; @@ -588,7 +588,7 @@ ATTR_HIDDEN int socks5_send_resolve_ptr_request(struct connection *conn, const void *ip, int af) { int ret, ret_send; - char buffer[20]; /* Can't go higher than that (with IPv6). */ + unsigned char buffer[20]; /* Can't go higher than that (with IPv6). */ size_t msg_len, data_len; struct socks5_request msg; struct socks5_request_resolve_ptr req; diff --git a/src/common/socks5.h b/src/common/socks5.h index 67da3aa..e2ca52f 100644 --- a/src/common/socks5.h +++ b/src/common/socks5.h @@ -92,14 +92,14 @@ struct socks5_request_ipv6 { struct socks5_request_domain { uint8_t len; /* Maximum size of len above. No NULL byte is needed. */ - char name[UINT8_MAX]; + unsigned char name[UINT8_MAX]; uint16_t port; }; /* Use for the Tor resolve command. */ struct socks5_request_resolve { uint8_t len; - char name[UINT8_MAX]; + unsigned char name[UINT8_MAX]; }; /* Use for the Tor resolve ptr command. */

1 0

[torsocks/master] Fix: remove the use of IPv4 sockaddr in connect
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit e9d747f7fe76673b5940dd39e2de3d2caf67132c Author: David Goulet <dgoulet(a)ev0ke.net> Date: Thu Feb 20 14:24:23 2014 +0000 Fix: remove the use of IPv4 sockaddr in connect This modifies the onion find by ip to use generic sockaddr structure. Also, a utils call is added to extract the port from a sockaddr structure depending on the family. This is a step in the direction of fully supported IPv6 thus removing the use of a cast sockaddr_in. Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/common/onion.c | 16 +++++++++++++--- src/common/onion.h | 2 +- src/common/utils.c | 24 ++++++++++++++++++++++++ src/common/utils.h | 1 + src/lib/connect.c | 8 ++------ src/lib/socket.c | 8 ++------ tests/unit/test_onion.c | 5 ++++- 7 files changed, 47 insertions(+), 17 deletions(-) diff --git a/src/common/onion.c b/src/common/onion.c index 573ca19..67b4297 100644 --- a/src/common/onion.c +++ b/src/common/onion.c @@ -248,14 +248,24 @@ end: * Return entry on success or else NULL. */ ATTR_HIDDEN -struct onion_entry *onion_entry_find_by_ip(in_addr_t ip, +struct onion_entry *onion_entry_find_by_addr(const struct sockaddr *sa, struct onion_pool *pool) { int i; struct onion_entry *entry = NULL; + const struct sockaddr_in *sin; + + assert(sa); + + /* Onion cookie are only IPv4. */ + if (sa->sa_family == AF_INET6) { + goto end; + } + + sin = (const struct sockaddr_in *) sa; DBG("[onion] Finding onion entry for IP %s", - inet_ntoa(*((struct in_addr *) &ip))); + inet_ntoa((*((struct in_addr *) &sin->sin_addr.s_addr)))); /* * XXX: This can be improved by simply getting the offset of the IP with @@ -264,7 +274,7 @@ struct onion_entry *onion_entry_find_by_ip(in_addr_t ip, * entries is 45. */ for (i = 0; i < pool->count; i++) { - if (pool->entries[i]->ip == ip) { + if (pool->entries[i]->ip == sin->sin_addr.s_addr) { entry = pool->entries[i]; DBG("[onion] Onion entry name %s found in pool.", entry->hostname); diff --git a/src/common/onion.h b/src/common/onion.h index 90b4d5b..64e8574 100644 --- a/src/common/onion.h +++ b/src/common/onion.h @@ -112,7 +112,7 @@ struct onion_entry *onion_entry_create(struct onion_pool *pool, const char *onion_name); struct onion_entry *onion_entry_find_by_name(const char *onion_name, struct onion_pool *pool); -struct onion_entry *onion_entry_find_by_ip(in_addr_t ip, +struct onion_entry *onion_entry_find_by_addr(const struct sockaddr *sa, struct onion_pool *pool); static inline void onion_pool_lock(struct onion_pool *pool) diff --git a/src/common/utils.c b/src/common/utils.c index ba34e33..890bbde 100644 --- a/src/common/utils.c +++ b/src/common/utils.c @@ -344,3 +344,27 @@ int utils_is_addr_any(const struct sockaddr *sa) end: return ret; } + +/* + * For a given sockaddr, return the port value considering the address family + * structure. + * + * Return the port number in the sockaddr sa or -1 is family is not unknown. + */ +ATTR_HIDDEN +int utils_get_port_from_addr(const struct sockaddr *sa) +{ + int port; + + assert(sa); + + if (sa->sa_family == AF_INET) { + port = ((const struct sockaddr_in *) sa)->sin_port; + } else if (sa->sa_family == AF_INET6) { + port = ((const struct sockaddr_in6 *) sa)->sin6_port; + } else { + port = -1; + } + + return port; +} diff --git a/src/common/utils.h b/src/common/utils.h index 2f950aa..83ea825 100644 --- a/src/common/utils.h +++ b/src/common/utils.h @@ -33,5 +33,6 @@ int utils_is_address_ipv6(const char *ip); int utils_sockaddr_is_localhost(const struct sockaddr *sa); int utils_localhost_resolve(const char *name, int af, void *buf, size_t len); int utils_is_addr_any(const struct sockaddr *sa); +int utils_get_port_from_addr(const struct sockaddr *sa); #endif /* TORSOCKS_UTILS_H */ diff --git a/src/lib/connect.c b/src/lib/connect.c index 03f6900..6622119 100644 --- a/src/lib/connect.c +++ b/src/lib/connect.c @@ -38,7 +38,6 @@ LIBC_CONNECT_RET_TYPE tsocks_connect(LIBC_CONNECT_SIG) socklen_t optlen; struct connection *new_conn; struct onion_entry *on_entry; - struct sockaddr_in *inet_addr; DBG("Connect catched on fd %d", sockfd); @@ -77,8 +76,6 @@ LIBC_CONNECT_RET_TYPE tsocks_connect(LIBC_CONNECT_SIG) DBG("[connect] Socket family %s and type %d", addr->sa_family == AF_INET ? "AF_INET" : "AF_INET6", sock_type); - inet_addr = (struct sockaddr_in *) addr; - /* * Lock registry to get the connection reference if one. In this code path, * if a connection object is found, it will not be used since a double @@ -99,8 +96,7 @@ LIBC_CONNECT_RET_TYPE tsocks_connect(LIBC_CONNECT_SIG) * existing .onion address. */ onion_pool_lock(&tsocks_onion_pool); - on_entry = onion_entry_find_by_ip(inet_addr->sin_addr.s_addr, - &tsocks_onion_pool); + on_entry = onion_entry_find_by_addr(addr, &tsocks_onion_pool); onion_pool_unlock(&tsocks_onion_pool); if (on_entry) { /* @@ -113,7 +109,7 @@ LIBC_CONNECT_RET_TYPE tsocks_connect(LIBC_CONNECT_SIG) goto error; } new_conn->dest_addr.domain = CONNECTION_DOMAIN_NAME; - new_conn->dest_addr.hostname.port = inet_addr->sin_port; + new_conn->dest_addr.hostname.port = utils_get_port_from_addr(addr); new_conn->dest_addr.hostname.addr = strdup(on_entry->hostname); if (!new_conn->dest_addr.hostname.addr) { errno = ENOMEM; diff --git a/src/lib/socket.c b/src/lib/socket.c index 36d2a90..cf080b5 100644 --- a/src/lib/socket.c +++ b/src/lib/socket.c @@ -33,12 +33,7 @@ LIBC_SOCKET_RET_TYPE tsocks_socket(LIBC_SOCKET_SIG) domain, type, protocol); if (type & SOCK_STREAM) { - if (domain == AF_INET6) { - /* Tor does not handle IPv6 at the moment. Reject it. */ - ERR("Socket is IPv6. Tor does not handle AF_INET6 connection."); - errno = EINVAL; - return -1; - } + goto end; } else { if (domain == AF_INET || domain == AF_INET6) { /* @@ -56,6 +51,7 @@ LIBC_SOCKET_RET_TYPE tsocks_socket(LIBC_SOCKET_SIG) } } +end: /* Stream socket for INET/INET6 is good so open it. */ return tsocks_libc_socket(domain, type, protocol); } diff --git a/tests/unit/test_onion.c b/tests/unit/test_onion.c index 0c91f71..c29d5e9 100644 --- a/tests/unit/test_onion.c +++ b/tests/unit/test_onion.c @@ -34,6 +34,7 @@ static void test_onion_entry(struct onion_pool *pool) const char *onion_addr1 = "87idq6tnejk5plpn.onion"; const char *onion_addr2 = "97idq6tnejk5plpn.onion"; const char *onion_addr1_typo = "87idq6tnejk5plpn.onio"; + struct sockaddr_in sin; diag("Onion entry subsystem initialization test"); @@ -71,7 +72,9 @@ static void test_onion_entry(struct onion_pool *pool) inet_ntoa(*((struct in_addr *) &entry->ip))) == 0, "Valid onion entry found by name"); - entry = onion_entry_find_by_ip(inet_addr(DEFAULT_ONION_ADDR_RANGE), pool); + sin.sin_family = AF_INET; + sin.sin_addr.s_addr = inet_addr(DEFAULT_ONION_ADDR_RANGE); + entry = onion_entry_find_by_addr((const struct sockaddr *) &sin, pool); ok(entry && pool->count == 1 && strcmp(entry->hostname, onion_addr1) == 0 &&

1 0

[torsocks/master] Fix: use connection_get_ref on creation
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit e1a0df6849059822ffdd079e4ac670f05857818d Author: David Goulet <dgoulet(a)ev0ke.net> Date: Thu Feb 20 12:54:05 2014 +0000 Fix: use connection_get_ref on creation Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/common/connection.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/common/connection.c b/src/common/connection.c index 89f991b..4c75579 100644 --- a/src/common/connection.c +++ b/src/common/connection.c @@ -211,7 +211,7 @@ struct connection *connection_create(int fd, const struct sockaddr *dest) } conn->fd = fd; - conn->refcount.count = 1; + connection_get_ref(conn); return conn;

1 0

[torsocks/master] Fix: make tsock_tor_resolve support IPv6
by dgoulet＠torproject.org 04 Apr '14

04 Apr '14

commit 8495857ce613023e75bd3f29da860952e793cd7f Author: David Goulet <dgoulet(a)ev0ke.net> Date: Thu Feb 20 15:08:09 2014 +0000 Fix: make tsock_tor_resolve support IPv6 Note that the tor daemon does not support IPv6 DNS resolution through the SOCKS port thus for now it is denied. Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/lib/getaddrinfo.c | 2 +- src/lib/gethostbyname.c | 4 ++-- src/lib/torsocks.c | 25 +++++++++++++++++++------ src/lib/torsocks.h | 2 +- 4 files changed, 23 insertions(+), 10 deletions(-) diff --git a/src/lib/getaddrinfo.c b/src/lib/getaddrinfo.c index da9d4ed..003e51f 100644 --- a/src/lib/getaddrinfo.c +++ b/src/lib/getaddrinfo.c @@ -85,7 +85,7 @@ LIBC_GETADDRINFO_RET_TYPE tsocks_getaddrinfo(LIBC_GETADDRINFO_SIG) ret = inet_pton(af, node, addr); if (ret == 0) { /* The node most probably is a DNS name. */ - ret = tsocks_tor_resolve(node, (uint32_t *) addr); + ret = tsocks_tor_resolve(af, node, addr); if (ret < 0) { ret = EAI_FAIL; goto error; diff --git a/src/lib/gethostbyname.c b/src/lib/gethostbyname.c index 1b9d00e..6b4ea21 100644 --- a/src/lib/gethostbyname.c +++ b/src/lib/gethostbyname.c @@ -72,7 +72,7 @@ LIBC_GETHOSTBYNAME_RET_TYPE tsocks_gethostbyname(LIBC_GETHOSTBYNAME_SIG) } /* Resolve the given hostname through Tor. */ - ret = tsocks_tor_resolve(name, &ip); + ret = tsocks_tor_resolve(AF_INET, name, &ip); if (ret < 0) { goto error; } @@ -341,7 +341,7 @@ LIBC_GETHOSTBYNAME_R_RET_TYPE tsocks_gethostbyname_r(LIBC_GETHOSTBYNAME_R_SIG) } /* Resolve the given hostname through Tor. */ - ret = tsocks_tor_resolve(name, &ip); + ret = tsocks_tor_resolve(AF_INET, name, &ip); if (ret < 0) { goto error; } diff --git a/src/lib/torsocks.c b/src/lib/torsocks.c index bb7773c..9b3100c 100644 --- a/src/lib/torsocks.c +++ b/src/lib/torsocks.c @@ -367,16 +367,30 @@ error: * * Return 0 on success else a negative value and the result addr is untouched. */ -int tsocks_tor_resolve(const char *hostname, uint32_t *ip_addr) +int tsocks_tor_resolve(int af, const char *hostname, void *ip_addr) { int ret; + size_t addr_len; struct connection conn; assert(hostname); assert(ip_addr); - ret = utils_localhost_resolve(hostname, AF_INET, ip_addr, - sizeof(uint32_t)); + if (af == AF_INET) { + addr_len = sizeof(uint32_t); + conn.dest_addr.domain = CONNECTION_DOMAIN_INET; + } else if (af == AF_INET6) { + addr_len = 16; + conn.dest_addr.domain = CONNECTION_DOMAIN_INET6; + /* Tor daemon does not support IPv6 DNS resolution yet. */ + ret = -ENOSYS; + goto error; + } else { + ret = -EINVAL; + goto error; + } + + ret = utils_localhost_resolve(hostname, af, ip_addr, addr_len); if (ret) { /* Found to be a localhost name. */ ret = 0; @@ -401,13 +415,12 @@ int tsocks_tor_resolve(const char *hostname, uint32_t *ip_addr) } } - conn.fd = tsocks_libc_socket(PF_INET, SOCK_STREAM, IPPROTO_TCP); + conn.fd = tsocks_libc_socket(af, SOCK_STREAM, IPPROTO_TCP); if (conn.fd < 0) { PERROR("socket"); ret = -errno; goto error; } - conn.dest_addr.domain = CONNECTION_DOMAIN_INET; ret = setup_tor_connection(&conn); if (ret < 0) { @@ -420,7 +433,7 @@ int tsocks_tor_resolve(const char *hostname, uint32_t *ip_addr) } /* Force IPv4 resolution for now. */ - ret = socks5_recv_resolve_reply(&conn, ip_addr, sizeof(uint32_t)); + ret = socks5_recv_resolve_reply(&conn, ip_addr, addr_len); if (ret < 0) { goto end_close; } diff --git a/src/lib/torsocks.h b/src/lib/torsocks.h index 01c25b0..1b95cb9 100644 --- a/src/lib/torsocks.h +++ b/src/lib/torsocks.h @@ -383,7 +383,7 @@ extern unsigned int tsocks_cleaned_up; int tsocks_connect_to_tor(struct connection *conn); void *tsocks_find_libc_symbol(const char *symbol, enum tsocks_sym_action action); -int tsocks_tor_resolve(const char *hostname, uint32_t *ip_addr); +int tsocks_tor_resolve(int af, const char *hostname, void *ip_addr); int tsocks_tor_resolve_ptr(const char *addr, char **ip, int af); void tsocks_cleanup(void);

1 0