- tor-commits - lists.torproject.org

[tor/master] Merge remote-tracking branch 'teor/feature17327-v4'
by nickm＠torproject.org 15 Dec '15

15 Dec '15

commit aa4be914f06baa92857de201a212b9fc9856bdb1 Merge: 125e0c7 60fc2b2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 15 13:19:18 2015 -0500 Merge remote-tracking branch 'teor/feature17327-v4' changes/bug6027 | 4 + changes/feature17327 | 5 ++ doc/tor.1.txt | 9 ++- src/or/config.c | 49 +++++++++-- src/or/config.h | 8 +- src/or/or.h | 2 + src/or/router.c | 1 + src/or/routerlist.c | 27 ++++++- src/or/routerlist.h | 2 + src/test/test_config.c | 175 ++++++++++++++++++++++++++++++++++++++++ src/test/test_dir_handle_get.c | 28 +++---- 11 files changed, 280 insertions(+), 30 deletions(-) diff --cc doc/tor.1.txt index 562fed9,3ef5674..f173a97 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@@ -358,20 -358,10 +358,20 @@@ GENERAL OPTION DataDirectory. If the option is set to 1, make the DataDirectory readable by the default GID. (Default: 0) - [[FallbackDir]] **FallbackDir** __address__:__port__ orport=__port__ id=__fingerprint__ [weight=__num__]:: + [[FallbackDir]] **FallbackDir** __address__:__port__ orport=__port__ id=__fingerprint__ [weight=__num__] [ipv6=__address__:__orport__]:: When we're unable to connect to any directory cache for directory info - (usually because we don't know about any yet) we try a FallbackDir. - By default, the directory authorities are also FallbackDirs. + (usually because we don't know about any yet) we try a directory authority. + Clients also simultaneously try a FallbackDir, to avoid hangs on client + startup if a directory authority is down. Clients retry FallbackDirs more + often than directory authorities, to reduce the load on the directory + authorities. + By default, the directory authorities are also FallbackDirs. Specifying a + FallbackDir replaces Tor's default hard-coded FallbackDirs (if any). + +[[UseDefaultFallbackDirs]] **UseDefaultFallbackDirs** **0**|**1**:: + Use Tor's default hard-coded FallbackDirs (if any). (When a + FallbackDir line is present, it replaces the hard-coded FallbackDirs, + regardless of the value of UseDefaultFallbackDirs.) (Default: 1) [[DirAuthority]] **DirAuthority** [__nickname__] [**flags**] __address__:__port__ __fingerprint__:: Use a nonstandard authoritative directory server at the provided address diff --cc src/test/test_config.c index 1d25f86,580dae4..0137d1c --- a/src/test/test_config.c +++ b/src/test/test_config.c @@@ -3326,8 -3383,12 +3496,13 @@@ test_config_use_multiple_directories(vo { #name, test_config_ ## name, flags, NULL, NULL } struct testcase_t config_tests[] = { + CONFIG_TEST(adding_trusted_dir_server, TT_FORK), + CONFIG_TEST(adding_fallback_dir_server, TT_FORK), + CONFIG_TEST(parsing_trusted_dir_server, 0), + CONFIG_TEST(parsing_fallback_dir_server, 0), + CONFIG_TEST(adding_default_trusted_dir_servers, TT_FORK), CONFIG_TEST(adding_dir_servers, TT_FORK), + CONFIG_TEST(default_dir_servers, TT_FORK), CONFIG_TEST(resolve_my_address, TT_FORK), CONFIG_TEST(addressmap, 0), CONFIG_TEST(parse_bridge_line, 0),

1 0

[tor/master] Add a new ipv6=address:orport flag to DirAuthority and FallbackDir
by nickm＠torproject.org 15 Dec '15

15 Dec '15

commit 85003f4c80b7c980099fedca7dba0c0a90209084 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 22 16:10:40 2013 -0500 Add a new ipv6=address:orport flag to DirAuthority and FallbackDir Resolves # 6027 --- changes/bug6027 | 4 ++++ doc/tor.1.txt | 9 ++++++--- src/or/config.c | 32 +++++++++++++++++++++++++++++++- src/or/or.h | 2 ++ src/or/router.c | 1 + src/or/routerlist.c | 27 ++++++++++++++++++++++++--- src/or/routerlist.h | 2 ++ 7 files changed, 70 insertions(+), 7 deletions(-) diff --git a/changes/bug6027 b/changes/bug6027 new file mode 100644 index 0000000..5233876 --- /dev/null +++ b/changes/bug6027 @@ -0,0 +1,4 @@ + o Minor features: + - Allow users to configure directory authorities and fallback + directory servers with IPv6 addresses and ORPorts. Resolves + ticket 6027. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 041b000..3ef5674 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -358,7 +358,7 @@ GENERAL OPTIONS DataDirectory. If the option is set to 1, make the DataDirectory readable by the default GID. (Default: 0) -[[FallbackDir]] **FallbackDir** __address__:__port__ orport=__port__ id=__fingerprint__ [weight=__num__]:: +[[FallbackDir]] **FallbackDir** __address__:__port__ orport=__port__ id=__fingerprint__ [weight=__num__] [ipv6=__address__:__orport__]:: When we're unable to connect to any directory cache for directory info (usually because we don't know about any yet) we try a FallbackDir. By default, the directory authorities are also FallbackDirs. @@ -374,9 +374,12 @@ GENERAL OPTIONS "bridge" flag is set. If a flag "orport=**port**" is given, Tor will use the given port when opening encrypted tunnels to the dirserver. If a flag "weight=**num**" is given, then the directory server is chosen randomly - with probability proportional to that weight (default 1.0). Lastly, if a + with probability proportional to that weight (default 1.0). If a flag "v3ident=**fp**" is given, the dirserver is a v3 directory authority - whose v3 long-term signing key has the fingerprint **fp**. + + whose v3 long-term signing key has the fingerprint **fp**. Lastly, + if an "ipv6=__address__:__orport__" flag is present, then the directory + authority is listening for IPv6 connections on the indicated IPv6 address + and OR Port. + + If no **DirAuthority** line is given, Tor will use the default directory authorities. NOTE: this option is intended for setting up a private Tor diff --git a/src/or/config.c b/src/or/config.c index 7b42c9f..894bd89 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -5538,6 +5538,7 @@ parse_dir_authority_line(const char *line, dirinfo_type_t required_type, smartlist_t *items = NULL; int r; char *addrport=NULL, *address=NULL, *nickname=NULL, *fingerprint=NULL; + tor_addr_port_t ipv6_addrport, *ipv6_addrport_ptr = NULL; uint16_t dir_port = 0, or_port = 0; char digest[DIGEST_LEN]; char v3_digest[DIGEST_LEN]; @@ -5594,6 +5595,19 @@ parse_dir_authority_line(const char *line, dirinfo_type_t required_type, } else { type |= V3_DIRINFO|EXTRAINFO_DIRINFO|MICRODESC_DIRINFO; } + } else if (!strcasecmpstart(flag, "ipv6=")) { + if (ipv6_addrport_ptr) { + log_warn(LD_CONFIG, "Redundant ipv6 addr/port on DirAuthority line"); + } else { + if (tor_addr_port_parse(LOG_WARN, flag+strlen("ipv6="), + &ipv6_addrport.addr, &ipv6_addrport.port) < 0 + || tor_addr_family(&ipv6_addrport.addr) != AF_INET6) { + log_warn(LD_CONFIG, "Bad ipv6 addr/port %s on DirAuthority line", + escaped(flag)); + goto err; + } + ipv6_addrport_ptr = &ipv6_addrport; + } } else { log_warn(LD_CONFIG, "Unrecognized flag '%s' on DirAuthority line", flag); @@ -5636,6 +5650,7 @@ parse_dir_authority_line(const char *line, dirinfo_type_t required_type, log_debug(LD_DIR, "Trusted %d dirserver at %s:%d (%s)", (int)type, address, (int)dir_port, (char*)smartlist_get(items,0)); if (!(ds = trusted_dir_server_new(nickname, address, dir_port, or_port, + ipv6_addrport_ptr, digest, v3_digest, type, weight))) goto err; dir_server_add(ds); @@ -5673,6 +5688,7 @@ parse_dir_fallback_line(const char *line, int ok; char id[DIGEST_LEN]; char *address=NULL; + tor_addr_port_t ipv6_addrport, *ipv6_addrport_ptr = NULL; double weight=1.0; memset(id, 0, sizeof(id)); @@ -5691,6 +5707,19 @@ parse_dir_fallback_line(const char *line, } else if (!strcmpstart(cp, "id=")) { ok = !base16_decode(id, DIGEST_LEN, cp+strlen("id="), strlen(cp)-strlen("id=")); + } else if (!strcasecmpstart(cp, "ipv6=")) { + if (ipv6_addrport_ptr) { + log_warn(LD_CONFIG, "Redundant ipv6 addr/port on FallbackDir line"); + } else { + if (tor_addr_port_parse(LOG_WARN, cp+strlen("ipv6="), + &ipv6_addrport.addr, &ipv6_addrport.port) < 0 + || tor_addr_family(&ipv6_addrport.addr) != AF_INET6) { + log_warn(LD_CONFIG, "Bad ipv6 addr/port %s on FallbackDir line", + escaped(cp)); + goto end; + } + ipv6_addrport_ptr = &ipv6_addrport; + } } else if (!strcmpstart(cp, "weight=")) { int ok; const char *wstring = cp + strlen("weight="); @@ -5732,7 +5761,8 @@ parse_dir_fallback_line(const char *line, if (!validate_only) { dir_server_t *ds; - ds = fallback_dir_server_new(&addr, dirport, orport, id, weight); + ds = fallback_dir_server_new(&addr, dirport, orport, ipv6_addrport_ptr, + id, weight); if (!ds) { log_warn(LD_CONFIG, "Couldn't create FallbackDir %s", escaped(line)); goto end; diff --git a/src/or/or.h b/src/or/or.h index 945934e..8fd141b 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -5009,9 +5009,11 @@ typedef struct dir_server_t { char *description; char *nickname; char *address; /**< Hostname. */ + tor_addr_t ipv6_addr; /**< IPv6 address if present; AF_UNSPEC if not */ uint32_t addr; /**< IPv4 address. */ uint16_t dir_port; /**< Directory port. */ uint16_t or_port; /**< OR port: Used for tunneling connections. */ + uint16_t ipv6_orport; /**< OR port corresponding to ipv6_addr. */ double weight; /** Weight used when selecting this node at random */ char digest[DIGEST_LEN]; /**< Digest of identity key. */ char v3_identity_digest[DIGEST_LEN]; /**< Digest of v3 (authority only, diff --git a/src/or/router.c b/src/or/router.c index bed9dc5..49e2e31 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -1026,6 +1026,7 @@ init_keys(void) ds = trusted_dir_server_new(options->Nickname, NULL, router_get_advertised_dir_port(options, 0), router_get_advertised_or_port(options), + NULL, digest, v3_digest, type, 0.0); diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 5e79064..8bded42 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -4043,6 +4043,7 @@ dir_server_new(int is_authority, const tor_addr_t *addr, const char *hostname, uint16_t dir_port, uint16_t or_port, + const tor_addr_port_t *addrport_ipv6, const char *digest, const char *v3_auth_digest, dirinfo_type_t type, double weight) @@ -4059,7 +4060,7 @@ dir_server_new(int is_authority, if (tor_addr_family(addr) == AF_INET) a = tor_addr_to_ipv4h(addr); else - return NULL; /*XXXX Support IPv6 */ + return NULL; if (!hostname) hostname_ = tor_dup_addr(addr); @@ -4076,6 +4077,18 @@ dir_server_new(int is_authority, ent->is_authority = is_authority; ent->type = type; ent->weight = weight; + if (addrport_ipv6) { + if (tor_addr_family(&addrport_ipv6->addr) != AF_INET6) { + log_warn(LD_BUG, "Hey, I got a non-ipv6 addr as addrport_ipv6."); + tor_addr_make_unspec(&ent->ipv6_addr); + } else { + tor_addr_copy(&ent->ipv6_addr, &addrport_ipv6->addr); + ent->ipv6_orport = addrport_ipv6->port; + } + } else { + tor_addr_make_unspec(&ent->ipv6_addr); + } + memcpy(ent->digest, digest, DIGEST_LEN); if (v3_auth_digest && (type & V3_DIRINFO)) memcpy(ent->v3_identity_digest, v3_auth_digest, DIGEST_LEN); @@ -4088,6 +4101,7 @@ dir_server_new(int is_authority, hostname, (int)dir_port); ent->fake_status.addr = ent->addr; + tor_addr_copy(&ent->fake_status.ipv6_addr, &ent->ipv6_addr); memcpy(ent->fake_status.identity_digest, digest, DIGEST_LEN); if (nickname) strlcpy(ent->fake_status.nickname, nickname, @@ -4096,6 +4110,7 @@ dir_server_new(int is_authority, ent->fake_status.nickname[0] = '\0'; ent->fake_status.dir_port = ent->dir_port; ent->fake_status.or_port = ent->or_port; + ent->fake_status.ipv6_orport = ent->ipv6_orport; return ent; } @@ -4107,6 +4122,7 @@ dir_server_new(int is_authority, dir_server_t * trusted_dir_server_new(const char *nickname, const char *address, uint16_t dir_port, uint16_t or_port, + const tor_addr_port_t *ipv6_addrport, const char *digest, const char *v3_auth_digest, dirinfo_type_t type, double weight) { @@ -4137,7 +4153,9 @@ trusted_dir_server_new(const char *nickname, const char *address, tor_addr_from_ipv4h(&addr, a); result = dir_server_new(1, nickname, &addr, hostname, - dir_port, or_port, digest, + dir_port, or_port, + ipv6_addrport, + digest, v3_auth_digest, type, weight); tor_free(hostname); return result; @@ -4149,9 +4167,12 @@ trusted_dir_server_new(const char *nickname, const char *address, dir_server_t * fallback_dir_server_new(const tor_addr_t *addr, uint16_t dir_port, uint16_t or_port, + const tor_addr_port_t *addrport_ipv6, const char *id_digest, double weight) { - return dir_server_new(0, NULL, addr, NULL, dir_port, or_port, id_digest, + return dir_server_new(0, NULL, addr, NULL, dir_port, or_port, + addrport_ipv6, + id_digest, NULL, ALL_DIRINFO, weight); } diff --git a/src/or/routerlist.h b/src/or/routerlist.h index 100ab58..3c4c9cd 100644 --- a/src/or/routerlist.h +++ b/src/or/routerlist.h @@ -170,10 +170,12 @@ int router_exit_policy_rejects_all(const routerinfo_t *router); dir_server_t *trusted_dir_server_new(const char *nickname, const char *address, uint16_t dir_port, uint16_t or_port, + const tor_addr_port_t *addrport_ipv6, const char *digest, const char *v3_auth_digest, dirinfo_type_t type, double weight); dir_server_t *fallback_dir_server_new(const tor_addr_t *addr, uint16_t dir_port, uint16_t or_port, + const tor_addr_port_t *addrport_ipv6, const char *id_digest, double weight); void dir_server_add(dir_server_t *ent);

1 0

[tor/master] Authorities on IPv6: minor fixes and unit tests
by nickm＠torproject.org 15 Dec '15

15 Dec '15

commit 1c2366ea43d44b2d6d04303fd6086405d7ca4b6c Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Fri Dec 11 22:14:46 2015 +1100 Authorities on IPv6: minor fixes and unit tests Update the code for IPv6 authorities and fallbacks for function argument changes. Update unit tests affected by the function argument changes in the patch. Add unit tests for authority and fallback: * adding via a function * line parsing * adding default authorities (Adding default fallbacks is unit tested in #15775.) --- changes/feature17327 | 5 ++ src/or/config.c | 13 ++- src/or/config.h | 8 +- src/test/test_config.c | 175 ++++++++++++++++++++++++++++++++++++++++ src/test/test_dir_handle_get.c | 28 +++---- 5 files changed, 205 insertions(+), 24 deletions(-) diff --git a/changes/feature17327 b/changes/feature17327 new file mode 100644 index 0000000..2fab099 --- /dev/null +++ b/changes/feature17327 @@ -0,0 +1,5 @@ + o Minor feature (IPv6): + - Add a flag ipv6=address:orport to the DirAuthority and FallbackDir torrc + options. Add hard-coded ipv6 addresses for directory authorities with + ipv6 lines in their descriptors. + Closes ticket 17327; patch from Nick Mathewson / "teor". diff --git a/src/or/config.c b/src/or/config.c index 894bd89..3092a47 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -560,9 +560,6 @@ static int options_transition_affects_descriptor( static int check_nickname_list(char **lst, const char *name, char **msg); static char *get_bindaddr_from_transport_listen_line(const char *line, const char *transport); -static int parse_dir_authority_line(const char *line, - dirinfo_type_t required_type, - int validate_only); static int parse_ports(or_options_t *options, int validate_only, char **msg_out, int *n_ports_out, int *world_writable_control_socket); @@ -897,7 +894,7 @@ static const char *default_authorities[] = { * but only add them insofar as they share bits with type. * Each authority's bits are restricted to the bits shared with type. * If type is ALL_DIRINFO or NO_DIRINFO (zero), add all authorities. */ -static void +STATIC void add_default_trusted_dir_authorities(dirinfo_type_t type) { int i; @@ -5531,7 +5528,7 @@ get_options_for_server_transport(const char *transport) * (minus whatever bits it's missing) as a valid authority. * Return 0 on success or filtering out by type, * or -1 if the line isn't well-formed or if we can't add it. */ -static int +STATIC int parse_dir_authority_line(const char *line, dirinfo_type_t required_type, int validate_only) { @@ -5600,7 +5597,8 @@ parse_dir_authority_line(const char *line, dirinfo_type_t required_type, log_warn(LD_CONFIG, "Redundant ipv6 addr/port on DirAuthority line"); } else { if (tor_addr_port_parse(LOG_WARN, flag+strlen("ipv6="), - &ipv6_addrport.addr, &ipv6_addrport.port) < 0 + &ipv6_addrport.addr, &ipv6_addrport.port, + -1) < 0 || tor_addr_family(&ipv6_addrport.addr) != AF_INET6) { log_warn(LD_CONFIG, "Bad ipv6 addr/port %s on DirAuthority line", escaped(flag)); @@ -5712,7 +5710,8 @@ parse_dir_fallback_line(const char *line, log_warn(LD_CONFIG, "Redundant ipv6 addr/port on FallbackDir line"); } else { if (tor_addr_port_parse(LOG_WARN, cp+strlen("ipv6="), - &ipv6_addrport.addr, &ipv6_addrport.port) < 0 + &ipv6_addrport.addr, &ipv6_addrport.port, + -1) < 0 || tor_addr_family(&ipv6_addrport.addr) != AF_INET6) { log_warn(LD_CONFIG, "Bad ipv6 addr/port %s on FallbackDir line", escaped(cp)); diff --git a/src/or/config.h b/src/or/config.h index 7e88688..bfdd169 100644 --- a/src/or/config.h +++ b/src/or/config.h @@ -152,10 +152,12 @@ STATIC int parse_transport_line(const or_options_t *options, int server); STATIC int consider_adding_dir_servers(const or_options_t *options, const or_options_t *old_options); +STATIC void add_default_trusted_dir_authorities(dirinfo_type_t type); MOCK_DECL(STATIC void, add_default_fallback_dir_servers, (void)); -STATIC int -parse_dir_fallback_line(const char *line, - int validate_only); +STATIC int parse_dir_authority_line(const char *line, + dirinfo_type_t required_type, + int validate_only); +STATIC int parse_dir_fallback_line(const char *line, int validate_only); #endif #endif diff --git a/src/test/test_config.c b/src/test/test_config.c index 28e9fa0..580dae4 100644 --- a/src/test/test_config.c +++ b/src/test/test_config.c @@ -1444,6 +1444,176 @@ test_config_resolve_my_address(void *arg) UNMOCK(tor_gethostname); } +static void +test_config_adding_trusted_dir_server(void *arg) +{ + (void)arg; + + const char digest[DIGEST_LEN] = ""; + dir_server_t *ds = NULL; + tor_addr_port_t ipv6; + int rv = -1; + + clear_dir_servers(); + routerlist_free_all(); + + /* create a trusted ds without an IPv6 address and port */ + ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, NULL, digest, + NULL, V3_DIRINFO, 1.0); + tt_assert(ds); + dir_server_add(ds); + tt_assert(get_n_authorities(V3_DIRINFO) == 1); + tt_assert(smartlist_len(router_get_fallback_dir_servers()) == 1); + + /* create a trusted ds with an IPv6 address and port */ + rv = tor_addr_port_parse(LOG_WARN, "[::1]:9061", &ipv6.addr, &ipv6.port, -1); + tt_assert(rv == 0); + ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, &ipv6, digest, + NULL, V3_DIRINFO, 1.0); + tt_assert(ds); + dir_server_add(ds); + tt_assert(get_n_authorities(V3_DIRINFO) == 2); + tt_assert(smartlist_len(router_get_fallback_dir_servers()) == 2); + + done: + clear_dir_servers(); + routerlist_free_all(); +} + +static void +test_config_adding_fallback_dir_server(void *arg) +{ + (void)arg; + + const char digest[DIGEST_LEN] = ""; + dir_server_t *ds = NULL; + tor_addr_t ipv4; + tor_addr_port_t ipv6; + int rv = -1; + + clear_dir_servers(); + routerlist_free_all(); + + rv = tor_addr_parse(&ipv4, "127.0.0.1"); + tt_assert(rv == AF_INET); + + /* create a trusted ds without an IPv6 address and port */ + ds = fallback_dir_server_new(&ipv4, 9059, 9060, NULL, digest, 1.0); + tt_assert(ds); + dir_server_add(ds); + tt_assert(smartlist_len(router_get_fallback_dir_servers()) == 1); + + /* create a trusted ds with an IPv6 address and port */ + rv = tor_addr_port_parse(LOG_WARN, "[::1]:9061", &ipv6.addr, &ipv6.port, -1); + tt_assert(rv == 0); + ds = fallback_dir_server_new(&ipv4, 9059, 9060, &ipv6, digest, 1.0); + tt_assert(ds); + dir_server_add(ds); + tt_assert(smartlist_len(router_get_fallback_dir_servers()) == 2); + + done: + clear_dir_servers(); + routerlist_free_all(); +} + +/* No secrets here: + * v3ident is `echo "onion" | shasum | cut -d" " -f1 | tr "a-f" "A-F"` + * fingerprint is `echo "unionem" | shasum | cut -d" " -f1 | tr "a-f" "A-F"` + * with added spaces + */ +#define TEST_DIR_AUTH_LINE_START \ + "foobar orport=12345 " \ + "v3ident=14C131DFC5C6F93646BE72FA1401C02A8DF2E8B4 " +#define TEST_DIR_AUTH_LINE_END \ + "1.2.3.4:54321 " \ + "FDB2 FBD2 AAA5 25FA 2999 E617 5091 5A32 C777 3B17" +#define TEST_DIR_AUTH_IPV6_FLAG \ + "ipv6=[feed::beef]:9 " + +static void +test_config_parsing_trusted_dir_server(void *arg) +{ + (void)arg; + int rv = -1; + + /* parse a trusted dir server without an IPv6 address and port */ + rv = parse_dir_authority_line(TEST_DIR_AUTH_LINE_START + TEST_DIR_AUTH_LINE_END, + V3_DIRINFO, 1); + tt_assert(rv == 0); + + /* parse a trusted dir server with an IPv6 address and port */ + rv = parse_dir_authority_line(TEST_DIR_AUTH_LINE_START + TEST_DIR_AUTH_IPV6_FLAG + TEST_DIR_AUTH_LINE_END, + V3_DIRINFO, 1); + tt_assert(rv == 0); + + /* Since we are only validating, there is no cleanup. */ + done: + ; +} + +#undef TEST_DIR_AUTH_LINE_START +#undef TEST_DIR_AUTH_LINE_END +#undef TEST_DIR_AUTH_IPV6_FLAG + +/* No secrets here: + * id is `echo "syn-propanethial-S-oxide" | shasum | cut -d" " -f1` + */ +#define TEST_DIR_FALLBACK_LINE \ + "1.2.3.4:54321 orport=12345 " \ + "id=50e643986f31ea1235bcc1af17a1c5c5cfc0ee54 " +#define TEST_DIR_FALLBACK_IPV6_FLAG \ + "ipv6=[2015:c0de::deed]:9" + +static void +test_config_parsing_fallback_dir_server(void *arg) +{ + (void)arg; + int rv = -1; + + /* parse a trusted dir server without an IPv6 address and port */ + rv = parse_dir_fallback_line(TEST_DIR_FALLBACK_LINE, 1); + tt_assert(rv == 0); + + /* parse a trusted dir server with an IPv6 address and port */ + rv = parse_dir_fallback_line(TEST_DIR_FALLBACK_LINE + TEST_DIR_FALLBACK_IPV6_FLAG, + 1); + tt_assert(rv == 0); + + /* Since we are only validating, there is no cleanup. */ + done: + ; +} + +#undef TEST_DIR_FALLBACK_LINE +#undef TEST_DIR_FALLBACK_IPV6_FLAG + +static void +test_config_adding_default_trusted_dir_servers(void *arg) +{ + (void)arg; + + clear_dir_servers(); + routerlist_free_all(); + + /* Assume we only have one bridge authority */ + add_default_trusted_dir_authorities(BRIDGE_DIRINFO); + tt_assert(get_n_authorities(BRIDGE_DIRINFO) == 1); + tt_assert(smartlist_len(router_get_fallback_dir_servers()) == 1); + + /* Assume we have nine V3 authorities */ + add_default_trusted_dir_authorities(V3_DIRINFO); + tt_assert(get_n_authorities(V3_DIRINFO) == 9); + tt_assert(smartlist_len(router_get_fallback_dir_servers()) == 10); + + done: + clear_dir_servers(); + routerlist_free_all(); +} + static int n_add_default_fallback_dir_servers_known_default = 0; /** @@ -3213,6 +3383,11 @@ test_config_adding_dir_servers(void *arg) { #name, test_config_ ## name, flags, NULL, NULL } struct testcase_t config_tests[] = { + CONFIG_TEST(adding_trusted_dir_server, TT_FORK), + CONFIG_TEST(adding_fallback_dir_server, TT_FORK), + CONFIG_TEST(parsing_trusted_dir_server, 0), + CONFIG_TEST(parsing_fallback_dir_server, 0), + CONFIG_TEST(adding_default_trusted_dir_servers, TT_FORK), CONFIG_TEST(adding_dir_servers, TT_FORK), CONFIG_TEST(resolve_my_address, TT_FORK), CONFIG_TEST(addressmap, 0), diff --git a/src/test/test_dir_handle_get.c b/src/test/test_dir_handle_get.c index be003df..e1ac50e 100644 --- a/src/test/test_dir_handle_get.c +++ b/src/test/test_dir_handle_get.c @@ -1242,8 +1242,8 @@ test_dir_handle_get_server_keys_all(void* data) routerlist_free_all(); /* create a trusted ds */ - ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, digest, NULL, - V3_DIRINFO, 1.0); + ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, NULL, digest, + NULL, V3_DIRINFO, 1.0); tt_assert(ds); dir_server_add(ds); @@ -1400,8 +1400,8 @@ test_dir_handle_get_server_keys_fp(void* data) routerlist_free_all(); /* create a trusted ds */ - ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, digest, NULL, - V3_DIRINFO, 1.0); + ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, NULL, digest, + NULL, V3_DIRINFO, 1.0); tt_assert(ds); dir_server_add(ds); @@ -1554,8 +1554,8 @@ test_dir_handle_get_server_keys_fpsk(void* data) routerlist_free_all(); /* create a trusted ds */ - ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, digest, NULL, - V3_DIRINFO, 1.0); + ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, NULL, digest, + NULL, V3_DIRINFO, 1.0); tt_assert(ds); /* ds v3_identity_digest is the certificate's identity_key */ @@ -1610,8 +1610,8 @@ test_dir_handle_get_server_keys_busy(void* data) routerlist_free_all(); /* create a trusted ds */ - ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, digest, NULL, - V3_DIRINFO, 1.0); + ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, NULL, digest, + NULL, V3_DIRINFO, 1.0); tt_assert(ds); /* ds v3_identity_digest is the certificate's identity_key */ @@ -2005,8 +2005,8 @@ test_dir_handle_get_status_vote_d(void* data) dirvote_free_all(); /* create a trusted ds */ - ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, digest, NULL, - V3_DIRINFO, 1.0); + ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, NULL, digest, + NULL, V3_DIRINFO, 1.0); tt_assert(ds); dir_server_add(ds); @@ -2353,8 +2353,8 @@ test_dir_handle_get_status_vote_next_authority(void* data) mock_cert = authority_cert_parse_from_string(TEST_CERTIFICATE, NULL); /* create a trusted ds */ - ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, digest, NULL, - V3_DIRINFO, 1.0); + ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, NULL, digest, + NULL, V3_DIRINFO, 1.0); tt_assert(ds); dir_server_add(ds); @@ -2431,8 +2431,8 @@ test_dir_handle_get_status_vote_current_authority(void* data) mock_cert = authority_cert_parse_from_string(TEST_CERTIFICATE, NULL); /* create a trusted ds */ - ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, digest, NULL, - V3_DIRINFO, 1.0); + ds = trusted_dir_server_new("ds", "127.0.0.1", 9059, 9060, NULL, digest, + NULL, V3_DIRINFO, 1.0); tt_assert(ds); dir_server_add(ds);

1 0

[tor/master] Update KeepCapabilities based on comments from asn
by nickm＠torproject.org 15 Dec '15

15 Dec '15

commit 405a8d3fb4884d5e5c5f32881a1a810b733a5aad Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 26 11:03:35 2015 -0500 Update KeepCapabilities based on comments from asn * The option is now KeepBindCapabilities * We now warn if the user specifically asked for KeepBindCapabilities and we can't deliver. * The unit tests are willing to start. * Fewer unused-variable warnings. * More documentation, fewer misspellings. --- changes/feature8195 | 2 +- doc/tor.1.txt | 4 ++-- src/common/compat.c | 13 ++++++++++++- src/common/compat.h | 5 ++++- src/or/config.c | 25 ++++++++++++++----------- src/or/or.h | 2 +- 6 files changed, 34 insertions(+), 17 deletions(-) diff --git a/changes/feature8195 b/changes/feature8195 index 0c366b5..cb81f2e 100644 --- a/changes/feature8195 +++ b/changes/feature8195 @@ -3,4 +3,4 @@ can now retain the capabilitity to bind to low ports. By default, Tor will do this only when it's switching user ID and some low ports have been configured. You can change this behavior with - the new option KeepCapabilities. Closes ticket 8195. + the new option KeepBindCapabilities. Closes ticket 8195. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index a7bf28b..58313d8 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -601,9 +601,9 @@ GENERAL OPTIONS [[User]] **User** __UID__:: On startup, setuid to this user and setgid to their primary group. -[[KeepCapabilities]] **KeepCapabilities** **0**|**1**|**auto**:: +[[KeepBindCapabilities]] **KeepBindCapabilities** **0**|**1**|**auto**:: On Linux, when we are started as root and we switch our identity using - the **User** option, the **KeepCapabilities** option tells us whether to + the **User** option, the **KeepBindCapabilities** option tells us whether to try to retain our ability to bind to low ports. If this value is 1, we try to keep the capability; if it is 0 we do not; and if it is **auto**, we keep the capability only if we are configured to listen on a low port. diff --git a/src/common/compat.c b/src/common/compat.c index 6551934..217bc00 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -1997,8 +1997,11 @@ drop_capabilities(int pre_setuid) /** Call setuid and setgid to run as user and switch to their * primary group. Return 0 on success. On failure, log and return -1. * - * If SWITCH_ID_KEEP_BINDLOW is set in 'flags', try to use the capabilitity + * If SWITCH_ID_KEEP_BINDLOW is set in 'flags', try to use the capability * system to retain the abilitity to bind low ports. + * + * If SWITCH_ID_WARN_IF_NO_CAPS is set in flags, also warn if we have + * don't have capability support. */ int switch_id(const char *user, const unsigned flags) @@ -2009,6 +2012,7 @@ switch_id(const char *user, const unsigned flags) gid_t old_gid; static int have_already_switched_id = 0; const int keep_bindlow = !!(flags & SWITCH_ID_KEEP_BINDLOW); + const int warn_if_no_caps = !!(flags & SWITCH_ID_WARN_IF_NO_CAPS); tor_assert(user); @@ -2033,10 +2037,17 @@ switch_id(const char *user, const unsigned flags) } #ifdef HAVE_LINUX_CAPABILITIES + (void) warn_if_no_caps; if (keep_bindlow) { if (drop_capabilities(1)) return -1; } +#else + (void) keep_bindlow; + if (warn_if_no_caps) { + log_warn(LD_CONFIG, "KeepBindCapabilities set, but no capability support " + "on this system."); + } #endif /* Properly switch egid,gid,euid,uid here or bail out */ diff --git a/src/common/compat.h b/src/common/compat.h index b245d7d..df95636 100644 --- a/src/common/compat.h +++ b/src/common/compat.h @@ -632,7 +632,10 @@ int tor_disable_debugger_attach(void); int have_capability_support(void); -#define SWITCH_ID_KEEP_BINDLOW 1 +/** Flag for switch_id; see switch_id() for documentation */ +#define SWITCH_ID_KEEP_BINDLOW (1<<0) +/** Flag for switch_id; see switch_id() for documentation */ +#define SWITCH_ID_WARN_IF_NO_CAPS (1<<1) int switch_id(const char *user, unsigned flags); #ifdef HAVE_PWD_H char *get_user_homedir(const char *username); diff --git a/src/or/config.c b/src/or/config.c index 5060b1b..0b95f95 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -308,7 +308,7 @@ static config_var_t option_vars_[] = { V(Socks5ProxyUsername, STRING, NULL), V(Socks5ProxyPassword, STRING, NULL), V(KeepalivePeriod, INTERVAL, "5 minutes"), - V(KeepCapabilities, AUTOBOOL, "auto"), + V(KeepBindCapabilities, AUTOBOOL, "auto"), VAR("Log", LINELIST, Logs, NULL), V(LogMessageDomains, BOOL, "0"), V(LogTimeGranularity, MSEC_INTERVAL, "1 second"), @@ -1183,11 +1183,14 @@ options_act_reversible(const or_options_t *old_options, char **msg) } /* Setuid/setgid as appropriate */ - tor_assert(have_low_ports != -1); if (options->User) { + tor_assert(have_low_ports != -1); unsigned switch_id_flags = 0; - if (options->KeepCapabilities == 1 || - (options->KeepCapabilities == -1 && have_low_ports)) { + if (options->KeepBindCapabilities == 1) { + switch_id_flags |= SWITCH_ID_KEEP_BINDLOW; + switch_id_flags |= SWITCH_ID_WARN_IF_NO_CAPS; + } + if (options->KeepBindCapabilities == -1 && have_low_ports) { switch_id_flags |= SWITCH_ID_KEEP_BINDLOW; } if (switch_id(options->User, switch_id_flags) != 0) { @@ -4008,8 +4011,8 @@ options_transition_allowed(const or_options_t *old, return -1; } - if (old->KeepCapabilities != new_val->KeepCapabilities) { - *msg = tor_strdup("While Tor is running, changing KeepCapabilities is " + if (old->KeepBindCapabilities != new_val->KeepBindCapabilities) { + *msg = tor_strdup("While Tor is running, changing KeepBindCapabilities is " "not allowed."); return -1; } @@ -6612,8 +6615,8 @@ parse_ports(or_options_t *options, int validate_only, } /** Given a list of port_cfg_t in ports, check them for internal - * consistency and warn as appropriate. Set *n_low_port to the number - * of sub-1024 ports we will be binding. */ + * consistency and warn as appropriate. Set *n_low_ports_out to the + * number of sub-1024 ports we will be binding. */ static int check_server_ports(const smartlist_t *ports, const or_options_t *options, @@ -6681,10 +6684,10 @@ check_server_ports(const smartlist_t *ports, } if (n_low_port && options->AccountingMax && - (!have_capability_support() || options->KeepCapabilities == 0)) { + (!have_capability_support() || options->KeepBindCapabilities == 0)) { const char *extra = ""; - if (options->KeepCapabilities == 0 && have_capability_support()) - extra = ", and you have disabled KeepCapabilities."; + if (options->KeepBindCapabilities == 0 && have_capability_support()) + extra = ", and you have disabled KeepBindCapabilities."; log_warn(LD_CONFIG, "You have set AccountingMax to use hibernation. You have also " "chosen a low DirPort or OrPort%s." diff --git a/src/or/or.h b/src/or/or.h index b071303..54c5cb0 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4319,7 +4319,7 @@ typedef struct { char *master_key_fname; /** Autobool: Do we try to retain capabilities if we can? */ - int KeepCapabilities; + int KeepBindCapabilities; } or_options_t; /** Persistent state for an onion router, as saved to disk. */

1 0

[tor/master] Add unit tests for switch_id(), including tests for capabilities
by nickm＠torproject.org 15 Dec '15

15 Dec '15

commit fd0c6671d13333f2ddb41e792b40162c841adae6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 6 15:35:15 2015 -0500 Add unit tests for switch_id(), including tests for capabilities --- .gitignore | 2 + src/test/include.am | 17 ++++- src/test/test_switch_id.c | 181 ++++++++++++++++++++++++++++++++++++++++++++ src/test/test_switch_id.sh | 25 ++++++ 4 files changed, 222 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index c1dff8b..dad8be1 100644 --- a/.gitignore +++ b/.gitignore @@ -172,6 +172,7 @@ cscope.* /src/test/test-child /src/test/test-memwipe /src/test/test-ntor-cl +/src/test/test-switch-id /src/test/test_workqueue /src/test/test.exe /src/test/test-slow.exe @@ -179,6 +180,7 @@ cscope.* /src/test/test-child.exe /src/test/test-ntor-cl.exe /src/test/test-memwipe.exe +/src/test/test-switch-id.exe /src/test/test_workqueue.exe /src/test/test_zero_length_keys.sh /src/test/test_ntor.sh diff --git a/src/test/include.am b/src/test/include.am index d0a819f..3fed3b7 100644 --- a/src/test/include.am +++ b/src/test/include.am @@ -4,14 +4,16 @@ export SHELL=@SHELL@ export abs_top_srcdir=@abs_top_srcdir@ export builddir=@builddir@ -TESTSCRIPTS = src/test/test_zero_length_keys.sh +TESTSCRIPTS = src/test/test_zero_length_keys.sh \ + src/test/test_switch_id.sh if USEPYTHON TESTSCRIPTS += src/test/test_ntor.sh src/test/test_bt.sh endif TESTS += src/test/test src/test/test-slow src/test/test-memwipe \ - src/test/test_workqueue src/test/test_keygen.sh $(TESTSCRIPTS) + src/test/test_workqueue src/test/test_keygen.sh \ + $(TESTSCRIPTS) # These flavors are run using automake's test-driver and test-network.sh TEST_CHUTNEY_FLAVORS = basic-min bridges-min hs-min bridges+hs @@ -33,7 +35,8 @@ noinst_PROGRAMS+= \ src/test/test-slow \ src/test/test-memwipe \ src/test/test-child \ - src/test/test_workqueue + src/test/test_workqueue \ + src/test/test-switch-id endif src_test_AM_CPPFLAGS = -DSHARE_DATADIR="\"$(datadir)\"" \ @@ -131,6 +134,14 @@ src_test_test_workqueue_SOURCES = \ src_test_test_workqueue_CPPFLAGS= $(src_test_AM_CPPFLAGS) src_test_test_workqueue_CFLAGS = $(AM_CFLAGS) $(TEST_CFLAGS) +src_test_test_switch_id_SOURCES = \ + src/test/test_switch_id.c +src_test_test_switch_id_CPPFLAGS= $(src_test_AM_CPPFLAGS) +src_test_test_switch_id_CFLAGS = $(AM_CFLAGS) $(TEST_CFLAGS) +src_test_test_switch_id_LDADD = \ + src/common/libor-testing.a \ + @TOR_ZLIB_LIBS@ @TOR_LIB_MATH@ + src_test_test_LDFLAGS = @TOR_LDFLAGS_zlib@ @TOR_LDFLAGS_openssl@ \ @TOR_LDFLAGS_libevent@ src_test_test_LDADD = src/or/libtor-testing.a src/common/libor-testing.a \ diff --git a/src/test/test_switch_id.c b/src/test/test_switch_id.c new file mode 100644 index 0000000..e85025c --- /dev/null +++ b/src/test/test_switch_id.c @@ -0,0 +1,181 @@ +/* Copyright (c) 2015, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +#include "or.h" + +#ifdef HAVE_SYS_CAPABILITY_H +#include <sys/capability.h> +#endif + +#define TEST_BUILT_WITH_CAPS 0 +#define TEST_HAVE_CAPS 1 +#define TEST_ROOT_CAN_BIND_LOW 2 +#define TEST_SETUID 3 +#define TEST_SETUID_KEEPCAPS 4 +#define TEST_SETUID_STRICT 5 + +static const char *username; + +static const struct { + const char *name; + int test_id; +} which_test[] = { + { "built-with-caps", TEST_BUILT_WITH_CAPS }, + { "have-caps", TEST_HAVE_CAPS }, + { "root-bind-low", TEST_ROOT_CAN_BIND_LOW }, + { "setuid", TEST_SETUID }, + { "setuid-keepcaps", TEST_SETUID_KEEPCAPS }, + { "setuid-strict", TEST_SETUID_STRICT }, + { NULL, 0 } +}; + +/* 0 on no, 1 on yes, -1 on failure. */ +static int +check_can_bind_low_ports(void) +{ + int port; + struct sockaddr_in sin; + memset(&sin, 0, sizeof(sin)); + sin.sin_family = AF_INET; + + for (port = 600; port < 1024; ++port) { + sin.sin_port = htons(port); + tor_socket_t fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); + if (! SOCKET_OK(fd)) { + perror("socket"); + return -1; + } + + int one = 1; + if (setsockopt(fd, SOL_SOCKET,SO_REUSEADDR, &one, sizeof(one))) { + perror("setsockopt"); + tor_close_socket_simple(fd); + return -1; + } + + int res = bind(fd, (struct sockaddr *)&sin, sizeof(sin)); + tor_close_socket_simple(fd); + + if (res == 0) { + /* bind was successful */ + return 1; + } else if (errno == EACCES || errno == EPERM) { + /* Got a permission-denied error. */ + return 0; + } else if (errno == EADDRINUSE) { + /* Huh; somebody is using that port. */ + } else { + perror("bind"); + } + } + + return -1; +} + +int +main(int argc, char **argv) +{ + const char *testname; + if (argc != 3) { + fprintf(stderr, "I want 2 arguments: a username and a command.\n"); + return 1; + } + if (getuid() != 0) { + fprintf(stderr, "This test only works when it's run as root.\n"); + return 1; + } + username = argv[1]; + testname = argv[2]; + int test_id = -1; + int i; + for (i = 0; which_test[i].name; ++i) { + if (!strcmp(which_test[i].name, testname)) { + test_id = which_test[i].test_id; + break; + } + } + if (test_id == -1) { + fprintf(stderr, "Unrecognized test '%s'\n", testname); + return 1; + } + +#ifdef HAVE_LINUX_CAPABILITIES + const int have_cap_support = 1; +#else + const int have_cap_support = 0; +#endif + + int okay; + + init_logging(1); + log_severity_list_t sev; + memset(&sev, 0, sizeof(sev)); + set_log_severity_config(LOG_WARN, LOG_ERR, &sev); + add_stream_log(&sev, "", fileno(stderr)); + + switch (test_id) + { + case TEST_BUILT_WITH_CAPS: + /* Succeed if we were built with capability support. */ + okay = have_cap_support; + break; + case TEST_HAVE_CAPS: + /* Succeed if "capabilities work" == "we were built with capability + * support." */ + okay = have_cap_support == have_capability_support(); + break; + case TEST_ROOT_CAN_BIND_LOW: + /* Succeed if root can bind low ports. */ + okay = check_can_bind_low_ports() == 1; + break; + case TEST_SETUID: + /* Succeed if we can do a setuid with no capability retention, and doing + * so makes us lose the ability to bind low ports */ + case TEST_SETUID_KEEPCAPS: + /* Succeed if we can do a setuid with capability retention, and doing so + * does not make us lose the ability to bind low ports */ + { + int keepcaps = (test_id == TEST_SETUID_KEEPCAPS); + okay = switch_id(username, keepcaps ? SWITCH_ID_KEEP_BINDLOW : 0) == 0; + if (okay) { + okay = check_can_bind_low_ports() == keepcaps; + } + break; + } + case TEST_SETUID_STRICT: + /* Succeed if, after a setuid, we cannot setuid back, and we cannot + * re-grab any capabilities. */ + okay = switch_id(username, SWITCH_ID_KEEP_BINDLOW) == 0; + if (okay) { + /* We'd better not be able to setuid back! */ + if (setuid(0) == 0 || errno != EPERM) { + okay = 0; + } + } +#ifdef HAVE_LINUX_CAPABILITIES + if (okay) { + cap_t caps = cap_get_proc(); + const cap_value_t caplist[] = { + CAP_SETUID, + }; + cap_set_flag(caps, CAP_PERMITTED, 1, caplist, CAP_SET); + if (cap_set_proc(caps) == 0 || errno != EPERM) { + okay = 0; + } + cap_free(caps); + } +#endif + break; + default: + fprintf(stderr, "Unsupported test '%s'\n", testname); + okay = 0; + break; + } + + if (!okay) { + fprintf(stderr, "Test %s failed!\n", testname); + } + + return (okay ? 0 : 1); +} + diff --git a/src/test/test_switch_id.sh b/src/test/test_switch_id.sh new file mode 100755 index 0000000..1b4e099 --- /dev/null +++ b/src/test/test_switch_id.sh @@ -0,0 +1,25 @@ +#!/bin/sh + +if test "`id -u`" != '0'; then + echo "This test only works when run as root. Skipping." >&2 + exit 77 +fi + +if test "`id -u nobody`" = ""; then + echo "This test requires that your system have a 'nobody' user. Sorry." >&2 + exit 1 +fi + +"${builddir:-.}/src/test/test-switch-id" nobody setuid || exit 1 +"${builddir:-.}/src/test/test-switch-id" nobody root-bind-low || exit 1 +"${builddir:-.}/src/test/test-switch-id" nobody setuid-strict || exit 1 +"${builddir:-.}/src/test/test-switch-id" nobody built-with-caps || exit 0 +# ... Go beyond this point only if we were built with capability support. + +"${builddir:-.}/src/test/test-switch-id" nobody have-caps || exit 1 +"${builddir:-.}/src/test/test-switch-id" nobody setuid-keepcaps || exit 1 + + +echo "All okay" + +exit 0

1 0

[tor/master] Add ability to keep the CAP_NET_BIND_SERVICE capability on Linux
by nickm＠torproject.org 15 Dec '15

15 Dec '15

commit e8cc839e41adc4975a61fee62abe7f6664fd0c0e Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 6 13:12:44 2015 -0500 Add ability to keep the CAP_NET_BIND_SERVICE capability on Linux This feature allows us to bind low ports when starting as root and switching UIDs. Based on code by David Goulet. Implement feature 8195 --- changes/feature8195 | 6 ++++ configure.ac | 16 ++++++++- doc/tor.1.txt | 8 +++++ src/common/compat.c | 97 ++++++++++++++++++++++++++++++++++++++++++++++++++- src/common/compat.h | 10 +++++- src/or/config.c | 46 +++++++++++++++++++----- src/or/or.h | 3 ++ 7 files changed, 175 insertions(+), 11 deletions(-) diff --git a/changes/feature8195 b/changes/feature8195 new file mode 100644 index 0000000..0c366b5 --- /dev/null +++ b/changes/feature8195 @@ -0,0 +1,6 @@ + o Major features: + - When Tor is started as root on Linux and told to switch user ID, it + can now retain the capabilitity to bind to low ports. By default, + Tor will do this only when it's switching user ID and some low + ports have been configured. You can change this behavior with + the new option KeepCapabilities. Closes ticket 8195. diff --git a/configure.ac b/configure.ac index 3bf2f47..eb7f2c2 100644 --- a/configure.ac +++ b/configure.ac @@ -698,6 +698,19 @@ else fi AC_SUBST(TOR_ZLIB_LIBS) +dnl ---------------------------------------------------------------------- +dnl Check if libcap is available for capabilities. + +tor_cap_pkg_debian="libcap2" +tor_cap_pkg_redhat="libcap" +tor_cap_devpkg_debian="libcap-dev" +tor_cap_devpkg_redhat="libcap-devel" + +AC_CHECK_LIB([cap], [cap_init], [], + AC_MSG_NOTICE([Libcap was not found. Capabilities will not be usable.]) +) +AC_CHECK_FUNCS(cap_set_proc) + dnl --------------------------------------------------------------------- dnl Now that we know about our major libraries, we can check for compiler dnl and linker hardening options. We need to do this with the libraries known, @@ -705,7 +718,7 @@ dnl since sometimes the linker will like an option but not be willing to dnl use it with a build of a library. all_ldflags_for_check="$TOR_LDFLAGS_zlib $TOR_LDFLAGS_openssl $TOR_LDFLAGS_libevent" -all_libs_for_check="$TOR_ZLIB_LIBS $TOR_LIB_MATH $TOR_LIBEVENT_LIBS $TOR_OPENSSL_LIBS $TOR_SYSTEMD_LIBS $TOR_LIB_WS32 $TOR_LIB_GDI" +all_libs_for_check="$TOR_ZLIB_LIBS $TOR_LIB_MATH $TOR_LIBEVENT_LIBS $TOR_OPENSSL_LIBS $TOR_SYSTEMD_LIBS $TOR_LIB_WS32 $TOR_LIB_GDI $TOR_CAP_LIBS" AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [ #if !defined(__clang__) @@ -898,6 +911,7 @@ AC_CHECK_HEADERS( fcntl.h \ signal.h \ string.h \ + sys/capability.h \ sys/fcntl.h \ sys/stat.h \ sys/time.h \ diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 916433b..a7bf28b 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -601,6 +601,14 @@ GENERAL OPTIONS [[User]] **User** __UID__:: On startup, setuid to this user and setgid to their primary group. +[[KeepCapabilities]] **KeepCapabilities** **0**|**1**|**auto**:: + On Linux, when we are started as root and we switch our identity using + the **User** option, the **KeepCapabilities** option tells us whether to + try to retain our ability to bind to low ports. If this value is 1, we + try to keep the capability; if it is 0 we do not; and if it is **auto**, + we keep the capability only if we are configured to listen on a low port. + (Default: auto.) + [[HardwareAccel]] **HardwareAccel** **0**|**1**:: If non-zero, try to use built-in (static) crypto hardware acceleration when available. (Default: 0) diff --git a/src/common/compat.c b/src/common/compat.c index 7d72b4b..6551934 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -71,6 +71,9 @@ #ifdef HAVE_SYS_STATVFS_H #include <sys/statvfs.h> #endif +#ifdef HAVE_SYS_CAPABILITY_H +#include <sys/capability.h> +#endif #ifdef _WIN32 #include <conio.h> @@ -1917,17 +1920,95 @@ tor_getpwuid(uid_t uid) } #endif +/** Return true iff we were compiled with capability support, and capabilities + * seem to work. **/ +int +have_capability_support(void) +{ +#ifdef HAVE_LINUX_CAPABILITIES + cap_t caps = cap_get_proc(); + if (caps == NULL) + return 0; + cap_free(caps); + return 1; +#else + return 0; +#endif +} + +#ifdef HAVE_LINUX_CAPABILITIES +/** Helper. Drop all capabilities but a small set, and set PR_KEEPCAPS as + * appropriate. + * + * If pre_setuid, retain only CAP_NET_BIND_SERVICE, CAP_SETUID, and + * CAP_SETGID, and use PR_KEEPCAPS to ensure that capabilities persist across + * setuid(). + * + * If not pre_setuid, retain only CAP_NET_BIND_SERVICE, and disable + * PR_KEEPCAPS. + * + * Return 0 on success, and -1 on failure. + */ +static int +drop_capabilities(int pre_setuid) +{ + /* We keep these three capabilities, and these only, as we setuid. + * After we setuid, we drop all but the first. */ + const cap_value_t caplist[] = { + CAP_NET_BIND_SERVICE, CAP_SETUID, CAP_SETGID + }; + const char *where = pre_setuid ? "pre-setuid" : "post-setuid"; + const int n_effective = pre_setuid ? 3 : 1; + const int n_permitted = pre_setuid ? 3 : 1; + const int n_inheritable = 1; + const int keepcaps = pre_setuid ? 1 : 0; + + /* Sets whether we keep capabilities across a setuid. */ + if (prctl(PR_SET_KEEPCAPS, keepcaps) < 0) { + log_warn(LD_CONFIG, "Unable to call prctl() %s: %s", + where, strerror(errno)); + return -1; + } + + cap_t caps = cap_get_proc(); + if (!caps) { + log_warn(LD_CONFIG, "Unable to call cap_get_proc() %s: %s", + where, strerror(errno)); + return -1; + } + cap_clear(caps); + + cap_set_flag(caps, CAP_EFFECTIVE, n_effective, caplist, CAP_SET); + cap_set_flag(caps, CAP_PERMITTED, n_permitted, caplist, CAP_SET); + cap_set_flag(caps, CAP_INHERITABLE, n_inheritable, caplist, CAP_SET); + + int r = cap_set_proc(caps); + cap_free(caps); + if (r < 0) { + log_warn(LD_CONFIG, "No permission to set capabilities %s: %s", + where, strerror(errno)); + return -1; + } + + return 0; +} +#endif + /** Call setuid and setgid to run as user and switch to their * primary group. Return 0 on success. On failure, log and return -1. + * + * If SWITCH_ID_KEEP_BINDLOW is set in 'flags', try to use the capabilitity + * system to retain the abilitity to bind low ports. */ int -switch_id(const char *user) +switch_id(const char *user, const unsigned flags) { #ifndef _WIN32 const struct passwd *pw = NULL; uid_t old_uid; gid_t old_gid; static int have_already_switched_id = 0; + const int keep_bindlow = !!(flags & SWITCH_ID_KEEP_BINDLOW); tor_assert(user); @@ -1951,6 +2032,13 @@ switch_id(const char *user) return -1; } +#ifdef HAVE_LINUX_CAPABILITIES + if (keep_bindlow) { + if (drop_capabilities(1)) + return -1; + } +#endif + /* Properly switch egid,gid,euid,uid here or bail out */ if (setgroups(1, &pw->pw_gid)) { log_warn(LD_GENERAL, "Error setting groups to gid %d: \"%s\".", @@ -2004,6 +2092,12 @@ switch_id(const char *user) /* We've properly switched egid, gid, euid, uid, and supplementary groups if * we're here. */ +#ifdef HAVE_LINUX_CAPABILITIES + if (keep_bindlow) { + if (drop_capabilities(0)) + return -1; + } +#endif #if !defined(CYGWIN) && !defined(__CYGWIN__) /* If we tried to drop privilege to a group/user other than root, attempt to @@ -2051,6 +2145,7 @@ switch_id(const char *user) #else (void)user; + (void)flags; log_warn(LD_CONFIG, "User specified but switching users is unsupported on your OS."); diff --git a/src/common/compat.h b/src/common/compat.h index c7c468c..b245d7d 100644 --- a/src/common/compat.h +++ b/src/common/compat.h @@ -625,7 +625,15 @@ typedef unsigned long rlim_t; int get_max_sockets(void); int set_max_file_descriptors(rlim_t limit, int *max); int tor_disable_debugger_attach(void); -int switch_id(const char *user); + +#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_CAP_SET_PROC) +#define HAVE_LINUX_CAPABILITIES +#endif + +int have_capability_support(void); + +#define SWITCH_ID_KEEP_BINDLOW 1 +int switch_id(const char *user, unsigned flags); #ifdef HAVE_PWD_H char *get_user_homedir(const char *username); #endif diff --git a/src/or/config.c b/src/or/config.c index 22039b4..5060b1b 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -308,6 +308,7 @@ static config_var_t option_vars_[] = { V(Socks5ProxyUsername, STRING, NULL), V(Socks5ProxyPassword, STRING, NULL), V(KeepalivePeriod, INTERVAL, "5 minutes"), + V(KeepCapabilities, AUTOBOOL, "auto"), VAR("Log", LINELIST, Logs, NULL), V(LogMessageDomains, BOOL, "0"), V(LogTimeGranularity, MSEC_INTERVAL, "1 second"), @@ -567,7 +568,8 @@ static int parse_ports(or_options_t *options, int validate_only, char **msg_out, int *n_ports_out, int *world_writable_control_socket); static int check_server_ports(const smartlist_t *ports, - const or_options_t *options); + const or_options_t *options, + int *num_low_ports_out); static int validate_data_directory(or_options_t *options); static int write_configuration_file(const char *fname, @@ -1045,6 +1047,9 @@ consider_adding_dir_servers(const or_options_t *options, return 0; } +/* Helps determine flags to pass to switch_id. */ +static int have_low_ports = -1; + /** Fetch the active option list, and take actions based on it. All of the * things we do should survive being done repeatedly. If present, * old_options contains the previous value of the options. @@ -1178,8 +1183,14 @@ options_act_reversible(const or_options_t *old_options, char **msg) } /* Setuid/setgid as appropriate */ + tor_assert(have_low_ports != -1); if (options->User) { - if (switch_id(options->User) != 0) { + unsigned switch_id_flags = 0; + if (options->KeepCapabilities == 1 || + (options->KeepCapabilities == -1 && have_low_ports)) { + switch_id_flags |= SWITCH_ID_KEEP_BINDLOW; + } + if (switch_id(options->User, switch_id_flags) != 0) { /* No need to roll back, since you can't change the value. */ *msg = tor_strdup("Problem with User value. See logs for details."); goto done; @@ -3997,6 +4008,12 @@ options_transition_allowed(const or_options_t *old, return -1; } + if (old->KeepCapabilities != new_val->KeepCapabilities) { + *msg = tor_strdup("While Tor is running, changing KeepCapabilities is " + "not allowed."); + return -1; + } + if (!opt_streq(old->SyslogIdentityTag, new_val->SyslogIdentityTag)) { *msg = tor_strdup("While Tor is running, changing " "SyslogIdentityTag is not allowed."); @@ -6535,10 +6552,13 @@ parse_ports(or_options_t *options, int validate_only, } } - if (check_server_ports(ports, options) < 0) { + int n_low_ports = 0; + if (check_server_ports(ports, options, &n_low_ports) < 0) { *msg = tor_strdup("Misconfigured server ports"); goto err; } + if (have_low_ports < 0) + have_low_ports = (n_low_ports > 0); *n_ports_out = smartlist_len(ports); @@ -6592,10 +6612,12 @@ parse_ports(or_options_t *options, int validate_only, } /** Given a list of port_cfg_t in ports, check them for internal - * consistency and warn as appropriate. */ + * consistency and warn as appropriate. Set *n_low_port to the number + * of sub-1024 ports we will be binding. */ static int check_server_ports(const smartlist_t *ports, - const or_options_t *options) + const or_options_t *options, + int *n_low_ports_out) { int n_orport_advertised = 0; int n_orport_advertised_ipv4 = 0; @@ -6658,16 +6680,24 @@ check_server_ports(const smartlist_t *ports, r = -1; } - if (n_low_port && options->AccountingMax) { + if (n_low_port && options->AccountingMax && + (!have_capability_support() || options->KeepCapabilities == 0)) { + const char *extra = ""; + if (options->KeepCapabilities == 0 && have_capability_support()) + extra = ", and you have disabled KeepCapabilities."; log_warn(LD_CONFIG, "You have set AccountingMax to use hibernation. You have also " - "chosen a low DirPort or OrPort. This combination can make Tor stop " + "chosen a low DirPort or OrPort%s." + "This combination can make Tor stop " "working when it tries to re-attach the port after a period of " "hibernation. Please choose a different port or turn off " "hibernation unless you know this combination will work on your " - "platform."); + "platform.", extra); } + if (n_low_ports_out) + *n_low_ports_out = n_low_port; + return r; } diff --git a/src/or/or.h b/src/or/or.h index 651d8be..b071303 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4317,6 +4317,9 @@ typedef struct { int keygen_passphrase_fd; int change_key_passphrase; char *master_key_fname; + + /** Autobool: Do we try to retain capabilities if we can? */ + int KeepCapabilities; } or_options_t; /** Persistent state for an onion router, as saved to disk. */

1 0

[tor/master] remove redundant section in tor.1.txt
by nickm＠torproject.org 15 Dec '15

15 Dec '15

commit 125e0c7022fa0bf7ac4d09e0a5a07db63bf529ea Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 15 13:18:06 2015 -0500 remove redundant section in tor.1.txt --- doc/tor.1.txt | 5 ----- 1 file changed, 5 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 7dd8812..562fed9 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2425,11 +2425,6 @@ The following options are used for running a testing Tor network. fallback directory mirrors before giving up. Changing this requires that **TestingTorNetwork** is set. (Default: 7) -[[TestingClientBootstrapConsensusMaxDownloadTries]] **TestingClientBootstrapConsensusMaxDownloadTries** __NUM__:: - Try this many times to download a consensus while bootstrapping using - only authorities before giving up. Changing this requires that - **TestingTorNetwork** is set. (Default: 4) - [[TestingClientBootstrapConsensusMaxInProgressTries]] **TestingClientBootstrapConsensusMaxInProgressTries** __NUM__:: Try this many simultaneous connections to download a consensus before waiting for one to complete, timeout, or error out. Changing this

1 0

[tor/master] Merge branch 'feature8195_small_squashed'
by nickm＠torproject.org 15 Dec '15

15 Dec '15

commit aba39ea39075803c974ab6451a55b52deb425468 Merge: 744958e 405a8d3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 15 13:11:06 2015 -0500 Merge branch 'feature8195_small_squashed' .gitignore | 2 + changes/feature8195 | 6 ++ configure.ac | 16 +++- doc/tor.1.txt | 8 ++ src/common/compat.c | 108 +++++++++++++++++++++++++- src/common/compat.h | 13 +++- src/or/config.c | 49 ++++++++++-- src/or/or.h | 3 + src/test/include.am | 17 ++++- src/test/test_switch_id.c | 181 ++++++++++++++++++++++++++++++++++++++++++++ src/test/test_switch_id.sh | 25 ++++++ 11 files changed, 414 insertions(+), 14 deletions(-) diff --cc src/test/include.am index f593782,3fed3b7..d52867b --- a/src/test/include.am +++ b/src/test/include.am @@@ -1,14 -1,11 +1,15 @@@ - -export PYTHON=@PYTHON@ -export SHELL=@SHELL@ -export abs_top_srcdir=@abs_top_srcdir@ -export builddir=@builddir@ +# When the day comes that Tor requires Automake >= 1.12 change +# TESTS_ENVIRONMENT to AM_TESTS_ENVIRONMENT because the former is reserved for +# users while the later is reserved for developers. +TESTS_ENVIRONMENT = \ + export PYTHON="$(PYTHON)"; \ + export SHELL="$(SHELL)"; \ + export abs_top_srcdir="$(abs_top_srcdir)"; \ + export builddir="$(builddir)"; \ + export TESTING_TOR_BINARY="$(TESTING_TOR_BINARY)"; - TESTSCRIPTS = src/test/test_zero_length_keys.sh + TESTSCRIPTS = src/test/test_zero_length_keys.sh \ + src/test/test_switch_id.sh if USEPYTHON TESTSCRIPTS += src/test/test_ntor.sh src/test/test_bt.sh

1 0

[tor/master] Prop210: Add router_digest_is_fallback_dir
by nickm＠torproject.org 15 Dec '15

15 Dec '15

commit d72af1085a1d9ed6f2c9bdb5e9c85eba991db842 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Fri Dec 11 05:49:23 2015 +1100 Prop210: Add router_digest_is_fallback_dir router_digest_is_fallback_dir returns 1 if the digest is in the currently loaded list of fallback directories, and 0 otherwise. This function is for future use. --- src/or/routerlist.c | 18 +++++++++++++++++- src/or/routerlist.h | 1 + 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 0027a04..458d19c 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -1362,7 +1362,9 @@ router_get_trusteddirserver_by_digest(const char *digest) } /** Return the dir_server_t for the fallback dirserver whose identity - * key hashes to digest, or NULL if no such authority is known. + * key hashes to digest, or NULL if no such fallback is in the list of + * fallback_dir_servers. (fallback_dir_servers is affected by the FallbackDir + * and UseDefaultFallbackDirs torrc options.) */ dir_server_t * router_get_fallback_dirserver_by_digest(const char *digest) @@ -1370,6 +1372,9 @@ router_get_fallback_dirserver_by_digest(const char *digest) if (!fallback_dir_servers) return NULL; + if (!digest) + return NULL; + SMARTLIST_FOREACH(fallback_dir_servers, dir_server_t *, ds, { if (tor_memeq(ds->digest, digest, DIGEST_LEN)) @@ -1379,6 +1384,17 @@ router_get_fallback_dirserver_by_digest(const char *digest) return NULL; } +/** Return 1 if any fallback dirserver's identity key hashes to digest, + * or 0 if no such fallback is in the list of fallback_dir_servers. + * (fallback_dir_servers is affected by the FallbackDir and + * UseDefaultFallbackDirs torrc options.) + */ +int +router_digest_is_fallback_dir(const char *digest) +{ + return (router_get_fallback_dirserver_by_digest(digest) != NULL); +} + /** Return the dir_server_t for the directory authority whose * v3 identity key hashes to digest, or NULL if no such authority * is known. diff --git a/src/or/routerlist.h b/src/or/routerlist.h index 100ab58..d660bcd 100644 --- a/src/or/routerlist.h +++ b/src/or/routerlist.h @@ -50,6 +50,7 @@ const routerstatus_t *router_pick_directory_server(dirinfo_type_t type, dir_server_t *router_get_trusteddirserver_by_digest(const char *d); dir_server_t *router_get_fallback_dirserver_by_digest( const char *digest); +int router_digest_is_fallback_dir(const char *digest); dir_server_t *trusteddirserver_get_by_v3_auth_digest(const char *d); const routerstatus_t *router_pick_trusteddirserver(dirinfo_type_t type, int flags);

1 0

[tor/master] Merge remote-tracking branch 'teor/feature4483-v10-squashed'
by nickm＠torproject.org 15 Dec '15

15 Dec '15

commit a7d44731d9ac831cd68f34ac640b50cdde3a60af Merge: 5443399 d72af10 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 15 12:57:57 2015 -0500 Merge remote-tracking branch 'teor/feature4483-v10-squashed' changes/bug4483-multiple-consensus-downloads | 9 + doc/tor.1.txt | 61 ++- src/common/torint.h | 26 + src/or/config.c | 76 ++- src/or/connection.c | 230 +++++--- src/or/connection.h | 59 +- src/or/directory.c | 479 ++++++++++++++-- src/or/directory.h | 27 +- src/or/entrynodes.c | 2 +- src/or/main.c | 24 +- src/or/networkstatus.c | 358 +++++++++++- src/or/networkstatus.h | 8 + src/or/or.h | 120 +++- src/or/routerlist.c | 37 +- src/or/routerlist.h | 1 + src/test/Makefile.nmake | 3 +- src/test/include.am | 1 + src/test/test.c | 2 + src/test/test_config.c | 99 +++- src/test/test_connection.c | 757 ++++++++++++++++++++++++++ src/test/test_dir.c | 431 +++++++++++++++ src/test/test_routerlist.c | 4 +- 22 files changed, 2621 insertions(+), 193 deletions(-) diff --cc doc/tor.1.txt index 7f8d9b6,2d95a54..d8802bf --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@@ -360,14 -360,11 +360,18 @@@ GENERAL OPTION [[FallbackDir]] **FallbackDir** __address__:__port__ orport=__port__ id=__fingerprint__ [weight=__num__]:: When we're unable to connect to any directory cache for directory info - (usually because we don't know about any yet) we try a FallbackDir. + (usually because we don't know about any yet) we try a directory authority. + Clients also simultaneously try a FallbackDir, to avoid hangs on client + startup if a directory authority is down. Clients retry FallbackDirs more + often than directory authorities, to reduce the load on the directory + authorities. + By default, the directory authorities are also FallbackDirs. Specifying a + FallbackDir replaces Tor's default hard-coded FallbackDirs (if any). + +[[UseDefaultFallbackDirs]] **UseDefaultFallbackDirs** **0**|**1**:: + Use Tor's default hard-coded FallbackDirs (if any). (When a + FallbackDir line is present, it replaces the hard-coded FallbackDirs, + regardless of the value of UseDefaultFallbackDirs.) (Default: 1) [[DirAuthority]] **DirAuthority** [__nickname__] [**flags**] __address__:__port__ __fingerprint__:: Use a nonstandard authoritative directory server at the provided address diff --cc src/test/test_config.c index 4ecd514,376dc1a..1d25f86 --- a/src/test/test_config.c +++ b/src/test/test_config.c @@@ -3206,44 -3246,47 +3242,86 @@@ test_config_adding_dir_servers(void *ar } static void +test_config_default_dir_servers(void *arg) +{ + or_options_t *opts = NULL; + (void)arg; + int trusted_count = 0; + int fallback_count = 0; + + opts = tor_malloc_zero(sizeof(or_options_t)); + opts->UseDefaultFallbackDirs = 0; + consider_adding_dir_servers(opts, opts); + trusted_count = smartlist_len(router_get_trusted_dir_servers()); + fallback_count = smartlist_len(router_get_fallback_dir_servers()); + or_options_free(opts); + opts = NULL; + + /* assume a release will never go out with less than 7 authorities */ + tt_assert(trusted_count >= 7); + /* if we disable the default fallbacks, there must not be any extra */ + tt_assert(fallback_count == trusted_count); + + opts = tor_malloc_zero(sizeof(or_options_t)); + opts->UseDefaultFallbackDirs = 1; + consider_adding_dir_servers(opts, opts); + trusted_count = smartlist_len(router_get_trusted_dir_servers()); + fallback_count = smartlist_len(router_get_fallback_dir_servers()); + or_options_free(opts); + opts = NULL; + + /* assume a release will never go out with less than 7 authorities */ + tt_assert(trusted_count >= 7); + /* XX/teor - allow for default fallbacks to be added without breaking + * the unit tests. Set a minimum fallback count once the list is stable. */ + tt_assert(fallback_count >= trusted_count); + + done: + or_options_free(opts); +} + ++static void + test_config_use_multiple_directories(void *arg) + { + (void)arg; + + or_options_t *options = tor_malloc_zero(sizeof(or_options_t)); + + /* Clients can use multiple directory mirrors for bootstrap */ + memset(options, 0, sizeof(or_options_t)); + options->ClientOnly = 1; + tt_assert(networkstatus_consensus_can_use_multiple_directories(options) + == 1); + + /* Bridge Clients can use multiple directory mirrors for bootstrap */ + memset(options, 0, sizeof(or_options_t)); + options->UseBridges = 1; + tt_assert(networkstatus_consensus_can_use_multiple_directories(options) + == 1); + + /* Bridge Relays (Bridges) must act like clients, and use multiple + * directory mirrors for bootstrap */ + memset(options, 0, sizeof(or_options_t)); + options->BridgeRelay = 1; + tt_assert(networkstatus_consensus_can_use_multiple_directories(options) + == 1); + + /* Clients set to FetchDirInfoEarly must fetch it from the authorities */ + memset(options, 0, sizeof(or_options_t)); + options->FetchDirInfoEarly = 1; + tt_assert(networkstatus_consensus_can_use_multiple_directories(options) + == 0); + + /* OR servers must fetch the consensus from the authorities */ + memset(options, 0, sizeof(or_options_t)); + options->ORPort_set = 1; + tt_assert(networkstatus_consensus_can_use_multiple_directories(options) + == 0); + + done: + tor_free(options); + } + #define CONFIG_TEST(name, flags) \ { #name, test_config_ ## name, flags, NULL, NULL }

1 0