January 2015 - tor-commits - lists.torproject.org

[tor/master] Restrict unix: addresses to control and socks for now
by nickm＠torproject.org 29 Jan '15

29 Jan '15

commit 4c1a77953942f4921f8a151e01933c8f9d104e7f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 29 14:51:59 2015 -0500 Restrict unix: addresses to control and socks for now --- src/or/config.c | 6 ++++++ src/or/connection.c | 27 +++++++++++++++++++-------- src/or/connection.h | 1 + 3 files changed, 26 insertions(+), 8 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index ab1f318..05b4d14 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -5862,6 +5862,12 @@ parse_port_config(smartlist_t *out, goto err; } + if (unix_socket_path && + ! conn_listener_type_supports_af_unix(listener_type)) { + log_warn(LD_CONFIG, "%sPort does not support unix sockets", portname); + goto err; + } + if (unix_socket_path) { port = 1; } else if (is_unix_socket) { diff --git a/src/or/connection.c b/src/or/connection.c index 170d3d7..b7dfb1d 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -449,6 +449,22 @@ connection_link_connections(connection_t *conn_a, connection_t *conn_b) conn_b->linked_conn = conn_a; } +/** Return true iff the provided connection listener type supports AF_UNIX + * sockets. */ +int +conn_listener_type_supports_af_unix(int type) +{ + /* For now only control ports or SOCKS ports can be Unix domain sockets + * and listeners at the same time */ + switch (type) { + case CONN_TYPE_CONTROL_LISTENER: + case CONN_TYPE_AP_LISTENER: + return 1; + default: + return 0; + } +} + /** Deallocate memory used by <b>conn</b>. Deallocate its buffers if * necessary, close its socket if necessary, and mark the directory as dirty * if <b>conn</b> is an OR or OP connection. @@ -516,8 +532,7 @@ connection_free_(connection_t *conn) if (conn->socket_family == AF_UNIX) { /* For now only control and SOCKS ports can be Unix domain sockets * and listeners at the same time */ - tor_assert(conn->type == CONN_TYPE_CONTROL_LISTENER || - conn->type == CONN_TYPE_AP_LISTENER); + tor_assert(conn_listener_type_supports_af_unix(conn->type)); if (unlink(conn->address) < 0 && errno != ENOENT) { log_warn(LD_NET, "Could not unlink %s: %s", conn->address, @@ -1172,17 +1187,13 @@ connection_listener_new(const struct sockaddr *listensockaddr, } #ifdef HAVE_SYS_UN_H /* - * AF_UNIX generic setup stuff (this covers both CONN_TYPE_CONTROL_LISTENER - * and CONN_TYPE_AP_LISTENER cases) + * AF_UNIX generic setup stuff */ } else if (listensockaddr->sa_family == AF_UNIX) { /* We want to start reading for both AF_UNIX cases */ start_reading = 1; - /* For now only control ports or SOCKS ports can be Unix domain sockets - * and listeners at the same time */ - tor_assert(type == CONN_TYPE_CONTROL_LISTENER || - type == CONN_TYPE_AP_LISTENER); + tor_assert(conn_listener_type_supports_af_unix(type)); if (check_location_for_unix_socket(options, address, (type == CONN_TYPE_CONTROL_LISTENER) ? diff --git a/src/or/connection.h b/src/or/connection.h index 50bea51..d0a34ec 100644 --- a/src/or/connection.h +++ b/src/or/connection.h @@ -17,6 +17,7 @@ const char *conn_type_to_string(int type); const char *conn_state_to_string(int type, int state); +int conn_listener_type_supports_af_unix(int type); dir_connection_t *dir_connection_new(int socket_family); or_connection_t *or_connection_new(int type, int socket_family);

1 0

[tor/master] Remove SocksSocket; it's now spelled differently thanks to 14451
by nickm＠torproject.org 29 Jan '15

29 Jan '15

commit 204374f7d92997a510a7aabe5ec57f0f87a3499f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 29 14:45:21 2015 -0500 Remove SocksSocket; it's now spelled differently thanks to 14451 Also, revise bug12585 changes file to mention new syntax --- changes/bug12585 | 7 +++++-- doc/tor.1.txt | 4 ---- src/or/config.c | 34 +++++++++------------------------- src/or/connection.c | 2 +- src/or/or.h | 4 ---- 5 files changed, 15 insertions(+), 36 deletions(-) diff --git a/changes/bug12585 b/changes/bug12585 index 495a2f0..ac03993 100644 --- a/changes/bug12585 +++ b/changes/bug12585 @@ -1,9 +1,12 @@ o Major features (security) - - Implementation of SocksSocket option - SocksSocket implements a SOCKS + - Implementation of an AF_UNIX socket option to implement a SOCKS proxy reachable by Unix Domain Socket. This allows client applications to communicate with Tor without having the ability to create AF_INET or AF_INET6 family sockets. If an application has permission to create a socket with AF_UNIX, it may directly communicate with Tor as if it were an other SOCKS proxy. This should allow high risk applications to be entirely prevented from connecting directly with TCP/IP, they will be able to only connect to the - internet through AF_UNIX and only through Tor. Closes ticket 12585. + internet through AF_UNIX and only through Tor. + To create a socket of this type, use the syntax "unix:/path/to/socket". + Closes ticket 12585. + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 5302b33..50ab80e 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -483,10 +483,6 @@ GENERAL OPTIONS in accordance to RFC 1929. Both username and password must be between 1 and 255 characters. -[[SocksSocket]] **SocksSocket** __Path__ [_flags_] [_isolation flags_]:: - Like SocksPort, but listens on a Unix domain socket, rather than a TCP - socket. '0' disables SocksSocket (Unix and Unix-like systems only.) - [[SocksSocketsGroupWritable]] **SocksSocketsGroupWritable** **0**|**1**:: If this option is set to 0, don't allow the filesystem group to read and write unix sockets (e.g. SocksSocket). If the option is set to 1, make diff --git a/src/or/config.c b/src/or/config.c index 0bdf8d0..ab1f318 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -69,7 +69,7 @@ extern int quiet_level; /* Prefix used to indicate a Unix socket in a FooPort configuration. */ -static const char *unix_socket_prefix = "unix:"; +static const char unix_socket_prefix[] = "unix:"; /** A list of abbreviations and aliases to map command-line options, obsolete * option names, or alternative option names, to their current values. */ @@ -203,7 +203,6 @@ static config_var_t option_vars_[] = { V(ControlPortWriteToFile, FILENAME, NULL), V(ControlSocket, LINELIST, NULL), V(ControlSocketsGroupWritable, BOOL, "0"), - V(SocksSocket, LINELIST, NULL), V(SocksSocketsGroupWritable, BOOL, "0"), V(CookieAuthentication, BOOL, "0"), V(CookieAuthFileGroupReadable, BOOL, "0"), @@ -1053,20 +1052,6 @@ options_act_reversible(const or_options_t *old_options, char **msg) } #endif -#ifndef HAVE_SYS_UN_H - if (options->SocksSocket || options->SocksSocketsGroupWritable) { - *msg = tor_strdup("Unix domain sockets (SocksSocket) not supported " - "on this OS/with this build."); - goto rollback; - } -#else - if (options->SocksSocketsGroupWritable && !options->SocksSocket) { - *msg = tor_strdup("Setting SocksSocketGroupWritable without setting" - "a SocksSocket makes no sense."); - goto rollback; - } -#endif - if (running_tor) { int n_ports=0; /* We need to set the connection limit before we can open the listeners. */ @@ -5656,6 +5641,14 @@ config_parse_unix_port(const char *addrport, char **path_out) int config_parse_unix_port(const char *addrport, char **path_out) { + tor_assert(path_out); + tor_assert(addrport); + + if (strcmpstart(addrport, unix_socket_prefix)) { + /* Not a Unix socket path. */ + return -ENOENT; + } + log_warn(LD_CONFIG, "Port configuration %s is for an AF_UNIX socket, but we have no" "support available on this platform", @@ -6218,13 +6211,6 @@ parse_ports(or_options_t *options, int validate_only, *msg = tor_strdup("Invalid ControlSocket configuration"); goto err; } - if (parse_port_config(ports, options->SocksSocket, NULL, - "SocksSocket", - CONN_TYPE_AP_LISTENER, NULL, 0, - CL_PORT_IS_UNIXSOCKET) < 0) { - *msg = tor_strdup("Invalid SocksSocket configuration"); - goto err; - } } if (! options->ClientOnly) { if (parse_port_config(ports, @@ -6268,8 +6254,6 @@ parse_ports(or_options_t *options, int validate_only, !! count_real_listeners(ports, CONN_TYPE_OR_LISTENER); options->SocksPort_set = !! count_real_listeners(ports, CONN_TYPE_AP_LISTENER); - options->SocksSocket_set = - !! count_real_listeners(ports, CONN_TYPE_AP_LISTENER); options->TransPort_set = !! count_real_listeners(ports, CONN_TYPE_AP_TRANS_LISTENER); options->NATDPort_set = diff --git a/src/or/connection.c b/src/or/connection.c index f26ada0..170d3d7 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -1496,7 +1496,7 @@ connection_handle_listener_read(connection_t *conn, int new_type) if (new_type == CONN_TYPE_AP && conn->socket_family == AF_UNIX) { newconn->port = 0; newconn->address = tor_strdup(conn->address); - log_info(LD_NET, "New SOCKS SocksSocket connection opened"); + log_info(LD_NET, "New SOCKS AF_UNIX connection opened"); } if (new_type == CONN_TYPE_CONTROL) { log_notice(LD_CONTROL, "New control connection opened from %s.", diff --git a/src/or/or.h b/src/or/or.h index 4906878..4207f3d 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3463,9 +3463,6 @@ typedef struct { * for control connections. */ int ControlSocketsGroupWritable; /**< Boolean: Are control sockets g+rw? */ - config_line_t *SocksSocket; /**< List of Unix Domain Sockets to listen on - * for SOCKS connections. */ - int SocksSocketsGroupWritable; /**< Boolean: Are SOCKS sockets g+rw? */ /** Ports to listen on for directory connections. */ config_line_t *DirPort_lines; @@ -3489,7 +3486,6 @@ typedef struct { */ unsigned int ORPort_set : 1; unsigned int SocksPort_set : 1; - unsigned int SocksSocket_set : 1; unsigned int TransPort_set : 1; unsigned int NATDPort_set : 1; unsigned int ControlPort_set : 1;

1 0

[tor/master] Merge branch 'bug14451_026_v1'
by nickm＠torproject.org 29 Jan '15

29 Jan '15

commit a87ea9b1c6a61acebc670f54a62e8c443329c34c Merge: f6afb04 4c5133e Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 29 15:16:15 2015 -0500 Merge branch 'bug14451_026_v1' changes/bug12585 | 7 +++- changes/bug14451 | 7 ++++ doc/tor.1.txt | 8 +--- src/or/config.c | 108 ++++++++++++++++++++++++++++++++++++-------------- src/or/config.h | 1 + src/or/connection.c | 29 +++++++++----- src/or/connection.h | 1 + src/or/or.h | 4 -- src/or/rendservice.c | 25 +++++------- 9 files changed, 123 insertions(+), 67 deletions(-)

1 0

[tor/master] Document unix: addresses
by nickm＠torproject.org 29 Jan '15

29 Jan '15

commit 64bde3ae94f843945bed9f438243de76281bc266 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 29 14:56:45 2015 -0500 Document unix: addresses --- doc/tor.1.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 50ab80e..90dad54 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -273,7 +273,7 @@ GENERAL OPTIONS all sockets will be set to this limit. Must be a value between 2048 and 262144, in 1024 byte increments. Default of 8192 is recommended. -[[ControlPort]] **ControlPort** __PORT__|**auto**:: +[[ControlPort]] **ControlPort** __PORT__|**unix:**__path__|**auto**:: If set, Tor will accept connections on this port and allow those connections to control the Tor process using the Tor Control Protocol (described in control-spec.txt). Note: unless you also specify one or @@ -953,7 +953,7 @@ The following options are useful only for clients (that is, if the same circuit. Currently, two addresses are "too close" if they lie in the same /16 range. (Default: 1) -[[SOCKSPort]] **SOCKSPort** \['address':]__port__|**auto** [_flags_] [_isolation flags_]:: +[[SOCKSPort]] **SOCKSPort** \['address':]__port__|**unix:**__path__|**auto** [_flags_] [_isolation flags_]:: Open this port to listen for connections from SOCKS-speaking applications. Set this to 0 if you don't want to allow application connections via SOCKS. Set it to "auto" to have Tor pick a port for

1 0

[tor/master] changes file for 14451
by nickm＠torproject.org 29 Jan '15

29 Jan '15

commit 4c5133e42d731a79480b6d54fbe81f440a9f4429 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 29 15:12:14 2015 -0500 changes file for 14451 --- changes/bug14451 | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/changes/bug14451 b/changes/bug14451 new file mode 100644 index 0000000..7949a78 --- /dev/null +++ b/changes/bug14451 @@ -0,0 +1,7 @@ + + + o Minor features: + - ControlPort now supports the unix:/path/to/dir syntax as an alternative + to the ControlSocket option, for consistency with SocksPort and + hidden services. Closes ticket 14451. +

1 0

[tor/master] Use HT_BUCKET_NUM_ in more places
by nickm＠torproject.org 29 Jan '15

29 Jan '15

commit f6afb04abbf46d04c718fa3506000f4fb41e2510 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 29 15:10:19 2015 -0500 Use HT_BUCKET_NUM_ in more places (patch from sysrqb) --- src/ext/ht.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/ext/ht.h b/src/ext/ht.h index 9b3bcaf..19a67a6 100644 --- a/src/ext/ht.h +++ b/src/ext/ht.h @@ -287,8 +287,7 @@ ht_string_hash(const char *s) HT_BUCKET_NUM_(head,field,(*elm)->field.hte_next,hashfn)); \ return &(*elm)->field.hte_next; \ } else { \ - unsigned b = (HT_ELT_HASH_(*elm, field, hashfn) \ - % head->hth_table_length)+1; \ + unsigned b = HT_BUCKET_NUM_(head,field,*elm,hashfn)+1; \ while (b < head->hth_table_length) { \ if (head->hth_table[b]) { \ HT_ASSERT_(b == \ @@ -434,7 +433,7 @@ ht_string_hash(const char *s) for (elm = head->hth_table[i]; elm; elm = elm->field.hte_next) { \ if (HT_ELT_HASH_(elm, field, hashfn) != hashfn(elm)) \ return 1000 + i; \ - if ((HT_ELT_HASH_(elm, field, hashfn) % head->hth_table_length) != i) \ + if (HT_BUCKET_NUM_(head,field,elm,hashfn) != i) \ return 10000 + i; \ ++n; \ } \

1 0

[tor/master] Merge remote-tracking branch 'public/ticket11737'
by nickm＠torproject.org 29 Jan '15

29 Jan '15

commit 5faa017b86c0ab3ec4ffc22c9ec8d6c1a67d58ea Merge: a3de2df 6344345 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 29 15:09:55 2015 -0500 Merge remote-tracking branch 'public/ticket11737' changes/ticket11737 | 4 ++++ src/ext/ht.h | 24 ++++++++++++++++++++---- 2 files changed, 24 insertions(+), 4 deletions(-)

1 0

[tor-messenger-build/master] Update rbm
by boklm＠torproject.org 29 Jan '15

29 Jan '15

commit 4cb1c1e46049f06ec66f866f925e8d3d897eaf9b Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Jan 29 20:37:27 2015 +0100 Update rbm --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index 0e79064..59c8153 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 0e790646def8f52fd888a4a2be47453e4035116a +Subproject commit 59c81538c309ec61ebb773fa436cf3d2dfabec4f

1 0

[torspec/master] update prop227: "one or more"
by nickm＠torproject.org 29 Jan '15

29 Jan '15

commit 987eb8516858a46aa14d7e40ec7d4453710a47a4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 29 14:16:08 2015 -0500 update prop227: "one or more" --- proposals/227-vote-on-package-fingerprints.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/proposals/227-vote-on-package-fingerprints.txt b/proposals/227-vote-on-package-fingerprints.txt index 9c5f0da..a3f6d1a 100644 --- a/proposals/227-vote-on-package-fingerprints.txt +++ b/proposals/227-vote-on-package-fingerprints.txt @@ -35,7 +35,7 @@ Status: Open NONSPACE = one or more non-space printing characters - DIGESTVAL = DIGESTTYPE = any number of non-=, non-" " characters. + DIGESTVAL = DIGESTTYPE = one or more non-=, non-" " characters. SP = " " NL = a newline

1 0

[translation/tails-iuk_completed] Update translations for tails-iuk_completed
by translation＠torproject.org 29 Jan '15

29 Jan '15

commit 8836afe68dac267e9217c86b63dd57472e6ceade Author: Translation commit bot <translation(a)torproject.org> Date: Thu Jan 29 17:16:21 2015 +0000 Update translations for tails-iuk_completed --- fr_CA.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fr_CA.po b/fr_CA.po index 47ba68d..034071d 100644 --- a/fr_CA.po +++ b/fr_CA.po @@ -11,7 +11,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: Tails developers <tails(a)boum.org>\n" "POT-Creation-Date: 2015-01-13 14:19+0100\n" -"PO-Revision-Date: 2015-01-29 16:45+0000\n" +"PO-Revision-Date: 2015-01-29 16:51+0000\n" "Last-Translator: yahoe.001\n" "Language-Team: French (Canada) (http://www.transifex.com/projects/p/torproject/language/fr_CA/)\n" "MIME-Version: 1.0\n"

1 0