July 2016 - tor-commits - lists.torproject.org

[tor/release-0.2.8] Add (SOCK_DGRAM, IPPROTO_UDP) sockets to the sandboxing whitelist
by nickm＠torproject.org 17 Jul '16

17 Jul '16

commit 36b06be73862d6f3206d0e2a6fe17af06f8b7c88 Author: Peter Palfrader <peter(a)palfrader.org> Date: Mon Jul 11 09:37:01 2016 +0200 Add (SOCK_DGRAM, IPPROTO_UDP) sockets to the sandboxing whitelist If we did not find a non-private IPaddress by iterating over interfaces, we would try to get one via get_interface_address6_via_udp_socket_hack(). This opens a datagram socket with IPPROTO_UDP. Previously all our datagram sockets (via libevent) used IPPROTO_IP, so we did not have that in the sandboxing whitelist. Add (SOCK_DGRAM, IPPROTO_UDP) sockets to the sandboxing whitelist. Fixes bug 19660. --- changes/bug19660 | 8 ++++++++ src/common/sandbox.c | 30 +++++++++++++++--------------- 2 files changed, 23 insertions(+), 15 deletions(-) diff --git a/changes/bug19660 b/changes/bug19660 new file mode 100644 index 0000000..72d32c8 --- /dev/null +++ b/changes/bug19660 @@ -0,0 +1,8 @@ + o Minor bugfixes (sandboxing): + - If we did not find a non-private IPaddress by iterating over + interfaces, we would try to get one via + get_interface_address6_via_udp_socket_hack(). This opens a + datagram socket with IPPROTO_UDP. Previously all our datagram + sockets (via libevent) used IPPROTO_IP, so we did not have that + in the sandboxing whitelist. Add (SOCK_DGRAM, IPPROTO_UDP) + sockets to the sandboxing whitelist. Fixes bug 19660. diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 70c5bbd..54c1267 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -585,7 +585,7 @@ static int sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; - int i; + int i, j; (void) filter; #ifdef __i386__ @@ -602,20 +602,20 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) for (i = 0; i < 2; ++i) { const int pf = i ? PF_INET : PF_INET6; - - rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), - SCMP_CMP(0, SCMP_CMP_EQ, pf), - SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM), - SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_TCP)); - if (rc) - return rc; - - rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), - SCMP_CMP(0, SCMP_CMP_EQ, pf), - SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_DGRAM), - SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP)); - if (rc) - return rc; + for (j=0; j < 3; ++j) { + const int type = (j == 0) ? SOCK_STREAM : + (j == 1) ? SOCK_DGRAM : + SOCK_DGRAM; + const int protocol = (j == 0) ? IPPROTO_TCP : + (j == 1) ? IPPROTO_IP : + IPPROTO_UDP; + rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), + SCMP_CMP(0, SCMP_CMP_EQ, pf), + SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, type), + SCMP_CMP(2, SCMP_CMP_EQ, protocol)); + if (rc) + return rc; + } } rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),

1 0

[tor/master] Add (SOCK_DGRAM, IPPROTO_UDP) sockets to the sandboxing whitelist
by nickm＠torproject.org 17 Jul '16

17 Jul '16

commit 36b06be73862d6f3206d0e2a6fe17af06f8b7c88 Author: Peter Palfrader <peter(a)palfrader.org> Date: Mon Jul 11 09:37:01 2016 +0200 Add (SOCK_DGRAM, IPPROTO_UDP) sockets to the sandboxing whitelist If we did not find a non-private IPaddress by iterating over interfaces, we would try to get one via get_interface_address6_via_udp_socket_hack(). This opens a datagram socket with IPPROTO_UDP. Previously all our datagram sockets (via libevent) used IPPROTO_IP, so we did not have that in the sandboxing whitelist. Add (SOCK_DGRAM, IPPROTO_UDP) sockets to the sandboxing whitelist. Fixes bug 19660. --- changes/bug19660 | 8 ++++++++ src/common/sandbox.c | 30 +++++++++++++++--------------- 2 files changed, 23 insertions(+), 15 deletions(-) diff --git a/changes/bug19660 b/changes/bug19660 new file mode 100644 index 0000000..72d32c8 --- /dev/null +++ b/changes/bug19660 @@ -0,0 +1,8 @@ + o Minor bugfixes (sandboxing): + - If we did not find a non-private IPaddress by iterating over + interfaces, we would try to get one via + get_interface_address6_via_udp_socket_hack(). This opens a + datagram socket with IPPROTO_UDP. Previously all our datagram + sockets (via libevent) used IPPROTO_IP, so we did not have that + in the sandboxing whitelist. Add (SOCK_DGRAM, IPPROTO_UDP) + sockets to the sandboxing whitelist. Fixes bug 19660. diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 70c5bbd..54c1267 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -585,7 +585,7 @@ static int sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; - int i; + int i, j; (void) filter; #ifdef __i386__ @@ -602,20 +602,20 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) for (i = 0; i < 2; ++i) { const int pf = i ? PF_INET : PF_INET6; - - rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), - SCMP_CMP(0, SCMP_CMP_EQ, pf), - SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM), - SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_TCP)); - if (rc) - return rc; - - rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), - SCMP_CMP(0, SCMP_CMP_EQ, pf), - SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_DGRAM), - SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP)); - if (rc) - return rc; + for (j=0; j < 3; ++j) { + const int type = (j == 0) ? SOCK_STREAM : + (j == 1) ? SOCK_DGRAM : + SOCK_DGRAM; + const int protocol = (j == 0) ? IPPROTO_TCP : + (j == 1) ? IPPROTO_IP : + IPPROTO_UDP; + rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), + SCMP_CMP(0, SCMP_CMP_EQ, pf), + SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, type), + SCMP_CMP(2, SCMP_CMP_EQ, protocol)); + if (rc) + return rc; + } } rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),

1 0

[tor/master] Merge branch 'maint-0.2.8'
by nickm＠torproject.org 17 Jul '16

17 Jul '16

commit c138c9a2be868c4d8bad4e6ae5637205f1bdcf0f Merge: 9932544 fbae15a Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Jul 17 13:55:04 2016 -0400 Merge branch 'maint-0.2.8' changes/bug19660 | 8 ++++++++ changes/bug19682 | 3 +++ src/common/sandbox.c | 30 +++++++++++++++--------------- src/test/test_util_format.c | 8 ++++---- 4 files changed, 30 insertions(+), 19 deletions(-)

1 0

[tor/maint-0.2.8] Add (SOCK_DGRAM, IPPROTO_UDP) sockets to the sandboxing whitelist
by nickm＠torproject.org 17 Jul '16

17 Jul '16

commit 36b06be73862d6f3206d0e2a6fe17af06f8b7c88 Author: Peter Palfrader <peter(a)palfrader.org> Date: Mon Jul 11 09:37:01 2016 +0200 Add (SOCK_DGRAM, IPPROTO_UDP) sockets to the sandboxing whitelist If we did not find a non-private IPaddress by iterating over interfaces, we would try to get one via get_interface_address6_via_udp_socket_hack(). This opens a datagram socket with IPPROTO_UDP. Previously all our datagram sockets (via libevent) used IPPROTO_IP, so we did not have that in the sandboxing whitelist. Add (SOCK_DGRAM, IPPROTO_UDP) sockets to the sandboxing whitelist. Fixes bug 19660. --- changes/bug19660 | 8 ++++++++ src/common/sandbox.c | 30 +++++++++++++++--------------- 2 files changed, 23 insertions(+), 15 deletions(-) diff --git a/changes/bug19660 b/changes/bug19660 new file mode 100644 index 0000000..72d32c8 --- /dev/null +++ b/changes/bug19660 @@ -0,0 +1,8 @@ + o Minor bugfixes (sandboxing): + - If we did not find a non-private IPaddress by iterating over + interfaces, we would try to get one via + get_interface_address6_via_udp_socket_hack(). This opens a + datagram socket with IPPROTO_UDP. Previously all our datagram + sockets (via libevent) used IPPROTO_IP, so we did not have that + in the sandboxing whitelist. Add (SOCK_DGRAM, IPPROTO_UDP) + sockets to the sandboxing whitelist. Fixes bug 19660. diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 70c5bbd..54c1267 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -585,7 +585,7 @@ static int sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { int rc = 0; - int i; + int i, j; (void) filter; #ifdef __i386__ @@ -602,20 +602,20 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) for (i = 0; i < 2; ++i) { const int pf = i ? PF_INET : PF_INET6; - - rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), - SCMP_CMP(0, SCMP_CMP_EQ, pf), - SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM), - SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_TCP)); - if (rc) - return rc; - - rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), - SCMP_CMP(0, SCMP_CMP_EQ, pf), - SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_DGRAM), - SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP)); - if (rc) - return rc; + for (j=0; j < 3; ++j) { + const int type = (j == 0) ? SOCK_STREAM : + (j == 1) ? SOCK_DGRAM : + SOCK_DGRAM; + const int protocol = (j == 0) ? IPPROTO_TCP : + (j == 1) ? IPPROTO_IP : + IPPROTO_UDP; + rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), + SCMP_CMP(0, SCMP_CMP_EQ, pf), + SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, type), + SCMP_CMP(2, SCMP_CMP_EQ, protocol)); + if (rc) + return rc; + } } rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket),

1 0

[tor/maint-0.2.8] Merge remote-tracking branch 'weasel/bug19660' into maint-0.2.8
by nickm＠torproject.org 17 Jul '16

17 Jul '16

commit fbae15a856fccdecfb19ff80229b584026ae2def Merge: bec4e41 36b06be Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Jul 17 13:54:40 2016 -0400 Merge remote-tracking branch 'weasel/bug19660' into maint-0.2.8 changes/bug19660 | 8 ++++++++ src/common/sandbox.c | 30 +++++++++++++++--------------- 2 files changed, 23 insertions(+), 15 deletions(-)

1 0

[tor/release-0.2.8] Merge branch 'maint-0.2.8' into release-0.2.8
by nickm＠torproject.org 17 Jul '16

17 Jul '16

commit fe53f9c17d2e4f92db81d9b4e801ae45dbe4db08 Merge: 449c61f fbae15a Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Jul 17 13:54:58 2016 -0400 Merge branch 'maint-0.2.8' into release-0.2.8 changes/bug19660 | 8 ++++++++ changes/bug19682 | 3 +++ src/common/sandbox.c | 30 +++++++++++++++--------------- src/test/test_util_format.c | 8 ++++---- 4 files changed, 30 insertions(+), 19 deletions(-)

1 0

[tor/release-0.2.8] Merge remote-tracking branch 'weasel/bug19660' into maint-0.2.8
by nickm＠torproject.org 17 Jul '16

17 Jul '16

commit fbae15a856fccdecfb19ff80229b584026ae2def Merge: bec4e41 36b06be Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Jul 17 13:54:40 2016 -0400 Merge remote-tracking branch 'weasel/bug19660' into maint-0.2.8 changes/bug19660 | 8 ++++++++ src/common/sandbox.c | 30 +++++++++++++++--------------- 2 files changed, 23 insertions(+), 15 deletions(-)

1 0

[tor/release-0.2.8] Fix warnings in test_util_formats.
by nickm＠torproject.org 17 Jul '16

17 Jul '16

commit bec4e41f4b48c288613a13021da9a29d5fb1ecac Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Jul 17 13:51:45 2016 -0400 Fix warnings in test_util_formats. Storing 255 into a char gives a warning when char is signed. Fixes bug 19682; bugfix on 0.2.8.1-alpha, where these tests were added. --- changes/bug19682 | 3 +++ src/test/test_util_format.c | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/changes/bug19682 b/changes/bug19682 new file mode 100644 index 0000000..c799c41 --- /dev/null +++ b/changes/bug19682 @@ -0,0 +1,3 @@ + o Minor bugfixes (compilation): + - Fix compilation warning in the unit tests on systems where + char is signed. Fixes bug 19682; bugfix on 0.2.8.1-alpha. diff --git a/src/test/test_util_format.c b/src/test/test_util_format.c index a25054c..3d02930 100644 --- a/src/test/test_util_format.c +++ b/src/test/test_util_format.c @@ -106,10 +106,10 @@ test_util_format_base64_encode(void *ignored) for (i = 0;i<50;i++) { src[i] = 0; } - src[50] = 255; - src[51] = 255; - src[52] = 255; - src[53] = 255; + src[50] = (char)255; + src[51] = (char)255; + src[52] = (char)255; + src[53] = (char)255; res = base64_encode(dst, 1000, src, 54, BASE64_ENCODE_MULTILINE); tt_int_op(res, OP_EQ, 74);

1 0

[tor/maint-0.2.8] Fix warnings in test_util_formats.
by nickm＠torproject.org 17 Jul '16

17 Jul '16

commit bec4e41f4b48c288613a13021da9a29d5fb1ecac Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Jul 17 13:51:45 2016 -0400 Fix warnings in test_util_formats. Storing 255 into a char gives a warning when char is signed. Fixes bug 19682; bugfix on 0.2.8.1-alpha, where these tests were added. --- changes/bug19682 | 3 +++ src/test/test_util_format.c | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/changes/bug19682 b/changes/bug19682 new file mode 100644 index 0000000..c799c41 --- /dev/null +++ b/changes/bug19682 @@ -0,0 +1,3 @@ + o Minor bugfixes (compilation): + - Fix compilation warning in the unit tests on systems where + char is signed. Fixes bug 19682; bugfix on 0.2.8.1-alpha. diff --git a/src/test/test_util_format.c b/src/test/test_util_format.c index a25054c..3d02930 100644 --- a/src/test/test_util_format.c +++ b/src/test/test_util_format.c @@ -106,10 +106,10 @@ test_util_format_base64_encode(void *ignored) for (i = 0;i<50;i++) { src[i] = 0; } - src[50] = 255; - src[51] = 255; - src[52] = 255; - src[53] = 255; + src[50] = (char)255; + src[51] = (char)255; + src[52] = (char)255; + src[53] = (char)255; res = base64_encode(dst, 1000, src, 54, BASE64_ENCODE_MULTILINE); tt_int_op(res, OP_EQ, 74);

1 0

[translation/tails-misc_completed] Update translations for tails-misc_completed
by translation＠torproject.org 17 Jul '16

17 Jul '16

commit 9bf7bc9e0bf6ca6ca627f0ae811ef5d1e8c51774 Author: Translation commit bot <translation(a)torproject.org> Date: Sun Jul 17 14:16:23 2016 +0000 Update translations for tails-misc_completed --- sk_SK.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sk_SK.po b/sk_SK.po index 79e9404..4f03f01 100644 --- a/sk_SK.po +++ b/sk_SK.po @@ -11,7 +11,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2016-06-06 14:26+0200\n" -"PO-Revision-Date: 2016-07-12 19:41+0000\n" +"PO-Revision-Date: 2016-07-17 13:57+0000\n" "Last-Translator: Dasa M <littlearchr8(a)gmail.com>\n" "Language-Team: Slovak (Slovakia) (http://www.transifex.com/otf/torproject/language/sk_SK/)\n" "MIME-Version: 1.0\n"

1 0