October 2022 - tor-commits - lists.torproject.org

[tor] branch main updated: Enable IP_BIND_ADDRESS_NO_PORT if supported
by gitolite role 31 Oct '22

31 Oct '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a commit to branch main in repository tor. The following commit(s) were added to refs/heads/main by this push: new b65ffa6f06 Enable IP_BIND_ADDRESS_NO_PORT if supported new c733ccda99 Merge branch 'tor-gitlab/mr/579' b65ffa6f06 is described below commit b65ffa6f06b2d7bc313e0780f3d76a8acb499ac9 Author: Alex Xu (Hello71) <alex_y_xu(a)yahoo.ca> AuthorDate: Sat May 21 15:21:25 2022 -0400 Enable IP_BIND_ADDRESS_NO_PORT if supported --- changes/ip_bind_address_no_port | 5 +++++ src/core/mainloop/connection.c | 17 +++++++++++++++++ src/lib/sandbox/sandbox.c | 8 ++++++++ 3 files changed, 30 insertions(+) diff --git a/changes/ip_bind_address_no_port b/changes/ip_bind_address_no_port new file mode 100644 index 0000000000..9c4f712a9e --- /dev/null +++ b/changes/ip_bind_address_no_port @@ -0,0 +1,5 @@ + o Minor features (relays): + - Set the Linux-specific IP_BIND_ADDRESS_NO_PORT option on outgoing + sockets, allowing relays using OutboundBindAddress to make more outgoing + connections than ephemeral ports, as long as they are to separate + destinations. Related to issue 40597; patch by Alex Xu (Hello71). diff --git a/src/core/mainloop/connection.c b/src/core/mainloop/connection.c index 75fc3c8918..82cd19181d 100644 --- a/src/core/mainloop/connection.c +++ b/src/core/mainloop/connection.c @@ -2224,6 +2224,23 @@ connection_connect_sockaddr,(connection_t *conn, tor_socket_strerror(errno)); } +#ifdef IP_BIND_ADDRESS_NO_PORT + static int try_ip_bind_address_no_port = 1; + if (bindaddr && try_ip_bind_address_no_port && + setsockopt(s, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &(int){1}, sizeof(int))) { + if (errno == EINVAL) { + log_notice(LD_NET, "Tor was built with support for " + "IP_BIND_ADDRESS_NO_PORT, but the current kernel " + "doesn't support it. This might cause Tor to run out " + "of ephemeral ports more quickly."); + try_ip_bind_address_no_port = 0; + } else { + log_warn(LD_NET, "Error setting IP_BIND_ADDRESS_NO_PORT on new " + "connection: %s", tor_socket_strerror(errno)); + } + } +#endif + if (bindaddr && bind(s, bindaddr, bindaddr_len) < 0) { *socket_error = tor_socket_errno(s); if (ERRNO_IS_EADDRINUSE(*socket_error)) { diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c index 7c024d7e37..a476e57fbc 100644 --- a/src/lib/sandbox/sandbox.c +++ b/src/lib/sandbox/sandbox.c @@ -1033,6 +1033,14 @@ sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return rc; #endif /* defined(IPV6_V6ONLY) */ +#ifdef IP_BIND_ADDRESS_NO_PORT + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), + SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP), + SCMP_CMP(2, SCMP_CMP_EQ, IP_BIND_ADDRESS_NO_PORT)); + if (rc) + return rc; +#endif + return 0; } -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor] branch release-0.4.7 updated (fb15bf94f2 -> f0e0957080)
by gitolite role 31 Oct '22

31 Oct '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a change to branch release-0.4.7 in repository tor. from fb15bf94f2 Merge branch 'maint-0.4.7' into release-0.4.7 new 619dd35321 sandbox: Add my-consensus-<flavor-name> to sandbox for dirauth new f0e0957080 Merge branch 'maint-0.4.7' into release-0.4.7 The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: changes/ticket40663 | 3 +++ src/app/main/main.c | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 changes/ticket40663 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 1

[tor] branch maint-0.4.7 updated (5db238f3e3 -> 619dd35321)
by gitolite role 31 Oct '22

31 Oct '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a change to branch maint-0.4.7 in repository tor. from 5db238f3e3 thread: Bump max detectable CPU from 16 to 128 new 619dd35321 sandbox: Add my-consensus-<flavor-name> to sandbox for dirauth The 1 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: changes/ticket40663 | 3 +++ src/app/main/main.c | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 changes/ticket40663 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor] branch main updated: sandbox: Add my-consensus-<flavor-name> to sandbox for dirauth
by gitolite role 31 Oct '22

31 Oct '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a commit to branch main in repository tor. The following commit(s) were added to refs/heads/main by this push: new 619dd35321 sandbox: Add my-consensus-<flavor-name> to sandbox for dirauth new 2a838c196d Merge branch 'maint-0.4.7' 619dd35321 is described below commit 619dd35321c13684d5496b660a3404d2d3fe2827 Author: David Goulet <dgoulet(a)torproject.org> AuthorDate: Mon Oct 31 11:37:43 2022 -0400 sandbox: Add my-consensus-<flavor-name> to sandbox for dirauth Fixese #40663 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket40663 | 3 +++ src/app/main/main.c | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/changes/ticket40663 b/changes/ticket40663 new file mode 100644 index 0000000000..3992d8e2b5 --- /dev/null +++ b/changes/ticket40663 @@ -0,0 +1,3 @@ + o Minor bugfixes (authorities, sandbox): + - Allow to write file my-consensus-<flavor-name> to disk when sandbox is + activated. Fixes bug 40663; bugfix on 0.3.5.1-alpha. diff --git a/src/app/main/main.c b/src/app/main/main.c index b73d722963..7fb92c59db 100644 --- a/src/app/main/main.c +++ b/src/app/main/main.c @@ -922,8 +922,11 @@ sandbox_init_filter(void) if (options->BridgeAuthoritativeDir) OPEN_DATADIR_SUFFIX("networkstatus-bridges", ".tmp"); - if (authdir_mode(options)) + if (authdir_mode(options)) { OPEN_DATADIR("approved-routers"); + OPEN_CACHEDIR_SUFFIX("my-consensus-microdesc", ".tmp"); + OPEN_CACHEDIR_SUFFIX("my-consensus-ns", ".tmp"); + } if (options->ServerDNSResolvConfFile) sandbox_cfg_allow_open_filename(&cfg, -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[builders/tor-browser-build] branch main updated: Fixed some ChangeLog.txt typos
by gitolite role 31 Oct '22

31 Oct '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch main in repository builders/tor-browser-build. The following commit(s) were added to refs/heads/main by this push: new 028b5281 Fixed some ChangeLog.txt typos 028b5281 is described below commit 028b5281702c123515452d48b5775fc21c18f0cf Author: Richard Pospesel <richard(a)torproject.org> AuthorDate: Mon Oct 31 19:13:57 2022 +0000 Fixed some ChangeLog.txt typos --- projects/browser/Bundle-Data/Docs/ChangeLog.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/browser/Bundle-Data/Docs/ChangeLog.txt b/projects/browser/Bundle-Data/Docs/ChangeLog.txt index 3642afc9..d91ba1b4 100644 --- a/projects/browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/browser/Bundle-Data/Docs/ChangeLog.txt @@ -38,7 +38,7 @@ Tor Browser 12.0a4 - October 28 2022 * Bug 41344: Authenticated Onion Services do not prompt for auth key in 12.0 alpha series [tor-browser] * Bug 41352: Update or drop the show manual logic in torbutton [tor-browser] * Bug 41369: Consider a different list-order for locales in language menu [tor-browser] - * Bug 41374: [torconnect] Missing a few strings in the DTD [tor-browser] + * Bug 41374: Missing a few torconnect strings in the DTD [tor-browser] * Bug 41377: Hide `Search for more languages...` from Language selector in multi-locale build [tor-browser] * Bug 41385: Bootstrap failure is logged but not raised up to about:torconnect [tor-browser] * Bug 41386: The new tor-launcher has a problem when another Tor is running [tor-browser] @@ -88,7 +88,7 @@ Tor Browser 12.0a4 - October 28 2022 * Bug 40669: Remove HTTPS-Everywhere keyring [tor-browser-build] * Bug 41357: Enable browser toolbox debugging by default for dev builds [tor-browser] * macOS - * Bug 40158: Add support for macOS AArch64 + * Bug 40158: Add support for macOS AArch64 [tor-browser-build] * Bug 40464: go 1.18 fails to build on macOS [tor-browser-build] * Linux * Bug 40659: Error building goservice for linux in nightly build [tor-browser-build] -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor] branch main updated: relay: Skip warnings for single onion services
by gitolite role 31 Oct '22

31 Oct '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a commit to branch main in repository tor. The following commit(s) were added to refs/heads/main by this push: new 7e80ad4787 relay: Skip warnings for single onion services new 3596d193be Merge branch 'tor-gitlab/mr/636' 7e80ad4787 is described below commit 7e80ad47878101136040e568eae8b68a78996732 Author: Jeremy Saklad <jeremy(a)saklad5.com> AuthorDate: Fri Oct 21 08:07:43 2022 -0500 relay: Skip warnings for single onion services Single onion services are not secret, so there is no added risk from using accounting or running a relay in the same instance. Related to #40691 --- changes/ticket40691 | 3 +++ src/feature/relay/relay_config.c | 7 +++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/changes/ticket40691 b/changes/ticket40691 new file mode 100644 index 0000000000..f1c518fc18 --- /dev/null +++ b/changes/ticket40691 @@ -0,0 +1,3 @@ + o Minor features (relay): + - Do not warn about configuration options that may expose a non-anonymous + onion service. Closes ticket 40691. diff --git a/src/feature/relay/relay_config.c b/src/feature/relay/relay_config.c index 85ccfc18a7..aa9d48beac 100644 --- a/src/feature/relay/relay_config.c +++ b/src/feature/relay/relay_config.c @@ -33,6 +33,7 @@ #include "core/or/port_cfg_st.h" #include "feature/hibernate/hibernate.h" +#include "feature/hs/hs_service.h" #include "feature/nodelist/nickname.h" #include "feature/stats/geoip_stats.h" #include "feature/stats/predict_ports.h" @@ -942,7 +943,8 @@ options_validate_relay_accounting(const or_options_t *old_options, if (accounting_parse_options(options, 1)<0) REJECT("Failed to parse accounting options. See logs for details."); - if (options->AccountingMax) { + if (options->AccountingMax && + !hs_service_non_anonymous_mode_enabled(options)) { if (options->RendConfigLines && server_mode(options)) { log_warn(LD_CONFIG, "Using accounting with a hidden service and an " "ORPort is risky: your hidden service(s) and your public " @@ -1118,7 +1120,8 @@ options_validate_relay_mode(const or_options_t *old_options, if (BUG(!msg)) return -1; - if (server_mode(options) && options->RendConfigLines) + if (server_mode(options) && options->RendConfigLines && + !hs_service_non_anonymous_mode_enabled(options)) log_warn(LD_CONFIG, "Tor is currently configured as a relay and a hidden service. " "That's not very secure: you should probably run your hidden service " -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[builders/tor-browser-build] branch main updated: Update migrate_langs in projects/release/update_responses_config.yml
by gitolite role 31 Oct '22

31 Oct '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch main in repository builders/tor-browser-build. The following commit(s) were added to refs/heads/main by this push: new f214e845 Update migrate_langs in projects/release/update_responses_config.yml f214e845 is described below commit f214e8455b2199e8b7fa98c9f3a27f9bacdcc077 Author: Nicolas Vigier <boklm(a)torproject.org> AuthorDate: Mon Oct 31 07:55:37 2022 +0100 Update migrate_langs in projects/release/update_responses_config.yml This reverts the changes from 3a12465d983bb96948486384fd16a91963558f5f to that file. Since we changed in a3f49129c0c697eb7e951c871b8bfa8dd2e1fe27 the default locale to be `ALL`, users of any unkwnown locale should now be redirected to `ALL`, without the need for setting `migrate_langs` for those locales. --- projects/release/update_responses_config.yml | 37 ---------------------------- 1 file changed, 37 deletions(-) diff --git a/projects/release/update_responses_config.yml b/projects/release/update_responses_config.yml index 566bf4d1..0f42a09b 100644 --- a/projects/release/update_responses_config.yml +++ b/projects/release/update_responses_config.yml @@ -39,43 +39,6 @@ versions: migrate_archs: # for example, pt-PT: pt-BR migrate_langs: - ar: ALL - ca: ALL - cs: ALL - da: ALL - de: ALL - el: ALL - en-US: ALL - es-AR: ALL - es-ES: ALL - fa: ALL - fr: ALL - ga-IE: ALL - he: ALL - hu: ALL - id: ALL - is: ALL - it: ALL - ja: ALL - ka: ALL - ko: ALL - lt: ALL - mk: ALL - ms: ALL - my: ALL - nb-NO: ALL - nl: ALL - pl: ALL - pt-BR: ALL - ro: ALL - ru: ALL - sv-SE: ALL - th: ALL - tr: ALL - uk: ALL - vi: ALL - zh-CN: ALL - zh-TW: ALL minSupportedInstructionSet: SSE2 # minSupportedOsVersion on macOS corresponds to the Darwin version ( https://en.wikipedia.org/wiki/Darwin_(operating_system) ) osx64: -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor] branch release-0.4.7 updated (2eb875b4a0 -> fb15bf94f2)
by gitolite role 31 Oct '22

31 Oct '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a change to branch release-0.4.7 in repository tor. from 2eb875b4a0 Merge branch 'maint-0.4.7' into release-0.4.7 new 5db238f3e3 thread: Bump max detectable CPU from 16 to 128 new fb15bf94f2 Merge branch 'maint-0.4.7' into release-0.4.7 The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: changes/ticket40703 | 4 ++++ src/lib/thread/numcpus.c | 6 +++++- src/test/test_util.c | 2 +- 3 files changed, 10 insertions(+), 2 deletions(-) create mode 100644 changes/ticket40703 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 1

[tor] branch maint-0.4.7 updated (f09b913e18 -> 5db238f3e3)
by gitolite role 31 Oct '22

31 Oct '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a change to branch maint-0.4.7 in repository tor. from f09b913e18 Merge branch 'tor-gitlab/mr/645' into maint-0.4.7 new 5db238f3e3 thread: Bump max detectable CPU from 16 to 128 The 1 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: changes/ticket40703 | 4 ++++ src/lib/thread/numcpus.c | 6 +++++- src/test/test_util.c | 2 +- 3 files changed, 10 insertions(+), 2 deletions(-) create mode 100644 changes/ticket40703 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor] branch main updated: thread: Bump max detectable CPU from 16 to 128
by gitolite role 31 Oct '22

31 Oct '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a commit to branch main in repository tor. The following commit(s) were added to refs/heads/main by this push: new 5db238f3e3 thread: Bump max detectable CPU from 16 to 128 new 65a85a9d23 Merge branch 'maint-0.4.7' 5db238f3e3 is described below commit 5db238f3e3df54b11cf376d57d2cd89257b594f8 Author: David Goulet <dgoulet(a)torproject.org> AuthorDate: Fri Oct 28 11:13:46 2022 -0400 thread: Bump max detectable CPU from 16 to 128 Lets take advantage of those beefy machines ;). Closes #40703 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket40703 | 4 ++++ src/lib/thread/numcpus.c | 6 +++++- src/test/test_util.c | 2 +- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/changes/ticket40703 b/changes/ticket40703 new file mode 100644 index 0000000000..f005f8f851 --- /dev/null +++ b/changes/ticket40703 @@ -0,0 +1,4 @@ + o Minor feature (performance): + - Bump the maximum amount of CPU to use from 16 to 128. Note that NumCPUs + torrc option overrides this hardcoded maximum. Fixes bug 40703; bugfix on + 0.3.5.1-alpha. diff --git a/src/lib/thread/numcpus.c b/src/lib/thread/numcpus.c index 2c2589fdfe..e0ddb69931 100644 --- a/src/lib/thread/numcpus.c +++ b/src/lib/thread/numcpus.c @@ -70,7 +70,11 @@ compute_num_cpus_impl(void) #endif /* defined(_WIN32) || ... */ } -#define MAX_DETECTABLE_CPUS 16 +/** This is an arbitrary number but at this point in time, it is not that + * uncommon to see servers up to that amount of CPUs. Most servers will likely + * be around 16 to 32 cores now. Lets take advantage of large machines! The + * "NumCPUs" torrc option overrides this maximum. */ +#define MAX_DETECTABLE_CPUS 128 /** Return how many CPUs we are running with. We assume that nobody is * using hot-swappable CPUs, so we don't recompute this after the first diff --git a/src/test/test_util.c b/src/test/test_util.c index aa38d0fc5d..1dae2c617e 100644 --- a/src/test/test_util.c +++ b/src/test/test_util.c @@ -4987,7 +4987,7 @@ test_util_num_cpus(void *arg) tt_skip(); tt_int_op(num, OP_GE, 1); - tt_int_op(num, OP_LE, 16); + tt_int_op(num, OP_LE, 128); done: ; -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0