January 2015 - tor-commits - lists.torproject.org

[torsocks/master] Add AllowOutboundLocalhost.
by dgoulet＠torproject.org 19 Jan '15

19 Jan '15

commit 7cfcd619d6fc293dfd05af42f30b2f39243ff736 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Mon Jan 19 00:44:05 2015 +0000 Add AllowOutboundLocalhost. This addresses the tails problem with #8137 in that, with the options set, all connections to the loopback address is allowed. Since this is a massive foot + gun option for the users, it's off by default. Note that to correctly fix MAPADDRESS and all the things that the Whonix people are complaining about would require bringing back the old tsocks "local" configuration option. Signed-off-by: Yawning Angel <yawning(a)schwanenlied.me> Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- doc/torsocks.conf | 5 +++++ doc/torsocks.conf.5 | 6 ++++++ src/common/config-file.c | 36 ++++++++++++++++++++++++++++++++++++ src/common/config-file.h | 7 +++++++ src/lib/connect.c | 9 +++++++++ 5 files changed, 63 insertions(+) diff --git a/doc/torsocks.conf b/doc/torsocks.conf index c1596c0..7e82a27 100644 --- a/doc/torsocks.conf +++ b/doc/torsocks.conf @@ -28,3 +28,8 @@ OnionAddrRange 127.42.42.0/24 # Set Torsocks to accept inbound connections. If set to 1, listen() and # accept() will be allowed to be used with non localhost address. (Default: 0) #AllowInbound 1 + +# Set Torsocks to allow outbound connections to the loopback interface. +# If set to 1, connect() will be allowed to be used to the loopback interface +# bypassing Tor. This option should not be used by most users. (Default: 0) +#AllowOutboundLocalhost 1 diff --git a/doc/torsocks.conf.5 b/doc/torsocks.conf.5 index 451af59..13ac7b9 100644 --- a/doc/torsocks.conf.5 +++ b/doc/torsocks.conf.5 @@ -77,6 +77,12 @@ Allow inbound connections meaning that listen() and accept()/accept4() will be allowed for non localhost address so the applicaton can handle incoming connection. Note that Unix socket are allowed. (Default: 0) +.TP +.I AllowOutboundLocalhost 0|1 +Allow outbound connections to the loopback interface meaning that connect() +will be allowed to connect to localhost addresses bypassing Tor. This option +should not be used by most users. (Default: 0) + .SH EXAMPLE $ export TORSOCKS_CONF_FILE=$PWD/torsocks.conf $ torsocks ssh account(a)sshserver.com diff --git a/src/common/config-file.c b/src/common/config-file.c index 79fe5ca..64b3d42 100644 --- a/src/common/config-file.c +++ b/src/common/config-file.c @@ -38,6 +38,7 @@ static const char *conf_onion_str = "OnionAddrRange"; static const char *conf_socks5_user_str = "SOCKS5Username"; static const char *conf_socks5_pass_str = "SOCKS5Password"; static const char *conf_allow_inbound_str = "AllowInbound"; +static const char *conf_allow_outbound_localhost_str = "AllowOutboundLocalhost"; /* * Once this value reaches 2, it means both user and password for a SOCKS5 @@ -227,6 +228,11 @@ static int parse_config_line(const char *line, struct configuration *config) if (ret < 0) { goto error; } + } else if (!strcmp(tokens[0], conf_allow_outbound_localhost_str)) { + ret = conf_file_set_allow_outbound_localhost(tokens[1], config); + if (ret < 0) { + goto error; + } } else { WARN("Config file contains unknown value: %s", line); } @@ -366,6 +372,36 @@ int conf_file_set_allow_inbound(const char *val, struct configuration *config) } /* + * Set the allow outbound localhost option for the given config. + * + * Return 0 if option is off, 1 if on and negative value on error. + */ +ATTR_HIDDEN +int conf_file_set_allow_outbound_localhost(const char *val, + struct configuration *config) +{ + int ret; + + assert(val); + assert(config); + + ret = atoi(val); + if (ret == 0) { + config->allow_outbound_localhost = 0; + DBG("[config] Outbound localhost connections disallowed."); + } else if (ret == 1) { + config->allow_outbound_localhost = 1; + DBG("[config] Outbound localhost connections allowed."); + } else { + ERR("[config] Invalid %s value for %s", val, + conf_allow_outbound_localhost_str); + ret = -EINVAL; + } + + return ret; +} + +/* * Read and populate the given config parsed data structure. * * Return 0 on success or else a negative value. diff --git a/src/common/config-file.h b/src/common/config-file.h index c35507d..da3d507 100644 --- a/src/common/config-file.h +++ b/src/common/config-file.h @@ -78,6 +78,11 @@ struct configuration { * for non localhost addresses. */ unsigned int allow_inbound:1; + + /* + * Allow outbound connections to localhost that bypass Tor. + */ + unsigned int allow_outbound_localhost:1; }; int config_file_read(const char *filename, struct configuration *config); @@ -87,5 +92,7 @@ int conf_file_set_socks5_pass(const char *password, int conf_file_set_socks5_user(const char *username, struct configuration *config); int conf_file_set_allow_inbound(const char *val, struct configuration *config); +int conf_file_set_allow_outbound_localhost(const char *val, struct + configuration *config); #endif /* CONFIG_FILE_H */ diff --git a/src/lib/connect.c b/src/lib/connect.c index 5e56e4e..1bf81ac 100644 --- a/src/lib/connect.c +++ b/src/lib/connect.c @@ -172,6 +172,15 @@ LIBC_CONNECT_RET_TYPE tsocks_connect(LIBC_CONNECT_SIG) * thus this check is done after the onion entry lookup. */ if (utils_sockaddr_is_localhost(addr)) { + /* + * Certain setups need to be able to reach localhost, despite + * running torsocks. If they enabled the config option, allow such + * connections. + */ + if (tsocks_config.allow_outbound_localhost) { + goto libc_connect; + } + WARN("[connect] Connection to a local address are denied since it " "might be a TCP DNS query to a local DNS server. " "Rejecting it for safety reasons.");

1 0

[torsocks/master] Fix: switch back to a syscall whitelist scheme
by dgoulet＠torproject.org 19 Jan '15

19 Jan '15

commit a9ed7e3bb4c081f4cf39ece91027f1c9b6f099f2 Author: David Goulet <dgoulet(a)ev0ke.net> Date: Mon Jan 19 11:59:41 2015 -0500 Fix: switch back to a syscall whitelist scheme syscall() can't take a va_list so we can't forward every non dangerous syscall using the libc syscall() thus having to deny non supported ones. It's a bit sad but I have no other solution for that. Please let me know if anyone comes up with one! :) Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/lib/syscall.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/lib/syscall.c b/src/lib/syscall.c index 96016bb..ec10000 100644 --- a/src/lib/syscall.c +++ b/src/lib/syscall.c @@ -229,8 +229,14 @@ LIBC_SYSCALL_RET_TYPE tsocks_syscall(long int number, va_list args) ret = handle_recvmsg(args); break; default: - /* Safe to call the libc syscall function. */ - ret = tsocks_libc_syscall(number, args); + /* + * Because of the design of syscall(), we can't pass a va_list to it so + * we are constraint to use a whitelist scheme and denying the rest. + */ + WARN("[syscall] Unsupported syscall number %ld. Denying the call", + number); + ret = -1; + errno = ENOSYS; break; } @@ -297,8 +303,8 @@ LIBC___SYSCALL_RET_TYPE tsocks___syscall(quad_t number, va_list args) break; default: /* - * Deny call since we have no idea if this call can leak or not data - * off the Tor network. + * Because of the design of syscall(), we can't pass a va_list to it so + * we are constraint to use a whitelist scheme and denying the rest. */ WARN("[syscall] Unsupported __syscall number %ld. Denying the call", number);

1 0

[torsocks/master] Fix error messages about setuid/setgid executables
by dgoulet＠torproject.org 19 Jan '15

19 Jan '15

commit 0dcfe377c749860502359d5eb62a15550d317f66 Author: Dmitry Shachnev <mitya57(a)gmail.com> Date: Thu Dec 4 15:42:43 2014 +0300 Fix error messages about setuid/setgid executables Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/bin/torsocks.in | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/bin/torsocks.in b/src/bin/torsocks.in index a392d0b..7fd43d6 100644 --- a/src/bin/torsocks.in +++ b/src/bin/torsocks.in @@ -105,8 +105,11 @@ torify_app () elif [ -z $app_path ]; then echo "ERROR: $1 cannot be found." >&2 exit 1 - elif [ -u $app_path -o -g $app_path ]; then - echo "ERROR: $1 is set${2}id. torsocks will not work on a set${2}id executable." >&2 + elif [ -u $app_path ]; then + echo "ERROR: $1 is setuid. torsocks will not work on a setuid executable." >&2 + exit 1 + elif [ -g $app_path ]; then + echo "ERROR: $1 is setgid. torsocks will not work on a setgid executable." >&2 exit 1 fi

1 0

[tor/master] Some days I just can't C.
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit 061682c829b262dbcaf0fdc40c9aa5a2a599cc0c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 19 11:58:40 2015 -0500 Some days I just can't C. --- src/or/connection_edge.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 9031edb..d1ad56d 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1064,7 +1064,7 @@ connection_ap_handshake_rewrite(entry_connection_t *conn, * previously registered Automap entries, TrackHostExits entries, * and client-side DNS cache entries (not recommended). */ - if (!socks->command != SOCKS_COMMAND_RESOLVE_PTR && + if (socks->command != SOCKS_COMMAND_RESOLVE_PTR && !out->automap) { unsigned rewrite_flags = AMR_FLAG_USE_AUTOMAP | AMR_FLAG_USE_TRACKEXIT; addressmap_entry_source_t exit_source2;

1 0

[tor/master] Remove a now-needless testing workaround.
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit f92b01b9635eb2655a449529d6e7eb30a46bb29f Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 19 11:55:52 2015 -0500 Remove a now-needless testing workaround. --- src/test/test_entryconn.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/test/test_entryconn.c b/src/test/test_entryconn.c index 146cddc..7e0757f 100644 --- a/src/test/test_entryconn.c +++ b/src/test/test_entryconn.c @@ -269,7 +269,6 @@ test_entryconn_rewrite_automap_reverse(void *arg) strlcpy(ec2->socks_request->address, ec->socks_request->address, sizeof(ec2->socks_request->address)); - ec2->entry_cfg.use_cached_ipv4_answers = 1; // XXXX REMOVE. This is only there to hide a bug. ec2->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR; connection_ap_handshake_rewrite(ec2, &rr);

1 0

[tor/master] Make check-spaces happier.
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit 2e8b8c8698a326597a07020e2f29a79948094f0e Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 19 11:56:03 2015 -0500 Make check-spaces happier. --- src/or/connection_edge.c | 6 ++++-- src/or/connection_edge.h | 1 - src/or/relay.c | 6 ++++-- src/test/test_entryconn.c | 6 +++--- 4 files changed, 11 insertions(+), 8 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index a11b8e2..9031edb 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1378,7 +1378,8 @@ connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn, log_warn(LD_NET, "Rejecting SOCKS4 request for an IPv6 address."); connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY); return -1; - } else if (socks->socks_version == 4 && !conn->entry_cfg.ipv4_traffic) { + } else if (socks->socks_version == 4 && + !conn->entry_cfg.ipv4_traffic) { /* You can't do any kind of Socks4 request when IPv4 is forbidden. * * XXX raise this check outside the enclosing block? */ @@ -3282,7 +3283,8 @@ connection_edge_compatible_with_circuit(const entry_connection_t *conn, if ((iso & ISO_CLIENTADDR) && !tor_addr_eq(&ENTRY_TO_CONN(conn)->addr, &circ->client_addr)) return 0; - if ((iso & ISO_SESSIONGRP) && conn->entry_cfg.session_group != circ->session_group) + if ((iso & ISO_SESSIONGRP) && + conn->entry_cfg.session_group != circ->session_group) return 0; if ((iso & ISO_NYM_EPOCH) && conn->nym_epoch != circ->nym_epoch) return 0; diff --git a/src/or/connection_edge.h b/src/or/connection_edge.h index 0cc391e..7c0b9c0 100644 --- a/src/or/connection_edge.h +++ b/src/or/connection_edge.h @@ -144,7 +144,6 @@ STATIC int connected_cell_format_payload(uint8_t *payload_out, const tor_addr_t *addr, uint32_t ttl); - typedef struct { /** Original address, after we lowercased it but before we started * mapping it. diff --git a/src/or/relay.c b/src/or/relay.c index 350353e..8653d8c 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -804,8 +804,10 @@ connection_ap_process_end_not_open( return 0; } - if ((tor_addr_family(&addr) == AF_INET && !conn->entry_cfg.ipv4_traffic) || - (tor_addr_family(&addr) == AF_INET6 && !conn->entry_cfg.ipv6_traffic)) { + if ((tor_addr_family(&addr) == AF_INET && + !conn->entry_cfg.ipv4_traffic) || + (tor_addr_family(&addr) == AF_INET6 && + !conn->entry_cfg.ipv6_traffic)) { log_fn(LOG_PROTOCOL_WARN, LD_APP, "Got an EXITPOLICY failure on a connection with a " "mismatched family. Closing."); diff --git a/src/test/test_entryconn.c b/src/test/test_entryconn.c index 7e0757f..6edc166 100644 --- a/src/test/test_entryconn.c +++ b/src/test/test_entryconn.c @@ -617,7 +617,8 @@ test_entryconn_rewrite_mapaddress_automap_onion(void *arg) tt_int_op(rr.automap, OP_EQ, 0); tt_int_op(rr.should_close, OP_EQ, 0); tt_int_op(rr.end_reason, OP_EQ, 0); - tt_assert(!strcmpstart(ec3->socks_request->address, "abcdefghijklmnop.onion")); + tt_assert(!strcmpstart(ec3->socks_request->address, + "abcdefghijklmnop.onion")); /* Now resolve abcefghijklmnop.onion. */ strlcpy(ec4->socks_request->address, "abcdefghijklmnop.onion", @@ -633,7 +634,7 @@ test_entryconn_rewrite_mapaddress_automap_onion(void *arg) tt_str_op(rr.orig_address, OP_EQ, "abcdefghijklmnop.onion"); tt_assert(!strcmpstart(ec4->socks_request->address, "192.168.")); /* XXXX doesn't work - tt_str_op(ec4->socks_request->address, OP_EQ, ec2->socks_request->address); + tt_str_op(ec4->socks_request->address, OP_EQ, ec2->socks_request->address); */ done: @@ -742,7 +743,6 @@ test_entryconn_rewrite_mapaddress_automap_onion4(void *arg) test_entryconn_rewrite_mapaddress_automap_onion_common(arg, 0, 1); } - #define REWRITE(name) \ { #name, test_entryconn_##name, TT_FORK, &test_rewrite_setup, NULL }

1 0

[tor/master] Replace a 4 with a 6; fix a bug that nobody noticed :/
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit a8dd93027470f3d6b56352fddadfd7b702d26831 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 19 11:51:08 2015 -0500 Replace a 4 with a 6; fix a bug that nobody noticed :/ Fixes 14280 bugfix on 1053af0b9c4127873034a935ce33 in 0.2.4.7-alpha. --- changes/bug14280 | 5 +++++ src/or/connection_edge.c | 3 +-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/changes/bug14280 b/changes/bug14280 new file mode 100644 index 0000000..917d40c --- /dev/null +++ b/changes/bug14280 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - Reject socks requests to literal IPv6 addresses when IPv6Traffic + flag is not set; and not because the NoIPv4Traffic flag was set. + Previously we'd looked at the NoIPv4Traffic flag for both types + of literal addresses. Fixes bug 14280; bugfix on 0.2.4.7-alpha. diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 13053a3..a11b8e2 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1364,9 +1364,8 @@ connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn, /* If we reach this point, it's an IPv4 or an IPv6 address. */ sa_family_t family = tor_addr_family(&addr); - /* XXXX bug: the second one should be "ipv6_traffic" */ if ((family == AF_INET && ! conn->entry_cfg.ipv4_traffic) || - (family == AF_INET6 && ! conn->entry_cfg.ipv4_traffic)) { + (family == AF_INET6 && ! conn->entry_cfg.ipv6_traffic)) { /* You can't do an IPv4 address on a v6-only socks listener, * or vice versa. */ log_warn(LD_NET, "Rejecting SOCKS request for an IP address "

1 0

[tor/master] Actually set *expires_out in addressmap_rewrite.
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit 2e1ed0815d3f426e7e30b09f3c781425c76e72d5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 13 09:42:23 2015 -0500 Actually set *expires_out in addressmap_rewrite. Fixes 14193; bugfix on 35d08e30d, which went into 0.2.3.17-beta. --- changes/bug14193 | 4 ++++ src/or/addressmap.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/changes/bug14193 b/changes/bug14193 new file mode 100644 index 0000000..a700668 --- /dev/null +++ b/changes/bug14193 @@ -0,0 +1,4 @@ + o Minor bugfixes (client DNS): + - Report the correct cached DNS expiration times. Previously, we + would report everything as "never expires." Fixes bug 14193; + bugfix on 0.2.3.17-beta. diff --git a/src/or/addressmap.c b/src/or/addressmap.c index 8ad2432..908d94f 100644 --- a/src/or/addressmap.c +++ b/src/or/addressmap.c @@ -431,7 +431,7 @@ addressmap_rewrite(char *address, size_t maxlen, if (exit_source_out) *exit_source_out = exit_source; if (expires_out) - *expires_out = TIME_MAX; + *expires_out = expires; return (rewrites > 0); }

1 0

[tor/master] Fix memory leaks in entryconn tests.
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit 6cbe016cb10fe737d7c3403c0a2f7d0a361d834b Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 13 12:13:46 2015 -0500 Fix memory leaks in entryconn tests. --- src/test/test_entryconn.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/test/test_entryconn.c b/src/test/test_entryconn.c index a37f194..8efd916 100644 --- a/src/test/test_entryconn.c +++ b/src/test/test_entryconn.c @@ -100,7 +100,6 @@ test_entryconn_rewrite_automap_ipv4(void *arg) ec3 = entry_connection_new(CONN_TYPE_AP, AF_INET); get_options_mutable()->AutomapHostsOnResolve = 1; - get_options_mutable()->AutomapHostsSuffixes = smartlist_new(); smartlist_add(get_options_mutable()->AutomapHostsSuffixes, tor_strdup(".")); parse_virtual_addr_network("127.202.0.0/16", AF_INET, 0, &msg); @@ -174,7 +173,6 @@ test_entryconn_rewrite_automap_ipv6(void *arg) ec3 = entry_connection_new(CONN_TYPE_AP, AF_INET6); get_options_mutable()->AutomapHostsOnResolve = 1; - get_options_mutable()->AutomapHostsSuffixes = smartlist_new(); smartlist_add(get_options_mutable()->AutomapHostsSuffixes, tor_strdup(".")); parse_virtual_addr_network("FE80::/32", AF_INET6, 0, &msg); @@ -248,7 +246,6 @@ test_entryconn_rewrite_automap_reverse(void *arg) ec2 = entry_connection_new(CONN_TYPE_AP, AF_INET); get_options_mutable()->AutomapHostsOnResolve = 1; - get_options_mutable()->AutomapHostsSuffixes = smartlist_new(); get_options_mutable()->SafeLogging_ = SAFELOG_SCRUB_NONE; smartlist_add(get_options_mutable()->AutomapHostsSuffixes, tor_strdup(".bloom")); @@ -492,7 +489,6 @@ test_entryconn_rewrite_automap_exit(void *arg) ec2 = entry_connection_new(CONN_TYPE_AP, AF_INET); get_options_mutable()->AutomapHostsOnResolve = 1; - get_options_mutable()->AutomapHostsSuffixes = smartlist_new(); get_options_mutable()->AllowDotExit = 1; smartlist_add(get_options_mutable()->AutomapHostsSuffixes, tor_strdup(".EXIT")); @@ -578,7 +574,6 @@ test_entryconn_rewrite_mapaddress_automap_onion(void *arg) ec4 = entry_connection_new(CONN_TYPE_AP, AF_INET); get_options_mutable()->AutomapHostsOnResolve = 1; - get_options_mutable()->AutomapHostsSuffixes = smartlist_new(); get_options_mutable()->AllowDotExit = 1; smartlist_add(get_options_mutable()->AutomapHostsSuffixes, tor_strdup(".onion"));

1 0

[tor/master] (Disabled, failing) test for the bug in 7555.
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit ab6bd78eca0f3edc7ed910d8567c409fe3dfdd92 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 13 12:26:04 2015 -0500 (Disabled, failing) test for the bug in 7555. --- src/test/test_entryconn.c | 70 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) diff --git a/src/test/test_entryconn.c b/src/test/test_entryconn.c index 8efd916..fefd2ea 100644 --- a/src/test/test_entryconn.c +++ b/src/test/test_entryconn.c @@ -641,8 +641,74 @@ test_entryconn_rewrite_mapaddress_automap_onion(void *arg) connection_free_(ENTRY_TO_CONN(ec2)); connection_free_(ENTRY_TO_CONN(ec3)); connection_free_(ENTRY_TO_CONN(ec4)); +} + +#if 0 +/* This fails because of #7555 */ +/* This time is the same, but we start with a mapping from a non-onion + * address. */ +static void +test_entryconn_rewrite_mapaddress_automap_onion2(void *arg) +{ + entry_connection_t *ec = arg; + entry_connection_t *ec2 = NULL; + entry_connection_t *ec3 = NULL; + rewrite_result_t rr; + + ec2 = entry_connection_new(CONN_TYPE_AP, AF_INET); + ec3 = entry_connection_new(CONN_TYPE_AP, AF_INET); + + get_options_mutable()->AutomapHostsOnResolve = 1; + get_options_mutable()->AllowDotExit = 1; + smartlist_add(get_options_mutable()->AutomapHostsSuffixes, + tor_strdup(".onion")); + config_line_append(&get_options_mutable()->AddressMap, + "MapAddress", "irc.example.com abcdefghijklmnop.onion"); + config_register_addressmaps(get_options()); + + /* Connect to irc.example.com */ + strlcpy(ec->socks_request->address, "irc.example.com", + sizeof(ec->socks_request->address)); + ec->socks_request->command = SOCKS_COMMAND_CONNECT; + connection_ap_handshake_rewrite(ec, &rr); + tt_int_op(rr.automap, OP_EQ, 0); + tt_int_op(rr.should_close, OP_EQ, 0); + tt_int_op(rr.end_reason, OP_EQ, 0); + tt_i64_op(rr.map_expires, OP_EQ, TIME_MAX); + tt_int_op(rr.exit_source, OP_EQ, ADDRMAPSRC_NONE); + tt_str_op(rr.orig_address, OP_EQ, "irc.example.com"); + tt_str_op(ec->socks_request->address, OP_EQ, "abcdefghijklmnop.onion"); + + /* Okay, resolve irc.example.com */ + strlcpy(ec2->socks_request->address, "irc.example.com", + sizeof(ec2->socks_request->address)); + ec2->socks_request->command = SOCKS_COMMAND_RESOLVE; + connection_ap_handshake_rewrite(ec2, &rr); + + // tt_int_op(rr.automap, OP_EQ, 1); + tt_int_op(rr.should_close, OP_EQ, 0); + tt_int_op(rr.end_reason, OP_EQ, 0); + tt_i64_op(rr.map_expires, OP_EQ, TIME_MAX); + tt_int_op(rr.exit_source, OP_EQ, ADDRMAPSRC_NONE); + tt_str_op(rr.orig_address, OP_EQ, "irc.example.com"); + tt_assert(!strcmpstart(ec2->socks_request->address, "192.168.")); + + /* Now connect */ + strlcpy(ec3->socks_request->address, ec2->socks_request->address, + sizeof(ec3->socks_request->address)); + ec3->socks_request->command = SOCKS_COMMAND_CONNECT; + connection_ap_handshake_rewrite(ec3, &rr); + tt_int_op(rr.automap, OP_EQ, 0); + tt_int_op(rr.should_close, OP_EQ, 0); + tt_int_op(rr.end_reason, OP_EQ, 0); + tt_assert(!strcmpstart(ec3->socks_request->address, "abcdefghijklmnop.onion")); + + done: + connection_free_(ENTRY_TO_CONN(ec2)); + connection_free_(ENTRY_TO_CONN(ec3)); } +#endif #define REWRITE(name) \ { #name, test_entryconn_##name, TT_FORK, &test_rewrite_setup, NULL } @@ -661,6 +727,10 @@ struct testcase_t entryconn_tests[] = { REWRITE(rewrite_automap_exit), REWRITE(rewrite_mapaddress_exit), REWRITE(rewrite_mapaddress_automap_onion), + /* + This fails because of #7555 + REWRITE(rewrite_mapaddress_automap_onion2), + */ END_OF_TESTCASES };

1 0