commit 55d8b8e578e17d8654f33f62fdc4a4419a6b92a7 Author: Cristian Toader cristian.matei.toader@gmail.com Date: Tue Sep 3 16:37:12 2013 +0300

fixed bug where sandbox_getaddrinfo() would fail when -Sandbox is 0 --- src/common/address.c | 2 +- src/common/sandbox.c | 30 ++++++++++++++++++++++++++---- src/common/sandbox.h | 3 ++- 3 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/src/common/address.c b/src/common/address.c index 5c8603e..a46aeb0 100644 --- a/src/common/address.c +++ b/src/common/address.c @@ -235,7 +235,7 @@ tor_addr_lookup(const char *name, uint16_t family, tor_addr_t *addr) memset(&hints, 0, sizeof(hints)); hints.ai_family = family; hints.ai_socktype = SOCK_STREAM; - err = sandbox_getaddrinfo(name, &res); + err = sandbox_getaddrinfo(name, hints, &res); if (!err) { best = NULL; for (res_p = res; res_p; res_p = res_p->ai_next) { diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 1f0584c..19c2898 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -54,6 +54,7 @@ #include <time.h> #include <poll.h>

+static int sandbox_active = 0; static sandbox_cfg_t *filter_dynamic = NULL; static sb_addr_info_t *sb_addr_info = NULL;

@@ -948,7 +949,8 @@ sandbox_cfg_allow_execve_array(sandbox_cfg_t **cfg, ...) }

int -sandbox_getaddrinfo(const char *name, struct addrinfo **res) +sandbox_getaddrinfo(const char *name, struct addrinfo hints, + struct addrinfo **res) { sb_addr_info_t *el;

@@ -956,18 +958,31 @@ sandbox_getaddrinfo(const char *name, struct addrinfo **res)

for (el = sb_addr_info; el; el = el->next) { if (!strcmp(el->name, name)) { - *res = (struct addrinfo *)malloc(sizeof(struct addrinfo)); + *res = (struct addrinfo *) malloc(sizeof(struct addrinfo)); if (!res) { return -2; }

memcpy(*res, el->info, sizeof(struct addrinfo)); - return 0; } }

+ if (!sandbox_active) { + if (getaddrinfo(name, NULL, &hints, res)) { + log_err(LD_BUG,"(Sandbox) getaddrinfo failed!"); + return -1; + } + + return 0; + } + + // getting here means something went wrong log_err(LD_BUG,"(Sandbox) failed to get address %s!", name); + if (*res) { + free(*res); + res = NULL; + } return -1; }

@@ -1069,7 +1084,14 @@ install_syscall_filter(sandbox_cfg_t* cfg) goto end; }

- rc = seccomp_load(ctx); + // loading the seccomp2 filter + if((rc = seccomp_load(ctx))) { + log_err(LD_BUG, "(Sandbox) failed to load!"); + goto end; + } + + // marking the sandbox as active + sandbox_active = 1;

end: seccomp_release(ctx); diff --git a/src/common/sandbox.h b/src/common/sandbox.h index 59474c4..503bb70 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -133,7 +133,8 @@ typedef struct { int sandbox_add_addrinfo(const char *addr);

/** Replacement for getaddrinfo(), using pre-recorded results. */ -int sandbox_getaddrinfo(const char *name, struct addrinfo **res); +int sandbox_getaddrinfo(const char *name, struct addrinfo hints, + struct addrinfo **res);

/** Use <b>fd</b> to log non-survivable sandbox violations. */ void sandbox_set_debugging_fd(int fd);