- tor-commits - lists.torproject.org

[tor/release-0.2.2] Add a new flag to check_private_dir to make it _not_ change permissions
by nickm＠torproject.org 16 May '11

16 May '11

commit 5d147d8527da3c8cff7f5ab5f0d0185d51fff79b Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 13 15:40:03 2011 -0400 Add a new flag to check_private_dir to make it _not_ change permissions We'll need this for checking permissions on the directories that hold control sockets: if somebody says "ControlSocket ~/foo", it would be pretty rude to do a chmod 700 on their homedir. --- src/common/util.c | 7 +++++++ src/common/util.h | 1 + 2 files changed, 8 insertions(+), 0 deletions(-) diff --git a/src/common/util.c b/src/common/util.c index 3f81874..d84ed9c 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -1670,6 +1670,8 @@ file_status(const char *fname) * check&CPD_CHECK, and we think we can create it, return 0. Else * return -1. If CPD_GROUP_OK is set, then it's okay if the directory * is group-readable, but in all cases we create the directory mode 0700. + * If CPD_CHECK_MODE_ONLY is set, then we don't alter the directory permissions + * if they are too permissive: we just return -1. */ int check_private_dir(const char *dirname, cpd_check_t check) @@ -1741,6 +1743,11 @@ check_private_dir(const char *dirname, cpd_check_t check) } if (st.st_mode & mask) { unsigned new_mode; + if (check & CPD_CHECK_MODE_ONLY) { + log_warn(LD_FS, "Permissions on directory %s are too permissive.", + dirname); + return -1; + } log_warn(LD_FS, "Fixing permissions on directory %s", dirname); new_mode = st.st_mode; new_mode |= 0700; /* Owner should have rwx */ diff --git a/src/common/util.h b/src/common/util.h index f759532..f32709a 100644 --- a/src/common/util.h +++ b/src/common/util.h @@ -291,6 +291,7 @@ typedef unsigned int cpd_check_t; #define CPD_CREATE 1 #define CPD_CHECK 2 #define CPD_GROUP_OK 4 +#define CPD_CHECK_MODE_ONLY 8 int check_private_dir(const char *dirname, cpd_check_t check); #define OPEN_FLAGS_REPLACE (O_WRONLY|O_CREAT|O_TRUNC) #define OPEN_FLAGS_APPEND (O_WRONLY|O_CREAT|O_APPEND)

1 0

[tor/release-0.2.2] Merge remote-tracking branch 'origin/maint-0.2.2' into release-0.2.2
by nickm＠torproject.org 16 May '11

16 May '11

commit fd105e1048001ec4498116e7db5304bf7a1c90ca Merge: da805ce 83fe07d Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 16 11:01:23 2011 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' into release-0.2.2 changes/bug1345 | 13 ++++++++++ changes/bug2732-simple | 7 +++++ changes/bug2792_checkdir | 8 ++++++ changes/bug2972 | 5 ++++ changes/bug3019 | 4 +++ changes/bug3026 | 4 +++ changes/bug3175 | 7 +++++ doc/tor.1.txt | 5 ++++ src/common/compat.c | 39 +++++++++++++++++++++++++++++++ src/common/compat.h | 2 + src/common/container.c | 21 ++++++++++++++++- src/common/container.h | 4 ++- src/common/di_ops.c | 14 +++++----- src/common/di_ops.h | 1 + src/common/util.c | 58 ++++++++++++++++++++++++++++++++++++++-------- src/common/util.h | 7 ++++- src/or/circuitbuild.c | 57 +++++++++++++++++++++++++++++++++++++++----- src/or/circuitbuild.h | 9 ++++--- src/or/circuituse.c | 51 ++++++++++++++++++++++------------------ src/or/circuituse.h | 2 + src/or/config.c | 40 ++++++++++++++++++++++++++++--- src/or/connection.c | 49 ++++++++++++++++++++++++++++++++++++++ src/or/connection_edge.c | 51 ++++++++++++++++++++++++++++++++++++++-- src/or/connection_edge.h | 1 + src/or/directory.c | 5 ++++ src/or/dirvote.c | 13 ++++++---- src/or/main.c | 1 - src/or/or.h | 4 +++ src/or/routerlist.c | 27 ++++----------------- src/test/test_util.c | 30 +++++++++++++++++++++++ 30 files changed, 450 insertions(+), 89 deletions(-)

1 0

[tor/release-0.2.2] Increase the length of the buffer in smartlist_string_num_isin().
by nickm＠torproject.org 16 May '11

16 May '11

commit 83fe07d3f26aff703230305c9ff529592af32d4f Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun May 15 22:13:53 2011 -0400 Increase the length of the buffer in smartlist_string_num_isin(). This was harmless, since we only used this for checking for lists of port values, but it's the principle of the thing. Fixes 3175; bugfix on 0.1.0.1-rc --- changes/bug3175 | 7 +++++++ src/common/container.c | 2 +- 2 files changed, 8 insertions(+), 1 deletions(-) diff --git a/changes/bug3175 b/changes/bug3175 new file mode 100644 index 0000000..3360fbc --- /dev/null +++ b/changes/bug3175 @@ -0,0 +1,7 @@ + o Minor bugfixes: + - Resolve an untriggerable issue in smartlist_string_num_isin(), + where if the function had ever in the future been used to check + for the presence of a too-large number, it would have given an + incorrect result. (Fortunately, we only used it for 16-bit + values.) Fixes bug 3175; bugfix on Tor 0.1.0.1-rc. + diff --git a/src/common/container.c b/src/common/container.c index ca49cbb..da44b7f 100644 --- a/src/common/container.c +++ b/src/common/container.c @@ -210,7 +210,7 @@ smartlist_string_isin_case(const smartlist_t *sl, const char *element) int smartlist_string_num_isin(const smartlist_t *sl, int num) { - char buf[16]; + char buf[32]; /* long enough for 64-bit int, and then some. */ tor_snprintf(buf,sizeof(buf),"%d", num); return smartlist_string_isin(sl, buf); }

1 0

[tor/release-0.2.2] Make check_private_dir accept g+rx dirs if told to do so.
by nickm＠torproject.org 16 May '11

16 May '11

commit b147c01295deb8c09807fda3b5e4945edcfaf81a Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 13 14:55:40 2011 -0400 Make check_private_dir accept g+rx dirs if told to do so. --- src/common/util.c | 33 ++++++++++++++++++++++++--------- src/common/util.h | 6 +++++- 2 files changed, 29 insertions(+), 10 deletions(-) diff --git a/src/common/util.c b/src/common/util.c index 86f4141..3f81874 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -1665,16 +1665,22 @@ file_status(const char *fname) } /** Check whether dirname exists and is private. If yes return 0. If - * it does not exist, and check==CPD_CREATE is set, try to create it + * it does not exist, and check&CPD_CREATE is set, try to create it * and return 0 on success. If it does not exist, and - * check==CPD_CHECK, and we think we can create it, return 0. Else - * return -1. */ + * check&CPD_CHECK, and we think we can create it, return 0. Else + * return -1. If CPD_GROUP_OK is set, then it's okay if the directory + * is group-readable, but in all cases we create the directory mode 0700. + */ int check_private_dir(const char *dirname, cpd_check_t check) { int r; struct stat st; char *f; +#ifndef MS_WINDOWS + int mask; +#endif + tor_assert(dirname); f = tor_strdup(dirname); clean_name_for_stat(f); @@ -1686,10 +1692,7 @@ check_private_dir(const char *dirname, cpd_check_t check) strerror(errno)); return -1; } - if (check == CPD_NONE) { - log_warn(LD_FS, "Directory %s does not exist.", dirname); - return -1; - } else if (check == CPD_CREATE) { + if (check & CPD_CREATE) { log_info(LD_GENERAL, "Creating directory %s", dirname); #if defined (MS_WINDOWS) && !defined (WINCE) r = mkdir(dirname); @@ -1701,6 +1704,9 @@ check_private_dir(const char *dirname, cpd_check_t check) strerror(errno)); return -1; } + } else if (!(check & CPD_CHECK)) { + log_warn(LD_FS, "Directory %s does not exist.", dirname); + return -1; } /* XXXX In the case where check==CPD_CHECK, we should look at the * parent directory a little harder. */ @@ -1728,9 +1734,18 @@ check_private_dir(const char *dirname, cpd_check_t check) tor_free(process_ownername); return -1; } - if (st.st_mode & 0077) { + if (check & CPD_GROUP_OK) { + mask = 0027; + } else { + mask = 0077; + } + if (st.st_mode & mask) { + unsigned new_mode; log_warn(LD_FS, "Fixing permissions on directory %s", dirname); - if (chmod(dirname, 0700)) { + new_mode = st.st_mode; + new_mode |= 0700; /* Owner should have rwx */ + new_mode &= ~mask; /* Clear the other bits that we didn't want set...*/ + if (chmod(dirname, new_mode)) { log_warn(LD_FS, "Could not chmod directory %s: %s", dirname, strerror(errno)); return -1; diff --git a/src/common/util.h b/src/common/util.h index 961b587..f759532 100644 --- a/src/common/util.h +++ b/src/common/util.h @@ -286,7 +286,11 @@ file_status_t file_status(const char *filename); /** Possible behaviors for check_private_dir() on encountering a nonexistent * directory; see that function's documentation for details. */ -typedef enum { CPD_NONE, CPD_CREATE, CPD_CHECK } cpd_check_t; +typedef unsigned int cpd_check_t; +#define CPD_NONE 0 +#define CPD_CREATE 1 +#define CPD_CHECK 2 +#define CPD_GROUP_OK 4 int check_private_dir(const char *dirname, cpd_check_t check); #define OPEN_FLAGS_REPLACE (O_WRONLY|O_CREAT|O_TRUNC) #define OPEN_FLAGS_APPEND (O_WRONLY|O_CREAT|O_APPEND)

1 0

[tor/release-0.2.2] Fix up some comment issues spotted by rransom
by nickm＠torproject.org 16 May '11

16 May '11

commit 287f6cb128c890e31faa951be6d42cd6801f4e59 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun May 15 13:03:15 2011 -0400 Fix up some comment issues spotted by rransom --- src/common/compat.c | 7 ++++++- src/common/util.c | 6 +++--- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/src/common/compat.c b/src/common/compat.c index 3c5e938..fc066da 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -1481,7 +1481,12 @@ get_parent_directory(char *fname) fname += 2; } #endif - /* Now we want to remove the final character that */ + /* Now we want to remove all path-separators at the end of the string, + * and to remove the end of the string starting with the path separator + * before the last non-path-separator. In perl, this would be + * s#[/]*$##; s#/[^/]*$##; + * on a unixy platform. + */ cp = fname + strlen(fname); at_end = 1; while (--cp > fname) { diff --git a/src/common/util.c b/src/common/util.c index d84ed9c..0e739f2 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -1664,10 +1664,10 @@ file_status(const char *fname) return FN_ERROR; } -/** Check whether dirname exists and is private. If yes return 0. If - * it does not exist, and check&CPD_CREATE is set, try to create it +/** Check whether dirname exists and is private. If yes return 0. If + * it does not exist, and check&CPD_CREATE is set, try to create it * and return 0 on success. If it does not exist, and - * check&CPD_CHECK, and we think we can create it, return 0. Else + * check&CPD_CHECK, and we think we can create it, return 0. Else * return -1. If CPD_GROUP_OK is set, then it's okay if the directory * is group-readable, but in all cases we create the directory mode 0700. * If CPD_CHECK_MODE_ONLY is set, then we don't alter the directory permissions

1 0

[tor/release-0.2.2] Merge branch 'bug1345' into maint-0.2.2
by nickm＠torproject.org 16 May '11

16 May '11

commit a5d40c2d0f1372c119d4a4a4b0287ecea298322e Merge: 228b77f 2bb6bdc Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun May 15 11:40:14 2011 -0400 Merge branch 'bug1345' into maint-0.2.2 changes/bug1345 | 13 +++++++++++ src/common/container.c | 19 +++++++++++++++++ src/common/container.h | 2 + src/or/circuituse.c | 41 +++++++++++++++++++++++------------- src/or/circuituse.h | 2 + src/or/config.c | 23 ++++++++++++++++++++ src/or/connection_edge.c | 51 +++++++++++++++++++++++++++++++++++++++++++-- src/or/connection_edge.h | 1 + src/or/main.c | 1 - src/or/or.h | 3 ++ 10 files changed, 137 insertions(+), 19 deletions(-)

1 0

[tor/release-0.2.2] Merge branch 'bug3026' into maint-0.2.2
by nickm＠torproject.org 16 May '11

16 May '11

commit 69ff26b05c789e556c3e1401f5065ebf5e49c9d8 Merge: f287100 6b83b3b Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun May 15 12:18:23 2011 -0400 Merge branch 'bug3026' into maint-0.2.2 changes/bug3026 | 4 ++++ src/or/directory.c | 5 +++++ 2 files changed, 9 insertions(+), 0 deletions(-)

1 0

[tor/release-0.2.2] Replace a nasty add-malloc-snprintf with a nice clean asprintf
by nickm＠torproject.org 16 May '11

16 May '11

commit f2871009346e0589455be14e9cef930c19082c0a Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun May 15 11:41:49 2011 -0400 Replace a nasty add-malloc-snprintf with a nice clean asprintf --- src/or/circuituse.c | 10 ++-------- 1 files changed, 2 insertions(+), 8 deletions(-) diff --git a/src/or/circuituse.c b/src/or/circuituse.c index 86db7c3..7289aa5 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -1513,8 +1513,7 @@ static void consider_recording_trackhost(edge_connection_t *conn, origin_circuit_t *circ) { or_options_t *options = get_options(); - size_t len; - char *new_address; + char *new_address = NULL; char fp[HEX_DIGEST_LEN+1]; /* Search the addressmap for this conn's destination. */ @@ -1534,12 +1533,7 @@ consider_recording_trackhost(edge_connection_t *conn, origin_circuit_t *circ) circ->build_state->chosen_exit->identity_digest, DIGEST_LEN); /* Add this exit/hostname pair to the addressmap. */ - len = strlen(conn->socks_request->address) + 1 /* '.' */ + - strlen(fp) + 1 /* '.' */ + - strlen("exit") + 1 /* '\0' */; - new_address = tor_malloc(len); - - tor_snprintf(new_address, len, "%s.%s.exit", + tor_asprintf(&new_address, "%s.%s.exit", conn->socks_request->address, fp); addressmap_register(conn->socks_request->address, new_address,

1 0

[tor/release-0.2.2] Another doc tweak on tor_memcmp: b, not .
by nickm＠torproject.org 16 May '11

16 May '11

commit 10d670674aa49ee6764cf93fe7d3f485a3f9ffd8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun May 15 19:56:05 2011 -0400 Another doc tweak on tor_memcmp: b, not . --- src/common/di_ops.c | 12 ++++++------ 1 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/common/di_ops.c b/src/common/di_ops.c index 3da033c..b22a58d 100644 --- a/src/common/di_ops.c +++ b/src/common/di_ops.c @@ -10,11 +10,11 @@ #include "di_ops.h" /** - * Timing-safe version of memcmp. As memcmp, compare the sz bytes - * at a with the sz bytes at , and return less than 0 if the - * bytes at a lexically precede those at b, 0 if the byte ranges - * are equal, and greater than zero if the bytes at a lexically follow - * those at . + * Timing-safe version of memcmp. As memcmp, compare the sz bytes at + * a with the sz bytes at b, and return less than 0 if + * the bytes at a lexically precede those at b, 0 if the byte + * ranges are equal, and greater than zero if the bytes at a lexically + * follow those at b. * * This implementation differs from memcmp in that its timing behavior is not * data-dependent: it should return in the same amount of time regardless of @@ -85,7 +85,7 @@ tor_memcmp(const void *a, const void *b, size_t len) /** * Timing-safe memory comparison. Return true if the sz bytes at - * a are the same as the sz bytes at , and 0 otherwise. + * a are the same as the sz bytes at b, and 0 otherwise. * * This implementation differs from !memcmp(a,b,sz) in that its timing * behavior is not data-dependent: it should return in the same amount of time

1 0

[tor/release-0.2.2] minor tweaks to 4b19730c8234d
by nickm＠torproject.org 16 May '11

16 May '11

commit b48f83ab8c27b6a26d4afe5177238a99637a1dc1 Author: Roger Dingledine <arma(a)torproject.org> Date: Sun May 15 19:20:42 2011 -0400 minor tweaks to 4b19730c8234d --- src/common/di_ops.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/common/di_ops.c b/src/common/di_ops.c index c1e292f..3da033c 100644 --- a/src/common/di_ops.c +++ b/src/common/di_ops.c @@ -3,7 +3,7 @@ /** * \file di_ops.c - * \brief Functions for data-independent operations + * \brief Functions for data-independent operations. **/ #include "orconfig.h" @@ -11,7 +11,7 @@ /** * Timing-safe version of memcmp. As memcmp, compare the sz bytes - * at a with the sz bytes at , and returns less than 0 if the + * at a with the sz bytes at , and return less than 0 if the * bytes at a lexically precede those at b, 0 if the byte ranges * are equal, and greater than zero if the bytes at a lexically follow * those at .

1 0