November 2019 - tor-commits - lists.torproject.org

[tor/master] Move some ControlSocket checks to options_validate_cb()
by nickm＠torproject.org 21 Nov '19

21 Nov '19

commit effed7fb1ca30fa741cad8a8a2178a0008ed285d Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 7 12:28:29 2019 -0500 Move some ControlSocket checks to options_validate_cb() There is no reason for them be in options_act_reversible(). --- src/app/config/config.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/src/app/config/config.c b/src/app/config/config.c index 06607e380..ff9bf833f 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -1455,20 +1455,6 @@ options_act_reversible,(const or_options_t *old_options, char **msg)) sd_notifyf(0, "MAINPID=%ld\n", (long int)getpid()); #endif -#ifndef HAVE_SYS_UN_H - if (options->ControlSocket || options->ControlSocketsGroupWritable) { - *msg = tor_strdup("Unix domain sockets (ControlSocket) not supported " - "on this OS/with this build."); - goto rollback; - } -#else /* defined(HAVE_SYS_UN_H) */ - if (options->ControlSocketsGroupWritable && !options->ControlSocket) { - *msg = tor_strdup("Setting ControlSocketGroupWritable without setting" - "a ControlSocket makes no sense."); - goto rollback; - } -#endif /* !defined(HAVE_SYS_UN_H) */ - if (running_tor) { int n_ports=0; /* We need to set the connection limit before we can open the listeners. */ @@ -3180,6 +3166,20 @@ options_validate_cb(const void *old_options_, void *options_, char **msg) &world_writable_control_socket) < 0) return -1; +#ifndef HAVE_SYS_UN_H + if (options->ControlSocket || options->ControlSocketsGroupWritable) { + *msg = tor_strdup("Unix domain sockets (ControlSocket) not supported " + "on this OS/with this build."); + return -1; + } +#else /* defined(HAVE_SYS_UN_H) */ + if (options->ControlSocketsGroupWritable && !options->ControlSocket) { + *msg = tor_strdup("Setting ControlSocketGroupWritable without setting" + "a ControlSocket makes no sense."); + return -1; + } +#endif /* !defined(HAVE_SYS_UN_H) */ + /* Set UseEntryGuards from the configured value, before we check it below. * We change UseEntryGuards when it's incompatible with other options, * but leave UseEntryGuards_option with the original value.

1 0

[tor/master] Extract a function for one-time-only pre-reversible options.
by nickm＠torproject.org 21 Nov '19

21 Nov '19

commit 006ce47ffa0dbc60dc0e3fc5d58e24943e291ef9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 7 12:47:20 2019 -0500 Extract a function for one-time-only pre-reversible options. These changes _only_ happen at startup, and happen before _any_ reversible option change is set. --- src/app/config/config.c | 109 ++++++++++++++++++++++++++++-------------------- 1 file changed, 64 insertions(+), 45 deletions(-) diff --git a/src/app/config/config.c b/src/app/config/config.c index ff9bf833f..57835f95d 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -904,8 +904,8 @@ static smartlist_t *configured_ports = NULL; /** True iff we're currently validating options, and any calls to * get_options() are likely to be bugs. */ static int in_option_validation = 0; -/* True iff we've initialized libevent */ -static int libevent_initialized = 0; +/** True iff we have run options_act_once_on_startup() */ +static bool have_set_startup_options = false; /* A global configuration manager to handle all configuration objects. */ static config_mgr_t *options_mgr = NULL; @@ -1085,7 +1085,7 @@ config_free_all(void) cleanup_protocol_warning_severity_level(); - libevent_initialized = 0; + have_set_startup_options = false; config_mgr_free(options_mgr); } @@ -1422,27 +1422,24 @@ create_keys_directory(const or_options_t *options) /* Helps determine flags to pass to switch_id. */ static int have_low_ports = -1; -/** Fetch the active option list, and take actions based on it. All of the - * things we do should survive being done repeatedly. If present, - * old_options contains the previous value of the options. - * - * Return 0 if all goes well, return -1 if things went badly. - */ -MOCK_IMPL(STATIC int, -options_act_reversible,(const or_options_t *old_options, char **msg)) +/** Take case of initial startup tasks that must occur before any of the + * transactional option-related changes are allowed. */ +static int +options_act_once_on_startup(char **msg_out) { - smartlist_t *new_listeners = smartlist_new(); - or_options_t *options = get_options_mutable(); + if (have_set_startup_options) + return 0; + + const or_options_t *options = get_options(); int running_tor = options->command == CMD_RUN_TOR; - int set_conn_limit = 0; - int r = -1; - int logs_marked = 0, logs_initialized = 0; - int old_min_log_level = get_min_log_level(); + + if (!running_tor) + return 0; /* Daemonize _first_, since we only want to open most of this stuff in * the subprocess. Libevent bases can't be reliably inherited across * processes. */ - if (running_tor && options->RunAsDaemon) { + if (options->RunAsDaemon) { if (! start_daemon_has_been_called()) subsystems_prefork(); /* No need to roll back, since you can't change the value. */ @@ -1455,6 +1452,55 @@ options_act_reversible,(const or_options_t *old_options, char **msg)) sd_notifyf(0, "MAINPID=%ld\n", (long int)getpid()); #endif + /* Set up libevent. (We need to do this before we can register the + * listeners as listeners.) */ + init_libevent(options); + + /* This has to come up after libevent is initialized. */ + control_initialize_event_queue(); + + /* + * Initialize the scheduler - this has to come after + * options_init_from_torrc() sets up libevent - why yes, that seems + * completely sensible to hide the libevent setup in the option parsing + * code! It also needs to happen before init_keys(), so it needs to + * happen here too. How yucky. */ + scheduler_init(); + + /* Attempt to lock all current and future memory with mlockall() only once. + * This must happen before setuid. */ + if (options->DisableAllSwap) { + if (tor_mlockall() == -1) { + *msg_out = tor_strdup("DisableAllSwap failure. Do you have proper " + "permissions?"); + return -1; + } + } + + have_set_startup_options = true; + return 0; +} + +/** Fetch the active option list, and take actions based on it. All of the + * things we do should survive being done repeatedly. If present, + * old_options contains the previous value of the options. + * + * Return 0 if all goes well, return -1 if things went badly. + */ +MOCK_IMPL(STATIC int, +options_act_reversible,(const or_options_t *old_options, char **msg)) +{ + smartlist_t *new_listeners = smartlist_new(); + or_options_t *options = get_options_mutable(); + int running_tor = options->command == CMD_RUN_TOR; + int set_conn_limit = 0; + int r = -1; + int logs_marked = 0, logs_initialized = 0; + int old_min_log_level = get_min_log_level(); + + if (options_act_once_on_startup(msg) < 0) + goto rollback; + if (running_tor) { int n_ports=0; /* We need to set the connection limit before we can open the listeners. */ @@ -1471,24 +1517,6 @@ options_act_reversible,(const or_options_t *old_options, char **msg)) options->ConnLimit_ = old_options->ConnLimit_; } - /* Set up libevent. (We need to do this before we can register the - * listeners as listeners.) */ - if (running_tor && !libevent_initialized) { - init_libevent(options); - libevent_initialized = 1; - - /* This has to come up after libevent is initialized. */ - control_initialize_event_queue(); - - /* - * Initialize the scheduler - this has to come after - * options_init_from_torrc() sets up libevent - why yes, that seems - * completely sensible to hide the libevent setup in the option parsing - * code! It also needs to happen before init_keys(), so it needs to - * happen here too. How yucky. */ - scheduler_init(); - } - /* Adjust the port configuration so we can launch listeners. */ /* 31851: some ports are relay-only */ if (parse_ports(options, 0, msg, &n_ports, NULL)) { @@ -1533,15 +1561,6 @@ options_act_reversible,(const or_options_t *old_options, char **msg)) } #endif /* defined(HAVE_NET_IF_H) && defined(HAVE_NET_PFVAR_H) */ - /* Attempt to lock all current and future memory with mlockall() only once */ - if (options->DisableAllSwap) { - if (tor_mlockall() == -1) { - *msg = tor_strdup("DisableAllSwap failure. Do you have proper " - "permissions?"); - goto done; - } - } - /* Setuid/setgid as appropriate */ if (options->User) { tor_assert(have_low_ports != -1);

1 0

[tor/master] Split log configuration out of options_act_reversible().
by nickm＠torproject.org 21 Nov '19

21 Nov '19

commit 5060007f4b959c5b8cd483817969252c4e4138aa Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 7 17:42:47 2019 -0500 Split log configuration out of options_act_reversible(). --- scripts/maint/practracker/exceptions.txt | 2 +- src/app/config/config.c | 199 ++++++++++++++++++++++--------- src/app/config/config.h | 2 +- 3 files changed, 144 insertions(+), 59 deletions(-) diff --git a/scripts/maint/practracker/exceptions.txt b/scripts/maint/practracker/exceptions.txt index a70119e8a..1c3bf9cbe 100644 --- a/scripts/maint/practracker/exceptions.txt +++ b/scripts/maint/practracker/exceptions.txt @@ -33,7 +33,7 @@ # # Remember: It is better to fix the problem than to add a new exception! -problem file-size /src/app/config/config.c 7212 +problem file-size /src/app/config/config.c 7400 problem include-count /src/app/config/config.c 80 problem function-size /src/app/config/config.c:options_act_reversible() 298 problem function-size /src/app/config/config.c:options_act() 381 diff --git a/src/app/config/config.c b/src/app/config/config.c index 1ef23824d..082dff313 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -862,6 +862,8 @@ static void options_clear_cb(const config_mgr_t *mgr, void *opts); static setopt_err_t options_validate_and_set(const or_options_t *old_options, or_options_t *new_options, char **msg_out); +struct log_transaction_t; +static void options_rollback_log_transaction(struct log_transaction_t *xn); /** Magic value for or_options_t. */ #define OR_OPTIONS_MAGIC 9090909 @@ -1566,6 +1568,139 @@ options_create_directories(char **msg_out) return 0; } +/** Structure to represent an incompleted configuration of a set of logs. + * + * This structure is generated by options_start_log_transaction(), and is + * either committed by options_commit_log_transaction() or rolled back by + * options_rollback_log_transaction(). */ +typedef struct log_transaction_t { + /** Previous lowest severity of any configured log. */ + int old_min_log_level; + /** True if we have marked the previous logs to be closed */ + bool logs_marked; + /** True if we initialized the new set of logs */ + bool logs_initialized; + /** True if our safelogging configuration is different from what it was + * previously (or if we are starting for the first time). */ + bool safelogging_changed; +} log_transaction_t; + +/** + * Start configuring our logs based on the current value of get_options(). + * + * The value old_options holds either the previous options object, + * or NULL if we're starting for the first time. + * + * On success, return a log_transaction_t that we can either roll back or + * commit. + * + * On failure return NULL and write a message into a newly allocated string in + * *msg_out. + **/ +static log_transaction_t * +options_start_log_transaction(const or_options_t *old_options, + char **msg_out) +{ + const or_options_t *options = get_options(); + const bool running_tor = options->command == CMD_RUN_TOR; + + log_transaction_t *xn = tor_malloc_zero(sizeof(log_transaction_t)); + xn->old_min_log_level = get_min_log_level(); + + if (! running_tor) + goto done; + + mark_logs_temp(); /* Close current logs once new logs are open. */ + xn->logs_marked = true; + /* Configure the tor_log(s) */ + if (options_init_logs(old_options, options, 0)<0) { + *msg_out = tor_strdup("Failed to init Log options. See logs for details."); + options_rollback_log_transaction(xn); + xn = NULL; + goto done; + } + + xn->safelogging_changed = !old_options || + old_options->SafeLogging_ != options->SafeLogging_; + + xn->logs_initialized = true; + + done: + return xn; +} + +/** + * Finish configuring the logs that started to get configured with xn. + * Frees xn. + **/ +static void +options_commit_log_transaction(log_transaction_t *xn) +{ + const or_options_t *options = get_options(); + tor_assert(xn); + + if (xn->logs_marked) { + log_severity_list_t *severity = + tor_malloc_zero(sizeof(log_severity_list_t)); + close_temp_logs(); + add_callback_log(severity, control_event_logmsg); + logs_set_pending_callback_callback(control_event_logmsg_pending); + control_adjust_event_log_severity(); + tor_free(severity); + tor_log_update_sigsafe_err_fds(); + } + + if (xn->logs_initialized) { + flush_log_messages_from_startup(); + } + + { + const char *badness = NULL; + int bad_safelog = 0, bad_severity = 0, new_badness = 0; + if (options->SafeLogging_ != SAFELOG_SCRUB_ALL) { + bad_safelog = 1; + if (xn->safelogging_changed) + new_badness = 1; + } + if (get_min_log_level() >= LOG_INFO) { + bad_severity = 1; + if (get_min_log_level() != xn->old_min_log_level) + new_badness = 1; + } + if (bad_safelog && bad_severity) + badness = "you disabled SafeLogging, and " + "you're logging more than \"notice\""; + else if (bad_safelog) + badness = "you disabled SafeLogging"; + else + badness = "you're logging more than \"notice\""; + if (new_badness) + log_warn(LD_GENERAL, "Your log may contain sensitive information - %s. " + "Don't log unless it serves an important reason. " + "Overwrite the log afterwards.", badness); + } + + tor_free(xn); +} + +/** + * Revert the log configuration changes that that started to get configured + * with xn. Frees xn. + **/ +static void +options_rollback_log_transaction(log_transaction_t *xn) +{ + if (!xn) + return; + + if (xn->logs_marked) { + rollback_log_changes(); + control_adjust_event_log_severity(); + } + + tor_free(xn); +} + /** Fetch the active option list, and take actions based on it. All of the * things we do should survive being done repeatedly. If present, * old_options contains the previous value of the options. @@ -1587,10 +1722,9 @@ options_act_reversible,(const or_options_t *old_options, char **msg)) smartlist_t *new_listeners = smartlist_new(); or_options_t *options = get_options_mutable(); int running_tor = options->command == CMD_RUN_TOR; + log_transaction_t *log_transaction = NULL; int set_conn_limit = 0; int r = -1; - int logs_marked = 0, logs_initialized = 0; - int old_min_log_level = get_min_log_level(); if (options_act_once_on_startup(msg) < 0) goto rollback; @@ -1663,62 +1797,16 @@ options_act_reversible,(const or_options_t *old_options, char **msg)) goto done; } - /* Bail out at this point if we're not going to be a client or server: * we don't run Tor itself. */ - if (!running_tor) - goto commit; - - mark_logs_temp(); /* Close current logs once new logs are open. */ - logs_marked = 1; - /* Configure the tor_log(s) */ - if (options_init_logs(old_options, options, 0)<0) { - *msg = tor_strdup("Failed to init Log options. See logs for details."); + log_transaction = options_start_log_transaction(old_options, msg); + if (log_transaction == NULL) goto rollback; - } - logs_initialized = 1; - commit: + // Commit! r = 0; - if (logs_marked) { - log_severity_list_t *severity = - tor_malloc_zero(sizeof(log_severity_list_t)); - close_temp_logs(); - add_callback_log(severity, control_event_logmsg); - logs_set_pending_callback_callback(control_event_logmsg_pending); - control_adjust_event_log_severity(); - tor_free(severity); - tor_log_update_sigsafe_err_fds(); - } - if (logs_initialized) { - flush_log_messages_from_startup(); - } - { - const char *badness = NULL; - int bad_safelog = 0, bad_severity = 0, new_badness = 0; - if (options->SafeLogging_ != SAFELOG_SCRUB_ALL) { - bad_safelog = 1; - if (!old_options || old_options->SafeLogging_ != options->SafeLogging_) - new_badness = 1; - } - if (get_min_log_level() >= LOG_INFO) { - bad_severity = 1; - if (get_min_log_level() != old_min_log_level) - new_badness = 1; - } - if (bad_safelog && bad_severity) - badness = "you disabled SafeLogging, and " - "you're logging more than \"notice\""; - else if (bad_safelog) - badness = "you disabled SafeLogging"; - else - badness = "you're logging more than \"notice\""; - if (new_badness) - log_warn(LD_GENERAL, "Your log may contain sensitive information - %s. " - "Don't log unless it serves an important reason. " - "Overwrite the log afterwards.", badness); - } + options_commit_log_transaction(log_transaction); if (set_conn_limit) { /* @@ -1754,10 +1842,7 @@ options_act_reversible,(const or_options_t *old_options, char **msg)) r = -1; tor_assert(*msg); - if (logs_marked) { - rollback_log_changes(); - control_adjust_event_log_severity(); - } + options_rollback_log_transaction(log_transaction); if (set_conn_limit && old_options) set_max_file_descriptors((unsigned)old_options->ConnLimit, @@ -4857,7 +4942,7 @@ options_init_log_granularity(const or_options_t *options, * Initialize the logs based on the configuration file. */ STATIC int -options_init_logs(const or_options_t *old_options, or_options_t *options, +options_init_logs(const or_options_t *old_options, const or_options_t *options, int validate_only) { config_line_t *opt; diff --git a/src/app/config/config.h b/src/app/config/config.h index eeba9e64d..0af96a0c2 100644 --- a/src/app/config/config.h +++ b/src/app/config/config.h @@ -301,7 +301,7 @@ STATIC int open_and_add_file_log(const log_severity_list_t *severity, const char *fname, int truncate_log); STATIC int options_init_logs(const or_options_t *old_options, - or_options_t *options, int validate_only); + const or_options_t *options, int validate_only); #ifdef TOR_UNIT_TESTS int options_validate(const or_options_t *old_options,

1 0

[tor/master] Split listener configuration out of options_act_reversible()
by nickm＠torproject.org 21 Nov '19

21 Nov '19

commit 929b46f44a64f1e6d0150d6102e9478a444af730 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 7 22:23:28 2019 -0500 Split listener configuration out of options_act_reversible() --- src/app/config/config.c | 286 +++++++++++++++++++++++++++++++----------------- 1 file changed, 183 insertions(+), 103 deletions(-) diff --git a/src/app/config/config.c b/src/app/config/config.c index 082dff313..ab4094658 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -864,6 +864,9 @@ static setopt_err_t options_validate_and_set(const or_options_t *old_options, char **msg_out); struct log_transaction_t; static void options_rollback_log_transaction(struct log_transaction_t *xn); +struct listener_transaction_t; +static void options_rollback_listener_transaction( + struct listener_transaction_t *xn); /** Magic value for or_options_t. */ #define OR_OPTIONS_MAGIC 9090909 @@ -1568,6 +1571,180 @@ options_create_directories(char **msg_out) return 0; } +/** Structure to represent an incomplete configuration of a set of + * listeners. + * + * This structure is generated by options_start_listener_transaction(), and is + * either committed by options_commit_listener_transaction() or rolled back by + * options_rollback_listener_transaction(). */ +typedef struct listener_transaction_t { + bool set_conn_limit; /**< True if we've set the connection limit */ + unsigned old_conn_limit; /**< If nonzero, previous connlimit value. */ + smartlist_t *new_listeners; /**< List of new listeners that we opened. */ +} listener_transaction_t; + +/** + * Start configuring our listeners based on the current value of + * get_options(). + * + * The value old_options holds either the previous options object, + * or NULL if we're starting for the first time. + * + * On success, return a listener_transaction_t that we can either roll back or + * commit. + * + * On failure return NULL and write a message into a newly allocated string in + * *msg_out. + **/ +static listener_transaction_t * +options_start_listener_transaction(const or_options_t *old_options, + char **msg_out) +{ + listener_transaction_t *xn = tor_malloc_zero(sizeof(listener_transaction_t)); + xn->new_listeners = smartlist_new(); + or_options_t *options = get_options_mutable(); + const bool running_tor = options->command == CMD_RUN_TOR; + + if (! running_tor) { + return xn; + } + + int n_ports=0; + /* We need to set the connection limit before we can open the listeners. */ + if (! sandbox_is_active()) { + if (set_max_file_descriptors((unsigned)options->ConnLimit, + &options->ConnLimit_) < 0) { + *msg_out = tor_strdup("Problem with ConnLimit value. " + "See logs for details."); + goto rollback; + } + xn->set_conn_limit = true; + if (old_options) + xn->old_conn_limit = (unsigned)old_options->ConnLimit; + } else { + tor_assert(old_options); + options->ConnLimit_ = old_options->ConnLimit_; + } + + /* Adjust the port configuration so we can launch listeners. */ + /* 31851: some ports are relay-only */ + if (parse_ports(options, 0, msg_out, &n_ports, NULL)) { + if (!*msg_out) + *msg_out = tor_strdup("Unexpected problem parsing port config"); + goto rollback; + } + + /* Set the hibernation state appropriately.*/ + consider_hibernation(time(NULL)); + + /* Launch the listeners. (We do this before we setuid, so we can bind to + * ports under 1024.) We don't want to rebind if we're hibernating or + * shutting down. If networking is disabled, this will close all but the + * control listeners, but disable those. */ + /* 31851: some listeners are relay-only */ + if (!we_are_hibernating()) { + if (retry_all_listeners(xn->new_listeners, + options->DisableNetwork) < 0) { + *msg_out = tor_strdup("Failed to bind one of the listener ports."); + goto rollback; + } + } + if (options->DisableNetwork) { + /* Aggressively close non-controller stuff, NOW */ + log_notice(LD_NET, "DisableNetwork is set. Tor will not make or accept " + "non-control network connections. Shutting down all existing " + "connections."); + connection_mark_all_noncontrol_connections(); + /* We can't complete circuits until the network is re-enabled. */ + note_that_we_maybe_cant_complete_circuits(); + } + +#if defined(HAVE_NET_IF_H) && defined(HAVE_NET_PFVAR_H) + /* Open /dev/pf before (possibly) dropping privileges. */ + if (options->TransPort_set && + options->TransProxyType_parsed == TPT_DEFAULT) { + if (get_pf_socket() < 0) { + *msg_out = tor_strdup("Unable to open /dev/pf for transparent proxy."); + goto rollback; + } + } +#endif /* defined(HAVE_NET_IF_H) && defined(HAVE_NET_PFVAR_H) */ + + return xn; + + rollback: + options_rollback_listener_transaction(xn); + return NULL; +} + +/** + * Finish configuring the listeners that started to get configured with + * xn. Frees xn. + **/ +static void +options_commit_listener_transaction(listener_transaction_t *xn) +{ + tor_assert(xn); + if (xn->set_conn_limit) { + or_options_t *options = get_options_mutable(); + /* + * If we adjusted the conn limit, recompute the OOS threshold too + * + * How many possible sockets to keep in reserve? If we have lots of + * possible sockets, keep this below a limit and set ConnLimit_high_thresh + * very close to ConnLimit_, but if ConnLimit_ is low, shrink it in + * proportion. + * + * Somewhat arbitrarily, set socks_in_reserve to 5% of ConnLimit_, but + * cap it at 64. + */ + int socks_in_reserve = options->ConnLimit_ / 20; + if (socks_in_reserve > 64) socks_in_reserve = 64; + + options->ConnLimit_high_thresh = options->ConnLimit_ - socks_in_reserve; + options->ConnLimit_low_thresh = (options->ConnLimit_ / 4) * 3; + log_info(LD_GENERAL, + "Recomputed OOS thresholds: ConnLimit %d, ConnLimit_ %d, " + "ConnLimit_high_thresh %d, ConnLimit_low_thresh %d", + options->ConnLimit, options->ConnLimit_, + options->ConnLimit_high_thresh, + options->ConnLimit_low_thresh); + + /* Give the OOS handler a chance with the new thresholds */ + connection_check_oos(get_n_open_sockets(), 0); + } + + smartlist_free(xn->new_listeners); + tor_free(xn); +} + +/** + * Revert the listener configuration changes that that started to get + * configured with xn. Frees xn. + **/ +static void +options_rollback_listener_transaction(listener_transaction_t *xn) +{ + if (! xn) + return; + + or_options_t *options = get_options_mutable(); + + if (xn->set_conn_limit && xn->old_conn_limit) + set_max_file_descriptors(xn->old_conn_limit, &options->ConnLimit_); + + SMARTLIST_FOREACH(xn->new_listeners, connection_t *, conn, + { + log_notice(LD_NET, "Closing partially-constructed %s on %s:%d", + conn_type_to_string(conn->type), conn->address, conn->port); + connection_close_immediate(conn); + connection_mark_for_close(conn); + }); + + smartlist_free(xn->new_listeners); + tor_free(xn); +} + /** Structure to represent an incompleted configuration of a set of logs. * * This structure is generated by options_start_log_transaction(), and is @@ -1719,75 +1896,16 @@ MOCK_IMPL(STATIC int, options_act_reversible,(const or_options_t *old_options, char **msg)) { const bool first_time = ! have_set_startup_options; - smartlist_t *new_listeners = smartlist_new(); - or_options_t *options = get_options_mutable(); - int running_tor = options->command == CMD_RUN_TOR; log_transaction_t *log_transaction = NULL; - int set_conn_limit = 0; + listener_transaction_t *listener_transaction = NULL; int r = -1; if (options_act_once_on_startup(msg) < 0) goto rollback; - if (running_tor) { - int n_ports=0; - /* We need to set the connection limit before we can open the listeners. */ - if (! sandbox_is_active()) { - if (set_max_file_descriptors((unsigned)options->ConnLimit, - &options->ConnLimit_) < 0) { - *msg = tor_strdup("Problem with ConnLimit value. " - "See logs for details."); - goto rollback; - } - set_conn_limit = 1; - } else { - tor_assert(old_options); - options->ConnLimit_ = old_options->ConnLimit_; - } - - /* Adjust the port configuration so we can launch listeners. */ - /* 31851: some ports are relay-only */ - if (parse_ports(options, 0, msg, &n_ports, NULL)) { - if (!*msg) - *msg = tor_strdup("Unexpected problem parsing port config"); - goto rollback; - } - - /* Set the hibernation state appropriately.*/ - consider_hibernation(time(NULL)); - - /* Launch the listeners. (We do this before we setuid, so we can bind to - * ports under 1024.) We don't want to rebind if we're hibernating or - * shutting down. If networking is disabled, this will close all but the - * control listeners, but disable those. */ - /* 31851: some listeners are relay-only */ - if (!we_are_hibernating()) { - if (retry_all_listeners(new_listeners, options->DisableNetwork) < 0) { - *msg = tor_strdup("Failed to bind one of the listener ports."); - goto rollback; - } - } - if (options->DisableNetwork) { - /* Aggressively close non-controller stuff, NOW */ - log_notice(LD_NET, "DisableNetwork is set. Tor will not make or accept " - "non-control network connections. Shutting down all existing " - "connections."); - connection_mark_all_noncontrol_connections(); - /* We can't complete circuits until the network is re-enabled. */ - note_that_we_maybe_cant_complete_circuits(); - } - } - -#if defined(HAVE_NET_IF_H) && defined(HAVE_NET_PFVAR_H) - /* Open /dev/pf before dropping privileges. */ - if (options->TransPort_set && - options->TransProxyType_parsed == TPT_DEFAULT) { - if (get_pf_socket() < 0) { - *msg = tor_strdup("Unable to open /dev/pf for transparent proxy."); - goto rollback; - } - } -#endif /* defined(HAVE_NET_IF_H) && defined(HAVE_NET_PFVAR_H) */ + listener_transaction = options_start_listener_transaction(old_options, msg); + if (listener_transaction == NULL) + goto rollback; if (first_time) { if (options_switch_id(msg) < 0) @@ -1808,33 +1926,7 @@ options_act_reversible,(const or_options_t *old_options, char **msg)) options_commit_log_transaction(log_transaction); - if (set_conn_limit) { - /* - * If we adjusted the conn limit, recompute the OOS threshold too - * - * How many possible sockets to keep in reserve? If we have lots of - * possible sockets, keep this below a limit and set ConnLimit_high_thresh - * very close to ConnLimit_, but if ConnLimit_ is low, shrink it in - * proportion. - * - * Somewhat arbitrarily, set socks_in_reserve to 5% of ConnLimit_, but - * cap it at 64. - */ - int socks_in_reserve = options->ConnLimit_ / 20; - if (socks_in_reserve > 64) socks_in_reserve = 64; - - options->ConnLimit_high_thresh = options->ConnLimit_ - socks_in_reserve; - options->ConnLimit_low_thresh = (options->ConnLimit_ / 4) * 3; - log_info(LD_GENERAL, - "Recomputed OOS thresholds: ConnLimit %d, ConnLimit_ %d, " - "ConnLimit_high_thresh %d, ConnLimit_low_thresh %d", - options->ConnLimit, options->ConnLimit_, - options->ConnLimit_high_thresh, - options->ConnLimit_low_thresh); - - /* Give the OOS handler a chance with the new thresholds */ - connection_check_oos(get_n_open_sockets(), 0); - } + options_commit_listener_transaction(listener_transaction); goto done; @@ -1843,21 +1935,9 @@ options_act_reversible,(const or_options_t *old_options, char **msg)) tor_assert(*msg); options_rollback_log_transaction(log_transaction); - - if (set_conn_limit && old_options) - set_max_file_descriptors((unsigned)old_options->ConnLimit, - &options->ConnLimit_); - - SMARTLIST_FOREACH(new_listeners, connection_t *, conn, - { - log_notice(LD_NET, "Closing partially-constructed %s on %s:%d", - conn_type_to_string(conn->type), conn->address, conn->port); - connection_close_immediate(conn); - connection_mark_for_close(conn); - }); + options_rollback_listener_transaction(listener_transaction); done: - smartlist_free(new_listeners); return r; }

1 0

[tor/master] options_act_reversible(): Extract more startup-only pieces.
by nickm＠torproject.org 21 Nov '19

21 Nov '19

commit 20c24e72d92c2d15ef78d683d71b6e627ac66799 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 7 12:59:50 2019 -0500 options_act_reversible(): Extract more startup-only pieces. These have to happen after opening listeners and before opening logs :/ --- src/app/config/config.c | 156 ++++++++++++++++++++++++++++++------------------ 1 file changed, 99 insertions(+), 57 deletions(-) diff --git a/src/app/config/config.c b/src/app/config/config.c index 57835f95d..1ef23824d 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -1431,7 +1431,7 @@ options_act_once_on_startup(char **msg_out) return 0; const or_options_t *options = get_options(); - int running_tor = options->command == CMD_RUN_TOR; + const bool running_tor = options->command == CMD_RUN_TOR; if (!running_tor) return 0; @@ -1481,15 +1481,109 @@ options_act_once_on_startup(char **msg_out) return 0; } +/** + * Change our user ID if we're configured to do so. + **/ +static int +options_switch_id(char **msg_out) +{ + const or_options_t *options = get_options(); + + /* Setuid/setgid as appropriate */ + if (options->User) { + tor_assert(have_low_ports != -1); + unsigned switch_id_flags = 0; + if (options->KeepBindCapabilities == 1) { + switch_id_flags |= SWITCH_ID_KEEP_BINDLOW; + switch_id_flags |= SWITCH_ID_WARN_IF_NO_CAPS; + } + if (options->KeepBindCapabilities == -1 && have_low_ports) { + switch_id_flags |= SWITCH_ID_KEEP_BINDLOW; + } + if (switch_id(options->User, switch_id_flags) != 0) { + /* No need to roll back, since you can't change the value. */ + *msg_out = tor_strdup("Problem with User value. See logs for details."); + return -1; + } + } + + return 0; +} + +/** + * Create our DataDirectory, CacheDirectory, and KeyDirectory, and + * set their permissions correctly. + */ +static int +options_create_directories(char **msg_out) +{ + const or_options_t *options = get_options(); + const bool running_tor = options->command == CMD_RUN_TOR; + + /* Ensure data directory is private; create if possible. */ + /* It's okay to do this in "options_act_reversible()" even though it isn't + * actually reversible, since you can't change the DataDirectory while + * Tor is running. */ + if (check_and_create_data_directory(running_tor /* create */, + options->DataDirectory, + options->DataDirectoryGroupReadable, + options->User, + msg_out) < 0) { + return -1; + } + if (check_and_create_data_directory(running_tor /* create */, + options->KeyDirectory, + options->KeyDirectoryGroupReadable, + options->User, + msg_out) < 0) { + return -1; + } + + /* We need to handle the group-readable flag for the cache directory + * specially, since the directory defaults to being the same as the + * DataDirectory. */ + int cache_dir_group_readable; + if (options->CacheDirectoryGroupReadable != -1) { + /* If the user specified a value, use their setting */ + cache_dir_group_readable = options->CacheDirectoryGroupReadable; + } else if (!strcmp(options->CacheDirectory, options->DataDirectory)) { + /* If the user left the value as "auto", and the cache is the same as the + * datadirectory, use the datadirectory setting. + */ + cache_dir_group_readable = options->DataDirectoryGroupReadable; + } else { + /* Otherwise, "auto" means "not group readable". */ + cache_dir_group_readable = 0; + } + if (check_and_create_data_directory(running_tor /* create */, + options->CacheDirectory, + cache_dir_group_readable, + options->User, + msg_out) < 0) { + return -1; + } + + return 0; +} + /** Fetch the active option list, and take actions based on it. All of the * things we do should survive being done repeatedly. If present, * old_options contains the previous value of the options. * + * This function is only truly "reversible" _after_ the first time it + * is run. The first time that it runs, it performs some irreversible + * tasks in the correct sequence between the reversible option changes. + * + * Option changes should only be marked as "reversible" if they cannot + * be validated before switching them, but they can be switched back if + * some other validateion fails. + * * Return 0 if all goes well, return -1 if things went badly. */ MOCK_IMPL(STATIC int, options_act_reversible,(const or_options_t *old_options, char **msg)) { + const bool first_time = ! have_set_startup_options; smartlist_t *new_listeners = smartlist_new(); or_options_t *options = get_options_mutable(); int running_tor = options->command == CMD_RUN_TOR; @@ -1561,66 +1655,14 @@ options_act_reversible,(const or_options_t *old_options, char **msg)) } #endif /* defined(HAVE_NET_IF_H) && defined(HAVE_NET_PFVAR_H) */ - /* Setuid/setgid as appropriate */ - if (options->User) { - tor_assert(have_low_ports != -1); - unsigned switch_id_flags = 0; - if (options->KeepBindCapabilities == 1) { - switch_id_flags |= SWITCH_ID_KEEP_BINDLOW; - switch_id_flags |= SWITCH_ID_WARN_IF_NO_CAPS; - } - if (options->KeepBindCapabilities == -1 && have_low_ports) { - switch_id_flags |= SWITCH_ID_KEEP_BINDLOW; - } - if (switch_id(options->User, switch_id_flags) != 0) { - /* No need to roll back, since you can't change the value. */ - *msg = tor_strdup("Problem with User value. See logs for details."); + if (first_time) { + if (options_switch_id(msg) < 0) goto done; - } - } - /* Ensure data directory is private; create if possible. */ - /* It's okay to do this in "options_act_reversible()" even though it isn't - * actually reversible, since you can't change the DataDirectory while - * Tor is running. */ - if (check_and_create_data_directory(running_tor /* create */, - options->DataDirectory, - options->DataDirectoryGroupReadable, - options->User, - msg) < 0) { - goto done; - } - if (check_and_create_data_directory(running_tor /* create */, - options->KeyDirectory, - options->KeyDirectoryGroupReadable, - options->User, - msg) < 0) { - goto done; + if (options_create_directories(msg) < 0) + goto done; } - /* We need to handle the group-readable flag for the cache directory - * specially, since the directory defaults to being the same as the - * DataDirectory. */ - int cache_dir_group_readable; - if (options->CacheDirectoryGroupReadable != -1) { - /* If the user specified a value, use their setting */ - cache_dir_group_readable = options->CacheDirectoryGroupReadable; - } else if (!strcmp(options->CacheDirectory, options->DataDirectory)) { - /* If the user left the value as "auto", and the cache is the same as the - * datadirectory, use the datadirectory setting. - */ - cache_dir_group_readable = options->DataDirectoryGroupReadable; - } else { - /* Otherwise, "auto" means "not group readable". */ - cache_dir_group_readable = 0; - } - if (check_and_create_data_directory(running_tor /* create */, - options->CacheDirectory, - cache_dir_group_readable, - options->User, - msg) < 0) { - goto done; - } /* Bail out at this point if we're not going to be a client or server: * we don't run Tor itself. */

1 0

[tor/master] Typo fix in warning message about ControlSocket
by nickm＠torproject.org 21 Nov '19

21 Nov '19

commit cd8c96ce02735db83c241c26e06b9bab50a0dae4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 11 16:31:50 2019 -0500 Typo fix in warning message about ControlSocket --- src/app/config/config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/app/config/config.c b/src/app/config/config.c index ab4094658..edab684d7 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -3400,7 +3400,7 @@ options_validate_cb(const void *old_options_, void *options_, char **msg) } #else /* defined(HAVE_SYS_UN_H) */ if (options->ControlSocketsGroupWritable && !options->ControlSocket) { - *msg = tor_strdup("Setting ControlSocketGroupWritable without setting" + *msg = tor_strdup("Setting ControlSocketGroupWritable without setting " "a ControlSocket makes no sense."); return -1; }

1 0

[tor/master] parseconf test: ControlSocketsGroupWriteable without ControlSocket.
by nickm＠torproject.org 21 Nov '19

21 Nov '19

commit 9951afe177107c9bae5b1731bcb01c59c68e5ebc Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 11 16:32:25 2019 -0500 parseconf test: ControlSocketsGroupWriteable without ControlSocket. --- src/test/conf_examples/controlsock/error | 1 + src/test/conf_examples/controlsock/torrc | 1 + 2 files changed, 2 insertions(+) diff --git a/src/test/conf_examples/controlsock/error b/src/test/conf_examples/controlsock/error new file mode 100644 index 000000000..8fbea3789 --- /dev/null +++ b/src/test/conf_examples/controlsock/error @@ -0,0 +1 @@ +not supported on this OS\|without setting a ControlSocket diff --git a/src/test/conf_examples/controlsock/torrc b/src/test/conf_examples/controlsock/torrc new file mode 100644 index 000000000..dd3cb7ede --- /dev/null +++ b/src/test/conf_examples/controlsock/torrc @@ -0,0 +1 @@ +ControlSocketsGroupWritable 1

1 0

[translation/snowflakeaddon-messages.json_completed] https://gitweb.torproject.org/translation.git/commit/?h=snowflakeaddon-messages.json_completed
by translation＠torproject.org 21 Nov '19

21 Nov '19

commit 0dd6a8181db3ac6ec3873ecdca3ced8b55b2258f Author: Translation commit bot <translation(a)torproject.org> Date: Thu Nov 21 12:47:00 2019 +0000 https://gitweb.torproject.org/translation.git/commit/?h=snowflakeaddon-mess… --- nl/messages.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nl/messages.json b/nl/messages.json index 7b4f11d4e..1dedab06e 100644 --- a/nl/messages.json +++ b/nl/messages.json @@ -48,10 +48,10 @@ "message": "If your internet access is not censored, you should consider installing the Snowflake extension to help users in censored networks. There is no need to worry about which websites people are accessing through your proxy. Their visible browsing IP address will match their Tor exit node, not yours." }, "installFirefox": { - "message": "Install in Firefox" + "message": "Installeren in Firefox" }, "installChrome": { - "message": "Install in Chrome" + "message": "Installeren in Chrome" }, "reportingBugs": { "message": "Reporting Bugs"

1 0

[translation/snowflakeaddon-messages.json] https://gitweb.torproject.org/translation.git/commit/?h=snowflakeaddon-messages.json
by translation＠torproject.org 21 Nov '19

21 Nov '19

commit f906fa6e16af23800f9d9d92670e1b83a52d933b Author: Translation commit bot <translation(a)torproject.org> Date: Thu Nov 21 12:16:53 2019 +0000 https://gitweb.torproject.org/translation.git/commit/?h=snowflakeaddon-mess… --- ar/messages.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ar/messages.json b/ar/messages.json index 2288362cc..42a4af8a6 100644 --- a/ar/messages.json +++ b/ar/messages.json @@ -27,7 +27,7 @@ "message": "عدد المستخدمين فى آخر 24 ساعة الذين ساعدهم Snowflake الخاص بك على تخطى الرقابة: $1" }, "badgeCookiesOff": { - "message": "Cookies are not enabled." + "message": "ملفات تعريف الارتباط (كوكيز) غير مفعلة." }, "websiteIntro": { "message": "Snowflake is a system to defeat internet censorship. People who are censored can use Snowflake to access the internet. Their connection goes through Snowflake proxies, which are run by volunteers. For more detailed information about how Snowflake works see our <a href=\"https://trac.torproject.org/projects/tor/wiki/doc/Snowflake/\" data-msgid=\"__MSG_docWiki__\">documentation wiki</a>."

1 0

[translation/policies-code_of_conducttxtpot_completed] https://gitweb.torproject.org/translation.git/commit/?h=policies-code_of_conducttxtpot_completed
by translation＠torproject.org 21 Nov '19

21 Nov '19

commit 9cc7d60e47ee7aea1c56208ac3092b8d2661edbf Author: Translation commit bot <translation(a)torproject.org> Date: Thu Nov 21 12:16:48 2019 +0000 https://gitweb.torproject.org/translation.git/commit/?h=policies-code_of_co… --- code_of_conduct+pt_BR.po | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/code_of_conduct+pt_BR.po b/code_of_conduct+pt_BR.po index aed27e8af..682c50c21 100644 --- a/code_of_conduct+pt_BR.po +++ b/code_of_conduct+pt_BR.po @@ -8,8 +8,8 @@ # Hildeberto Abreu Magalhães <hildeberto(a)gmail.com>, 2019 # Eduardo Addad de Oliveira <eduardoaddad(a)hotmail.com>, 2019 # Irio Musskopf, 2019 -# Communia <ameaneantie(a)riseup.net>, 2019 # Cy Belle <cyb3ll3(a)protonmail.com>, 2019 +# Communia <ameaneantie(a)riseup.net>, 2019 # #, fuzzy msgid "" @@ -17,7 +17,7 @@ msgstr "" "Project-Id-Version: Code of conduct of the Tor Project\n" "POT-Creation-Date: 2019-08-02 12:00+0000\n" "PO-Revision-Date: 2019-08-27 18:54+0000\n" -"Last-Translator: Cy Belle <cyb3ll3(a)protonmail.com>, 2019\n" +"Last-Translator: Communia <ameaneantie(a)riseup.net>, 2019\n" "Language-Team: Portuguese (Brazil) (https://www.transifex.com/otf/teams/1519/pt_BR/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -70,6 +70,11 @@ msgid "" " Project, Inc. (TPI) are also subject to company policies and procedures. " "Those people should feel free to contact HR with questions or concerns." msgstr "" +"Este código de conduta se aplica ao Projeto Tor como um todo. Destina-se a " +"fornecer orientações aos contribuidores. Os funcionários e outras pessoas " +"sob contrato com The Tor Project, Inc. (TPI) também estão sujeitos às " +"políticas e procedimentos da casa. Todas essas pessoas devem se sentir " +"livres para entrar em contato com o RH com perguntas ou preocupações." #. type: Plain text #: ../code_of_conduct.txt:23

1 0