tor-commits September 2017

tor-commits@lists.torproject.org

16 participants
2950 discussions

[stem/master] Close control socket faster when under load
by atagar＠torproject.org 21 Sep '17

21 Sep '17

commit 02760c0638ee57b456920beccba178669a378537 Merge: d138f557 7d639f21 Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Sep 21 10:23:36 2017 -0700 Close control socket faster when under load When receiving a high volume of traffic (such as DEBUG events on a busy relay) our controller can take seconds or even minutes to close. This is because we send a QUIT signal, then wait for the response which is stuck behind potentially thousands of events. From what I can tell there's little point in issuing a QUIT so dropping that, and setting a time limit for processing backlogged events. I've done what I can to lighten our socket's recv() method, and even without the timeout we now process events much faster. But on busy relays under DEBUG load we simply cannot keep up. Clearly an edge case though, hence this compromise. The timeout is high enough that users will effectively never hit it, but when the controller connection is saturated we still work. Tested via the following script on my relay... import os import time import stem.control import stem.util.proc import stem.util.str_tools start_time = time.time() samplings = [] last_sample = None with stem.control.Controller.from_port() as controller: controller.authenticate() controller.add_event_listener(lambda *args: None, 'DEBUG') while True: utime, stime = stem.util.proc.stats(os.getpid(), stem.util.proc.Stat.CPU_UTIME, stem.util.proc.Stat.CPU_STIME) total_cpu_time = float(utime) + float(stime) if last_sample: samplings.append(total_cpu_time - last_sample) print '%0.1f%% (%s)' % (sum(samplings) / len(samplings) * 100, stem.util.str_tools.time_label(time.time() - start_time)) last_sample = total_cpu_time time.sleep(1) docs/change_log.rst | 4 +- stem/control.py | 29 +++++---- stem/response/__init__.py | 2 +- stem/socket.py | 115 +++++++++++++++++----------------- stem/util/log.py | 19 ++++++ stem/util/system.py | 18 +++--- test/settings.cfg | 1 + test/unit/response/control_message.py | 15 ++--- test/unit/util/__init__.py | 1 + test/unit/util/log.py | 23 +++++++ 10 files changed, 141 insertions(+), 86 deletions(-)

1 0

[stem/master] Remove bytes normalization from recv_message
by atagar＠torproject.org 21 Sep '17

21 Sep '17

commit cf3c55ef6aec640711e26be4a4f985850612c29c Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Sep 18 10:21:41 2017 -0700 Remove bytes normalization from recv_message Sockets always provide bytes, but we still normalized the type because tests and a few methods like ControlMessage.from_str() provided it a StringIO instead. This is silly. We can provide BytesIOs instead. Our recv_message is in the critical path so it's important to keep it as minimal as possible. This might break our tests for python 2.6. Not sure - don't have that python verison and getting it on modern systems is a pita. I'll check later. 2.6 has the io module, but unclear if it has BytesIO. If so we might need to tweak our imports later. --- stem/control.py | 4 ++-- stem/response/__init__.py | 2 +- stem/socket.py | 6 +----- test/unit/response/control_message.py | 15 ++++++--------- 4 files changed, 10 insertions(+), 17 deletions(-) diff --git a/stem/control.py b/stem/control.py index 2f1268ef..fd5f9f87 100644 --- a/stem/control.py +++ b/stem/control.py @@ -3298,7 +3298,7 @@ class Controller(BaseController): response = self.get_info('circuit-status') for circ in response.splitlines(): - circ_message = stem.socket.recv_message(io.StringIO(stem.util.str_tools._to_unicode('650 CIRC ' + circ + '\r\n'))) + circ_message = stem.socket.recv_message(io.BytesIO(stem.util.str_tools._to_unicode('650 CIRC %s\r\n' % circ))) stem.response.convert('EVENT', circ_message, arrived_at = 0) circuits.append(circ_message) @@ -3481,7 +3481,7 @@ class Controller(BaseController): response = self.get_info('stream-status') for stream in response.splitlines(): - message = stem.socket.recv_message(io.StringIO(stem.util.str_tools._to_unicode('650 STREAM ' + stream + '\r\n'))) + message = stem.socket.recv_message(io.BytesIO(stem.util.str_tools._to_bytes('650 STREAM %s\r\n' % stream))) stem.response.convert('EVENT', message, arrived_at = 0) streams.append(message) diff --git a/stem/response/__init__.py b/stem/response/__init__.py index eadb25c7..e0de0f5c 100644 --- a/stem/response/__init__.py +++ b/stem/response/__init__.py @@ -156,7 +156,7 @@ class ControlMessage(object): content = re.sub('([\r]?)\n', '\r\n', content) - msg = stem.socket.recv_message(io.StringIO(stem.util.str_tools._to_unicode(content))) + msg = stem.socket.recv_message(io.BytesIO(stem.util.str_tools._to_bytes(content))) if msg_type is not None: convert(msg_type, msg, **kwargs) diff --git a/stem/socket.py b/stem/socket.py index ca56ea69..9817c129 100644 --- a/stem/socket.py +++ b/stem/socket.py @@ -530,11 +530,7 @@ def recv_message(control_file): while True: try: - # From a real socket readline() would always provide bytes, but during - # tests we might be given a StringIO in which case it's unicode under - # python 3.x. - - line = stem.util.str_tools._to_bytes(control_file.readline()) + line = control_file.readline() except AttributeError: # if the control_file has been closed then we will receive: # AttributeError: 'NoneType' object has no attribute 'recv' diff --git a/test/unit/response/control_message.py b/test/unit/response/control_message.py index c0fb2f32..8b05d6a8 100644 --- a/test/unit/response/control_message.py +++ b/test/unit/response/control_message.py @@ -2,17 +2,14 @@ Unit tests for the stem.response.ControlMessage parsing and class. """ +import io import socket import unittest -try: - from StringIO import StringIO -except: - from io import StringIO - import stem.socket import stem.response import stem.response.getinfo +import stem.util.str_tools OK_REPLY = '250 OK\r\n' @@ -128,7 +125,7 @@ class TestControlMessage(unittest.TestCase): for index, line in enumerate(infonames_lines): # replace the CRLF for the line infonames_lines[index] = line.rstrip('\r\n') + '\n' - test_socket_file = StringIO(''.join(infonames_lines)) + test_socket_file = io.BytesIO(stem.util.str_tools._to_bytes(''.join(infonames_lines))) self.assertRaises(stem.ProtocolError, stem.socket.recv_message, test_socket_file) # puts the CRLF back @@ -154,8 +151,8 @@ class TestControlMessage(unittest.TestCase): # - this is part of the message prefix # - this is disrupting the line ending - self.assertRaises(stem.ProtocolError, stem.socket.recv_message, StringIO(removal_test_input)) - self.assertRaises(stem.ProtocolError, stem.socket.recv_message, StringIO(replacement_test_input)) + self.assertRaises(stem.ProtocolError, stem.socket.recv_message, io.BytesIO(stem.util.str_tools._to_bytes(removal_test_input))) + self.assertRaises(stem.ProtocolError, stem.socket.recv_message, io.BytesIO(stem.util.str_tools._to_bytes(replacement_test_input))) else: # otherwise the data will be malformed, but this goes undetected self._assert_message_parses(removal_test_input) @@ -179,7 +176,7 @@ class TestControlMessage(unittest.TestCase): stem.response.ControlMessage for the given input """ - message = stem.socket.recv_message(StringIO(controller_reply)) + message = stem.socket.recv_message(io.BytesIO(stem.util.str_tools._to_bytes(controller_reply))) # checks that the raw_content equals the input value self.assertEqual(controller_reply, message.raw_content())

1 0

[stem/master] Avoid trace logging when unused
by atagar＠torproject.org 21 Sep '17

21 Sep '17

commit 5cd78b36aa6608bd570eb7536f90aa5b9048fe58 Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Sep 17 13:52:15 2017 -0700 Avoid trace logging when unused If a tree falls in an empty forest does it make a sound? Constructing trace runlevel log messages in stem.socket is absolutley *killing* performance on busy relays. As in pegging cpu to the point of killing the tor process. ... ouch. Only constructing trace log messages if someone's actually listening for them. --- docs/change_log.rst | 3 ++- stem/socket.py | 31 ++++++++++++++++++------------- stem/util/log.py | 19 +++++++++++++++++++ stem/util/system.py | 18 ++++++++++-------- test/settings.cfg | 1 + test/unit/util/__init__.py | 1 + test/unit/util/log.py | 23 +++++++++++++++++++++++ 7 files changed, 74 insertions(+), 22 deletions(-) diff --git a/docs/change_log.rst b/docs/change_log.rst index 60457e48..8d9c10aa 100644 --- a/docs/change_log.rst +++ b/docs/change_log.rst @@ -79,6 +79,8 @@ The following are only available within Stem's `git repository * **Utilities** * Support connection resolution on OpenBSD using fstat (:trac:`13807`) + * Added :func:`~stem.util.system.size_of` + * Added :func:`~stem.util.log.is_tracing` * Added timeout argument to :func:`~stem.util.system.call` * Added cwd argument to :func:`~stem.util.system.call` * Added round argument to :func:`~stem.util.str_tools.size_label` @@ -86,7 +88,6 @@ The following are only available within Stem's `git repository * Supporing pid arguments in :func:`~stem.util.system.is_running` * Normalized :func:`~stem.util.term.format` to return unicode * Don't load vim swap files as configurations - * Added :func:`~stem.util.system.size_of` * **Interpreter** diff --git a/stem/socket.py b/stem/socket.py index d10b40d2..171e9417 100644 --- a/stem/socket.py +++ b/stem/socket.py @@ -80,6 +80,8 @@ import stem.util.str_tools from stem.util import log +MESSAGE_PREFIX = re.compile(b'^[a-zA-Z0-9]{3}[-+ ]') + # lines to limit our trace logging to, you can disable this by setting it to None TRUNCATE_LOGS = 10 @@ -484,9 +486,10 @@ def send_message(control_file, message, raw = False): control_file.write(stem.util.str_tools._to_bytes(message)) control_file.flush() - log_message = message.replace('\r\n', '\n').rstrip() - msg_div = '\n' if '\n' in log_message else ' ' - log.trace('Sent to tor:%s%s' % (msg_div, log_message)) + if log.is_tracing(): + log_message = message.replace('\r\n', '\n').rstrip() + msg_div = '\n' if '\n' in log_message else ' ' + log.trace('Sent to tor:%s%s' % (msg_div, log_message)) except socket.error as exc: log.info('Failed to send message: %s' % exc) @@ -557,7 +560,7 @@ def recv_message(control_file): # Parses the tor control lines. These are of the form... # <status code><divider><content>\r\n - if len(line) == 0: + if not line: # if the socket is disconnected then the readline() method will provide # empty content @@ -568,7 +571,7 @@ def recv_message(control_file): prefix = logging_prefix % 'ProtocolError' log.info(prefix + 'line too short, "%s"' % log.escape(line)) raise stem.ProtocolError('Badly formatted reply line: too short') - elif not re.match(b'^[a-zA-Z0-9]{3}[-+ ]', line): + elif not MESSAGE_PREFIX.match(line): prefix = logging_prefix % 'ProtocolError' log.info(prefix + 'malformed status code/divider, "%s"' % log.escape(line)) raise stem.ProtocolError('Badly formatted reply line: beginning is malformed') @@ -593,16 +596,18 @@ def recv_message(control_file): parsed_content.append((status_code, divider, content)) raw_content_str = b''.join(raw_content) - log_message = stem.util.str_tools._to_unicode(raw_content_str.replace(b'\r\n', b'\n').rstrip()) - log_message_lines = log_message.split('\n') - if TRUNCATE_LOGS and len(log_message_lines) > TRUNCATE_LOGS: - log_message = '\n'.join(log_message_lines[:TRUNCATE_LOGS] + ['... %i more lines...' % (len(log_message_lines) - TRUNCATE_LOGS)]) + if log.is_tracing(): + log_message = stem.util.str_tools._to_unicode(raw_content_str.replace(b'\r\n', b'\n').rstrip()) + log_message_lines = log_message.split('\n') + + if TRUNCATE_LOGS and len(log_message_lines) > TRUNCATE_LOGS: + log_message = '\n'.join(log_message_lines[:TRUNCATE_LOGS] + ['... %i more lines...' % (len(log_message_lines) - TRUNCATE_LOGS)]) - if len(log_message_lines) > 2: - log.trace('Received from tor:\n%s' % log_message) - else: - log.trace('Received from tor: %s' % log_message.replace('\n', '\\n')) + if len(log_message_lines) > 2: + log.trace('Received from tor:\n%s' % log_message) + else: + log.trace('Received from tor: %s' % log_message.replace('\n', '\\n')) return stem.response.ControlMessage(parsed_content, raw_content_str) elif divider == '+': diff --git a/stem/util/log.py b/stem/util/log.py index e157c7c0..88b533e6 100644 --- a/stem/util/log.py +++ b/stem/util/log.py @@ -88,6 +88,9 @@ DEDUPLICATION_MESSAGE_IDS = set() class _NullHandler(logging.Handler): + def __init__(self): + logging.Handler.__init__(self, level = logging.FATAL + 5) # disable logging + def emit(self, record): pass @@ -119,6 +122,22 @@ def logging_level(runlevel): return logging.FATAL + 5 +def is_tracing(): + """ + Checks if we're logging at the trace runlevel. + + .. versionadded:: 1.6.0 + + :returns: **True** if we're logging at the trace runlevel and **False** otherwise + """ + + for handler in get_logger().handlers: + if handler.level <= logging_level(TRACE): + return True + + return False + + def escape(message): """ Escapes specific sequences for logging (newlines, tabs, carriage returns). If diff --git a/stem/util/system.py b/stem/util/system.py index 3a40e13d..fb799227 100644 --- a/stem/util/system.py +++ b/stem/util/system.py @@ -1284,14 +1284,16 @@ def call(command, default = UNDEFINED, ignore_exit_status = False, timeout = Non runtime = time.time() - start_time log.debug('System call: %s (runtime: %0.2f)' % (command, runtime)) - trace_prefix = 'Received from system (%s)' % command - - if stdout and stderr: - log.trace(trace_prefix + ', stdout:\n%s\nstderr:\n%s' % (stdout, stderr)) - elif stdout: - log.trace(trace_prefix + ', stdout:\n%s' % stdout) - elif stderr: - log.trace(trace_prefix + ', stderr:\n%s' % stderr) + + if log.is_tracing(): + trace_prefix = 'Received from system (%s)' % command + + if stdout and stderr: + log.trace(trace_prefix + ', stdout:\n%s\nstderr:\n%s' % (stdout, stderr)) + elif stdout: + log.trace(trace_prefix + ', stdout:\n%s' % stdout) + elif stderr: + log.trace(trace_prefix + ', stderr:\n%s' % stderr) exit_status = process.poll() diff --git a/test/settings.cfg b/test/settings.cfg index 4cc9d7ee..5b3ba6bc 100644 --- a/test/settings.cfg +++ b/test/settings.cfg @@ -189,6 +189,7 @@ test.unit_tests |test.unit.util.enum.TestEnum |test.unit.util.connection.TestConnection |test.unit.util.conf.TestConf +|test.unit.util.log.TestLog |test.unit.util.proc.TestProc |test.unit.util.str_tools.TestStrTools |test.unit.util.system.TestSystem diff --git a/test/unit/util/__init__.py b/test/unit/util/__init__.py index 866ec4b3..89190f7e 100644 --- a/test/unit/util/__init__.py +++ b/test/unit/util/__init__.py @@ -12,6 +12,7 @@ __all__ = [ 'conf', 'connection', 'enum', + 'log', 'proc', 'str_tools', 'system', diff --git a/test/unit/util/log.py b/test/unit/util/log.py new file mode 100644 index 00000000..615d8d36 --- /dev/null +++ b/test/unit/util/log.py @@ -0,0 +1,23 @@ +""" +Unit tests for the stem.util.log functions. +""" + +import unittest + +from stem.util import log + + +class TestLog(unittest.TestCase): + def test_is_tracing(self): + logger = log.get_logger() + original_handlers = logger.handlers + logger.handlers = [log._NullHandler()] + + try: + self.assertFalse(log.is_tracing()) + logger.addHandler(log.LogBuffer(log.DEBUG)) + self.assertFalse(log.is_tracing()) + logger.addHandler(log.LogBuffer(log.TRACE)) + self.assertTrue(log.is_tracing()) + finally: + logger.handlers = original_handlers

1 0

[stem/master] Simplify socket logging
by atagar＠torproject.org 21 Sep '17

21 Sep '17

commit cc3656a4fb6597a7c3b2296495c752fc8a044e63 Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Sep 17 14:44:58 2017 -0700 Simplify socket logging We created quite a few pointless strings for socket exception logging. Both clunky in inefficient. --- stem/socket.py | 30 +++++++++++------------------- 1 file changed, 11 insertions(+), 19 deletions(-) diff --git a/stem/socket.py b/stem/socket.py index 171e9417..ca56ea69 100644 --- a/stem/socket.py +++ b/stem/socket.py @@ -81,6 +81,7 @@ import stem.util.str_tools from stem.util import log MESSAGE_PREFIX = re.compile(b'^[a-zA-Z0-9]{3}[-+ ]') +ERROR_MSG = 'Error while receiving a control message (%s): %s' # lines to limit our trace logging to, you can disable this by setting it to None @@ -526,7 +527,6 @@ def recv_message(control_file): """ parsed_content, raw_content = [], [] - logging_prefix = 'Error while receiving a control message (%s): ' while True: try: @@ -539,8 +539,7 @@ def recv_message(control_file): # if the control_file has been closed then we will receive: # AttributeError: 'NoneType' object has no attribute 'recv' - prefix = logging_prefix % 'SocketClosed' - log.info(prefix + 'socket file has been closed') + log.info(ERROR_MSG % ('SocketClosed', 'socket file has been closed')) raise stem.SocketClosed('socket file has been closed') except (socket.error, ValueError) as exc: # When disconnected we get... @@ -551,8 +550,7 @@ def recv_message(control_file): # Python 3: # ValueError: I/O operation on closed file. - prefix = logging_prefix % 'SocketClosed' - log.info(prefix + 'received exception "%s"' % exc) + log.info(ERROR_MSG % ('SocketClosed', 'received exception "%s"' % exc)) raise stem.SocketClosed(exc) raw_content.append(line) @@ -564,20 +562,16 @@ def recv_message(control_file): # if the socket is disconnected then the readline() method will provide # empty content - prefix = logging_prefix % 'SocketClosed' - log.info(prefix + 'empty socket content') + log.info(ERROR_MSG % ('SocketClosed', 'empty socket content')) raise stem.SocketClosed('Received empty socket content.') elif len(line) < 4: - prefix = logging_prefix % 'ProtocolError' - log.info(prefix + 'line too short, "%s"' % log.escape(line)) + log.info(ERROR_MSG % ('ProtocolError', 'line too short, "%s"' % log.escape(line))) raise stem.ProtocolError('Badly formatted reply line: too short') elif not MESSAGE_PREFIX.match(line): - prefix = logging_prefix % 'ProtocolError' - log.info(prefix + 'malformed status code/divider, "%s"' % log.escape(line)) + log.info(ERROR_MSG % ('ProtocolError', 'malformed status code/divider, "%s"' % log.escape(line))) raise stem.ProtocolError('Badly formatted reply line: beginning is malformed') elif not line.endswith(b'\r\n'): - prefix = logging_prefix % 'ProtocolError' - log.info(prefix + 'no CRLF linebreak, "%s"' % log.escape(line)) + log.info(ERROR_MSG % ('ProtocolError', 'no CRLF linebreak, "%s"' % log.escape(line))) raise stem.ProtocolError('All lines should end with CRLF') line = line[:-2] # strips off the CRLF @@ -618,15 +612,13 @@ def recv_message(control_file): try: line = stem.util.str_tools._to_bytes(control_file.readline()) except socket.error as exc: - prefix = logging_prefix % 'SocketClosed' - log.info(prefix + 'received an exception while mid-way through a data reply (exception: "%s", read content: "%s")' % (exc, log.escape(b''.join(raw_content)))) + log.info(ERROR_MSG % ('SocketClosed', 'received an exception while mid-way through a data reply (exception: "%s", read content: "%s")' % (exc, log.escape(b''.join(raw_content))))) raise stem.SocketClosed(exc) raw_content.append(line) if not line.endswith(b'\r\n'): - prefix = logging_prefix % 'ProtocolError' - log.info(prefix + 'CRLF linebreaks missing from a data reply, "%s"' % log.escape(b''.join(raw_content))) + log.info(ERROR_MSG % ('ProtocolError', 'CRLF linebreaks missing from a data reply, "%s"' % log.escape(b''.join(raw_content)))) raise stem.ProtocolError('All lines should end with CRLF') elif line == b'.\r\n': break # data block termination @@ -648,8 +640,8 @@ def recv_message(control_file): else: # this should never be reached due to the prefix regex, but might as well # be safe... - prefix = logging_prefix % 'ProtocolError' - log.warn(prefix + "\"%s\" isn't a recognized divider type" % divider) + + log.warn(ERROR_MSG % ('ProtocolError', "\"%s\" isn't a recognized divider type" % divider)) raise stem.ProtocolError("Unrecognized divider type '%s': %s" % (divider, stem.util.str_tools._to_unicode(line)))

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1320085 - Allow the getrlimit-equivalent subset of prlimit64. r=tedd
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit bf2b5cefbaddca978d5c5eca3b54f0f0af5c8d32 Author: Jed Davis <jld(a)mozilla.com> Date: Mon Nov 28 12:05:28 2016 -0700 Bug 1320085 - Allow the getrlimit-equivalent subset of prlimit64. r=tedd This applies only to content processes, where we already allow getrlimit (but not setrlimit). The rule added here does not allow using prlimit64 to set any resource limits or interact with any other process. MozReview-Commit-ID: nMry3t6QPj --HG-- extra : rebase_source : ecf792077a672ab1f2c5edf9fbeb915a0d8dd30e --- security/sandbox/linux/SandboxFilter.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp index f8db9dc802ea..018e9c64446c 100644 --- a/security/sandbox/linux/SandboxFilter.cpp +++ b/security/sandbox/linux/SandboxFilter.cpp @@ -735,6 +735,18 @@ public: CASES_FOR_getresgid: return Allow(); + case __NR_prlimit64: { + // Allow only the getrlimit() use case. (glibc seems to use + // only pid 0 to indicate the current process; pid == getpid() + // is equivalent and could also be allowed if needed.) + Arg<pid_t> pid(0); + // This is really a const struct ::rlimit*, but Arg<> doesn't + // work with pointers, only integer types. + Arg<uintptr_t> new_limit(2); + return If(AllOf(pid == 0, new_limit == 0), Allow()) + .Else(InvalidSyscall()); + } + case __NR_umask: case __NR_kill: case __NR_wait4:

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1355274 - Polyfill SOCK_DGRAM socketpairs with SOCK_SEQPACKET, for libasyncns. r=gcp
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit d63e9b803e99682fc561e60c81cbe7b793b7b70f Author: Jed Davis <jld(a)mozilla.com> Date: Tue Apr 11 20:55:34 2017 -0600 Bug 1355274 - Polyfill SOCK_DGRAM socketpairs with SOCK_SEQPACKET, for libasyncns. r=gcp MozReview-Commit-ID: 2DeklSGsjUV --HG-- extra : rebase_source : 8a202c23dc9a3ddede49b08ce1e0792dfb40bdbf --- security/sandbox/linux/SandboxFilter.cpp | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp index 7e1771a62665..5ddd58029e85 100644 --- a/security/sandbox/linux/SandboxFilter.cpp +++ b/security/sandbox/linux/SandboxFilter.cpp @@ -496,6 +496,16 @@ class ContentSandboxPolicy : public SandboxPolicyCommon { return 0; } + static intptr_t SocketpairDatagramTrap(ArgsRef aArgs, void* aux) { + auto fds = reinterpret_cast<int*>(aArgs.args[3]); + // Return sequential packet sockets instead of the expected + // datagram sockets; see bug 1355274 for details. + if (socketpair(AF_UNIX, SOCK_SEQPACKET, 0, fds) != 0) { + return -errno; + } + return 0; + } + public: explicit ContentSandboxPolicy(SandboxBrokerClient* aBroker):mBroker(aBroker) { } virtual ~ContentSandboxPolicy() { } @@ -508,6 +518,7 @@ public: switch(aCall) { case SYS_RECVFROM: case SYS_SENDTO: + case SYS_SENDMMSG: // libresolv via libasyncns; see bug 1355274 return Some(Allow()); case SYS_SOCKETPAIR: { @@ -517,9 +528,12 @@ public: return Some(Allow()); } Arg<int> domain(0), type(1); - return Some(If(AllOf(domain == AF_UNIX, - AnyOf(type == SOCK_STREAM, type == SOCK_SEQPACKET)), - Allow()) + return Some(If(domain == AF_UNIX, + Switch(type) + .Case(SOCK_STREAM, Allow()) + .Case(SOCK_SEQPACKET, Allow()) + .Case(SOCK_DGRAM, Trap(SocketpairDatagramTrap, nullptr)) + .Default(InvalidSyscall())) .Else(InvalidSyscall())); }

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1286865 - Step 0: Turn off crash-on-seccomp-fail by default on non-nightly. r=gcp
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit e3693eef06cadfc24d50abe34ae1bedf0385c3f8 Author: Jed Davis <jld(a)mozilla.com> Date: Fri Jan 27 14:25:50 2017 -0700 Bug 1286865 - Step 0: Turn off crash-on-seccomp-fail by default on non-nightly. r=gcp MozReview-Commit-ID: 1It6HNizbAc --HG-- extra : rebase_source : 1e96f11904abf2c38c5b4e50de7609ddc86cdd8a --- security/sandbox/linux/Sandbox.cpp | 32 ++++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-) diff --git a/security/sandbox/linux/Sandbox.cpp b/security/sandbox/linux/Sandbox.cpp index 7f1182be9972..b4e65a1745df 100644 --- a/security/sandbox/linux/Sandbox.cpp +++ b/security/sandbox/linux/Sandbox.cpp @@ -73,6 +73,8 @@ int gSeccompTsyncBroadcastSignum = 0; namespace mozilla { +static bool gSandboxCrashOnError = false; + // This is initialized by SandboxSetCrashFunc(). SandboxCrashFunc gSandboxCrashFunc; @@ -148,15 +150,18 @@ SigSysHandler(int nr, siginfo_t *info, void *void_context) // TODO, someday when this is enabled on MIPS: include the two extra // args in the error message. SANDBOX_LOG_ERROR("seccomp sandbox violation: pid %d, syscall %d," - " args %d %d %d %d %d %d. Killing process.", + " args %d %d %d %d %d %d.%s", pid, syscall_nr, - args[0], args[1], args[2], args[3], args[4], args[5]); + args[0], args[1], args[2], args[3], args[4], args[5], + gSandboxCrashOnError ? " Killing process." : ""); - // Bug 1017393: record syscall number somewhere useful. - info->si_addr = reinterpret_cast<void*>(syscall_nr); + if (gSandboxCrashOnError) { + // Bug 1017393: record syscall number somewhere useful. + info->si_addr = reinterpret_cast<void*>(syscall_nr); - gSandboxCrashFunc(nr, info, &savedCtx); - _exit(127); + gSandboxCrashFunc(nr, info, &savedCtx); + _exit(127); + } } /** @@ -515,6 +520,21 @@ SandboxEarlyInit(GeckoProcessType aType) } MOZ_RELEASE_ASSERT(IsSingleThreaded()); + // Set gSandboxCrashOnError if appropriate. This doesn't need to + // happen this early, but for now it's here so that I don't need to + // add NSPR dependencies for PR_GetEnv. + // + // This also means that users with "unexpected threads" setups won't + // crash even on nightly. +#ifdef NIGHTLY_BUILD + gSandboxCrashOnError = true; +#endif + if (const char* envVar = getenv("MOZ_SANDBOX_CRASH_ON_ERROR")) { + if (envVar[0]) { + gSandboxCrashOnError = envVar[0] != '0'; + } + } + // Which kinds of resource isolation (of those that need to be set // up at this point) can be used by this process? bool canChroot = false;

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1358647 - Disallow bind/listen/accept for Linux content processes. r=gcp
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 45459c3c090384c1632ac5c2aa4323ed6df656ce Author: Jed Davis <jld(a)mozilla.com> Date: Tue Apr 25 19:29:32 2017 -0600 Bug 1358647 - Disallow bind/listen/accept for Linux content processes. r=gcp MozReview-Commit-ID: Cz9MKxOJnsS --HG-- extra : rebase_source : d3ab7ff9020066d5fe9ac3121c88c85b9fde6224 --- security/sandbox/linux/SandboxFilter.cpp | 4 ---- 1 file changed, 4 deletions(-) diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp index 018e9c64446c..f1520aa29e15 100644 --- a/security/sandbox/linux/SandboxFilter.cpp +++ b/security/sandbox/linux/SandboxFilter.cpp @@ -531,10 +531,6 @@ public: case SYS_SEND: case SYS_SOCKET: // DANGEROUS case SYS_CONNECT: // DANGEROUS - case SYS_ACCEPT: - case SYS_ACCEPT4: - case SYS_BIND: - case SYS_LISTEN: case SYS_GETSOCKOPT: case SYS_SETSOCKOPT: case SYS_GETSOCKNAME:

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1361238 - Re-allow accept4, used by accessibility. r=gcp
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 9a694d0d0cda658157ec2f86e68db0e72b556e04 Author: Jed Davis <jld(a)mozilla.com> Date: Mon May 1 21:51:11 2017 -0600 Bug 1361238 - Re-allow accept4, used by accessibility. r=gcp MozReview-Commit-ID: 3M3T3bkx4nP --HG-- extra : rebase_source : b67332889615ae34cc67737da361f21ae545aeb4 --- security/sandbox/linux/SandboxFilter.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/security/sandbox/linux/SandboxFilter.cpp b/security/sandbox/linux/SandboxFilter.cpp index f1520aa29e15..7e1771a62665 100644 --- a/security/sandbox/linux/SandboxFilter.cpp +++ b/security/sandbox/linux/SandboxFilter.cpp @@ -531,6 +531,7 @@ public: case SYS_SEND: case SYS_SOCKET: // DANGEROUS case SYS_CONNECT: // DANGEROUS + case SYS_ACCEPT4: // Used by a11y; see bug 1361238 case SYS_GETSOCKOPT: case SYS_SETSOCKOPT: case SYS_GETSOCKNAME:

1 0

[tor-browser/tor-browser-52.3.0esr-7.5-2] Bug 1344106 - Remove Linux todos() now that Linux sandboxing is riding the trains. r=haik
by gk＠torproject.org 21 Sep '17

21 Sep '17

commit 5b224c4272f4752dea577c92f41b2f651778e975 Author: Haik Aftandilian <haftandilian(a)mozilla.com> Date: Fri Mar 3 09:50:29 2017 +0100 Bug 1344106 - Remove Linux todos() now that Linux sandboxing is riding the trains. r=haik MozReview-Commit-ID: 9tI2S6fEYkD --HG-- extra : rebase_source : 0a5d00f8498861e7ea281e527b2be6b2c4e472d6 --- .../sandbox/test/browser_content_sandbox_fs.js | 20 -------------------- .../test/browser_content_sandbox_syscalls.js | 22 +--------------------- 2 files changed, 1 insertion(+), 41 deletions(-) diff --git a/security/sandbox/test/browser_content_sandbox_fs.js b/security/sandbox/test/browser_content_sandbox_fs.js index 946f86bb9a92..7439bd46ee53 100644 --- a/security/sandbox/test/browser_content_sandbox_fs.js +++ b/security/sandbox/test/browser_content_sandbox_fs.js @@ -96,25 +96,11 @@ add_task(function*() { prefExists = false; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(prefExists, "pref security.sandbox.content.level exists"); - if (!prefExists) { - return; - } - } - ok(prefExists, "pref security.sandbox.content.level exists"); if (!prefExists) { return; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(level > 0, "content sandbox enabled for !nightly."); - return; - } - info(`security.sandbox.content.level=${level}`); ok(level > 0, "content sandbox is enabled."); if (level == 0) { @@ -124,12 +110,6 @@ add_task(function*() { let isFileIOSandboxed = isContentFileIOSandboxed(level); - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(isFileIOSandboxed, "content file I/O sandbox enabled for !nightly."); - return; - } - // Content sandbox enabled, but level doesn't include file I/O sandboxing. ok(isFileIOSandboxed, "content file I/O sandboxing is enabled."); if (!isFileIOSandboxed) { diff --git a/security/sandbox/test/browser_content_sandbox_syscalls.js b/security/sandbox/test/browser_content_sandbox_syscalls.js index d56456966b8a..848b145429f2 100644 --- a/security/sandbox/test/browser_content_sandbox_syscalls.js +++ b/security/sandbox/test/browser_content_sandbox_syscalls.js @@ -104,7 +104,7 @@ function areContentSyscallsSandboxed(level) { syscallsSandboxMinLevel = 1; break; case "Linux": - syscallsSandboxMinLevel = 2; + syscallsSandboxMinLevel = 1; break; default: Assert.ok(false, "Unknown OS"); @@ -140,25 +140,11 @@ add_task(function*() { prefExists = false; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(prefExists, "pref security.sandbox.content.level exists"); - if (!prefExists) { - return; - } - } - ok(prefExists, "pref security.sandbox.content.level exists"); if (!prefExists) { return; } - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(level > 0, "content sandbox enabled for !nightly."); - return; - } - info(`security.sandbox.content.level=${level}`); ok(level > 0, "content sandbox is enabled."); if (level == 0) { @@ -168,12 +154,6 @@ add_task(function*() { let areSyscallsSandboxed = areContentSyscallsSandboxed(level); - // Special case Linux on !isNightly - if (isLinux() && !isNightly()) { - todo(areSyscallsSandboxed, "content syscall sandbox enabled for !nightly."); - return; - } - // Content sandbox enabled, but level doesn't include syscall sandboxing. ok(areSyscallsSandboxed, "content syscall sandboxing is enabled."); if (!areSyscallsSandboxed) {

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits September 2017