November 2021 - tor-commits - lists.torproject.org

[tor/release-0.4.5] Merge branch 'maint-0.4.5' into release-0.4.5
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit 6470aed5ae6f171649ed0eac3411c5cf9f12e132 Merge: b4237f8288 882fd1f0d4 Author: Alexander Færøy <ahf(a)torproject.org> Date: Mon Nov 8 14:16:19 2021 +0000 Merge branch 'maint-0.4.5' into release-0.4.5 changes/bug40429 | 5 +++++ changes/ticket40511 | 6 ++++++ configure.ac | 14 +++++++++++++- 3 files changed, 24 insertions(+), 1 deletion(-)

1 0

[tor/release-0.4.5] Merge branch 'maint-0.3.5' into maint-0.4.5
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit 882fd1f0d45656e0535e70b5e115281b39ac6307 Merge: a7fe37f1fa 4a24673436 Author: Alexander Færøy <ahf(a)torproject.org> Date: Mon Nov 8 14:16:18 2021 +0000 Merge branch 'maint-0.3.5' into maint-0.4.5 changes/bug40429 | 5 +++++ changes/ticket40511 | 6 ++++++ configure.ac | 14 +++++++++++++- 3 files changed, 24 insertions(+), 1 deletion(-)

1 0

[tor/main] Prefer use of __MINGW_PRINTF/SCANF_FORMAT if available.
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit c93114ec9e45f4fb3843012056046eec15b875aa Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 5 12:08:48 2021 -0400 Prefer use of __MINGW_PRINTF/SCANF_FORMAT if available. Mingw headers sometimes like to define alternative scanf/printf format attributes depending on whether they're using clang, UCRT, MINGW_ANSI_STDIO, or the microsoft version of printf/scanf. This change attempts to use the right one on the given platform. This is an attempt to fix part of #40355. --- changes/bug40355_part2 | 4 ++++ configure.ac | 4 +++- src/feature/api/tor_api.c | 4 +++- src/lib/cc/compat_compiler.h | 31 +++++++++++++++++++++++++------ src/lib/string/printf.c | 4 ++-- 5 files changed, 37 insertions(+), 10 deletions(-) diff --git a/changes/bug40355_part2 b/changes/bug40355_part2 new file mode 100644 index 0000000000..000321d912 --- /dev/null +++ b/changes/bug40355_part2 @@ -0,0 +1,4 @@ + o Minor features (portability): + - Try to prevent a compiler warning about printf arguments that could + sometimes occur on MSYS2 depending on the configuration. + Closes ticket 40355. \ No newline at end of file diff --git a/configure.ac b/configure.ac index 366df64609..0d95b19796 100644 --- a/configure.ac +++ b/configure.ac @@ -689,6 +689,7 @@ AC_CHECK_FUNCS( readpassphrase \ rint \ sigaction \ + snprintf \ socketpair \ statvfs \ strncasecmp \ @@ -706,7 +707,8 @@ AC_CHECK_FUNCS( uname \ usleep \ vasprintf \ - _vscprintf + _vscprintf \ + vsnprintf ) # Apple messed up when they added some functions: they diff --git a/src/feature/api/tor_api.c b/src/feature/api/tor_api.c index 051be50b3a..88e91ebfd5 100644 --- a/src/feature/api/tor_api.c +++ b/src/feature/api/tor_api.c @@ -18,9 +18,9 @@ // Include this after the above headers, to insure that they don't // depend on anything else. #include "orconfig.h" +#include "lib/cc/compat_compiler.h" #include "lib/cc/torint.h" #include "feature/api/tor_api_internal.h" -#include "lib/cc/compat_compiler.h" #include <stdio.h> #include <stdlib.h> @@ -39,7 +39,9 @@ #include "lib/net/socketpair.h" #define raw_socketpair tor_ersatz_socketpair #define raw_closesocket closesocket +#if !defined(HAVE_SNPRINTF) #define snprintf _snprintf +#endif #else /* !defined(_WIN32) */ #define raw_socketpair socketpair #define raw_closesocket close diff --git a/src/lib/cc/compat_compiler.h b/src/lib/cc/compat_compiler.h index 50bfedffba..991b33d9e7 100644 --- a/src/lib/cc/compat_compiler.h +++ b/src/lib/cc/compat_compiler.h @@ -15,6 +15,15 @@ #include "orconfig.h" #include <inttypes.h> +#if defined(__MINGW32__) || defined(__MINGW64__) +#define MINGW_ANY +#endif + +#ifdef MINGW_ANY +/* We need this for __MINGW_PRINTF_FORMAT, alas. */ +#include <stdio.h> +#endif + #if defined(__has_feature) # if __has_feature(address_sanitizer) /* Some of the fancy glibc strcmp() macros include references to memory that @@ -36,16 +45,30 @@ #error "It seems that you encode characters in something other than ASCII." #endif +/* Use the right magic attribute on mingw, which might be printf, gnu_printf, + * or ms_printf, depending on how we're set up to build. + */ +#ifdef __MINGW_PRINTF_FORMAT +#define PRINTF_FORMAT_ATTR __MINGW_PRINTF_FORMAT +#else +#define PRINTF_FORMAT_ATTR printf +#endif +#ifdef __MINGW_SCANF_FORMAT +#define SCANF_FORMAT_ATTR __MINGW_SCANF_FORMAT +#else +#define SCANF_FORMAT_ATTR scanf +#endif + /* GCC can check printf and scanf types on arbitrary functions. */ #ifdef __GNUC__ #define CHECK_PRINTF(formatIdx, firstArg) \ - __attribute__ ((format(printf, formatIdx, firstArg))) + __attribute__ ((format(PRINTF_FORMAT_ATTR, formatIdx, firstArg))) #else #define CHECK_PRINTF(formatIdx, firstArg) #endif /* defined(__GNUC__) */ #ifdef __GNUC__ #define CHECK_SCANF(formatIdx, firstArg) \ - __attribute__ ((format(scanf, formatIdx, firstArg))) + __attribute__ ((format(SCANF_FORMAT_ATTR, formatIdx, firstArg))) #else #define CHECK_SCANF(formatIdx, firstArg) #endif /* defined(__GNUC__) */ @@ -191,10 +214,6 @@ #define OP_EQ == #define OP_NE != -#if defined(__MINGW32__) || defined(__MINGW64__) -#define MINGW_ANY -#endif - /** Macro: yield a pointer to the field at position <b>off</b> within the * structure <b>st</b>. Example: * <pre> diff --git a/src/lib/string/printf.c b/src/lib/string/printf.c index 62758093a7..bd35b76d1b 100644 --- a/src/lib/string/printf.c +++ b/src/lib/string/printf.c @@ -8,9 +8,9 @@ * \brief Compatibility wrappers around snprintf and its friends **/ +#include "lib/cc/torint.h" #include "lib/string/printf.h" #include "lib/err/torerr.h" -#include "lib/cc/torint.h" #include "lib/malloc/malloc.h" #include <stdlib.h> @@ -45,7 +45,7 @@ tor_vsnprintf(char *str, size_t size, const char *format, va_list args) return -1; /* no place for the NUL */ if (size > SIZE_T_CEILING) return -1; -#ifdef _WIN32 +#if defined(_WIN32) && !defined(HAVE_VSNPRINTF) r = _vsnprintf(str, size, format, args); #else r = vsnprintf(str, size, format, args);

1 0

[tor/main] Merge remote-tracking branch 'tor-gitlab/mr/485' into main
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit d1493f2f277641dc5657f4114e305b5390ef020e Merge: fe52c87652 c93114ec9e Author: Alexander Færøy <ahf(a)torproject.org> Date: Mon Nov 8 14:14:03 2021 +0000 Merge remote-tracking branch 'tor-gitlab/mr/485' into main changes/bug40355_part2 | 4 ++++ configure.ac | 4 +++- src/feature/api/tor_api.c | 4 +++- src/lib/cc/compat_compiler.h | 31 +++++++++++++++++++++++++------ src/lib/string/printf.c | 4 ++-- 5 files changed, 37 insertions(+), 10 deletions(-)

1 0

[tor/main] sandbox: Allow "statx" syscall on i386 for glibc 2.33
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit 001d880d1082f5d124e10554e2718e407c7e88c6 Author: Simon South <simon(a)simonsouth.net> Date: Fri Nov 5 10:10:10 2021 -0400 sandbox: Allow "statx" syscall on i386 for glibc 2.33 glibc versions 2.33 and newer use the modern "statx" system call in their implementations of stat() and opendir() for Linux on i386. Prevent failures in the sandbox unit tests by modifying the sandbox to allow this system call without restriction on i386 when it is available, and update the test suite to skip the "sandbox/stat_filename" test in this case as it is certain to fail. --- src/lib/sandbox/sandbox.c | 3 +++ src/test/test_sandbox.c | 7 ++++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c index fb02a345ab..a15f99ad76 100644 --- a/src/lib/sandbox/sandbox.c +++ b/src/lib/sandbox/sandbox.c @@ -252,6 +252,9 @@ static int filter_nopar_gen[] = { SCMP_SYS(sigreturn), #endif SCMP_SYS(stat), +#if defined(__i386__) && defined(__NR_statx) + SCMP_SYS(statx), +#endif SCMP_SYS(uname), SCMP_SYS(wait4), SCMP_SYS(write), diff --git a/src/test/test_sandbox.c b/src/test/test_sandbox.c index ab3356771f..7ec08a3546 100644 --- a/src/test/test_sandbox.c +++ b/src/test/test_sandbox.c @@ -332,12 +332,13 @@ struct testcase_t sandbox_tests[] = { /* Currently the sandbox is unable to filter stat() calls on systems where * glibc implements this function using either of the legacy "stat" or "stat64" - * system calls, or where glibc version 2.33 or later is in use and the newer - * "newfstatat" syscall is available. + * system calls, or (in glibc version 2.33 and later) either of the newer + * "newfstatat" or "statx" syscalls. * * Skip testing sandbox_cfg_allow_stat_filename() if it seems the likely the * function will have no effect and the test will therefore not succeed. */ -#if !defined(__NR_stat) && !defined(__NR_stat64) && !defined(__NR_newfstatat) +#if !defined(__NR_stat) && !defined(__NR_stat64) && !defined(__NR_newfstatat) \ + && !(defined(__i386__) && defined(__NR_statx)) SANDBOX_TEST_IN_SANDBOX(stat_filename), #else SANDBOX_TEST_SKIPPED(stat_filename),

1 0

[tor/main] changes: Add file for ticket 40505
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit 94d82baeecb31bdbba76403235f66aad8b6b7eb3 Author: Simon South <simon(a)simonsouth.net> Date: Wed Nov 3 13:23:04 2021 -0400 changes: Add file for ticket 40505 --- changes/bug40505 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changes/bug40505 b/changes/bug40505 new file mode 100644 index 0000000000..5aac2218b1 --- /dev/null +++ b/changes/bug40505 @@ -0,0 +1,5 @@ + o Minor bugfixes (sandbox): + - Fix the sandbox on i386 by modifying it to allow the + "clock_gettime64" and "statx" system calls and to filter the + "chown32" and "stat64" system calls in place of "chown" and + "stat", respectively. Fixes bug 40505; bugfix on 0.2.5.4-alpha. \ No newline at end of file

1 0

[tor/main] Merge remote-tracking branch 'tor-gitlab/mr/480' into main
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit fe52c876522b74167f6bd288270d738083461b6b Merge: 32c45a8f94 94d82baeec Author: Alexander Færøy <ahf(a)torproject.org> Date: Mon Nov 8 14:12:22 2021 +0000 Merge remote-tracking branch 'tor-gitlab/mr/480' into main changes/bug40505 | 5 +++++ src/lib/sandbox/sandbox.c | 46 +++++++++++++++++++++++++++++++++++++++++++++- src/test/test_sandbox.c | 9 +++++---- 3 files changed, 55 insertions(+), 5 deletions(-)

1 0

[tor/main] sandbox: Allow "clock_gettime64" syscall where defined
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit f5980e60ed519cb8c5ceded7e04f8e63c842c782 Author: Simon South <simon(a)simonsouth.net> Date: Wed Nov 3 11:53:33 2021 -0400 sandbox: Allow "clock_gettime64" syscall where defined On 32-bit architectures where Linux provides the "clock_gettime64" system call, including i386, glibc uses it in place of "clock_gettime". Modify the sandbox implementation to match, to prevent Tor's monotonic-time functions (in src/lib/time/compat_time.c) failing when the sandbox is active. --- src/lib/sandbox/sandbox.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c index a4e9cb7849..fb02a345ab 100644 --- a/src/lib/sandbox/sandbox.c +++ b/src/lib/sandbox/sandbox.c @@ -152,7 +152,11 @@ static sandbox_cfg_t *filter_dynamic = NULL; static int filter_nopar_gen[] = { SCMP_SYS(access), SCMP_SYS(brk), +#ifdef __NR_clock_gettime64 + SCMP_SYS(clock_gettime64), +#else SCMP_SYS(clock_gettime), +#endif SCMP_SYS(close), SCMP_SYS(clone), SCMP_SYS(dup),

1 0

[tor/main] test: Skip sandbox/stat_filename where "stat64" syscall defined
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit d59f63f1c40771e80638bac447947e51c07e3ad4 Author: Simon South <simon(a)simonsouth.net> Date: Wed Nov 3 12:21:35 2021 -0400 test: Skip sandbox/stat_filename where "stat64" syscall defined On 32-bit architectures where Linux provides the "stat64" system call, including i386, the sandbox is unable to filter calls to stat() as glibc uses this system call itself internally and the sandbox must allow it without restriction. Update the sandbox unit tests to skip the "sandbox/stat_filename" test on systems where the "stat64" system call is defined and the test is certain to fail. Also reorder the "#if" statement's clauses to correspond with the comment preceding it, for clarity. --- src/test/test_sandbox.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/test/test_sandbox.c b/src/test/test_sandbox.c index e5064c58ec..ab3356771f 100644 --- a/src/test/test_sandbox.c +++ b/src/test/test_sandbox.c @@ -331,13 +331,13 @@ struct testcase_t sandbox_tests[] = { SANDBOX_TEST_IN_SANDBOX(rename_filename), /* Currently the sandbox is unable to filter stat() calls on systems where - * glibc implements this function using the legacy "stat" system call, or where - * glibc version 2.33 or later is in use and the newer "newfstatat" syscall is - * available. + * glibc implements this function using either of the legacy "stat" or "stat64" + * system calls, or where glibc version 2.33 or later is in use and the newer + * "newfstatat" syscall is available. * * Skip testing sandbox_cfg_allow_stat_filename() if it seems the likely the * function will have no effect and the test will therefore not succeed. */ -#if !defined(__NR_newfstatat) && (!defined(__NR_stat) || defined(__NR_stat64)) +#if !defined(__NR_stat) && !defined(__NR_stat64) && !defined(__NR_newfstatat) SANDBOX_TEST_IN_SANDBOX(stat_filename), #else SANDBOX_TEST_SKIPPED(stat_filename),

1 0

[tor/main] sandbox: Filter "chown32" syscall on i386
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit 55571fc8d7c63e88075020cfc0a3012e5aa10927 Author: Simon South <simon(a)simonsouth.net> Date: Wed Nov 3 10:48:16 2021 -0400 sandbox: Filter "chown32" syscall on i386 On i386 glibc uses the "chown32" system call instead of "chown". Prevent attempts to filter calls to chown() on this architecture from failing by modifying the sandbox implementation to match. --- src/lib/sandbox/sandbox.c | 39 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c index aed7e3706f..a4e9cb7849 100644 --- a/src/lib/sandbox/sandbox.c +++ b/src/lib/sandbox/sandbox.c @@ -599,6 +599,32 @@ sb_chmod(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return 0; } +#ifdef __i386__ +static int +sb_chown32(scmp_filter_ctx ctx, sandbox_cfg_t *filter) +{ + int rc; + sandbox_cfg_t *elem = NULL; + + // for each dynamic parameter filters + for (elem = filter; elem != NULL; elem = elem->next) { + smp_param_t *param = elem->param; + + if (param != NULL && param->prot == 1 && param->syscall + == SCMP_SYS(chown32)) { + rc = seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(chown32), + SCMP_CMP_STR(0, SCMP_CMP_EQ, param->value)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add chown32 syscall, received " + "libseccomp error %d", rc); + return rc; + } + } + } + + return 0; +} +#else static int sb_chown(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { @@ -623,6 +649,7 @@ sb_chown(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return 0; } +#endif /* defined(__i386__) */ /** * Function responsible for setting up the rename syscall for @@ -1270,7 +1297,11 @@ static sandbox_filter_func_t filter_func[] = { #ifdef __NR_mmap2 sb_mmap2, #endif +#ifdef __i386__ + sb_chown32, +#else sb_chown, +#endif sb_chmod, sb_open, sb_openat, @@ -1544,6 +1575,12 @@ new_element(int syscall, char *value) return new_element2(syscall, value, NULL); } +#ifdef __i386__ +#define SCMP_chown SCMP_SYS(chown32) +#else +#define SCMP_chown SCMP_SYS(chown) +#endif + #ifdef __NR_stat64 #define SCMP_stat SCMP_SYS(stat64) #else @@ -1594,7 +1631,7 @@ sandbox_cfg_allow_chown_filename(sandbox_cfg_t **cfg, char *file) { sandbox_cfg_t *elem = NULL; - elem = new_element(SCMP_SYS(chown), file); + elem = new_element(SCMP_chown, file); elem->next = *cfg; *cfg = elem;

1 0