tor-commits July 2020

tor-commits@lists.torproject.org

17 participants
2100 discussions

[tor/master] Rename get_primary_dir_port()
by dgoulet＠torproject.org 21 Jul '20

21 Jul '20

commit 39146383fc30ee7cce61e3d5d753ae8605dddc22 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 21 12:16:53 2020 -0400 Rename get_primary_dir_port() Also, remove get_primary_or_port() -- nothing used it. --- src/app/config/config.h | 6 ++---- src/feature/relay/router.c | 2 +- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/src/app/config/config.h b/src/app/config/config.h index fdffd66683..ee39490072 100644 --- a/src/app/config/config.h +++ b/src/app/config/config.h @@ -160,10 +160,8 @@ MOCK_DECL(const smartlist_t *,get_configured_ports,(void)); int port_binds_ipv4(const port_cfg_t *port); int port_binds_ipv6(const port_cfg_t *port); int portconf_get_first_advertised_port(int listener_type, - int address_family); -#define get_primary_or_port() \ - (portconf_get_first_advertised_port(CONN_TYPE_OR_LISTENER, AF_INET)) -#define get_primary_dir_port() \ + int address_family); +#define portconf_get_primary_dir_port() \ (portconf_get_first_advertised_port(CONN_TYPE_DIR_LISTENER, AF_INET)) const tor_addr_t *portconf_get_first_advertised_addr(int listener_type, int address_family); diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c index 18d815097f..1ad5cbf5da 100644 --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@ -1572,7 +1572,7 @@ router_can_extend_over_ipv6,(const or_options_t *options)) uint16_t router_get_advertised_dir_port(const or_options_t *options, uint16_t dirport) { - int dirport_configured = get_primary_dir_port(); + int dirport_configured = portconf_get_primary_dir_port(); (void)options; if (!dirport_configured)

1 0

[tor/master] Rename get_first_advertised_{addr, port}_by_type_af().
by dgoulet＠torproject.org 21 Jul '20

21 Jul '20

commit fda9d7f5ed0758957b98d3b16a62bfd785f1917c Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 21 12:02:01 2020 -0400 Rename get_first_advertised_{addr,port}_by_type_af(). Rationale: these don't actually give the first advertised address/port, but instead give us the first such port that we are _configured_ to advertise. Putting them in a portconf_ namespace therefore makes sense. Similarly, there are no other functions that get the first configured advertised addr/port, so the "by_type_af()" part is needless. This is an automated commit, generated by this command: ./scripts/maint/rename_c_identifier.py \ get_first_advertised_addr_by_type_af portconf_get_first_advertised_addr \ get_first_advertised_port_by_type_af portconf_get_first_advertised_port --- src/app/config/config.c | 4 ++-- src/app/config/config.h | 8 ++++---- src/app/config/resolve_addr.h | 2 +- src/feature/relay/router.c | 8 ++++---- src/test/test_config.c | 20 ++++++++++---------- 5 files changed, 21 insertions(+), 21 deletions(-) diff --git a/src/app/config/config.c b/src/app/config/config.c index 9e7d1179ba..269677cbdf 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -6508,7 +6508,7 @@ get_first_listener_addrport_string(int listener_type) * address_family. Returns 0 when no port is found, and when passed * AF_UNSPEC. */ int -get_first_advertised_port_by_type_af(int listener_type, int address_family) +portconf_get_first_advertised_port(int listener_type, int address_family) { if (address_family == AF_UNSPEC) return 0; @@ -6530,7 +6530,7 @@ get_first_advertised_port_by_type_af(int listener_type, int address_family) * address_family. Returns NULL if there is no advertised address, * and when passed AF_UNSPEC. */ const tor_addr_t * -get_first_advertised_addr_by_type_af(int listener_type, int address_family) +portconf_get_first_advertised_addr(int listener_type, int address_family) { if (address_family == AF_UNSPEC) return NULL; diff --git a/src/app/config/config.h b/src/app/config/config.h index f7d4e49f6f..fdffd66683 100644 --- a/src/app/config/config.h +++ b/src/app/config/config.h @@ -159,13 +159,13 @@ int get_num_cpus(const or_options_t *options); MOCK_DECL(const smartlist_t *,get_configured_ports,(void)); int port_binds_ipv4(const port_cfg_t *port); int port_binds_ipv6(const port_cfg_t *port); -int get_first_advertised_port_by_type_af(int listener_type, +int portconf_get_first_advertised_port(int listener_type, int address_family); #define get_primary_or_port() \ - (get_first_advertised_port_by_type_af(CONN_TYPE_OR_LISTENER, AF_INET)) + (portconf_get_first_advertised_port(CONN_TYPE_OR_LISTENER, AF_INET)) #define get_primary_dir_port() \ - (get_first_advertised_port_by_type_af(CONN_TYPE_DIR_LISTENER, AF_INET)) -const tor_addr_t *get_first_advertised_addr_by_type_af(int listener_type, + (portconf_get_first_advertised_port(CONN_TYPE_DIR_LISTENER, AF_INET)) +const tor_addr_t *portconf_get_first_advertised_addr(int listener_type, int address_family); int port_exists_by_type_addr_port(int listener_type, const tor_addr_t *addr, int port, int check_wildcard); diff --git a/src/app/config/resolve_addr.h b/src/app/config/resolve_addr.h index 369f621fa9..c279d19f6e 100644 --- a/src/app/config/resolve_addr.h +++ b/src/app/config/resolve_addr.h @@ -15,7 +15,7 @@ #include "app/config/or_options_st.h" #define get_orport_addr(family) \ - (get_first_advertised_addr_by_type_af(CONN_TYPE_OR_LISTENER, family)) + (portconf_get_first_advertised_addr(CONN_TYPE_OR_LISTENER, family)) bool find_my_address(const or_options_t *options, int family, int warn_severity, tor_addr_t *addr_out, diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c index c2b01a641d..18d815097f 100644 --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@ -1474,7 +1474,7 @@ uint16_t router_get_advertised_or_port_by_af(const or_options_t *options, sa_family_t family) { - int port = get_first_advertised_port_by_type_af(CONN_TYPE_OR_LISTENER, + int port = portconf_get_first_advertised_port(CONN_TYPE_OR_LISTENER, family); (void)options; @@ -1502,7 +1502,7 @@ router_get_advertised_ipv6_or_ap(const or_options_t *options, tor_addr_make_null(&ipv6_ap_out->addr, AF_INET6); ipv6_ap_out->port = 0; - const tor_addr_t *addr = get_first_advertised_addr_by_type_af( + const tor_addr_t *addr = portconf_get_first_advertised_addr( CONN_TYPE_OR_LISTENER, AF_INET6); const uint16_t port = router_get_advertised_or_port_by_af( @@ -1824,11 +1824,11 @@ router_check_descriptor_address_port_consistency(const tor_addr_t *addr, family = tor_addr_family(addr); /* The first advertised Port may be the magic constant CFG_AUTO_PORT. */ - port_cfg = get_first_advertised_port_by_type_af(listener_type, family); + port_cfg = portconf_get_first_advertised_port(listener_type, family); if (port_cfg != 0 && !port_exists_by_type_addr_port(listener_type, addr, port_cfg, 1)) { const tor_addr_t *port_addr = - get_first_advertised_addr_by_type_af(listener_type, family); + portconf_get_first_advertised_addr(listener_type, family); /* If we're building a descriptor with no advertised address, * something is terribly wrong. */ tor_assert(port_addr); diff --git a/src/test/test_config.c b/src/test/test_config.c index 376200827d..e61a62818d 100644 --- a/src/test/test_config.c +++ b/src/test/test_config.c @@ -5181,17 +5181,17 @@ test_config_get_first_advertised(void *data) const tor_addr_t *addr; // no ports are configured? We get NULL. - port = get_first_advertised_port_by_type_af(CONN_TYPE_OR_LISTENER, + port = portconf_get_first_advertised_port(CONN_TYPE_OR_LISTENER, AF_INET); tt_int_op(port, OP_EQ, 0); - addr = get_first_advertised_addr_by_type_af(CONN_TYPE_OR_LISTENER, + addr = portconf_get_first_advertised_addr(CONN_TYPE_OR_LISTENER, AF_INET); tt_ptr_op(addr, OP_EQ, NULL); - port = get_first_advertised_port_by_type_af(CONN_TYPE_OR_LISTENER, + port = portconf_get_first_advertised_port(CONN_TYPE_OR_LISTENER, AF_INET6); tt_int_op(port, OP_EQ, 0); - addr = get_first_advertised_addr_by_type_af(CONN_TYPE_OR_LISTENER, + addr = portconf_get_first_advertised_addr(CONN_TYPE_OR_LISTENER, AF_INET6); tt_ptr_op(addr, OP_EQ, NULL); @@ -5205,27 +5205,27 @@ test_config_get_first_advertised(void *data) tt_assert(r == 0); // UNSPEC gets us nothing. - port = get_first_advertised_port_by_type_af(CONN_TYPE_OR_LISTENER, + port = portconf_get_first_advertised_port(CONN_TYPE_OR_LISTENER, AF_UNSPEC); tt_int_op(port, OP_EQ, 0); - addr = get_first_advertised_addr_by_type_af(CONN_TYPE_OR_LISTENER, + addr = portconf_get_first_advertised_addr(CONN_TYPE_OR_LISTENER, AF_UNSPEC); tt_ptr_op(addr, OP_EQ, NULL); // Try AF_INET. - port = get_first_advertised_port_by_type_af(CONN_TYPE_OR_LISTENER, + port = portconf_get_first_advertised_port(CONN_TYPE_OR_LISTENER, AF_INET); tt_int_op(port, OP_EQ, 9911); - addr = get_first_advertised_addr_by_type_af(CONN_TYPE_OR_LISTENER, + addr = portconf_get_first_advertised_addr(CONN_TYPE_OR_LISTENER, AF_INET); tt_ptr_op(addr, OP_NE, NULL); tt_str_op(fmt_addrport(addr,port), OP_EQ, "5.6.7.8:9911"); // Try AF_INET6 - port = get_first_advertised_port_by_type_af(CONN_TYPE_OR_LISTENER, + port = portconf_get_first_advertised_port(CONN_TYPE_OR_LISTENER, AF_INET6); tt_int_op(port, OP_EQ, 8080); - addr = get_first_advertised_addr_by_type_af(CONN_TYPE_OR_LISTENER, + addr = portconf_get_first_advertised_addr(CONN_TYPE_OR_LISTENER, AF_INET6); tt_ptr_op(addr, OP_NE, NULL); tt_str_op(fmt_addrport(addr,port), OP_EQ, "[1234::5678]:8080");

1 0

[tor/master] Extract shared parts of portcfg_get_first_advertised_*()
by dgoulet＠torproject.org 21 Jul '20

21 Jul '20

commit f57c31e4befebbee60d56693d8bac1b4a4918a97 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 21 12:14:40 2020 -0400 Extract shared parts of portcfg_get_first_advertised_*() --- src/app/config/config.c | 45 +++++++++++++++++++++++---------------------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/src/app/config/config.c b/src/app/config/config.c index 269677cbdf..1671f295e3 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -6504,14 +6504,13 @@ get_first_listener_addrport_string(int listener_type) return NULL; } -/** Return the first advertised port of type listener_type in - * address_family. Returns 0 when no port is found, and when passed - * AF_UNSPEC. */ -int -portconf_get_first_advertised_port(int listener_type, int address_family) +/** Find and return the first configured advertised `port_cfg_t` of type @a + * listener_type in @a address_family. */ +static const port_cfg_t * +portconf_get_first_advertised(int listener_type, int address_family) { if (address_family == AF_UNSPEC) - return 0; + return NULL; const smartlist_t *conf_ports = get_configured_ports(); SMARTLIST_FOREACH_BEGIN(conf_ports, const port_cfg_t *, cfg) { @@ -6519,11 +6518,23 @@ portconf_get_first_advertised_port(int listener_type, int address_family) !cfg->server_cfg.no_advertise) { if ((address_family == AF_INET && port_binds_ipv4(cfg)) || (address_family == AF_INET6 && port_binds_ipv6(cfg))) { - return cfg->port; + return cfg; } } } SMARTLIST_FOREACH_END(cfg); - return 0; + return NULL; +} + +/** Return the first advertised port of type listener_type in + * address_family. Returns 0 when no port is found, and when passed + * AF_UNSPEC. */ +int +portconf_get_first_advertised_port(int listener_type, int address_family) +{ + const port_cfg_t *cfg; + cfg = portconf_get_first_advertised(listener_type, address_family); + + return cfg ? cfg->port : 0; } /** Return the first advertised address of type listener_type in @@ -6532,20 +6543,10 @@ portconf_get_first_advertised_port(int listener_type, int address_family) const tor_addr_t * portconf_get_first_advertised_addr(int listener_type, int address_family) { - if (address_family == AF_UNSPEC) - return NULL; - if (!configured_ports) - return NULL; - SMARTLIST_FOREACH_BEGIN(configured_ports, const port_cfg_t *, cfg) { - if (cfg->type == listener_type && - !cfg->server_cfg.no_advertise) { - if ((address_family == AF_INET && port_binds_ipv4(cfg)) || - (address_family == AF_INET6 && port_binds_ipv6(cfg))) { - return &cfg->addr; - } - } - } SMARTLIST_FOREACH_END(cfg); - return NULL; + const port_cfg_t *cfg; + cfg = portconf_get_first_advertised(listener_type, address_family); + + return cfg ? &cfg->addr : NULL; } /** Return 1 if a port exists of type listener_type on addr and

1 0

[tor/master] Rename router_get_advertised_*() functions.
by dgoulet＠torproject.org 21 Jul '20

21 Jul '20

commit 088100d698d24d77a02675c23a553d6fe7da9c16 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 21 12:59:03 2020 -0400 Rename router_get_advertised_*() functions. These now (or_port and dir_port) now have "find" names, since they look at the portcfg first, then at the actual ports from the listeners. This is an automated commit, generated by this command: ./scripts/maint/rename_c_identifier.py \ router_get_advertised_or_port routerconf_find_or_port \ router_get_advertised_ipv6_or_ap routerconf_find_ipv6_or_ap \ router_has_advertised_ipv6_orport routerconf_has_ipv6_orport \ router_get_advertised_dir_port routerconf_find_dir_port --- src/core/mainloop/connection.c | 12 ++++++------ src/feature/dirauth/dirvote.c | 4 ++-- src/feature/relay/router.c | 34 +++++++++++++++++----------------- src/feature/relay/router.h | 8 ++++---- src/test/test_router.c | 34 +++++++++++++++++----------------- 5 files changed, 46 insertions(+), 46 deletions(-) diff --git a/src/core/mainloop/connection.c b/src/core/mainloop/connection.c index 0fc5e6a88b..efde9df7ed 100644 --- a/src/core/mainloop/connection.c +++ b/src/core/mainloop/connection.c @@ -3168,10 +3168,10 @@ retry_all_listeners(smartlist_t *new_conns, int close_all_noncontrol) smartlist_t *replacements = smartlist_new(); const or_options_t *options = get_options(); int retval = 0; - const uint16_t old_or_port = router_get_advertised_or_port(options, AF_INET); + const uint16_t old_or_port = routerconf_find_or_port(options, AF_INET); const uint16_t old_or_port_ipv6 = - router_get_advertised_or_port(options,AF_INET6); - const uint16_t old_dir_port = router_get_advertised_dir_port(options, 0); + routerconf_find_or_port(options,AF_INET6); + const uint16_t old_dir_port = routerconf_find_dir_port(options, 0); SMARTLIST_FOREACH_BEGIN(get_connection_array(), connection_t *, conn) { if (connection_is_listener(conn) && !conn->marked_for_close) @@ -3241,9 +3241,9 @@ retry_all_listeners(smartlist_t *new_conns, int close_all_noncontrol) SMARTLIST_FOREACH(replacements, listener_replacement_t *, r, tor_free(r)); smartlist_free(replacements); - if (old_or_port != router_get_advertised_or_port(options, AF_INET) || - old_or_port_ipv6 != router_get_advertised_or_port(options, AF_INET6) || - old_dir_port != router_get_advertised_dir_port(options, 0)) { + if (old_or_port != routerconf_find_or_port(options, AF_INET) || + old_or_port_ipv6 != routerconf_find_or_port(options, AF_INET6) || + old_dir_port != routerconf_find_dir_port(options, 0)) { /* Our chosen ORPort or DirPort is not what it used to be: the * descriptor we had (if any) should be regenerated. (We won't * automatically notice this because of changes in the option, diff --git a/src/feature/dirauth/dirvote.c b/src/feature/dirauth/dirvote.c index b0583a42f7..c3ab6fae15 100644 --- a/src/feature/dirauth/dirvote.c +++ b/src/feature/dirauth/dirvote.c @@ -4724,8 +4724,8 @@ dirserv_generate_networkstatus_vote_obj(crypto_pk_t *private_key, voter->sigs = smartlist_new(); voter->address = hostname; tor_addr_copy(&voter->ipv4_addr, &addr); - voter->ipv4_dirport = router_get_advertised_dir_port(options, 0); - voter->ipv4_orport = router_get_advertised_or_port(options, AF_INET); + voter->ipv4_dirport = routerconf_find_dir_port(options, 0); + voter->ipv4_orport = routerconf_find_or_port(options, AF_INET); voter->contact = tor_strdup(contact); if (options->V3AuthUseLegacyKey) { authority_cert_t *c = get_my_v3_legacy_cert(); diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c index 0f85db44d5..997be643dc 100644 --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@ -1151,10 +1151,10 @@ init_keys(void) ds = router_get_trusteddirserver_by_digest(digest); if (!ds) { tor_addr_port_t ipv6_orport; - router_get_advertised_ipv6_or_ap(options, &ipv6_orport); + routerconf_find_ipv6_or_ap(options, &ipv6_orport); ds = trusted_dir_server_new(options->Nickname, NULL, - router_get_advertised_dir_port(options, 0), - router_get_advertised_or_port(options,AF_INET), + routerconf_find_dir_port(options, 0), + routerconf_find_or_port(options,AF_INET), &ipv6_orport, digest, v3_digest, @@ -1306,10 +1306,10 @@ decide_to_advertise_dir_impl(const or_options_t *options, return 1; if (net_is_disabled()) return 0; - if (dir_port && !router_get_advertised_dir_port(options, dir_port)) + if (dir_port && !routerconf_find_dir_port(options, dir_port)) return 0; if (supports_tunnelled_dir_requests && - !router_get_advertised_or_port(options, AF_INET)) + !routerconf_find_or_port(options, AF_INET)) return 0; /* Part two: consider config options that could make us choose to @@ -1390,7 +1390,7 @@ decide_if_publishable_server(void) return 0; if (authdir_mode(options)) return 1; - if (!router_get_advertised_or_port(options, AF_INET)) + if (!routerconf_find_or_port(options, AF_INET)) return 0; if (!router_orport_seems_reachable(options, AF_INET)) { // We have an ipv4 orport, and it doesn't seem reachable. @@ -1463,7 +1463,7 @@ router_get_active_listener_port_by_type_af(int listener_type, * family; this is either the one configured in the ORPort option, or the one * we actually bound to if ORPort is "auto". Returns 0 if no port is found. */ uint16_t -router_get_advertised_or_port(const or_options_t *options, +routerconf_find_or_port(const or_options_t *options, sa_family_t family) { int port = portconf_get_first_advertised_port(CONN_TYPE_OR_LISTENER, @@ -1479,11 +1479,11 @@ router_get_advertised_or_port(const or_options_t *options, return port; } -/** As router_get_advertised_or_port(), but returns the IPv6 address and +/** As routerconf_find_or_port(), but returns the IPv6 address and * port in ipv6_ap_out, which must not be NULL. Returns a null address and * zero port, if no ORPort is found. */ void -router_get_advertised_ipv6_or_ap(const or_options_t *options, +routerconf_find_ipv6_or_ap(const or_options_t *options, tor_addr_port_t *ipv6_ap_out) { /* Bug in calling function, we can't return a sensible result, and it @@ -1497,7 +1497,7 @@ router_get_advertised_ipv6_or_ap(const or_options_t *options, const tor_addr_t *addr = portconf_get_first_advertised_addr( CONN_TYPE_OR_LISTENER, AF_INET6); - const uint16_t port = router_get_advertised_or_port(options, + const uint16_t port = routerconf_find_or_port(options, AF_INET6); if (!addr || port == 0) { @@ -1524,10 +1524,10 @@ router_get_advertised_ipv6_or_ap(const or_options_t *options, /** Returns true if this router has an advertised IPv6 ORPort. */ bool -router_has_advertised_ipv6_orport(const or_options_t *options) +routerconf_has_ipv6_orport(const or_options_t *options) { tor_addr_port_t ipv6_ap; - router_get_advertised_ipv6_or_ap(options, &ipv6_ap); + routerconf_find_ipv6_or_ap(options, &ipv6_ap); return tor_addr_port_is_valid_ap(&ipv6_ap, 0); } @@ -1552,7 +1552,7 @@ router_can_extend_over_ipv6,(const or_options_t *options)) { /* We might add some extra checks here, such as ExtendAllowIPv6Addresses * from ticket 33818. */ - return router_has_advertised_ipv6_orport(options); + return routerconf_has_ipv6_orport(options); } /** Return the port that we should advertise as our DirPort; @@ -1561,7 +1561,7 @@ router_can_extend_over_ipv6,(const or_options_t *options)) * the one configured in the DirPort option, * or the one we actually bound to if DirPort is "auto". */ uint16_t -router_get_advertised_dir_port(const or_options_t *options, uint16_t dirport) +routerconf_find_dir_port(const or_options_t *options, uint16_t dirport) { int dirport_configured = portconf_get_primary_dir_port(); (void)options; @@ -2056,13 +2056,13 @@ router_build_fresh_unsigned_routerinfo,(routerinfo_t **ri_out)) /* IPv4. */ tor_addr_copy(&ri->ipv4_addr, &ipv4_addr); - ri->ipv4_orport = router_get_advertised_or_port(options, AF_INET); - ri->ipv4_dirport = router_get_advertised_dir_port(options, 0); + ri->ipv4_orport = routerconf_find_or_port(options, AF_INET); + ri->ipv4_dirport = routerconf_find_dir_port(options, 0); /* IPv6. Do not publish an IPv6 if we don't have an ORPort that can be used * with the address. This is possible for instance if the ORPort is * IPv4Only. */ - ipv6_orport = router_get_advertised_or_port(options, AF_INET6); + ipv6_orport = routerconf_find_or_port(options, AF_INET6); if (have_v6 && ipv6_orport != 0) { tor_addr_copy(&ri->ipv6_addr, &ipv6_addr); ri->ipv6_orport = ipv6_orport; diff --git a/src/feature/relay/router.h b/src/feature/relay/router.h index e53f1dd3e2..c4e9af039f 100644 --- a/src/feature/relay/router.h +++ b/src/feature/relay/router.h @@ -65,13 +65,13 @@ int init_keys_client(void); uint16_t router_get_active_listener_port_by_type_af(int listener_type, sa_family_t family); -void router_get_advertised_ipv6_or_ap(const or_options_t *options, +void routerconf_find_ipv6_or_ap(const or_options_t *options, tor_addr_port_t *ipv6_ap_out); -bool router_has_advertised_ipv6_orport(const or_options_t *options); +bool routerconf_has_ipv6_orport(const or_options_t *options); MOCK_DECL(bool, router_can_extend_over_ipv6,(const or_options_t *options)); -uint16_t router_get_advertised_or_port(const or_options_t *options, +uint16_t routerconf_find_or_port(const or_options_t *options, sa_family_t family); -uint16_t router_get_advertised_dir_port(const or_options_t *options, +uint16_t routerconf_find_dir_port(const or_options_t *options, uint16_t dirport); int router_should_advertise_dirport(const or_options_t *options, diff --git a/src/test/test_router.c b/src/test/test_router.c index d87f9f8acf..ddd043b941 100644 --- a/src/test/test_router.c +++ b/src/test/test_router.c @@ -507,12 +507,12 @@ test_router_get_advertised_or_port(void *arg) listener_connection_t *listener = NULL; tor_addr_port_t ipv6; - // Test one failing case of router_get_advertised_ipv6_or_ap(). - router_get_advertised_ipv6_or_ap(opts, &ipv6); + // Test one failing case of routerconf_find_ipv6_or_ap(). + routerconf_find_ipv6_or_ap(opts, &ipv6); tt_str_op(fmt_addrport(&ipv6.addr, ipv6.port), OP_EQ, "[::]:0"); - // And one failing case of router_get_advertised_or_port(). - tt_int_op(0, OP_EQ, router_get_advertised_or_port(opts, AF_INET)); + // And one failing case of routerconf_find_or_port(). + tt_int_op(0, OP_EQ, routerconf_find_or_port(opts, AF_INET)); // Set up a couple of configured ports. config_line_append(&opts->ORPort_lines, "ORPort", "[1234::5678]:auto"); @@ -521,12 +521,12 @@ test_router_get_advertised_or_port(void *arg) tt_assert(r == 0); // There are no listeners, so the "auto" case will turn up no results. - tt_int_op(0, OP_EQ, router_get_advertised_or_port(opts, AF_INET6)); - router_get_advertised_ipv6_or_ap(opts, &ipv6); + tt_int_op(0, OP_EQ, routerconf_find_or_port(opts, AF_INET6)); + routerconf_find_ipv6_or_ap(opts, &ipv6); tt_str_op(fmt_addrport(&ipv6.addr, ipv6.port), OP_EQ, "[::]:0"); // This will return the matching value from the configured port. - tt_int_op(9999, OP_EQ, router_get_advertised_or_port(opts, AF_INET)); + tt_int_op(9999, OP_EQ, routerconf_find_or_port(opts, AF_INET)); // Now set up a dummy listener. MOCK(get_connection_array, mock_get_connection_array); @@ -536,15 +536,15 @@ test_router_get_advertised_or_port(void *arg) smartlist_add(fake_connection_array, TO_CONN(listener)); // We should get a port this time. - tt_int_op(54321, OP_EQ, router_get_advertised_or_port(opts, AF_INET6)); + tt_int_op(54321, OP_EQ, routerconf_find_or_port(opts, AF_INET6)); - // Test one succeeding case of router_get_advertised_ipv6_or_ap(). - router_get_advertised_ipv6_or_ap(opts, &ipv6); + // Test one succeeding case of routerconf_find_ipv6_or_ap(). + routerconf_find_ipv6_or_ap(opts, &ipv6); tt_str_op(fmt_addrport(&ipv6.addr, ipv6.port), OP_EQ, "[1234::5678]:54321"); // This will return the matching value from the configured port. - tt_int_op(9999, OP_EQ, router_get_advertised_or_port(opts, AF_INET)); + tt_int_op(9999, OP_EQ, routerconf_find_or_port(opts, AF_INET)); done: or_options_free(opts); @@ -570,26 +570,26 @@ test_router_get_advertised_or_port_localhost(void *arg) tt_assert(r == 0); // We should refuse to advertise them, since we have default dirauths. - router_get_advertised_ipv6_or_ap(opts, &ipv6); + routerconf_find_ipv6_or_ap(opts, &ipv6); tt_str_op(fmt_addrport(&ipv6.addr, ipv6.port), OP_EQ, "[::]:0"); // But the lower-level function should still report the correct value - tt_int_op(9999, OP_EQ, router_get_advertised_or_port(opts, AF_INET6)); + tt_int_op(9999, OP_EQ, routerconf_find_or_port(opts, AF_INET6)); // The IPv4 checks are done in resolve_my_address(), which doesn't use // ORPorts so we can't test them here. (See #33681.) Both these lower-level // functions should still report the correct value. - tt_int_op(8888, OP_EQ, router_get_advertised_or_port(opts, AF_INET)); + tt_int_op(8888, OP_EQ, routerconf_find_or_port(opts, AF_INET)); // Now try with a fake authority set up. config_line_append(&opts->DirAuthorities, "DirAuthority", "127.0.0.1:1066 " "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); - tt_int_op(9999, OP_EQ, router_get_advertised_or_port(opts, AF_INET6)); - router_get_advertised_ipv6_or_ap(opts, &ipv6); + tt_int_op(9999, OP_EQ, routerconf_find_or_port(opts, AF_INET6)); + routerconf_find_ipv6_or_ap(opts, &ipv6); tt_str_op(fmt_addrport(&ipv6.addr, ipv6.port), OP_EQ, "[::1]:9999"); - tt_int_op(8888, OP_EQ, router_get_advertised_or_port(opts, AF_INET)); + tt_int_op(8888, OP_EQ, routerconf_find_or_port(opts, AF_INET)); done: or_options_free(opts);

1 0

[tor/master] Combine router_get_advertised_or_port{, by_af_}() functions
by dgoulet＠torproject.org 21 Jul '20

21 Jul '20

commit f478080bd08033473dfedcf0f51f0be767b985f5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 21 12:34:56 2020 -0400 Combine router_get_advertised_or_port{,by_af_}() functions --- src/core/mainloop/connection.c | 9 ++++----- src/feature/dirauth/dirvote.c | 2 +- src/feature/relay/router.c | 31 +++++++++++-------------------- src/feature/relay/router.h | 5 ++--- src/test/test_router.c | 23 +++++++++-------------- 5 files changed, 27 insertions(+), 43 deletions(-) diff --git a/src/core/mainloop/connection.c b/src/core/mainloop/connection.c index b3c5e6f51c..0fc5e6a88b 100644 --- a/src/core/mainloop/connection.c +++ b/src/core/mainloop/connection.c @@ -3168,9 +3168,9 @@ retry_all_listeners(smartlist_t *new_conns, int close_all_noncontrol) smartlist_t *replacements = smartlist_new(); const or_options_t *options = get_options(); int retval = 0; - const uint16_t old_or_port = router_get_advertised_or_port(options); + const uint16_t old_or_port = router_get_advertised_or_port(options, AF_INET); const uint16_t old_or_port_ipv6 = - router_get_advertised_or_port_by_af(options,AF_INET6); + router_get_advertised_or_port(options,AF_INET6); const uint16_t old_dir_port = router_get_advertised_dir_port(options, 0); SMARTLIST_FOREACH_BEGIN(get_connection_array(), connection_t *, conn) { @@ -3241,9 +3241,8 @@ retry_all_listeners(smartlist_t *new_conns, int close_all_noncontrol) SMARTLIST_FOREACH(replacements, listener_replacement_t *, r, tor_free(r)); smartlist_free(replacements); - if (old_or_port != router_get_advertised_or_port(options) || - old_or_port_ipv6 != router_get_advertised_or_port_by_af(options, - AF_INET6) || + if (old_or_port != router_get_advertised_or_port(options, AF_INET) || + old_or_port_ipv6 != router_get_advertised_or_port(options, AF_INET6) || old_dir_port != router_get_advertised_dir_port(options, 0)) { /* Our chosen ORPort or DirPort is not what it used to be: the * descriptor we had (if any) should be regenerated. (We won't diff --git a/src/feature/dirauth/dirvote.c b/src/feature/dirauth/dirvote.c index c067c9b85e..b0583a42f7 100644 --- a/src/feature/dirauth/dirvote.c +++ b/src/feature/dirauth/dirvote.c @@ -4725,7 +4725,7 @@ dirserv_generate_networkstatus_vote_obj(crypto_pk_t *private_key, voter->address = hostname; tor_addr_copy(&voter->ipv4_addr, &addr); voter->ipv4_dirport = router_get_advertised_dir_port(options, 0); - voter->ipv4_orport = router_get_advertised_or_port(options); + voter->ipv4_orport = router_get_advertised_or_port(options, AF_INET); voter->contact = tor_strdup(contact); if (options->V3AuthUseLegacyKey) { authority_cert_t *c = get_my_v3_legacy_cert(); diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c index 1ad5cbf5da..0f85db44d5 100644 --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@ -1154,7 +1154,7 @@ init_keys(void) router_get_advertised_ipv6_or_ap(options, &ipv6_orport); ds = trusted_dir_server_new(options->Nickname, NULL, router_get_advertised_dir_port(options, 0), - router_get_advertised_or_port(options), + router_get_advertised_or_port(options,AF_INET), &ipv6_orport, digest, v3_digest, @@ -1309,7 +1309,7 @@ decide_to_advertise_dir_impl(const or_options_t *options, if (dir_port && !router_get_advertised_dir_port(options, dir_port)) return 0; if (supports_tunnelled_dir_requests && - !router_get_advertised_or_port(options)) + !router_get_advertised_or_port(options, AF_INET)) return 0; /* Part two: consider config options that could make us choose to @@ -1390,7 +1390,7 @@ decide_if_publishable_server(void) return 0; if (authdir_mode(options)) return 1; - if (!router_get_advertised_or_port(options)) + if (!router_get_advertised_or_port(options, AF_INET)) return 0; if (!router_orport_seems_reachable(options, AF_INET)) { // We have an ipv4 orport, and it doesn't seem reachable. @@ -1459,20 +1459,12 @@ router_get_active_listener_port_by_type_af(int listener_type, return 0; } -/** Return the port that we should advertise as our ORPort; this is either - * the one configured in the ORPort option, or the one we actually bound to - * if ORPort is "auto". Returns 0 if no port is found. */ +/** Return the port that we should advertise as our ORPort in a given address + * family; this is either the one configured in the ORPort option, or the one + * we actually bound to if ORPort is "auto". Returns 0 if no port is found. */ uint16_t -router_get_advertised_or_port(const or_options_t *options) -{ - return router_get_advertised_or_port_by_af(options, AF_INET); -} - -/** As router_get_advertised_or_port(), but allows an address family argument. - */ -uint16_t -router_get_advertised_or_port_by_af(const or_options_t *options, - sa_family_t family) +router_get_advertised_or_port(const or_options_t *options, + sa_family_t family) { int port = portconf_get_first_advertised_port(CONN_TYPE_OR_LISTENER, family); @@ -1505,8 +1497,7 @@ router_get_advertised_ipv6_or_ap(const or_options_t *options, const tor_addr_t *addr = portconf_get_first_advertised_addr( CONN_TYPE_OR_LISTENER, AF_INET6); - const uint16_t port = router_get_advertised_or_port_by_af( - options, + const uint16_t port = router_get_advertised_or_port(options, AF_INET6); if (!addr || port == 0) { @@ -2065,13 +2056,13 @@ router_build_fresh_unsigned_routerinfo,(routerinfo_t **ri_out)) /* IPv4. */ tor_addr_copy(&ri->ipv4_addr, &ipv4_addr); - ri->ipv4_orport = router_get_advertised_or_port_by_af(options, AF_INET); + ri->ipv4_orport = router_get_advertised_or_port(options, AF_INET); ri->ipv4_dirport = router_get_advertised_dir_port(options, 0); /* IPv6. Do not publish an IPv6 if we don't have an ORPort that can be used * with the address. This is possible for instance if the ORPort is * IPv4Only. */ - ipv6_orport = router_get_advertised_or_port_by_af(options, AF_INET6); + ipv6_orport = router_get_advertised_or_port(options, AF_INET6); if (have_v6 && ipv6_orport != 0) { tor_addr_copy(&ri->ipv6_addr, &ipv6_addr); ri->ipv6_orport = ipv6_orport; diff --git a/src/feature/relay/router.h b/src/feature/relay/router.h index fab109be7c..e53f1dd3e2 100644 --- a/src/feature/relay/router.h +++ b/src/feature/relay/router.h @@ -65,13 +65,12 @@ int init_keys_client(void); uint16_t router_get_active_listener_port_by_type_af(int listener_type, sa_family_t family); -uint16_t router_get_advertised_or_port(const or_options_t *options); void router_get_advertised_ipv6_or_ap(const or_options_t *options, tor_addr_port_t *ipv6_ap_out); bool router_has_advertised_ipv6_orport(const or_options_t *options); MOCK_DECL(bool, router_can_extend_over_ipv6,(const or_options_t *options)); -uint16_t router_get_advertised_or_port_by_af(const or_options_t *options, - sa_family_t family); +uint16_t router_get_advertised_or_port(const or_options_t *options, + sa_family_t family); uint16_t router_get_advertised_dir_port(const or_options_t *options, uint16_t dirport); diff --git a/src/test/test_router.c b/src/test/test_router.c index 6980a62e5e..d87f9f8acf 100644 --- a/src/test/test_router.c +++ b/src/test/test_router.c @@ -512,8 +512,7 @@ test_router_get_advertised_or_port(void *arg) tt_str_op(fmt_addrport(&ipv6.addr, ipv6.port), OP_EQ, "[::]:0"); // And one failing case of router_get_advertised_or_port(). - tt_int_op(0, OP_EQ, router_get_advertised_or_port_by_af(opts, AF_INET)); - tt_int_op(0, OP_EQ, router_get_advertised_or_port(opts)); + tt_int_op(0, OP_EQ, router_get_advertised_or_port(opts, AF_INET)); // Set up a couple of configured ports. config_line_append(&opts->ORPort_lines, "ORPort", "[1234::5678]:auto"); @@ -522,13 +521,12 @@ test_router_get_advertised_or_port(void *arg) tt_assert(r == 0); // There are no listeners, so the "auto" case will turn up no results. - tt_int_op(0, OP_EQ, router_get_advertised_or_port_by_af(opts, AF_INET6)); + tt_int_op(0, OP_EQ, router_get_advertised_or_port(opts, AF_INET6)); router_get_advertised_ipv6_or_ap(opts, &ipv6); tt_str_op(fmt_addrport(&ipv6.addr, ipv6.port), OP_EQ, "[::]:0"); // This will return the matching value from the configured port. - tt_int_op(9999, OP_EQ, router_get_advertised_or_port_by_af(opts, AF_INET)); - tt_int_op(9999, OP_EQ, router_get_advertised_or_port(opts)); + tt_int_op(9999, OP_EQ, router_get_advertised_or_port(opts, AF_INET)); // Now set up a dummy listener. MOCK(get_connection_array, mock_get_connection_array); @@ -538,7 +536,7 @@ test_router_get_advertised_or_port(void *arg) smartlist_add(fake_connection_array, TO_CONN(listener)); // We should get a port this time. - tt_int_op(54321, OP_EQ, router_get_advertised_or_port_by_af(opts, AF_INET6)); + tt_int_op(54321, OP_EQ, router_get_advertised_or_port(opts, AF_INET6)); // Test one succeeding case of router_get_advertised_ipv6_or_ap(). router_get_advertised_ipv6_or_ap(opts, &ipv6); @@ -546,8 +544,7 @@ test_router_get_advertised_or_port(void *arg) "[1234::5678]:54321"); // This will return the matching value from the configured port. - tt_int_op(9999, OP_EQ, router_get_advertised_or_port_by_af(opts, AF_INET)); - tt_int_op(9999, OP_EQ, router_get_advertised_or_port(opts)); + tt_int_op(9999, OP_EQ, router_get_advertised_or_port(opts, AF_INET)); done: or_options_free(opts); @@ -576,25 +573,23 @@ test_router_get_advertised_or_port_localhost(void *arg) router_get_advertised_ipv6_or_ap(opts, &ipv6); tt_str_op(fmt_addrport(&ipv6.addr, ipv6.port), OP_EQ, "[::]:0"); // But the lower-level function should still report the correct value - tt_int_op(9999, OP_EQ, router_get_advertised_or_port_by_af(opts, AF_INET6)); + tt_int_op(9999, OP_EQ, router_get_advertised_or_port(opts, AF_INET6)); // The IPv4 checks are done in resolve_my_address(), which doesn't use // ORPorts so we can't test them here. (See #33681.) Both these lower-level // functions should still report the correct value. - tt_int_op(8888, OP_EQ, router_get_advertised_or_port_by_af(opts, AF_INET)); - tt_int_op(8888, OP_EQ, router_get_advertised_or_port(opts)); + tt_int_op(8888, OP_EQ, router_get_advertised_or_port(opts, AF_INET)); // Now try with a fake authority set up. config_line_append(&opts->DirAuthorities, "DirAuthority", "127.0.0.1:1066 " "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); - tt_int_op(9999, OP_EQ, router_get_advertised_or_port_by_af(opts, AF_INET6)); + tt_int_op(9999, OP_EQ, router_get_advertised_or_port(opts, AF_INET6)); router_get_advertised_ipv6_or_ap(opts, &ipv6); tt_str_op(fmt_addrport(&ipv6.addr, ipv6.port), OP_EQ, "[::1]:9999"); - tt_int_op(8888, OP_EQ, router_get_advertised_or_port_by_af(opts, AF_INET)); - tt_int_op(8888, OP_EQ, router_get_advertised_or_port(opts)); + tt_int_op(8888, OP_EQ, router_get_advertised_or_port(opts, AF_INET)); done: or_options_free(opts);

1 0

[tor/master] Changes file for ticket 40055
by dgoulet＠torproject.org 21 Jul '20

21 Jul '20

commit 354eb0c0102ddc5be301097212a00e27ef40f439 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 21 13:02:38 2020 -0400 Changes file for ticket 40055 --- changes/ticket40055 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changes/ticket40055 b/changes/ticket40055 new file mode 100644 index 0000000000..cf375722a5 --- /dev/null +++ b/changes/ticket40055 @@ -0,0 +1,4 @@ + o Code simplification and refactoring: + - Rename functions about "advertised" ports which are not in fact + guaranteed to return the ports have been advertised. Closes + ticket 40055.

1 0

[tor-browser-build/master] Bug 40026: Fix full .mar creation for esr78
by gk＠torproject.org 21 Jul '20

21 Jul '20

commit 9bbec35a53f80d2408bf680de67cee505a317a1a Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jul 21 06:18:44 2020 +0000 Bug 40026: Fix full .mar creation for esr78 At the same time we remove the MBSDIFF environment variable as it is not needed for full .mar file generation. --- projects/tor-browser/build | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 386ea26..155a7bc 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -262,7 +262,10 @@ cd $distdir [% IF c("var/build_mar") -%] # Create full MAR file and compressed package. [% SET mar_file = 'tor-browser-' _ c("var/mar_osname") _ '-' _ c("var/torbrowser_version") _ '_${PKG_LOCALE}.mar' %] - MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/[% mar_file %] "$TBDIR" + MAR=$MARTOOLS/mar \ + MOZ_PRODUCT_VERSION=[% c("var/torbrowser_version") %] \ + MAR_CHANNEL_ID=torbrowser-torproject-[% c("var/channel") %] \ + $MARTOOLS/make_full_update.sh -q $OUTDIR/[% mar_file %] "$TBDIR" [% END -%] [% IF c("var/linux") %] @@ -377,7 +380,10 @@ cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ [% IF build_mar -%] # Create full MAR file and compressed package for this locale. - MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/[% mar_file %] "[% browserdir %]" + MAR=$MARTOOLS/mar \ + MOZ_PRODUCT_VERSION=[% c("var/torbrowser_version") %] \ + MAR_CHANNEL_ID=torbrowser-torproject-[% c("var/channel") %] \ + $MARTOOLS/make_full_update.sh -q $OUTDIR/[% mar_file %] "[% browserdir %]" [% END -%] [% IF c("var/linux") %]

1 0

[tor/master] When choosing an orport from an extendinfo, pick randomly.
by nickm＠torproject.org 21 Jul '20

21 Jul '20

commit ff68aeb49244d65398b5fabaf87d65da51343006 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jul 17 09:06:35 2020 -0400 When choosing an orport from an extendinfo, pick randomly. (This is not fully general yet: we only pick randomly among _supported_ addresses, and each extendinfo contains at most one IPv4 address and at most one IPv6 address, no matter what the extend cell had.) This change will help dual-stack relays do IPv6 reachability tests, in theory, by having them sometimes do IPv4 connections and sometimes do ipv6 connections. Closes ticket 33220. --- changes/ticket33220 | 5 +++++ src/core/or/extendinfo.c | 33 +++++++++++++++++++++++++++++---- 2 files changed, 34 insertions(+), 4 deletions(-) diff --git a/changes/ticket33220 b/changes/ticket33220 new file mode 100644 index 0000000000..e064dcd1c1 --- /dev/null +++ b/changes/ticket33220 @@ -0,0 +1,5 @@ + o Major features (relay, IPv6): + - When a relay with IPv6 support opens a connection to another + relay, and the extend cell lists both IPv4 and IPv6 addresses, the + first relay now picks randomly which address to use. Closes + ticket 33220. diff --git a/src/core/or/extendinfo.c b/src/core/or/extendinfo.c index bcdb57d5a0..ffc88295cf 100644 --- a/src/core/or/extendinfo.c +++ b/src/core/or/extendinfo.c @@ -19,6 +19,9 @@ #include "core/or/policies.h" #include "feature/nodelist/describe.h" #include "feature/nodelist/nodelist.h" +#include "feature/relay/router.h" +#include "feature/relay/routermode.h" +#include "lib/crypt_ops/crypto_rand.h" #include "core/or/extend_info_st.h" #include "feature/nodelist/node_st.h" @@ -274,16 +277,38 @@ extend_info_get_orport(const extend_info_t *ei, int family) const tor_addr_port_t * extend_info_pick_orport(const extend_info_t *ei) { - // XXXX S55 -- for now, we just pick the first. We'll work on - // XXXX more choices as we move forward. IF_BUG_ONCE(!ei) { return NULL; } + const or_options_t *options = get_options(); + if (!server_mode(options)) { + // If we aren't a server, just pick the first address we built into + // this extendinfo. + return &ei->orports[0]; + } + + const bool ipv6_ok = router_can_extend_over_ipv6(options); + + // Use 'usable' to collect the usable orports, then pick one. + const tor_addr_port_t *usable[EXTEND_INFO_MAX_ADDRS]; + int n_usable = 0; + for (int i = 0; i < EXTEND_INFO_MAX_ADDRS; ++i) { + const tor_addr_port_t *a = &ei->orports[i]; + const int family = tor_addr_family(&a->addr); + if (family == AF_INET || (ipv6_ok && family == AF_INET6)) { + usable[n_usable++] = a; + } + } - if (tor_addr_is_unspec(&ei->orports[0].addr)) { + if (n_usable == 0) { + // Need to bail out early, since nothing will work. return NULL; } - return &ei->orports[0]; + + crypto_fast_rng_t *rng = get_thread_fast_rng(); + const int idx = crypto_fast_rng_get_uint(rng, n_usable); + + return usable[idx]; } /**

1 0

[tor/master] Merge remote-tracking branch 'tor-gitlab/mr/64'
by nickm＠torproject.org 21 Jul '20

21 Jul '20

commit e8497bfaa70ef7ce8c48bc2c5464d6fddb8fcff1 Merge: 7d0e64016e ff68aeb492 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 21 09:33:41 2020 -0400 Merge remote-tracking branch 'tor-gitlab/mr/64' changes/ticket33220 | 5 +++++ src/core/or/extendinfo.c | 33 +++++++++++++++++++++++++++++---- 2 files changed, 34 insertions(+), 4 deletions(-)

1 0

[tor/master] Fix seccomp sandbox rules for openat #27315
by nickm＠torproject.org 21 Jul '20

21 Jul '20

commit c79b4397d3839b77e85ceccc5a948f58c9fe37e6 Author: Daniel Pinto <danielpinto52(a)gmail.com> Date: Wed Jul 1 20:30:04 2020 +0100 Fix seccomp sandbox rules for openat #27315 The need for casting negative syscall arguments depends on the glibc version. This affects the rules for the openat syscall which uses the constant AT_FDCWD that is defined as a negative number. This commit adds logic to only apply the cast when necessary, on glibc versions from 2.27 onwards. --- changes/bug27315 | 6 ++++++ src/lib/sandbox/sandbox.c | 42 ++++++++++++++++++++++++++++++++---------- 2 files changed, 38 insertions(+), 10 deletions(-) diff --git a/changes/bug27315 b/changes/bug27315 new file mode 100644 index 0000000000..8af3ac8559 --- /dev/null +++ b/changes/bug27315 @@ -0,0 +1,6 @@ + o Minor bugfixes (linux seccomp2 sandbox): + - Fix a regression on sandboxing rules for the openat() syscall. + The fix for bug 25440 fixed the problem on systems with glibc >= + 2.27 but broke tor on previous versions of glibc. We now apply + the correct seccomp rule according to the running glibc version. + Patch from Daniel Pinto. Fixes bug 27315; bugfix on 0.3.5.11. diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c index 8f577b0660..76aacb0834 100644 --- a/src/lib/sandbox/sandbox.c +++ b/src/lib/sandbox/sandbox.c @@ -134,6 +134,10 @@ static sandbox_cfg_t *filter_dynamic = NULL; * the high bits of the value might get masked out improperly. */ #define SCMP_CMP_MASKED(a,b,c) \ SCMP_CMP4((a), SCMP_CMP_MASKED_EQ, ~(scmp_datum_t)(b), (c)) +/* For negative constants, the rule to add depends on the glibc version. */ +#define SCMP_CMP_NEG(a,op,b) (libc_negative_constant_needs_cast() ? \ + (SCMP_CMP((a), (op), (unsigned int)(b))) : \ + (SCMP_CMP_STR((a), (op), (b)))) /** Variable used for storing all syscall numbers that will be allowed with the * stage 1 general Tor sandbox. @@ -424,31 +428,49 @@ sb_mmap2(scmp_filter_ctx ctx, sandbox_cfg_t *filter) #endif #endif -/* Return true if we think we're running with a libc that always uses - * openat on linux. */ +/* Return true the libc version is greater or equal than + * major.minor. Returns false otherwise. */ static int -libc_uses_openat_for_everything(void) +is_libc_at_least(int major, int minor) { #ifdef CHECK_LIBC_VERSION const char *version = gnu_get_libc_version(); if (version == NULL) return 0; - int major = -1; - int minor = -1; + int libc_major = -1; + int libc_minor = -1; - tor_sscanf(version, "%d.%d", &major, &minor); - if (major >= 3) + tor_sscanf(version, "%d.%d", &libc_major, &libc_minor); + if (libc_major > major) return 1; - else if (major == 2 && minor >= 26) + else if (libc_major == major && libc_minor >= minor) return 1; else return 0; #else /* !(defined(CHECK_LIBC_VERSION)) */ + (void)major; + (void)minor; return 0; #endif /* defined(CHECK_LIBC_VERSION) */ } +/* Return true if we think we're running with a libc that always uses + * openat on linux. */ +static int +libc_uses_openat_for_everything(void) +{ + return is_libc_at_least(2, 26); +} + +/* Return true if we think we're running with a libc that needs to cast + * negative arguments like AT_FDCWD for seccomp rules. */ +static int +libc_negative_constant_needs_cast(void) +{ + return is_libc_at_least(2, 27); +} + /** Allow a single file to be opened. If use_openat is true, * we're using a libc that remaps all the opens into openats. */ static int @@ -456,7 +478,7 @@ allow_file_open(scmp_filter_ctx ctx, int use_openat, const char *file) { if (use_openat) { return seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), - SCMP_CMP(0, SCMP_CMP_EQ, (unsigned int)AT_FDCWD), + SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD), SCMP_CMP_STR(1, SCMP_CMP_EQ, file)); } else { return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), @@ -592,7 +614,7 @@ sb_openat(scmp_filter_ctx ctx, sandbox_cfg_t *filter) if (param != NULL && param->prot == 1 && param->syscall == SCMP_SYS(openat)) { rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), - SCMP_CMP(0, SCMP_CMP_EQ, AT_FDCWD), + SCMP_CMP_NEG(0, SCMP_CMP_EQ, AT_FDCWD), SCMP_CMP_STR(1, SCMP_CMP_EQ, param->value), SCMP_CMP(2, SCMP_CMP_EQ, O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY| O_CLOEXEC));

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits July 2020