This is an automated email from the git hooks/post-receive script.

dgoulet pushed a commit to branch main in repository tor.

The following commit(s) were added to refs/heads/main by this push: new b65ffa6f06 Enable IP_BIND_ADDRESS_NO_PORT if supported new c733ccda99 Merge branch 'tor-gitlab/mr/579' b65ffa6f06 is described below

commit b65ffa6f06b2d7bc313e0780f3d76a8acb499ac9 Author: Alex Xu (Hello71) alex_y_xu@yahoo.ca AuthorDate: Sat May 21 15:21:25 2022 -0400

Enable IP_BIND_ADDRESS_NO_PORT if supported --- changes/ip_bind_address_no_port | 5 +++++ src/core/mainloop/connection.c | 17 +++++++++++++++++ src/lib/sandbox/sandbox.c | 8 ++++++++ 3 files changed, 30 insertions(+)

diff --git a/changes/ip_bind_address_no_port b/changes/ip_bind_address_no_port new file mode 100644 index 0000000000..9c4f712a9e --- /dev/null +++ b/changes/ip_bind_address_no_port @@ -0,0 +1,5 @@ + o Minor features (relays): + - Set the Linux-specific IP_BIND_ADDRESS_NO_PORT option on outgoing + sockets, allowing relays using OutboundBindAddress to make more outgoing + connections than ephemeral ports, as long as they are to separate + destinations. Related to issue 40597; patch by Alex Xu (Hello71). diff --git a/src/core/mainloop/connection.c b/src/core/mainloop/connection.c index 75fc3c8918..82cd19181d 100644 --- a/src/core/mainloop/connection.c +++ b/src/core/mainloop/connection.c @@ -2224,6 +2224,23 @@ connection_connect_sockaddr,(connection_t *conn, tor_socket_strerror(errno)); }

+#ifdef IP_BIND_ADDRESS_NO_PORT + static int try_ip_bind_address_no_port = 1; + if (bindaddr && try_ip_bind_address_no_port && + setsockopt(s, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &(int){1}, sizeof(int))) { + if (errno == EINVAL) { + log_notice(LD_NET, "Tor was built with support for " + "IP_BIND_ADDRESS_NO_PORT, but the current kernel " + "doesn't support it. This might cause Tor to run out " + "of ephemeral ports more quickly."); + try_ip_bind_address_no_port = 0; + } else { + log_warn(LD_NET, "Error setting IP_BIND_ADDRESS_NO_PORT on new " + "connection: %s", tor_socket_strerror(errno)); + } + } +#endif + if (bindaddr && bind(s, bindaddr, bindaddr_len) < 0) { *socket_error = tor_socket_errno(s); if (ERRNO_IS_EADDRINUSE(*socket_error)) { diff --git a/src/lib/sandbox/sandbox.c b/src/lib/sandbox/sandbox.c index 7c024d7e37..a476e57fbc 100644 --- a/src/lib/sandbox/sandbox.c +++ b/src/lib/sandbox/sandbox.c @@ -1033,6 +1033,14 @@ sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) return rc; #endif /* defined(IPV6_V6ONLY) */

+#ifdef IP_BIND_ADDRESS_NO_PORT + rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), + SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP), + SCMP_CMP(2, SCMP_CMP_EQ, IP_BIND_ADDRESS_NO_PORT)); + if (rc) + return rc; +#endif + return 0; }