January 2015 - tor-commits - lists.torproject.org

[torsocks/master] Fix: switch back to a syscall whitelist scheme
by dgoulet＠torproject.org 19 Jan '15

19 Jan '15

commit a9ed7e3bb4c081f4cf39ece91027f1c9b6f099f2 Author: David Goulet <dgoulet(a)ev0ke.net> Date: Mon Jan 19 11:59:41 2015 -0500 Fix: switch back to a syscall whitelist scheme syscall() can't take a va_list so we can't forward every non dangerous syscall using the libc syscall() thus having to deny non supported ones. It's a bit sad but I have no other solution for that. Please let me know if anyone comes up with one! :) Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/lib/syscall.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/lib/syscall.c b/src/lib/syscall.c index 96016bb..ec10000 100644 --- a/src/lib/syscall.c +++ b/src/lib/syscall.c @@ -229,8 +229,14 @@ LIBC_SYSCALL_RET_TYPE tsocks_syscall(long int number, va_list args) ret = handle_recvmsg(args); break; default: - /* Safe to call the libc syscall function. */ - ret = tsocks_libc_syscall(number, args); + /* + * Because of the design of syscall(), we can't pass a va_list to it so + * we are constraint to use a whitelist scheme and denying the rest. + */ + WARN("[syscall] Unsupported syscall number %ld. Denying the call", + number); + ret = -1; + errno = ENOSYS; break; } @@ -297,8 +303,8 @@ LIBC___SYSCALL_RET_TYPE tsocks___syscall(quad_t number, va_list args) break; default: /* - * Deny call since we have no idea if this call can leak or not data - * off the Tor network. + * Because of the design of syscall(), we can't pass a va_list to it so + * we are constraint to use a whitelist scheme and denying the rest. */ WARN("[syscall] Unsupported __syscall number %ld. Denying the call", number);

1 0

[torsocks/master] Fix error messages about setuid/setgid executables
by dgoulet＠torproject.org 19 Jan '15

19 Jan '15

commit 0dcfe377c749860502359d5eb62a15550d317f66 Author: Dmitry Shachnev <mitya57(a)gmail.com> Date: Thu Dec 4 15:42:43 2014 +0300 Fix error messages about setuid/setgid executables Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- src/bin/torsocks.in | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/bin/torsocks.in b/src/bin/torsocks.in index a392d0b..7fd43d6 100644 --- a/src/bin/torsocks.in +++ b/src/bin/torsocks.in @@ -105,8 +105,11 @@ torify_app () elif [ -z $app_path ]; then echo "ERROR: $1 cannot be found." >&2 exit 1 - elif [ -u $app_path -o -g $app_path ]; then - echo "ERROR: $1 is set${2}id. torsocks will not work on a set${2}id executable." >&2 + elif [ -u $app_path ]; then + echo "ERROR: $1 is setuid. torsocks will not work on a setuid executable." >&2 + exit 1 + elif [ -g $app_path ]; then + echo "ERROR: $1 is setgid. torsocks will not work on a setgid executable." >&2 exit 1 fi

1 0

[tor/master] Some days I just can't C.
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit 061682c829b262dbcaf0fdc40c9aa5a2a599cc0c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 19 11:58:40 2015 -0500 Some days I just can't C. --- src/or/connection_edge.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 9031edb..d1ad56d 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1064,7 +1064,7 @@ connection_ap_handshake_rewrite(entry_connection_t *conn, * previously registered Automap entries, TrackHostExits entries, * and client-side DNS cache entries (not recommended). */ - if (!socks->command != SOCKS_COMMAND_RESOLVE_PTR && + if (socks->command != SOCKS_COMMAND_RESOLVE_PTR && !out->automap) { unsigned rewrite_flags = AMR_FLAG_USE_AUTOMAP | AMR_FLAG_USE_TRACKEXIT; addressmap_entry_source_t exit_source2;

1 0

[tor/master] Remove a now-needless testing workaround.
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit f92b01b9635eb2655a449529d6e7eb30a46bb29f Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 19 11:55:52 2015 -0500 Remove a now-needless testing workaround. --- src/test/test_entryconn.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/test/test_entryconn.c b/src/test/test_entryconn.c index 146cddc..7e0757f 100644 --- a/src/test/test_entryconn.c +++ b/src/test/test_entryconn.c @@ -269,7 +269,6 @@ test_entryconn_rewrite_automap_reverse(void *arg) strlcpy(ec2->socks_request->address, ec->socks_request->address, sizeof(ec2->socks_request->address)); - ec2->entry_cfg.use_cached_ipv4_answers = 1; // XXXX REMOVE. This is only there to hide a bug. ec2->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR; connection_ap_handshake_rewrite(ec2, &rr);

1 0

[tor/master] Make check-spaces happier.
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit 2e8b8c8698a326597a07020e2f29a79948094f0e Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 19 11:56:03 2015 -0500 Make check-spaces happier. --- src/or/connection_edge.c | 6 ++++-- src/or/connection_edge.h | 1 - src/or/relay.c | 6 ++++-- src/test/test_entryconn.c | 6 +++--- 4 files changed, 11 insertions(+), 8 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index a11b8e2..9031edb 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1378,7 +1378,8 @@ connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn, log_warn(LD_NET, "Rejecting SOCKS4 request for an IPv6 address."); connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY); return -1; - } else if (socks->socks_version == 4 && !conn->entry_cfg.ipv4_traffic) { + } else if (socks->socks_version == 4 && + !conn->entry_cfg.ipv4_traffic) { /* You can't do any kind of Socks4 request when IPv4 is forbidden. * * XXX raise this check outside the enclosing block? */ @@ -3282,7 +3283,8 @@ connection_edge_compatible_with_circuit(const entry_connection_t *conn, if ((iso & ISO_CLIENTADDR) && !tor_addr_eq(&ENTRY_TO_CONN(conn)->addr, &circ->client_addr)) return 0; - if ((iso & ISO_SESSIONGRP) && conn->entry_cfg.session_group != circ->session_group) + if ((iso & ISO_SESSIONGRP) && + conn->entry_cfg.session_group != circ->session_group) return 0; if ((iso & ISO_NYM_EPOCH) && conn->nym_epoch != circ->nym_epoch) return 0; diff --git a/src/or/connection_edge.h b/src/or/connection_edge.h index 0cc391e..7c0b9c0 100644 --- a/src/or/connection_edge.h +++ b/src/or/connection_edge.h @@ -144,7 +144,6 @@ STATIC int connected_cell_format_payload(uint8_t *payload_out, const tor_addr_t *addr, uint32_t ttl); - typedef struct { /** Original address, after we lowercased it but before we started * mapping it. diff --git a/src/or/relay.c b/src/or/relay.c index 350353e..8653d8c 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -804,8 +804,10 @@ connection_ap_process_end_not_open( return 0; } - if ((tor_addr_family(&addr) == AF_INET && !conn->entry_cfg.ipv4_traffic) || - (tor_addr_family(&addr) == AF_INET6 && !conn->entry_cfg.ipv6_traffic)) { + if ((tor_addr_family(&addr) == AF_INET && + !conn->entry_cfg.ipv4_traffic) || + (tor_addr_family(&addr) == AF_INET6 && + !conn->entry_cfg.ipv6_traffic)) { log_fn(LOG_PROTOCOL_WARN, LD_APP, "Got an EXITPOLICY failure on a connection with a " "mismatched family. Closing."); diff --git a/src/test/test_entryconn.c b/src/test/test_entryconn.c index 7e0757f..6edc166 100644 --- a/src/test/test_entryconn.c +++ b/src/test/test_entryconn.c @@ -617,7 +617,8 @@ test_entryconn_rewrite_mapaddress_automap_onion(void *arg) tt_int_op(rr.automap, OP_EQ, 0); tt_int_op(rr.should_close, OP_EQ, 0); tt_int_op(rr.end_reason, OP_EQ, 0); - tt_assert(!strcmpstart(ec3->socks_request->address, "abcdefghijklmnop.onion")); + tt_assert(!strcmpstart(ec3->socks_request->address, + "abcdefghijklmnop.onion")); /* Now resolve abcefghijklmnop.onion. */ strlcpy(ec4->socks_request->address, "abcdefghijklmnop.onion", @@ -633,7 +634,7 @@ test_entryconn_rewrite_mapaddress_automap_onion(void *arg) tt_str_op(rr.orig_address, OP_EQ, "abcdefghijklmnop.onion"); tt_assert(!strcmpstart(ec4->socks_request->address, "192.168.")); /* XXXX doesn't work - tt_str_op(ec4->socks_request->address, OP_EQ, ec2->socks_request->address); + tt_str_op(ec4->socks_request->address, OP_EQ, ec2->socks_request->address); */ done: @@ -742,7 +743,6 @@ test_entryconn_rewrite_mapaddress_automap_onion4(void *arg) test_entryconn_rewrite_mapaddress_automap_onion_common(arg, 0, 1); } - #define REWRITE(name) \ { #name, test_entryconn_##name, TT_FORK, &test_rewrite_setup, NULL }

1 0

[tor/master] Replace a 4 with a 6; fix a bug that nobody noticed :/
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit a8dd93027470f3d6b56352fddadfd7b702d26831 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 19 11:51:08 2015 -0500 Replace a 4 with a 6; fix a bug that nobody noticed :/ Fixes 14280 bugfix on 1053af0b9c4127873034a935ce33 in 0.2.4.7-alpha. --- changes/bug14280 | 5 +++++ src/or/connection_edge.c | 3 +-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/changes/bug14280 b/changes/bug14280 new file mode 100644 index 0000000..917d40c --- /dev/null +++ b/changes/bug14280 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - Reject socks requests to literal IPv6 addresses when IPv6Traffic + flag is not set; and not because the NoIPv4Traffic flag was set. + Previously we'd looked at the NoIPv4Traffic flag for both types + of literal addresses. Fixes bug 14280; bugfix on 0.2.4.7-alpha. diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 13053a3..a11b8e2 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1364,9 +1364,8 @@ connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn, /* If we reach this point, it's an IPv4 or an IPv6 address. */ sa_family_t family = tor_addr_family(&addr); - /* XXXX bug: the second one should be "ipv6_traffic" */ if ((family == AF_INET && ! conn->entry_cfg.ipv4_traffic) || - (family == AF_INET6 && ! conn->entry_cfg.ipv4_traffic)) { + (family == AF_INET6 && ! conn->entry_cfg.ipv6_traffic)) { /* You can't do an IPv4 address on a v6-only socks listener, * or vice versa. */ log_warn(LD_NET, "Rejecting SOCKS request for an IP address "

1 0

[tor/master] Actually set *expires_out in addressmap_rewrite.
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit 2e1ed0815d3f426e7e30b09f3c781425c76e72d5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 13 09:42:23 2015 -0500 Actually set *expires_out in addressmap_rewrite. Fixes 14193; bugfix on 35d08e30d, which went into 0.2.3.17-beta. --- changes/bug14193 | 4 ++++ src/or/addressmap.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/changes/bug14193 b/changes/bug14193 new file mode 100644 index 0000000..a700668 --- /dev/null +++ b/changes/bug14193 @@ -0,0 +1,4 @@ + o Minor bugfixes (client DNS): + - Report the correct cached DNS expiration times. Previously, we + would report everything as "never expires." Fixes bug 14193; + bugfix on 0.2.3.17-beta. diff --git a/src/or/addressmap.c b/src/or/addressmap.c index 8ad2432..908d94f 100644 --- a/src/or/addressmap.c +++ b/src/or/addressmap.c @@ -431,7 +431,7 @@ addressmap_rewrite(char *address, size_t maxlen, if (exit_source_out) *exit_source_out = exit_source; if (expires_out) - *expires_out = TIME_MAX; + *expires_out = expires; return (rewrites > 0); }

1 0

[tor/master] Fix memory leaks in entryconn tests.
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit 6cbe016cb10fe737d7c3403c0a2f7d0a361d834b Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 13 12:13:46 2015 -0500 Fix memory leaks in entryconn tests. --- src/test/test_entryconn.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/test/test_entryconn.c b/src/test/test_entryconn.c index a37f194..8efd916 100644 --- a/src/test/test_entryconn.c +++ b/src/test/test_entryconn.c @@ -100,7 +100,6 @@ test_entryconn_rewrite_automap_ipv4(void *arg) ec3 = entry_connection_new(CONN_TYPE_AP, AF_INET); get_options_mutable()->AutomapHostsOnResolve = 1; - get_options_mutable()->AutomapHostsSuffixes = smartlist_new(); smartlist_add(get_options_mutable()->AutomapHostsSuffixes, tor_strdup(".")); parse_virtual_addr_network("127.202.0.0/16", AF_INET, 0, &msg); @@ -174,7 +173,6 @@ test_entryconn_rewrite_automap_ipv6(void *arg) ec3 = entry_connection_new(CONN_TYPE_AP, AF_INET6); get_options_mutable()->AutomapHostsOnResolve = 1; - get_options_mutable()->AutomapHostsSuffixes = smartlist_new(); smartlist_add(get_options_mutable()->AutomapHostsSuffixes, tor_strdup(".")); parse_virtual_addr_network("FE80::/32", AF_INET6, 0, &msg); @@ -248,7 +246,6 @@ test_entryconn_rewrite_automap_reverse(void *arg) ec2 = entry_connection_new(CONN_TYPE_AP, AF_INET); get_options_mutable()->AutomapHostsOnResolve = 1; - get_options_mutable()->AutomapHostsSuffixes = smartlist_new(); get_options_mutable()->SafeLogging_ = SAFELOG_SCRUB_NONE; smartlist_add(get_options_mutable()->AutomapHostsSuffixes, tor_strdup(".bloom")); @@ -492,7 +489,6 @@ test_entryconn_rewrite_automap_exit(void *arg) ec2 = entry_connection_new(CONN_TYPE_AP, AF_INET); get_options_mutable()->AutomapHostsOnResolve = 1; - get_options_mutable()->AutomapHostsSuffixes = smartlist_new(); get_options_mutable()->AllowDotExit = 1; smartlist_add(get_options_mutable()->AutomapHostsSuffixes, tor_strdup(".EXIT")); @@ -578,7 +574,6 @@ test_entryconn_rewrite_mapaddress_automap_onion(void *arg) ec4 = entry_connection_new(CONN_TYPE_AP, AF_INET); get_options_mutable()->AutomapHostsOnResolve = 1; - get_options_mutable()->AutomapHostsSuffixes = smartlist_new(); get_options_mutable()->AllowDotExit = 1; smartlist_add(get_options_mutable()->AutomapHostsSuffixes, tor_strdup(".onion"));

1 0

[tor/master] (Disabled, failing) test for the bug in 7555.
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit ab6bd78eca0f3edc7ed910d8567c409fe3dfdd92 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 13 12:26:04 2015 -0500 (Disabled, failing) test for the bug in 7555. --- src/test/test_entryconn.c | 70 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) diff --git a/src/test/test_entryconn.c b/src/test/test_entryconn.c index 8efd916..fefd2ea 100644 --- a/src/test/test_entryconn.c +++ b/src/test/test_entryconn.c @@ -641,8 +641,74 @@ test_entryconn_rewrite_mapaddress_automap_onion(void *arg) connection_free_(ENTRY_TO_CONN(ec2)); connection_free_(ENTRY_TO_CONN(ec3)); connection_free_(ENTRY_TO_CONN(ec4)); +} + +#if 0 +/* This fails because of #7555 */ +/* This time is the same, but we start with a mapping from a non-onion + * address. */ +static void +test_entryconn_rewrite_mapaddress_automap_onion2(void *arg) +{ + entry_connection_t *ec = arg; + entry_connection_t *ec2 = NULL; + entry_connection_t *ec3 = NULL; + rewrite_result_t rr; + + ec2 = entry_connection_new(CONN_TYPE_AP, AF_INET); + ec3 = entry_connection_new(CONN_TYPE_AP, AF_INET); + + get_options_mutable()->AutomapHostsOnResolve = 1; + get_options_mutable()->AllowDotExit = 1; + smartlist_add(get_options_mutable()->AutomapHostsSuffixes, + tor_strdup(".onion")); + config_line_append(&get_options_mutable()->AddressMap, + "MapAddress", "irc.example.com abcdefghijklmnop.onion"); + config_register_addressmaps(get_options()); + + /* Connect to irc.example.com */ + strlcpy(ec->socks_request->address, "irc.example.com", + sizeof(ec->socks_request->address)); + ec->socks_request->command = SOCKS_COMMAND_CONNECT; + connection_ap_handshake_rewrite(ec, &rr); + tt_int_op(rr.automap, OP_EQ, 0); + tt_int_op(rr.should_close, OP_EQ, 0); + tt_int_op(rr.end_reason, OP_EQ, 0); + tt_i64_op(rr.map_expires, OP_EQ, TIME_MAX); + tt_int_op(rr.exit_source, OP_EQ, ADDRMAPSRC_NONE); + tt_str_op(rr.orig_address, OP_EQ, "irc.example.com"); + tt_str_op(ec->socks_request->address, OP_EQ, "abcdefghijklmnop.onion"); + + /* Okay, resolve irc.example.com */ + strlcpy(ec2->socks_request->address, "irc.example.com", + sizeof(ec2->socks_request->address)); + ec2->socks_request->command = SOCKS_COMMAND_RESOLVE; + connection_ap_handshake_rewrite(ec2, &rr); + + // tt_int_op(rr.automap, OP_EQ, 1); + tt_int_op(rr.should_close, OP_EQ, 0); + tt_int_op(rr.end_reason, OP_EQ, 0); + tt_i64_op(rr.map_expires, OP_EQ, TIME_MAX); + tt_int_op(rr.exit_source, OP_EQ, ADDRMAPSRC_NONE); + tt_str_op(rr.orig_address, OP_EQ, "irc.example.com"); + tt_assert(!strcmpstart(ec2->socks_request->address, "192.168.")); + + /* Now connect */ + strlcpy(ec3->socks_request->address, ec2->socks_request->address, + sizeof(ec3->socks_request->address)); + ec3->socks_request->command = SOCKS_COMMAND_CONNECT; + connection_ap_handshake_rewrite(ec3, &rr); + tt_int_op(rr.automap, OP_EQ, 0); + tt_int_op(rr.should_close, OP_EQ, 0); + tt_int_op(rr.end_reason, OP_EQ, 0); + tt_assert(!strcmpstart(ec3->socks_request->address, "abcdefghijklmnop.onion")); + + done: + connection_free_(ENTRY_TO_CONN(ec2)); + connection_free_(ENTRY_TO_CONN(ec3)); } +#endif #define REWRITE(name) \ { #name, test_entryconn_##name, TT_FORK, &test_rewrite_setup, NULL } @@ -661,6 +727,10 @@ struct testcase_t entryconn_tests[] = { REWRITE(rewrite_automap_exit), REWRITE(rewrite_mapaddress_exit), REWRITE(rewrite_mapaddress_automap_onion), + /* + This fails because of #7555 + REWRITE(rewrite_mapaddress_automap_onion2), + */ END_OF_TESTCASES };

1 0

[tor/master] Uncomment a test
by nickm＠torproject.org 19 Jan '15

19 Jan '15

commit 73ccf0b33f13ecd9e9e3e481576c5132b9b79a6e Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 13 13:42:20 2015 -0500 Uncomment a test --- src/test/test_entryconn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/test_entryconn.c b/src/test/test_entryconn.c index 0d0f2b0..0ff353d 100644 --- a/src/test/test_entryconn.c +++ b/src/test/test_entryconn.c @@ -687,7 +687,7 @@ test_entryconn_rewrite_mapaddress_automap_onion2(void *arg) ec2->socks_request->command = SOCKS_COMMAND_RESOLVE; connection_ap_handshake_rewrite(ec2, &rr); - // tt_int_op(rr.automap, OP_EQ, 1); + tt_int_op(rr.automap, OP_EQ, 1); tt_int_op(rr.should_close, OP_EQ, 0); tt_int_op(rr.end_reason, OP_EQ, 0); tt_i64_op(rr.map_expires, OP_EQ, TIME_MAX);

1 0