July 2016 - tor-commits - lists.torproject.org

[chutney/master] Document test-network.sh in the README
by teor＠torproject.org 18 Jul '16

18 Jul '16

commit a1706338464510bedfb38404d22767078970e52e Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Mon Jul 18 12:48:15 2016 +1000 Document test-network.sh in the README --- README | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/README b/README index 44b23b3..97aad0a 100644 --- a/README +++ b/README @@ -17,6 +17,11 @@ You will need, at the moment: Stuff to try: +Automated Setup, Verification, and Shutdown: + ./tools/test-network.sh --flavor basic-min + ./tools/test-network.sh --tor-path <tor-build-directory> + ./tools/test-network.sh --coverage + Standard Actions: ./chutney configure networks/basic ./chutney start networks/basic

1 0

[chutney/master] Add a copy of src/test/test-network.sh from Tor
by teor＠torproject.org 18 Jul '16

18 Jul '16

commit 88623406f815046aa4e95b7f7915e1e7db093083 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Sun Jul 17 19:03:24 2016 +1000 Add a copy of src/test/test-network.sh from Tor This script comes from Tor git 9932544 on 2016-07-13. --- tools/test-network.sh | 99 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) diff --git a/tools/test-network.sh b/tools/test-network.sh new file mode 100755 index 0000000..05080e0 --- /dev/null +++ b/tools/test-network.sh @@ -0,0 +1,99 @@ +#! /bin/sh + +ECHO_N="/bin/echo -n" +use_coverage_binary=false + +until [ -z "$1" ] +do + case "$1" in + --chutney-path) + export CHUTNEY_PATH="$2" + shift + ;; + --tor-path) + export TOR_DIR="$2" + shift + ;; + --flavor|--flavour|--network-flavor|--network-flavour) + export NETWORK_FLAVOUR="$2" + shift + ;; + --delay|--sleep|--bootstrap-time|--time) + export BOOTSTRAP_TIME="$2" + shift + ;; + # Environmental variables used by chutney verify performance tests + # Send this many bytes per client connection (10 KBytes) + --data|--data-bytes|--data-byte|--bytes|--byte) + export CHUTNEY_DATA_BYTES="$2" + shift + ;; + # Make this many connections per client (1) + # Note: If you create 7 or more connections to a hidden service from + # a single client, you'll likely get a verification failure due to + # https://trac.torproject.org/projects/tor/ticket/15937 + --connections|--connection|--connection-count|--count) + export CHUTNEY_CONNECTIONS="$2" + shift + ;; + # Make each client connect to each HS (0) + # 0 means a single client connects to each HS + # 1 means every client connects to every HS + --hs-multi-client|--hs-multi-clients|--hs-client|--hs-clients) + export CHUTNEY_HS_MULTI_CLIENT="$2" + shift + ;; + --coverage) + use_coverage_binary=true + ;; + *) + echo "Sorry, I don't know what to do with '$1'." + exit 2 + ;; + esac + shift +done + +TOR_DIR="${TOR_DIR:-$PWD}" +NETWORK_FLAVOUR=${NETWORK_FLAVOUR:-"bridges+hs"} +CHUTNEY_NETWORK=networks/$NETWORK_FLAVOUR +myname=$(basename $0) + +[ -n "$CHUTNEY_PATH" ] || { + echo "$myname: \$CHUTNEY_PATH not set, trying $TOR_DIR/../chutney" + CHUTNEY_PATH="$TOR_DIR/../chutney" +} + +[ -d "$CHUTNEY_PATH" ] && [ -x "$CHUTNEY_PATH/chutney" ] || { + echo "$myname: missing 'chutney' in CHUTNEY_PATH ($CHUTNEY_PATH)" + echo "$myname: Get chutney: git clone https://git.torproject.org/\ +chutney.git" + echo "$myname: Set \$CHUTNEY_PATH to a non-standard location: export CHUTNEY_PATH=\`pwd\`/chutney" + exit 1 +} + +cd "$CHUTNEY_PATH" +# For picking up the right tor binaries. +tor_name=tor +tor_gencert_name=tor-gencert +if test "$use_coverage_binary" = true; then + tor_name=tor-cov +fi +export CHUTNEY_TOR="${TOR_DIR}/src/or/${tor_name}" +export CHUTNEY_TOR_GENCERT="${TOR_DIR}/src/tools/${tor_gencert_name}" + +./tools/bootstrap-network.sh $NETWORK_FLAVOUR || exit 2 + +# Sleep some, waiting for the network to bootstrap. +# TODO: Add chutney command 'bootstrap-status' and use that instead. +BOOTSTRAP_TIME=${BOOTSTRAP_TIME:-35} +$ECHO_N "$myname: sleeping for $BOOTSTRAP_TIME seconds" +n=$BOOTSTRAP_TIME; while [ $n -gt 0 ]; do + sleep 1; n=$(expr $n - 1); $ECHO_N . +done; echo "" +./chutney verify $CHUTNEY_NETWORK +VERIFY_EXIT_STATUS=$? +# work around a bug/feature in make -j2 (or more) +# where make hangs if any child processes are still alive +./chutney stop $CHUTNEY_NETWORK +exit $VERIFY_EXIT_STATUS

1 0

[chutney/master] Copy changes from Tor's test-network.sh
by teor＠torproject.org 18 Jul '16

18 Jul '16

commit fdd97043ec09017a116cffd360b3f8eeb0a77342 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Sun Jul 17 22:23:30 2016 +1000 Copy changes from Tor's test-network.sh Rewrite test-network.sh so out-of-tree and $PATH binaries work Add a dry run mode to test-network.sh We fixed #15937, update a comment --- tools/test-network.sh | 109 +++++++++++++++++++++++++++++++++++++------------- 1 file changed, 81 insertions(+), 28 deletions(-) diff --git a/tools/test-network.sh b/tools/test-network.sh index 05080e0..6707e2d 100755 --- a/tools/test-network.sh +++ b/tools/test-network.sh @@ -1,7 +1,9 @@ #! /bin/sh ECHO_N="/bin/echo -n" -use_coverage_binary=false + +# Output is prefixed with the name of the script +myname=$(basename $0) until [ -z "$1" ] do @@ -30,8 +32,8 @@ do ;; # Make this many connections per client (1) # Note: If you create 7 or more connections to a hidden service from - # a single client, you'll likely get a verification failure due to - # https://trac.torproject.org/projects/tor/ticket/15937 + # a single Tor 0.2.7 client, you'll likely get a verification failure due + # to #15937. This is fixed in 0.2.8. --connections|--connection|--connection-count|--count) export CHUTNEY_CONNECTIONS="$2" shift @@ -44,44 +46,95 @@ do shift ;; --coverage) - use_coverage_binary=true + export USE_COVERAGE_BINARY=true + ;; + --dry-run) + # process arguments, but don't call any other scripts + export NETWORK_DRY_RUN=true ;; *) - echo "Sorry, I don't know what to do with '$1'." - exit 2 + echo "$myname: Sorry, I don't know what to do with '$1'." + # continue processing arguments during a dry run + if [ "$NETWORK_DRY_RUN" != true]; then + exit 2 + fi ;; esac shift done -TOR_DIR="${TOR_DIR:-$PWD}" -NETWORK_FLAVOUR=${NETWORK_FLAVOUR:-"bridges+hs"} -CHUTNEY_NETWORK=networks/$NETWORK_FLAVOUR -myname=$(basename $0) - -[ -n "$CHUTNEY_PATH" ] || { - echo "$myname: \$CHUTNEY_PATH not set, trying $TOR_DIR/../chutney" - CHUTNEY_PATH="$TOR_DIR/../chutney" -} +# optional: $TOR_DIR is the tor build directory +# it's used to find the location of tor binaries +# if it's not set: +# - set it ro $BUILDDIR, or +# - if $PWD looks like a tor build directory, set it to $PWD, or +# - unset $TOR_DIR, and let chutney fall back to finding tor binaries in $PATH +if [ ! -d "$TOR_DIR" ]; then + if [ -d "$BUILDDIR/src/or" -a -d "$BUILDDIR/src/tools" ]; then + # Choose the build directory + # But only if it looks like one + echo "$myname: \$TOR_DIR not set, trying \$BUILDDIR" + export TOR_DIR="$BUILDDIR" + elif [ -d "$PWD/src/or" -a -d "$PWD/src/tools" ]; then + # Guess the tor directory is the current directory + # But only if it looks like one + echo "$myname: \$TOR_DIR not set, trying \$PWD" + export TOR_DIR="$PWD" + else + echo "$myname: no \$TOR_DIR, chutney will use \$PATH for tor binaries" + unset TOR_DIR + fi +fi -[ -d "$CHUTNEY_PATH" ] && [ -x "$CHUTNEY_PATH/chutney" ] || { - echo "$myname: missing 'chutney' in CHUTNEY_PATH ($CHUTNEY_PATH)" - echo "$myname: Get chutney: git clone https://git.torproject.org/\ +# mandatory: $CHUTNEY_PATH is the path to the chutney launch script +# if it's not set: +# - if $PWD looks like a chutney directory, set it to $PWD, or +# - set it based on $TOR_DIR, expecting chutney to be next to tor, or +# - fail and tell the user how to clone the chutney repository +if [ ! -d "$CHUTNEY_PATH" -o ! -x "$CHUTNEY_PATH/chutney" ]; then + if [ -x "$PWD/chutney" ]; then + echo "$myname: \$CHUTNEY_PATH not valid, trying \$PWD" + export CHUTNEY_PATH="$PWD" + elif [ -d "$TOR_DIR" -a -d "$TOR_DIR/../chutney" -a \ + -x "$TOR_DIR/../chutney/chutney" ]; then + echo "$myname: \$CHUTNEY_PATH not valid, trying \$TOR_DIR/../chutney" + export CHUTNEY_PATH="$TOR_DIR/../chutney" + else + # TODO: work out how to package and install chutney, + # so users can find it in $PATH + echo "$myname: missing 'chutney' in \$CHUTNEY_PATH ($CHUTNEY_PATH)" + echo "$myname: Get chutney: git clone https://git.torproject.org/\ chutney.git" - echo "$myname: Set \$CHUTNEY_PATH to a non-standard location: export CHUTNEY_PATH=\`pwd\`/chutney" - exit 1 -} + echo "$myname: Set \$CHUTNEY_PATH to a non-standard location: export \ +CHUTNEY_PATH=\`pwd\`/chutney" + unset CHUTNEY_PATH + exit 1 + fi +fi -cd "$CHUTNEY_PATH" # For picking up the right tor binaries. -tor_name=tor -tor_gencert_name=tor-gencert -if test "$use_coverage_binary" = true; then - tor_name=tor-cov +# If these varibles aren't set, chutney looks for tor binaries in $PATH +if [ -d "$TOR_DIR" ]; then + tor_name=tor + tor_gencert_name=tor-gencert + if [ "$USE_COVERAGE_BINARY" = true ]; then + tor_name=tor-cov + fi + export CHUTNEY_TOR="${TOR_DIR}/src/or/${tor_name}" + export CHUTNEY_TOR_GENCERT="${TOR_DIR}/src/tools/${tor_gencert_name}" +fi + +# Set the variables for the chutney network flavour +export NETWORK_FLAVOUR=${NETWORK_FLAVOUR:-"bridges+hs"} +export CHUTNEY_NETWORK=networks/$NETWORK_FLAVOUR + +# And finish up if we're doing a dry run +if [ "$NETWORK_DRY_RUN" = true ]; then + # we can't exit here, it breaks argument processing + return fi -export CHUTNEY_TOR="${TOR_DIR}/src/or/${tor_name}" -export CHUTNEY_TOR_GENCERT="${TOR_DIR}/src/tools/${tor_gencert_name}" +cd "$CHUTNEY_PATH" ./tools/bootstrap-network.sh $NETWORK_FLAVOUR || exit 2 # Sleep some, waiting for the network to bootstrap.

1 0

[tor/master] Keep make check-spaces happy
by andrea＠torproject.org 17 Jul '16

17 Jul '16

commit 94c27d4e8fede72b128e0bbdd8b60d77ed23ebe6 Author: Andrea Shepard <andrea(a)torproject.org> Date: Sun Jul 17 23:22:29 2016 +0000 Keep make check-spaces happy --- src/or/policies.c | 10 +++++----- src/test/test_address.c | 3 ++- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/src/or/policies.c b/src/or/policies.c index f625242..0b8f335 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -2866,11 +2866,11 @@ getinfo_helper_policies(control_connection_t *conn, } policies_parse_exit_policy_reject_private( - &private_policy_list, - options->IPv6Exit, - configured_addresses, - options->ExitPolicyRejectLocalInterfaces, - options->ExitPolicyRejectLocalInterfaces); + &private_policy_list, + options->IPv6Exit, + configured_addresses, + options->ExitPolicyRejectLocalInterfaces, + options->ExitPolicyRejectLocalInterfaces); *answer = policy_dump_to_string(private_policy_list, 1, 1); addr_policy_list_free(private_policy_list); diff --git a/src/test/test_address.c b/src/test/test_address.c index d621ee5..82d6bc7 100644 --- a/src/test/test_address.c +++ b/src/test/test_address.c @@ -823,7 +823,8 @@ test_address_get_if_addrs6_list_no_internal(void *arg) (void)arg; - int prev_level = setup_capture_of_logs(LOG_ERR); /* We might drop a log_err */ + /* We might drop a log_err */ + int prev_level = setup_capture_of_logs(LOG_ERR); results = get_interface_address6_list(LOG_ERR, AF_INET6, 0); tt_int_op(smartlist_len(mock_saved_logs()), OP_LE, 1); teardown_capture_of_logs(prev_level);

1 0

[translation/https_everywhere_completed] Update translations for https_everywhere_completed
by translation＠torproject.org 17 Jul '16

17 Jul '16

commit 5fec5a4e6970691497eb58c16e1a272238487fea Author: Translation commit bot <translation(a)torproject.org> Date: Sun Jul 17 23:15:34 2016 +0000 Update translations for https_everywhere_completed --- nb/https-everywhere.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nb/https-everywhere.dtd b/nb/https-everywhere.dtd index 8d36a26..1c4846b 100644 --- a/nb/https-everywhere.dtd +++ b/nb/https-everywhere.dtd @@ -20,7 +20,7 @@ <!ENTITY https-everywhere.menu.observatory "SSL-observatoriums-innstillinger"> <!ENTITY https-everywhere.menu.globalEnable "Aktiver HTTPS-everywhere"> <!ENTITY https-everywhere.menu.globalDisable "Skru av HTTPS-everywhere"> -<!ENTITY https-everywhere.menu.blockHttpRequests "Sperr alle HTTP-forespørsler"> +<!ENTITY https-everywhere.menu.blockUnencryptedRequests "Sperr alle ukrypterte forespørsler"> <!ENTITY https-everywhere.menu.showCounter "Vis teller"> <!ENTITY https-everywhere.menu.viewAllRules "Vis alle regler">

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 17 Jul '16

17 Jul '16

commit 8e5de6e331abaa9710bcdd05be667959ebefd0aa Author: Translation commit bot <translation(a)torproject.org> Date: Sun Jul 17 23:15:27 2016 +0000 Update translations for https_everywhere --- nb/https-everywhere.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nb/https-everywhere.dtd b/nb/https-everywhere.dtd index 0ccc899..1c4846b 100644 --- a/nb/https-everywhere.dtd +++ b/nb/https-everywhere.dtd @@ -20,7 +20,7 @@ <!ENTITY https-everywhere.menu.observatory "SSL-observatoriums-innstillinger"> <!ENTITY https-everywhere.menu.globalEnable "Aktiver HTTPS-everywhere"> <!ENTITY https-everywhere.menu.globalDisable "Skru av HTTPS-everywhere"> -<!ENTITY https-everywhere.menu.blockUnencryptedRequests "Block all unencrypted requests"> +<!ENTITY https-everywhere.menu.blockUnencryptedRequests "Sperr alle ukrypterte forespørsler"> <!ENTITY https-everywhere.menu.showCounter "Vis teller"> <!ENTITY https-everywhere.menu.viewAllRules "Vis alle regler">

1 0

[nyx/master] Lighter routine redraws
by atagar＠torproject.org 17 Jul '16

17 Jul '16

commit d9a84b0ab7f9065e899282b4d0f2ff2a0b7c818b Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Jul 17 11:35:43 2016 -0700 Lighter routine redraws Our old draw() method had a 'force' flag that, if false, would cause us to only be redrawn if our dimensions had changed. We did a 'soft redraw' on every keypress so dropping this flag was very noticeable, causing flickering and the interface to be laggy on things like the config panel. Inverting this flag so we force by default. This is because just about every time we called redraw we wanted to 'force' it. Soft redraws are the exception, not the rule. --- nyx/controller.py | 2 +- nyx/curses.py | 13 ++++++++++++- nyx/panel/__init__.py | 16 ++++++++++++++-- 3 files changed, 27 insertions(+), 4 deletions(-) diff --git a/nyx/controller.py b/nyx/controller.py index c5b90d6..d2f202f 100644 --- a/nyx/controller.py +++ b/nyx/controller.py @@ -292,7 +292,7 @@ class Controller(object): stdscr.clear() for panel_impl in display_panels: - panel_impl.redraw() + panel_impl.redraw(force = force) if force: self._last_drawn = current_time diff --git a/nyx/curses.py b/nyx/curses.py index 6e605a7..53a2c43 100644 --- a/nyx/curses.py +++ b/nyx/curses.py @@ -499,7 +499,7 @@ def is_wide_characters_supported(): return False -def draw(func, left = 0, top = 0, width = None, height = None, background = None): +def draw(func, left = 0, top = 0, width = None, height = None, background = None, draw_if_resized = None): """ Renders a subwindow. This calls the given draw function with a :class:`~nyx.curses._Subwindow`. @@ -510,6 +510,10 @@ def draw(func, left = 0, top = 0, width = None, height = None, background = None :param int width: panel width, uses all available space if **None** :param int height: panel height, uses all available space if **None** :param nyx.curses.Color background: background color, unset if **None** + :param nyx.curses.Dimension draw_if_resized: only draw content if + dimentions have changed from this + + :returns: :class:`~nyx.curses.Dimension` for the space we drew within """ with CURSES_LOCK: @@ -526,6 +530,11 @@ def draw(func, left = 0, top = 0, width = None, height = None, background = None if height: subwindow_height = min(height, subwindow_height) + subwindow_dimensions = Dimensions(subwindow_width, subwindow_height) + + if subwindow_dimensions == draw_if_resized: + return subwindow_dimensions # draw size hasn't changed + curses_subwindow = CURSES_SCREEN.subwin(subwindow_height, subwindow_width, top, left) curses_subwindow.erase() @@ -535,6 +544,8 @@ def draw(func, left = 0, top = 0, width = None, height = None, background = None func(_Subwindow(subwindow_width, subwindow_height, curses_subwindow)) curses_subwindow.refresh() + return subwindow_dimensions + class _Subwindow(object): """ diff --git a/nyx/panel/__init__.py b/nyx/panel/__init__.py index 85d1b78..ec13aaf 100644 --- a/nyx/panel/__init__.py +++ b/nyx/panel/__init__.py @@ -90,6 +90,9 @@ class Panel(object): self._top = 0 self._visible = False + self._last_draw_top = 0 + self._last_draw_size = nyx.curses.Dimensions(0, 0) + def get_top(self): """ Provides our top position in the overall screen. @@ -135,15 +138,24 @@ class Panel(object): return () - def redraw(self): + def redraw(self, force = True): """ Renders our panel's content to the screen. + + :param bool force: if **False** only redraws content if the panel's + dimensions have changed """ if not self._visible: return # not currently visible - nyx.curses.draw(self._draw, top = self._top, height = self.get_height()) + if not force and self._last_draw_top == self._top: + draw_dimension = self._last_draw_size + else: + draw_dimension = None # force redraw + + self._last_draw_top = self._top + self._last_draw_size = nyx.curses.draw(self._draw, top = self._top, height = self.get_height(), draw_if_resized = draw_dimension) def _draw(self, subwindow): pass

1 0

[tor/master] Merge remote-tracking branch 'weasel/bug19660' into maint-0.2.8
by nickm＠torproject.org 17 Jul '16

17 Jul '16

commit fbae15a856fccdecfb19ff80229b584026ae2def Merge: bec4e41 36b06be Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Jul 17 13:54:40 2016 -0400 Merge remote-tracking branch 'weasel/bug19660' into maint-0.2.8 changes/bug19660 | 8 ++++++++ src/common/sandbox.c | 30 +++++++++++++++--------------- 2 files changed, 23 insertions(+), 15 deletions(-)

1 0

[tor/master] Fix warnings in test_util_formats.
by nickm＠torproject.org 17 Jul '16

17 Jul '16

commit bec4e41f4b48c288613a13021da9a29d5fb1ecac Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Jul 17 13:51:45 2016 -0400 Fix warnings in test_util_formats. Storing 255 into a char gives a warning when char is signed. Fixes bug 19682; bugfix on 0.2.8.1-alpha, where these tests were added. --- changes/bug19682 | 3 +++ src/test/test_util_format.c | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/changes/bug19682 b/changes/bug19682 new file mode 100644 index 0000000..c799c41 --- /dev/null +++ b/changes/bug19682 @@ -0,0 +1,3 @@ + o Minor bugfixes (compilation): + - Fix compilation warning in the unit tests on systems where + char is signed. Fixes bug 19682; bugfix on 0.2.8.1-alpha. diff --git a/src/test/test_util_format.c b/src/test/test_util_format.c index a25054c..3d02930 100644 --- a/src/test/test_util_format.c +++ b/src/test/test_util_format.c @@ -106,10 +106,10 @@ test_util_format_base64_encode(void *ignored) for (i = 0;i<50;i++) { src[i] = 0; } - src[50] = 255; - src[51] = 255; - src[52] = 255; - src[53] = 255; + src[50] = (char)255; + src[51] = (char)255; + src[52] = (char)255; + src[53] = (char)255; res = base64_encode(dst, 1000, src, 54, BASE64_ENCODE_MULTILINE); tt_int_op(res, OP_EQ, 74);

1 0

[tor/release-0.2.8] Add (SOCK_DGRAM, IPPROTO_UDP) sockets to the sandboxing whitelist
by nickm＠torproject.org 17 Jul '16

17 Jul '16

commit 36b06be73862d6f3206d0e2a6fe17af06f8b7c88 Author: Peter Palfrader <peter(a)palfrader.org> Date: Mon Jul 11 09:37:01 2016 +0200 Add (SOCK_DGRAM, IPPROTO_UDP) sockets to the sandboxing whitelist If we did not find a non-private IPaddress by iterating over interfaces, we would try to get one via get_interface_address6_via_udp_socket_hack(). This opens a datagram socket with IPPROTO_UDP. Previously all our datagram sockets (via libevent) used IPPROTO_IP, so we did not have that in the sandboxing whitelist. Add (SOCK_DGRAM, IPPROTO_UDP) sockets to the sandboxing whitelist. Fixes bug 19660. --- changes/bug19660 | 8 ++++++++ src/common/sandbox.c | 30 +++++++++++++++--------------- 2 files changed, 23 insertions(+), 15 deletions(-) diff --git a/changes/bug19660 b/changes/bug19660 new file mode 100644 index 0000000..72d32c8 --- /dev/null +++ b/changes/bug19660 @@ -0,0 +1,8 @@ + o Minor bugfixes (sandboxing): + - If we did not find a non-private IPaddress by iterating over + interfaces, we would try to get one via + get_interface_address6_via_udp_socket_hack(). This opens a + datagram socket with IPPROTO_UDP. Previously all our datagram + sockets (via libevent) used IPPROTO_IP, so we did not have that + in the sandboxing whitelist. Add (SOCK_DGRAM, IPPROTO_UDP) + sockets to the sandboxing whitelist. Fixes bug 19660. diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 70c5bbd..54c1267 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -585,7 +585,7 @@ static int sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; - int i; + int i, j; (void) filter; #ifdef __i386__ @@ -602,20 +602,20 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) for (i = 0; i < 2; ++i) { const int pf = i ? PF_INET : PF_INET6; - - rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), - SCMP_CMP(0, SCMP_CMP_EQ, pf), - SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM), - SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_TCP)); - if (rc) - return rc; - - rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), - SCMP_CMP(0, SCMP_CMP_EQ, pf), - SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_DGRAM), - SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP)); - if (rc) - return rc; + for (j=0; j < 3; ++j) { + const int type = (j == 0) ? SOCK_STREAM : + (j == 1) ? SOCK_DGRAM : + SOCK_DGRAM; + const int protocol = (j == 0) ? IPPROTO_TCP : + (j == 1) ? IPPROTO_IP : + IPPROTO_UDP; + rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), + SCMP_CMP(0, SCMP_CMP_EQ, pf), + SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, type), + SCMP_CMP(2, SCMP_CMP_EQ, protocol)); + if (rc) + return rc; + } } rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),

1 0