December 2016 - tor-commits - lists.torproject.org

[tor/master] Merge branch 'maint-0.2.9'
by nickm＠torproject.org 08 Dec '16

08 Dec '16

commit 85538498b685bad290120b99481c7375b4886764 Merge: 7fea2c3 9fe6ffa Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 8 07:49:56 2016 -0500 Merge branch 'maint-0.2.9' src/test/test_options.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)

1 0

[tor/release-0.2.9] Netbsd doesn't have ipfw, only the regular pf transport stuff.
by nickm＠torproject.org 08 Dec '16

08 Dec '16

commit 53d4e89626856eabe235c50ffc3d6a697f176741 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 7 15:21:21 2016 -0500 Netbsd doesn't have ipfw, only the regular pf transport stuff. Attempted fix for 19960. Also, fixes a typo. --- changes/bug19960 | 4 ++++ src/or/config.c | 2 +- src/test/test_options.c | 13 +++++++++++-- 3 files changed, 16 insertions(+), 3 deletions(-) diff --git a/changes/bug19960 b/changes/bug19960 new file mode 100644 index 0000000..5d65585 --- /dev/null +++ b/changes/bug19960 @@ -0,0 +1,4 @@ + o Minor bugfixes (netbsd, unit tests): + - Stop expecting NetBSD unit tests to report success for ipfw; + on NetBSD, it's only pf that's supported. + Part of a fix for bug 19960; bugfix on 0.2.9.5-alpha. diff --git a/src/or/config.c b/src/or/config.c index 8568ea9..3693cdf 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -3004,7 +3004,7 @@ options_validate(or_options_t *old_options, or_options_t *options, } else if (!strcasecmp(options->TransProxyType, "ipfw")) { #ifndef KERNEL_MAY_SUPPORT_IPFW /* Earlier versions of OS X have ipfw */ - REJECT("ipfw is a FreeBSD-specific" + REJECT("ipfw is a FreeBSD-specific " "and OS X/Darwin-specific feature."); #else options->TransProxyType_parsed = TPT_IPFW; diff --git a/src/test/test_options.c b/src/test/test_options.c index 6770c16..2570f8d 100644 --- a/src/test/test_options.c +++ b/src/test/test_options.c @@ -1050,7 +1050,7 @@ test_options_validate__transproxy(void *ignored) tt_int_op(ret, OP_EQ, -1); #ifndef KERNEL_MAY_SUPPORT_IPFW - tt_str_op(msg, OP_EQ, "ipfw is a FreeBSD-specificand OS X/Darwin-specific " + tt_str_op(msg, OP_EQ, "ipfw is a FreeBSD-specific and OS X/Darwin-specific " "feature."); #else tt_int_op(tdata->opt->TransProxyType_parsed, OP_EQ, TPT_IPFW); @@ -1080,7 +1080,7 @@ test_options_validate__transproxy(void *ignored) TT_DIE(("Expected NULL but got '%s'", msg)); } #endif -#if defined(__FreeBSD_kernel__) || defined( DARWIN ) || defined(__NetBSD__) +#ifdef KERNEL_MAY_SUPPORT_IPFW tdata = get_options_test_data("TransProxyType ipfw\n" "TransPort 127.0.0.1:123\n"); ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg); @@ -1098,6 +1098,15 @@ test_options_validate__transproxy(void *ignored) TT_DIE(("Expected NULL but got '%s'", msg)); } #endif +#if defined(__NetBSD__) + tdata = get_options_test_data("TransProxyType default\n" + "TransPort 127.0.0.1:123\n"); + ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg); + tt_int_op(ret, OP_EQ, -1); + if (msg) { + TT_DIE(("Expected NULL but got '%s'", msg)); + } +#endif // Assert that a test has run for some TransProxyType tt_assert(tdata);

1 0

[tor/master] Use the correct preprocessor macro for Linux
by nickm＠torproject.org 08 Dec '16

08 Dec '16

commit 9fe6ffa58864b0719bdec9a55b84c11255fa505b Author: cypherpunks <cypherpunks(a)torproject.org> Date: Tue Aug 23 13:07:03 2016 +0000 Use the correct preprocessor macro for Linux Also combine all of the checks into one if-tree as only one of them should actually succeed. --- src/test/test_options.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/src/test/test_options.c b/src/test/test_options.c index 2570f8d..e85e118 100644 --- a/src/test/test_options.c +++ b/src/test/test_options.c @@ -1071,7 +1071,7 @@ test_options_validate__transproxy(void *ignored) free_options_test_data(tdata); tdata = NULL; -#if defined(linux) +#if defined(__linux__) tdata = get_options_test_data("TransProxyType tproxy\n" "TransPort 127.0.0.1:123\n"); ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg); @@ -1079,8 +1079,7 @@ test_options_validate__transproxy(void *ignored) if (msg) { TT_DIE(("Expected NULL but got '%s'", msg)); } -#endif -#ifdef KERNEL_MAY_SUPPORT_IPFW +#elif defined(KERNEL_MAY_SUPPORT_IPFW) tdata = get_options_test_data("TransProxyType ipfw\n" "TransPort 127.0.0.1:123\n"); ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg); @@ -1088,8 +1087,7 @@ test_options_validate__transproxy(void *ignored) if (msg) { TT_DIE(("Expected NULL but got '%s'", msg)); } -#endif -#if defined(__OpenBSD__) +#elif defined(__OpenBSD__) tdata = get_options_test_data("TransProxyType pf-divert\n" "TransPort 127.0.0.1:123\n"); ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg); @@ -1097,8 +1095,7 @@ test_options_validate__transproxy(void *ignored) if (msg) { TT_DIE(("Expected NULL but got '%s'", msg)); } -#endif -#if defined(__NetBSD__) +#elif defined(__NetBSD__) tdata = get_options_test_data("TransProxyType default\n" "TransPort 127.0.0.1:123\n"); ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg);

1 0

[tor/release-0.2.9] Use the correct preprocessor macro for Linux
by nickm＠torproject.org 08 Dec '16

08 Dec '16

commit 9fe6ffa58864b0719bdec9a55b84c11255fa505b Author: cypherpunks <cypherpunks(a)torproject.org> Date: Tue Aug 23 13:07:03 2016 +0000 Use the correct preprocessor macro for Linux Also combine all of the checks into one if-tree as only one of them should actually succeed. --- src/test/test_options.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/src/test/test_options.c b/src/test/test_options.c index 2570f8d..e85e118 100644 --- a/src/test/test_options.c +++ b/src/test/test_options.c @@ -1071,7 +1071,7 @@ test_options_validate__transproxy(void *ignored) free_options_test_data(tdata); tdata = NULL; -#if defined(linux) +#if defined(__linux__) tdata = get_options_test_data("TransProxyType tproxy\n" "TransPort 127.0.0.1:123\n"); ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg); @@ -1079,8 +1079,7 @@ test_options_validate__transproxy(void *ignored) if (msg) { TT_DIE(("Expected NULL but got '%s'", msg)); } -#endif -#ifdef KERNEL_MAY_SUPPORT_IPFW +#elif defined(KERNEL_MAY_SUPPORT_IPFW) tdata = get_options_test_data("TransProxyType ipfw\n" "TransPort 127.0.0.1:123\n"); ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg); @@ -1088,8 +1087,7 @@ test_options_validate__transproxy(void *ignored) if (msg) { TT_DIE(("Expected NULL but got '%s'", msg)); } -#endif -#if defined(__OpenBSD__) +#elif defined(__OpenBSD__) tdata = get_options_test_data("TransProxyType pf-divert\n" "TransPort 127.0.0.1:123\n"); ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg); @@ -1097,8 +1095,7 @@ test_options_validate__transproxy(void *ignored) if (msg) { TT_DIE(("Expected NULL but got '%s'", msg)); } -#endif -#if defined(__NetBSD__) +#elif defined(__NetBSD__) tdata = get_options_test_data("TransProxyType default\n" "TransPort 127.0.0.1:123\n"); ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg);

1 0

[tor-browser-bundle/master] Revert "Bug 20147: (re-)dzip.sh: various improvements"
by gk＠torproject.org 08 Dec '16

08 Dec '16

commit 55ba062a0ecda854d55f47f1e660746ad099581d Author: Georg Koppen <gk(a)torproject.org> Date: Thu Dec 8 12:48:18 2016 +0000 Revert "Bug 20147: (re-)dzip.sh: various improvements" This reverts commit a38d827c12ce75d13e18f19fc8f5bac8aca28c55. Surprisingly this breaks our builds. See the reopened #20417 for more details. --- gitian/build-helpers/dzip.sh | 17 +++++++++-------- gitian/build-helpers/re-dzip.sh | 23 +++++++++++++---------- 2 files changed, 22 insertions(+), 18 deletions(-) diff --git a/gitian/build-helpers/dzip.sh b/gitian/build-helpers/dzip.sh index 64fcdca..5772c8b 100755 --- a/gitian/build-helpers/dzip.sh +++ b/gitian/build-helpers/dzip.sh @@ -1,13 +1,14 @@ -#!/bin/sh -e +#!/bin/sh # Crappy deterministic zip wrapper export LC_ALL=C -ZIPFILE=${1:?} +ZIPFILE=$1 shift -if [ -n "$REFERENCE_DATETIME" ]; then - find "$@" -exec touch --date="$REFERENCE_DATETIME" -- {} + -fi -find "$@" -executable -exec chmod 700 {} + -find "$@" ! -executable -exec chmod 600 {} + -find "$@" | sort | zip $ZIPOPTS -X -@ "$ZIPFILE" +[ -n "$REFERENCE_DATETIME" ] && \ + find $@ -exec touch --date="$REFERENCE_DATETIME" {} \; + +find $@ -executable -exec chmod 700 {} \; +find $@ ! -executable -exec chmod 600 {} \; + +find $@ | sort | zip $ZIPOPTS -X -@ "$ZIPFILE" diff --git a/gitian/build-helpers/re-dzip.sh b/gitian/build-helpers/re-dzip.sh index 58942c4..27828e9 100755 --- a/gitian/build-helpers/re-dzip.sh +++ b/gitian/build-helpers/re-dzip.sh @@ -1,14 +1,17 @@ -#!/bin/sh -e +#!/bin/sh # Crappy deterministic zip repackager export LC_ALL=C -ZIPFILE_BASENAME=$(basename -- "${1:?}") -TEMPDIR=tmp-re-dzip-$$ -RE_DZIP=$(readlink -f -- "$(which -- "$0")") -PATH=$PATH:$(dirname "$RE_DZIP") +ZIPFILE=`basename $1` -mkdir "$TEMPDIR" -unzip $UNZIPOPTS -d "$TEMPDIR" -- "$1" -(cd "$TEMPDIR"; dzip.sh ./"$ZIPFILE_BASENAME" .) -mv -- "$TEMPDIR"/"$ZIPFILE_BASENAME" "$1" -rm -rf "$TEMPDIR" +mkdir tmp_dzip +cd tmp_dzip +unzip ../$1 +[ -n "$REFERENCE_DATETIME" ] && \ + find . -exec touch --date="$REFERENCE_DATETIME" {} \; +find . -executable -exec chmod 700 {} \; +find . ! -executable -exec chmod 600 {} \; +find . | sort | zip $ZIPOPTS -X -@ $ZIPFILE +mv $ZIPFILE ../$1 +cd .. +rm -rf tmp_dzip

1 0

[tor-browser-bundle/hardened-builds] Rotate ports third time for default obfs4 bridges
by gk＠torproject.org 08 Dec '16

08 Dec '16

commit 344769184feec10a70ba1bb06391c16c3bfd4ea6 Author: Lynn Tsai <lynntsai(a)gmail.com> Date: Tue Nov 29 22:46:59 2016 -0800 Rotate ports third time for default obfs4 bridges LeifEricson (blocked): Port 50001 --> 50002 Greenbelt (unblocked): Port 7013 --> 12166 Mosaddegh (blocked): Port 9332 --> 15937 MaBishomarim (blocked): Port 7920 --> 16488 JonbesheSabz (blocked): Port 4148 --> 4304 Azadi (unblocked): Port 6041 --> 16815 --- Bundle-Data/PTConfigs/bridge_prefs.js | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 664e607..6831555 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -15,24 +15,24 @@ pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.163:8080 A1 pref("extensions.torlauncher.default_bridge.scramblesuit.1", "scramblesuit 83.212.101.3:443 A09D536DD1752D542E1FBB3C9CE4449D51298239 password=XTCXLG2JAMJKZW2POLBAOWOQETQSMASH"); -pref("extensions.torlauncher.default_bridge.obfs4.1", "obfs4 154.35.22.10:9332 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.1", "obfs4 154.35.22.10:15937 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.2", "obfs4 198.245.60.50:443 752CF7825B3B9EA6A98C83AC41F7099D67007EA5 cert=xpmQtKUqQ/6v5X7ijgYE/f03+l2/EuQ1dexjyUhh16wQlu/cpXUGalmhDIlhuiQPNEKmKw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.3", "obfs4 192.99.11.54:443 7B126FAB960E5AC6A629C729434FF84FB5074EC2 cert=VW5f8+IBUWpPFxF+rsiVy2wXkyTQG7vEd+rHeN2jV5LIDNu8wMNEOqZXPwHdwMVEBdqXEw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.4", "obfs4 109.105.109.165:10527 8DFCD8FB3285E855F5A55EDDA35696C743ABFC4E cert=Bvg/itxeL4TWKLP6N1MaQzSOC6tcRIBv6q57DYAZc3b2AzuM+/TfB7mqTFEfXILCjEwzVA iat-mode=1"); -pref("extensions.torlauncher.default_bridge.obfs4.5", "obfs4 83.212.101.3:50001 A09D536DD1752D542E1FBB3C9CE4449D51298239 cert=lPRQ/MXdD1t5SRZ9MquYQNT9m5DV757jtdXdlePmRCudUU9CFUOX1Tm7/meFSyPOsud7Cw iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.5", "obfs4 83.212.101.3:50002 A09D536DD1752D542E1FBB3C9CE4449D51298239 cert=lPRQ/MXdD1t5SRZ9MquYQNT9m5DV757jtdXdlePmRCudUU9CFUOX1Tm7/meFSyPOsud7Cw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.6", "obfs4 109.105.109.147:13764 BBB28DF0F201E706BE564EFE690FE9577DD8386D cert=KfMQN/tNMFdda61hMgpiMI7pbwU1T+wxjTulYnfw+4sgvG0zSH7N7fwT10BI8MUdAD7iJA iat-mode=2"); -pref("extensions.torlauncher.default_bridge.obfs4.7", "obfs4 154.35.22.11:7920 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.7", "obfs4 154.35.22.11:16488 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.8", "obfs4 154.35.22.12:80 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.9", "obfs4 154.35.22.13:443 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.10", "obfs4 154.35.22.10:80 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.11", "obfs4 154.35.22.10:443 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.12", "obfs4 154.35.22.11:443 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.13", "obfs4 154.35.22.11:80 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.14", "obfs4 154.35.22.9:7013 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.14", "obfs4 154.35.22.9:12166 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.15", "obfs4 154.35.22.9:80 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.16", "obfs4 154.35.22.9:443 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.17", "obfs4 154.35.22.12:4148 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.18", "obfs4 154.35.22.13:6041 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.17", "obfs4 154.35.22.12:4304 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.18", "obfs4 154.35.22.13:16815 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.19", "obfs4 192.95.36.142:443 CDF2E852BF539B82BD10E27E9115A31734E378C2 cert=qUVQ0srL1JI/vO6V6m/24anYXiJD3QP2HgzUKQtQ7GRqqUvs7P+tG43RtAqdhLOALP7DJQ iat-mode=1"); pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 85.17.30.79:443 FC259A04A328A07FED1413E9FC6526530D9FD87A cert=RutxZlu8BtyP+y0NX7bAVD41+J/qXNhHUrKjFkRSdiBAhIHIQLhKQ2HxESAKZprn/lR3KA iat-mode=0");

1 0

[tor-browser-bundle/maint-6.0] Rotate ports third time for default obfs4 bridges
by gk＠torproject.org 08 Dec '16

08 Dec '16

commit 617d635074ddbd51cdf0ca287cc1faf6b3475965 Author: Lynn Tsai <lynntsai(a)gmail.com> Date: Tue Nov 29 22:46:59 2016 -0800 Rotate ports third time for default obfs4 bridges LeifEricson (blocked): Port 50001 --> 50002 Greenbelt (unblocked): Port 7013 --> 12166 Mosaddegh (blocked): Port 9332 --> 15937 MaBishomarim (blocked): Port 7920 --> 16488 JonbesheSabz (blocked): Port 4148 --> 4304 Azadi (unblocked): Port 6041 --> 16815 --- Bundle-Data/PTConfigs/bridge_prefs.js | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 664e607..6831555 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -15,24 +15,24 @@ pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.163:8080 A1 pref("extensions.torlauncher.default_bridge.scramblesuit.1", "scramblesuit 83.212.101.3:443 A09D536DD1752D542E1FBB3C9CE4449D51298239 password=XTCXLG2JAMJKZW2POLBAOWOQETQSMASH"); -pref("extensions.torlauncher.default_bridge.obfs4.1", "obfs4 154.35.22.10:9332 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.1", "obfs4 154.35.22.10:15937 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.2", "obfs4 198.245.60.50:443 752CF7825B3B9EA6A98C83AC41F7099D67007EA5 cert=xpmQtKUqQ/6v5X7ijgYE/f03+l2/EuQ1dexjyUhh16wQlu/cpXUGalmhDIlhuiQPNEKmKw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.3", "obfs4 192.99.11.54:443 7B126FAB960E5AC6A629C729434FF84FB5074EC2 cert=VW5f8+IBUWpPFxF+rsiVy2wXkyTQG7vEd+rHeN2jV5LIDNu8wMNEOqZXPwHdwMVEBdqXEw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.4", "obfs4 109.105.109.165:10527 8DFCD8FB3285E855F5A55EDDA35696C743ABFC4E cert=Bvg/itxeL4TWKLP6N1MaQzSOC6tcRIBv6q57DYAZc3b2AzuM+/TfB7mqTFEfXILCjEwzVA iat-mode=1"); -pref("extensions.torlauncher.default_bridge.obfs4.5", "obfs4 83.212.101.3:50001 A09D536DD1752D542E1FBB3C9CE4449D51298239 cert=lPRQ/MXdD1t5SRZ9MquYQNT9m5DV757jtdXdlePmRCudUU9CFUOX1Tm7/meFSyPOsud7Cw iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.5", "obfs4 83.212.101.3:50002 A09D536DD1752D542E1FBB3C9CE4449D51298239 cert=lPRQ/MXdD1t5SRZ9MquYQNT9m5DV757jtdXdlePmRCudUU9CFUOX1Tm7/meFSyPOsud7Cw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.6", "obfs4 109.105.109.147:13764 BBB28DF0F201E706BE564EFE690FE9577DD8386D cert=KfMQN/tNMFdda61hMgpiMI7pbwU1T+wxjTulYnfw+4sgvG0zSH7N7fwT10BI8MUdAD7iJA iat-mode=2"); -pref("extensions.torlauncher.default_bridge.obfs4.7", "obfs4 154.35.22.11:7920 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.7", "obfs4 154.35.22.11:16488 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.8", "obfs4 154.35.22.12:80 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.9", "obfs4 154.35.22.13:443 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.10", "obfs4 154.35.22.10:80 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.11", "obfs4 154.35.22.10:443 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.12", "obfs4 154.35.22.11:443 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.13", "obfs4 154.35.22.11:80 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.14", "obfs4 154.35.22.9:7013 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.14", "obfs4 154.35.22.9:12166 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.15", "obfs4 154.35.22.9:80 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.16", "obfs4 154.35.22.9:443 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.17", "obfs4 154.35.22.12:4148 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.18", "obfs4 154.35.22.13:6041 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.17", "obfs4 154.35.22.12:4304 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.18", "obfs4 154.35.22.13:16815 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.19", "obfs4 192.95.36.142:443 CDF2E852BF539B82BD10E27E9115A31734E378C2 cert=qUVQ0srL1JI/vO6V6m/24anYXiJD3QP2HgzUKQtQ7GRqqUvs7P+tG43RtAqdhLOALP7DJQ iat-mode=1"); pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 85.17.30.79:443 FC259A04A328A07FED1413E9FC6526530D9FD87A cert=RutxZlu8BtyP+y0NX7bAVD41+J/qXNhHUrKjFkRSdiBAhIHIQLhKQ2HxESAKZprn/lR3KA iat-mode=0");

1 0

[tor-browser-bundle/master] Rotate ports third time for default obfs4 bridges
by gk＠torproject.org 08 Dec '16

08 Dec '16

commit 2d3fb691b40323a0960e1c2758c00713f212e5fb Author: Lynn Tsai <lynntsai(a)gmail.com> Date: Tue Nov 29 22:46:59 2016 -0800 Rotate ports third time for default obfs4 bridges LeifEricson (blocked): Port 50001 --> 50002 Greenbelt (unblocked): Port 7013 --> 12166 Mosaddegh (blocked): Port 9332 --> 15937 MaBishomarim (blocked): Port 7920 --> 16488 JonbesheSabz (blocked): Port 4148 --> 4304 Azadi (unblocked): Port 6041 --> 16815 --- Bundle-Data/PTConfigs/bridge_prefs.js | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 664e607..6831555 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -15,24 +15,24 @@ pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.163:8080 A1 pref("extensions.torlauncher.default_bridge.scramblesuit.1", "scramblesuit 83.212.101.3:443 A09D536DD1752D542E1FBB3C9CE4449D51298239 password=XTCXLG2JAMJKZW2POLBAOWOQETQSMASH"); -pref("extensions.torlauncher.default_bridge.obfs4.1", "obfs4 154.35.22.10:9332 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.1", "obfs4 154.35.22.10:15937 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.2", "obfs4 198.245.60.50:443 752CF7825B3B9EA6A98C83AC41F7099D67007EA5 cert=xpmQtKUqQ/6v5X7ijgYE/f03+l2/EuQ1dexjyUhh16wQlu/cpXUGalmhDIlhuiQPNEKmKw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.3", "obfs4 192.99.11.54:443 7B126FAB960E5AC6A629C729434FF84FB5074EC2 cert=VW5f8+IBUWpPFxF+rsiVy2wXkyTQG7vEd+rHeN2jV5LIDNu8wMNEOqZXPwHdwMVEBdqXEw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.4", "obfs4 109.105.109.165:10527 8DFCD8FB3285E855F5A55EDDA35696C743ABFC4E cert=Bvg/itxeL4TWKLP6N1MaQzSOC6tcRIBv6q57DYAZc3b2AzuM+/TfB7mqTFEfXILCjEwzVA iat-mode=1"); -pref("extensions.torlauncher.default_bridge.obfs4.5", "obfs4 83.212.101.3:50001 A09D536DD1752D542E1FBB3C9CE4449D51298239 cert=lPRQ/MXdD1t5SRZ9MquYQNT9m5DV757jtdXdlePmRCudUU9CFUOX1Tm7/meFSyPOsud7Cw iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.5", "obfs4 83.212.101.3:50002 A09D536DD1752D542E1FBB3C9CE4449D51298239 cert=lPRQ/MXdD1t5SRZ9MquYQNT9m5DV757jtdXdlePmRCudUU9CFUOX1Tm7/meFSyPOsud7Cw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.6", "obfs4 109.105.109.147:13764 BBB28DF0F201E706BE564EFE690FE9577DD8386D cert=KfMQN/tNMFdda61hMgpiMI7pbwU1T+wxjTulYnfw+4sgvG0zSH7N7fwT10BI8MUdAD7iJA iat-mode=2"); -pref("extensions.torlauncher.default_bridge.obfs4.7", "obfs4 154.35.22.11:7920 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.7", "obfs4 154.35.22.11:16488 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.8", "obfs4 154.35.22.12:80 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.9", "obfs4 154.35.22.13:443 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.10", "obfs4 154.35.22.10:80 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.11", "obfs4 154.35.22.10:443 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.12", "obfs4 154.35.22.11:443 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.13", "obfs4 154.35.22.11:80 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.14", "obfs4 154.35.22.9:7013 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.14", "obfs4 154.35.22.9:12166 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.15", "obfs4 154.35.22.9:80 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.16", "obfs4 154.35.22.9:443 C73ADBAC8ADFDBF0FC0F3F4E8091C0107D093716 cert=gEGKc5WN/bSjFa6UkG9hOcft1tuK+cV8hbZ0H6cqXiMPLqSbCh2Q3PHe5OOr6oMVORhoJA iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.17", "obfs4 154.35.22.12:4148 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.18", "obfs4 154.35.22.13:6041 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.17", "obfs4 154.35.22.12:4304 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.18", "obfs4 154.35.22.13:16815 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.19", "obfs4 192.95.36.142:443 CDF2E852BF539B82BD10E27E9115A31734E378C2 cert=qUVQ0srL1JI/vO6V6m/24anYXiJD3QP2HgzUKQtQ7GRqqUvs7P+tG43RtAqdhLOALP7DJQ iat-mode=1"); pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 85.17.30.79:443 FC259A04A328A07FED1413E9FC6526530D9FD87A cert=RutxZlu8BtyP+y0NX7bAVD41+J/qXNhHUrKjFkRSdiBAhIHIQLhKQ2HxESAKZprn/lR3KA iat-mode=0");

1 0

[sandboxed-tor-browser/master] Tighten the seccomp rules some more.
by yawning＠torproject.org 08 Dec '16

08 Dec '16

commit dcc1b9fffe82f55801b90c4ada9c21551e642f62 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Thu Dec 8 05:34:57 2016 +0000 Tighten the seccomp rules some more. * Stop being lazy and validate all the socket() flags to allow tor. * Tighten the rlimit() related calls allowed to firefox. ASAN insists on being able to use `setrlimit()`. I should drop support for the "hardened" channel because it increases attack surface. --- src/cmd/gen-seccomp/seccomp_firefox.go | 34 +++++++++++++++-- src/cmd/gen-seccomp/seccomp_tor.go | 69 ++++++++++++++++++++++++++++++++-- 2 files changed, 97 insertions(+), 6 deletions(-) diff --git a/src/cmd/gen-seccomp/seccomp_firefox.go b/src/cmd/gen-seccomp/seccomp_firefox.go index 9b25a66..03ed1fb 100644 --- a/src/cmd/gen-seccomp/seccomp_firefox.go +++ b/src/cmd/gen-seccomp/seccomp_firefox.go @@ -33,6 +33,9 @@ func compileTorBrowserSeccompProfile(fd *os.File, is386 bool) error { defer f.Release() // TODO; Filter the arguments on more of these calls. + // + // Maybe draaw inspiration from: + // https://github.com/mozilla/gecko-dev/blob/master/security/sandbox/linux/San… allowedNoArgs := []string{ "clock_gettime", "clock_getres", @@ -149,7 +152,6 @@ func compileTorBrowserSeccompProfile(fd *os.File, is386 bool) error { "rt_sigprocmask", "rt_sigreturn", "sigaltstack", - "setrlimit", "arch_prctl", "capset", @@ -175,6 +177,9 @@ func compileTorBrowserSeccompProfile(fd *os.File, is386 bool) error { "unshare", "wait4", + // ASAN explodes if this doesn't work. Sigh. + "setrlimit", + // Firefox uses this, but will take no for an answer. // "quotactl", @@ -198,7 +203,6 @@ func compileTorBrowserSeccompProfile(fd *os.File, is386 bool) error { "_llseek", "mmap2", - "prlimit64", "ugetrlimit", "set_thread_area", "waitpid", @@ -225,10 +229,13 @@ func compileTorBrowserSeccompProfile(fd *os.File, is386 bool) error { return err } - // Unrelated to sockets, only i386 needs this, and it can be filtered. + // Unrelated to sockets, only i386 needs these, and it can be filtered. if err = allowCmpEq(f, "time", 0, 0); err != nil { return err } + if err = ffFilterPrlimit64(f); err != nil { + return err + } } // Because we patch PulseAudio's mutex creation, we can omit all PI futex @@ -276,3 +283,24 @@ func ffFilterSocketcall(f *seccomp.ScmpFilter) error { } return allowCmpEq(f, "socketcall", 0, allowedCalls...) } + +func ffFilterPrlimit64(f *seccomp.ScmpFilter) error { + scall, err := seccomp.GetSyscallFromName("prlimit64") + if err != nil { + return err + } + + // Per Mozilla's sandbox: only prlimit64(0, resource, NULL, old_limit) + // which is functionally equivalent to getrlimit(). 0 instead of the + // pid() is a glibc-ism. + + isPid0, err := seccomp.MakeCondition(0, seccomp.CompareEqual, 0) + if err != nil { + return err + } + isNoNewLimit, err := seccomp.MakeCondition(2, seccomp.CompareEqual, 9) + if err != nil { + return err + } + return f.AddRuleConditional(scall, seccomp.ActAllow, []seccomp.ScmpCondition{isPid0, isNoNewLimit}) +} diff --git a/src/cmd/gen-seccomp/seccomp_tor.go b/src/cmd/gen-seccomp/seccomp_tor.go index d6ec2ca..7300b64 100644 --- a/src/cmd/gen-seccomp/seccomp_tor.go +++ b/src/cmd/gen-seccomp/seccomp_tor.go @@ -23,6 +23,8 @@ import ( seccomp "github.com/seccomp/libseccomp-golang" ) +var maskedCloexecNonblock = ^(uint64(syscall.SOCK_CLOEXEC | syscall.SOCK_NONBLOCK)) + func compileTorSeccompProfile(fd *os.File, useBridges bool, is386 bool) error { defer fd.Close() @@ -292,7 +294,7 @@ func torFilterAccept4(f *seccomp.ScmpFilter) error { return err } - cond, err := seccomp.MakeCondition(3, seccomp.CompareMaskedEqual, 0, syscall.SOCK_CLOEXEC|syscall.SOCK_NONBLOCK) + cond, err := seccomp.MakeCondition(3, seccomp.CompareMaskedEqual, maskedCloexecNonblock, 0) if err != nil { return nil } @@ -318,8 +320,69 @@ func torFilterPoll(f *seccomp.ScmpFilter) error { } func torFilterSocket(f *seccomp.ScmpFilter) error { - // XXX: Tighten this some more. - return allowCmpEq(f, "socket", 0, syscall.AF_UNIX, syscall.AF_INET, syscall.AF_INET6 /*, syscall.AF_NETLINK */) + scall, err := seccomp.GetSyscallFromName("socket") + if err != nil { + return err + } + + makeCondType := func(t uint64) (seccomp.ScmpCondition, error) { + return seccomp.MakeCondition(1, seccomp.CompareMaskedEqual, maskedCloexecNonblock, t) + } + + // tor allows PF_FILE, which is PF_LOCAL on Linux, not sure why. + + for _, d := range []uint64{syscall.AF_INET, syscall.AF_INET6} { + isDomain, err := seccomp.MakeCondition(0, seccomp.CompareEqual, d) + if err != nil { + return err + } + + for _, t := range []uint64{syscall.SOCK_STREAM, syscall.SOCK_DGRAM} { + protocols := []uint64{syscall.IPPROTO_IP, syscall.IPPROTO_UDP} + if t == syscall.SOCK_STREAM { + protocols = append(protocols, syscall.IPPROTO_TCP) + } + + isType, err := makeCondType(t) + if err != nil { + return err + } + + for _, p := range protocols { + isProtocol, err := seccomp.MakeCondition(2, seccomp.CompareEqual, p) + if err != nil { + return err + } + + if err = f.AddRuleConditional(scall, seccomp.ActAllow, []seccomp.ScmpCondition{isDomain, isType, isProtocol}); err != nil { + return err + } + } + } + } + + isAfLocal, err := seccomp.MakeCondition(0, seccomp.CompareEqual, syscall.AF_LOCAL) + if err != nil { + return err + } + for _, t := range []uint64{syscall.SOCK_STREAM, syscall.SOCK_DGRAM} { + isType, err := makeCondType(t) + if err != nil { + return err + } + isProtocol, err := seccomp.MakeCondition(2, seccomp.CompareEqual, 0) + if err != nil { + return err + } + if err = f.AddRuleConditional(scall, seccomp.ActAllow, []seccomp.ScmpCondition{isAfLocal, isType, isProtocol}); err != nil { + return err + } + } + + // tor allows socket(AF_NETLINK, SOCK_RAW, 0), which is used to check it's + // IP address, but will take "no". + + return nil } func torFilterSetsockopt(f *seccomp.ScmpFilter) error {

1 0

[sandboxed-tor-browser/master] Filter socketcall() by argument.
by yawning＠torproject.org 08 Dec '16

08 Dec '16

commit 1db6b5aeec0983b264469be96690d916e236e314 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Wed Dec 7 07:05:09 2016 +0000 Filter socketcall() by argument. This still isn't great, particularly firefox that appears to need all the socket calls, but at least this denies calls that neither container needs. --- src/cmd/gen-seccomp/main.go | 2 - src/cmd/gen-seccomp/seccomp.go | 28 ++++++++-- src/cmd/gen-seccomp/seccomp_firefox.go | 57 +++++++++++++++----- src/cmd/gen-seccomp/seccomp_tor.go | 96 +++++++++++++++++++--------------- 4 files changed, 119 insertions(+), 64 deletions(-) diff --git a/src/cmd/gen-seccomp/main.go b/src/cmd/gen-seccomp/main.go index 3ad1be5..5dcbbf2 100644 --- a/src/cmd/gen-seccomp/main.go +++ b/src/cmd/gen-seccomp/main.go @@ -32,8 +32,6 @@ func main() { log.Fatalf("failed to get absolute path: %v", err) } - log.Printf("outDir: %v", outDir) - // Tor Browser (amd64) f, err := os.Create(filepath.Join(outDir, "tor-amd64.bpf")) if err != nil { diff --git a/src/cmd/gen-seccomp/seccomp.go b/src/cmd/gen-seccomp/seccomp.go index 9ec17e8..ece1e7e 100644 --- a/src/cmd/gen-seccomp/seccomp.go +++ b/src/cmd/gen-seccomp/seccomp.go @@ -66,6 +66,28 @@ const ( fionread = 0x541b tcgets = 0x5401 tiocgpgrp = 0x540f + + // socketcall() call numbers (linux/net.h) + sysSocket = 1 // sys_socket() + sysBind = 2 // sys_bind() + sysConnect = 3 // sys_connect() + sysListen = 4 // sys_listen() + sysAccept = 5 // sys_accept() + sysGetsockname = 6 // sys_getsockname() + sysGetpeername = 7 // sys_getpeername() + sysSocketpair = 8 // sys_socketpair() + sysSend = 9 // sys_send() + sysRecv = 10 // sys_recv() + sysSendto = 11 // sys_sendto() + sysRecvfrom = 12 // sys_recvfrom() + sysShutdown = 13 // sys_shutdown() + sysSetsockopt = 14 // sys_setsockopt() + sysGetsockopt = 15 // sys_getsockopt() + sysSendmsg = 16 // sys_sendmsg() + sysRecvmsg = 17 // sys_recvmsg() + sysAccept4 = 18 // sys_accept4() + sysRecvmmsg = 19 // sys_recvmmsg + sysSendmmsg = 20 // sys_sendmmsg ) func newWhitelist(is386 bool) (*seccomp.ScmpFilter, error) { @@ -95,11 +117,7 @@ func allowSyscalls(f *seccomp.ScmpFilter, calls []string, is386 bool) error { for _, scallName := range calls { scall, err := seccomp.GetSyscallFromName(scallName) if err != nil { - if is386 && scallName == "newselect" { - scall = seccomp.ScmpSyscall(142) - } else { - return fmt.Errorf("seccomp: unknown system call: %v", scallName) - } + return fmt.Errorf("seccomp: unknown system call: %v", scallName) } if err = f.AddRule(scall, seccomp.ActAllow); err != nil { return err diff --git a/src/cmd/gen-seccomp/seccomp_firefox.go b/src/cmd/gen-seccomp/seccomp_firefox.go index 22e4bb5..9b25a66 100644 --- a/src/cmd/gen-seccomp/seccomp_firefox.go +++ b/src/cmd/gen-seccomp/seccomp_firefox.go @@ -19,6 +19,8 @@ package main import ( "os" "syscall" + + seccomp "github.com/seccomp/libseccomp-golang" ) func compileTorBrowserSeccompProfile(fd *os.File, is386 bool) error { @@ -30,6 +32,7 @@ func compileTorBrowserSeccompProfile(fd *os.File, is386 bool) error { } defer f.Release() + // TODO; Filter the arguments on more of these calls. allowedNoArgs := []string{ "clock_gettime", "clock_getres", @@ -207,11 +210,7 @@ func compileTorBrowserSeccompProfile(fd *os.File, is386 bool) error { "recv", "send", - "newselect", - - "socket", // Filtered on amd64. - - "socketcall", // Fuck Debian stable.... :( + "_newselect", } allowedNoArgs = append(allowedNoArgs, allowedNoArgs386...) } @@ -219,6 +218,19 @@ func compileTorBrowserSeccompProfile(fd *os.File, is386 bool) error { return err } + // Like with how I do the tor rules, handle socketcall() before everything + // else. + if is386 { + if err = ffFilterSocketcall(f); err != nil { + return err + } + + // Unrelated to sockets, only i386 needs this, and it can be filtered. + if err = allowCmpEq(f, "time", 0, 0); err != nil { + return err + } + } + // Because we patch PulseAudio's mutex creation, we can omit all PI futex // calls. if err = allowCmpEq(f, "futex", 1, futexWait, futexWaitPrivate, futexWakePrivate, futexCmpRequeuePrivate, futexWakeOpPrivate, futexWaitBitsetPrivate|futexClockRealtime, futexWake, futexWaitBitsetPrivate); err != nil { @@ -234,16 +246,33 @@ func compileTorBrowserSeccompProfile(fd *os.File, is386 bool) error { if err = allowCmpEq(f, "prctl", 0, syscall.PR_SET_NAME, syscall.PR_GET_NAME, syscall.PR_GET_TIMERSLACK, syscall.PR_SET_SECCOMP); err != nil { return err } - - if is386 { - if err = allowCmpEq(f, "time", 0, 0); err != nil { - return err - } - } else { - if err = allowCmpEq(f, "socket", 0, syscall.AF_UNIX); err != nil { - return err - } + if err = allowCmpEq(f, "socket", 0, syscall.AF_UNIX); err != nil { + return err } return f.ExportBPF(fd) } + +func ffFilterSocketcall(f *seccomp.ScmpFilter) error { + // This is kind of pointless because it allows basically all the things. + allowedCalls := []uint64{ + sysSocket, + sysBind, + sysConnect, + sysListen, + sysGetsockname, + sysGetpeername, + sysSocketpair, + sysSend, + sysRecv, + sysSendto, + sysRecvfrom, + sysShutdown, + sysSetsockopt, + sysGetsockopt, + sysSendmsg, + sysRecvmsg, + sysAccept4, + } + return allowCmpEq(f, "socketcall", 0, allowedCalls...) +} diff --git a/src/cmd/gen-seccomp/seccomp_tor.go b/src/cmd/gen-seccomp/seccomp_tor.go index 0a1b8cc..d6ec2ca 100644 --- a/src/cmd/gen-seccomp/seccomp_tor.go +++ b/src/cmd/gen-seccomp/seccomp_tor.go @@ -118,14 +118,18 @@ func compileTorSeccompProfile(fd *os.File, useBridges bool, is386 bool) error { "ugetrlimit", "set_thread_area", - - "socketcall", // I *SHOULDN"T* need this, but Debian stable freaks out. } allowedNoArgs = append(allowedNoArgs, allowedNoArgs386...) } if err = allowSyscalls(f, allowedNoArgs, is386); err != nil { return err } + if is386 { + // Handle socketcall() before filtering other things. + if err = torFilterSocketcall(f, useBridges); err != nil { + return err + } + } if err = allowCmpEq(f, "time", 0, 0); err != nil { return err @@ -157,22 +161,22 @@ func compileTorSeccompProfile(fd *os.File, useBridges bool, is386 bool) error { if err = allowCmpEq(f, "mremap", 3, mremapMaymove); err != nil { return err } - if err = torFilterAccept4(f, is386); err != nil { + if err = torFilterAccept4(f); err != nil { return err } if err = torFilterPoll(f); err != nil { return err } - if err = torFilterSocket(f, is386); err != nil { + if err = torFilterSocket(f); err != nil { return err } - if err = torFilterSetsockopt(f, is386); err != nil { + if err = torFilterSetsockopt(f); err != nil { return err } - if err = torFilterGetsockopt(f, is386); err != nil { + if err = torFilterGetsockopt(f); err != nil { return err } - if err = torFilterSocketpair(f, is386); err != nil { + if err = torFilterSocketpair(f); err != nil { return err } if err = torFilterMmap(f, is386); err != nil { @@ -196,7 +200,7 @@ func compileTorSeccompProfile(fd *os.File, useBridges bool, is386 bool) error { "getppid", } if is386 { - obfsCalls = append(obfsCalls, "newselect") + obfsCalls = append(obfsCalls, "_newselect") } if err = allowSyscalls(f, obfsCalls, is386); err != nil { return err @@ -212,7 +216,7 @@ func compileTorSeccompProfile(fd *os.File, useBridges bool, is386 bool) error { if err = allowCmpEq(f, "futex", 1, futexWake, futexWait); err != nil { return err } - if err = obfsFilterSetsockopt(f, is386); err != nil { + if err = obfsFilterSetsockopt(f); err != nil { return err } if err = obfsFilterMmap(f, is386); err != nil { @@ -223,6 +227,40 @@ func compileTorSeccompProfile(fd *os.File, useBridges bool, is386 bool) error { return f.ExportBPF(fd) } +func torFilterSocketcall(f *seccomp.ScmpFilter, useBridges bool) error { + // This interface needs to die in a fire, because it's leaving + // gaping attack surface. It kind of will assuming that things + // move on to 4.3 or later. + // + // Emperically on Fedora 25 getsockopt and setsockopt still are + // multiplexed, though that may just be my rules or libseccomp2. + // + // Re-test after Debian stable moves to a modern kernel. + + allowedCalls := []uint64{ + sysSocket, + sysBind, + sysConnect, + sysListen, + sysGetsockname, + sysSocketpair, + sysSend, + sysRecv, + sysSendto, + sysRecvfrom, + sysSetsockopt, + sysGetsockopt, + sysSendmsg, + sysRecvmsg, + sysAccept4, + } + if useBridges { + allowedCalls = append(allowedCalls, sysGetpeername) + } + + return allowCmpEq(f, "socketcall", 0, allowedCalls...) +} + func torFilterPrctl(f *seccomp.ScmpFilter) error { scall, err := seccomp.GetSyscallFromName("prctl") if err != nil { @@ -248,17 +286,11 @@ func torFilterPrctl(f *seccomp.ScmpFilter) error { return f.AddRuleConditional(scall, seccomp.ActAllow, []seccomp.ScmpCondition{isPrSetDeathsig}) } -func torFilterAccept4(f *seccomp.ScmpFilter, is386 bool) error { +func torFilterAccept4(f *seccomp.ScmpFilter) error { scall, err := seccomp.GetSyscallFromName("accept4") if err != nil { return err } - if is386 { - // XXX: The tor common/sandbox.c file, explcitly allows socketcall() - // by arg for this call, and only this call, when libseccomp should - // do the right thing. - return f.AddRule(scall, seccomp.ActAllow) - } cond, err := seccomp.MakeCondition(3, seccomp.CompareMaskedEqual, 0, syscall.SOCK_CLOEXEC|syscall.SOCK_NONBLOCK) if err != nil { @@ -285,27 +317,16 @@ func torFilterPoll(f *seccomp.ScmpFilter) error { return f.AddRuleConditional(scall, seccomp.ActAllow, []seccomp.ScmpCondition{isPollIn, timeoutIsTen}) } -func torFilterSocket(f *seccomp.ScmpFilter, is386 bool) error { - scall, err := seccomp.GetSyscallFromName("socket") - if err != nil { - return err - } - if is386 { - return f.AddRule(scall, seccomp.ActAllow) - } - +func torFilterSocket(f *seccomp.ScmpFilter) error { // XXX: Tighten this some more. return allowCmpEq(f, "socket", 0, syscall.AF_UNIX, syscall.AF_INET, syscall.AF_INET6 /*, syscall.AF_NETLINK */) } -func torFilterSetsockopt(f *seccomp.ScmpFilter, is386 bool) error { +func torFilterSetsockopt(f *seccomp.ScmpFilter) error { scall, err := seccomp.GetSyscallFromName("setsockopt") if err != nil { return err } - if is386 { - return f.AddRule(scall, seccomp.ActAllow) - } isSolSocket, err := seccomp.MakeCondition(1, seccomp.CompareEqual, syscall.SOL_SOCKET) if err != nil { @@ -331,14 +352,11 @@ func torFilterSetsockopt(f *seccomp.ScmpFilter, is386 bool) error { return nil } -func torFilterGetsockopt(f *seccomp.ScmpFilter, is386 bool) error { +func torFilterGetsockopt(f *seccomp.ScmpFilter) error { scall, err := seccomp.GetSyscallFromName("getsockopt") if err != nil { return err } - if is386 { - return f.AddRule(scall, seccomp.ActAllow) - } isSolSocket, err := seccomp.MakeCondition(1, seccomp.CompareEqual, syscall.SOL_SOCKET) if err != nil { @@ -351,14 +369,11 @@ func torFilterGetsockopt(f *seccomp.ScmpFilter, is386 bool) error { return f.AddRuleConditional(scall, seccomp.ActAllow, []seccomp.ScmpCondition{isSolSocket, optIsError}) } -func torFilterSocketpair(f *seccomp.ScmpFilter, is386 bool) error { +func torFilterSocketpair(f *seccomp.ScmpFilter) error { scall, err := seccomp.GetSyscallFromName("socketpair") if err != nil { return err } - if is386 { - return f.AddRule(scall, seccomp.ActAllow) - } isPfLocal, err := seccomp.MakeCondition(0, seccomp.CompareEqual, syscall.AF_LOCAL) if err != nil { @@ -530,12 +545,7 @@ func torFilterFcntl(f *seccomp.ScmpFilter, is386 bool) error { return nil } -func obfsFilterSetsockopt(f *seccomp.ScmpFilter, is386 bool) error { - // 386 already blindly allows all setsockopt() calls. - if is386 { - return nil - } - +func obfsFilterSetsockopt(f *seccomp.ScmpFilter) error { scall, err := seccomp.GetSyscallFromName("setsockopt") if err != nil { return err

1 0