[tor-commits] [tor/master] Remove SocksSocket; it's now spelled differently thanks to 14451
nickm at torproject.org
nickm at torproject.org
Thu Jan 29 20:18:23 UTC 2015
commit 204374f7d92997a510a7aabe5ec57f0f87a3499f
Author: Nick Mathewson <nickm at torproject.org>
Date: Thu Jan 29 14:45:21 2015 -0500
Remove SocksSocket; it's now spelled differently thanks to 14451
Also, revise bug12585 changes file to mention new syntax
---
changes/bug12585 | 7 +++++--
doc/tor.1.txt | 4 ----
src/or/config.c | 34 +++++++++-------------------------
src/or/connection.c | 2 +-
src/or/or.h | 4 ----
5 files changed, 15 insertions(+), 36 deletions(-)
diff --git a/changes/bug12585 b/changes/bug12585
index 495a2f0..ac03993 100644
--- a/changes/bug12585
+++ b/changes/bug12585
@@ -1,9 +1,12 @@
o Major features (security)
- - Implementation of SocksSocket option - SocksSocket implements a SOCKS
+ - Implementation of an AF_UNIX socket option to implement a SOCKS
proxy reachable by Unix Domain Socket. This allows client applications to
communicate with Tor without having the ability to create AF_INET or
AF_INET6 family sockets. If an application has permission to create a socket
with AF_UNIX, it may directly communicate with Tor as if it were an other
SOCKS proxy. This should allow high risk applications to be entirely prevented
from connecting directly with TCP/IP, they will be able to only connect to the
- internet through AF_UNIX and only through Tor. Closes ticket 12585.
+ internet through AF_UNIX and only through Tor.
+ To create a socket of this type, use the syntax "unix:/path/to/socket".
+ Closes ticket 12585.
+
diff --git a/doc/tor.1.txt b/doc/tor.1.txt
index 5302b33..50ab80e 100644
--- a/doc/tor.1.txt
+++ b/doc/tor.1.txt
@@ -483,10 +483,6 @@ GENERAL OPTIONS
in accordance to RFC 1929. Both username and password must be between 1 and
255 characters.
-[[SocksSocket]] **SocksSocket** __Path__ [_flags_] [_isolation flags_]::
- Like SocksPort, but listens on a Unix domain socket, rather than a TCP
- socket. '0' disables SocksSocket (Unix and Unix-like systems only.)
-
[[SocksSocketsGroupWritable]] **SocksSocketsGroupWritable** **0**|**1**::
If this option is set to 0, don't allow the filesystem group to read and
write unix sockets (e.g. SocksSocket). If the option is set to 1, make
diff --git a/src/or/config.c b/src/or/config.c
index 0bdf8d0..ab1f318 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -69,7 +69,7 @@
extern int quiet_level;
/* Prefix used to indicate a Unix socket in a FooPort configuration. */
-static const char *unix_socket_prefix = "unix:";
+static const char unix_socket_prefix[] = "unix:";
/** A list of abbreviations and aliases to map command-line options, obsolete
* option names, or alternative option names, to their current values. */
@@ -203,7 +203,6 @@ static config_var_t option_vars_[] = {
V(ControlPortWriteToFile, FILENAME, NULL),
V(ControlSocket, LINELIST, NULL),
V(ControlSocketsGroupWritable, BOOL, "0"),
- V(SocksSocket, LINELIST, NULL),
V(SocksSocketsGroupWritable, BOOL, "0"),
V(CookieAuthentication, BOOL, "0"),
V(CookieAuthFileGroupReadable, BOOL, "0"),
@@ -1053,20 +1052,6 @@ options_act_reversible(const or_options_t *old_options, char **msg)
}
#endif
-#ifndef HAVE_SYS_UN_H
- if (options->SocksSocket || options->SocksSocketsGroupWritable) {
- *msg = tor_strdup("Unix domain sockets (SocksSocket) not supported "
- "on this OS/with this build.");
- goto rollback;
- }
-#else
- if (options->SocksSocketsGroupWritable && !options->SocksSocket) {
- *msg = tor_strdup("Setting SocksSocketGroupWritable without setting"
- "a SocksSocket makes no sense.");
- goto rollback;
- }
-#endif
-
if (running_tor) {
int n_ports=0;
/* We need to set the connection limit before we can open the listeners. */
@@ -5656,6 +5641,14 @@ config_parse_unix_port(const char *addrport, char **path_out)
int
config_parse_unix_port(const char *addrport, char **path_out)
{
+ tor_assert(path_out);
+ tor_assert(addrport);
+
+ if (strcmpstart(addrport, unix_socket_prefix)) {
+ /* Not a Unix socket path. */
+ return -ENOENT;
+ }
+
log_warn(LD_CONFIG,
"Port configuration %s is for an AF_UNIX socket, but we have no"
"support available on this platform",
@@ -6218,13 +6211,6 @@ parse_ports(or_options_t *options, int validate_only,
*msg = tor_strdup("Invalid ControlSocket configuration");
goto err;
}
- if (parse_port_config(ports, options->SocksSocket, NULL,
- "SocksSocket",
- CONN_TYPE_AP_LISTENER, NULL, 0,
- CL_PORT_IS_UNIXSOCKET) < 0) {
- *msg = tor_strdup("Invalid SocksSocket configuration");
- goto err;
- }
}
if (! options->ClientOnly) {
if (parse_port_config(ports,
@@ -6268,8 +6254,6 @@ parse_ports(or_options_t *options, int validate_only,
!! count_real_listeners(ports, CONN_TYPE_OR_LISTENER);
options->SocksPort_set =
!! count_real_listeners(ports, CONN_TYPE_AP_LISTENER);
- options->SocksSocket_set =
- !! count_real_listeners(ports, CONN_TYPE_AP_LISTENER);
options->TransPort_set =
!! count_real_listeners(ports, CONN_TYPE_AP_TRANS_LISTENER);
options->NATDPort_set =
diff --git a/src/or/connection.c b/src/or/connection.c
index f26ada0..170d3d7 100644
--- a/src/or/connection.c
+++ b/src/or/connection.c
@@ -1496,7 +1496,7 @@ connection_handle_listener_read(connection_t *conn, int new_type)
if (new_type == CONN_TYPE_AP && conn->socket_family == AF_UNIX) {
newconn->port = 0;
newconn->address = tor_strdup(conn->address);
- log_info(LD_NET, "New SOCKS SocksSocket connection opened");
+ log_info(LD_NET, "New SOCKS AF_UNIX connection opened");
}
if (new_type == CONN_TYPE_CONTROL) {
log_notice(LD_CONTROL, "New control connection opened from %s.",
diff --git a/src/or/or.h b/src/or/or.h
index 4906878..4207f3d 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -3463,9 +3463,6 @@ typedef struct {
* for control connections. */
int ControlSocketsGroupWritable; /**< Boolean: Are control sockets g+rw? */
- config_line_t *SocksSocket; /**< List of Unix Domain Sockets to listen on
- * for SOCKS connections. */
-
int SocksSocketsGroupWritable; /**< Boolean: Are SOCKS sockets g+rw? */
/** Ports to listen on for directory connections. */
config_line_t *DirPort_lines;
@@ -3489,7 +3486,6 @@ typedef struct {
*/
unsigned int ORPort_set : 1;
unsigned int SocksPort_set : 1;
- unsigned int SocksSocket_set : 1;
unsigned int TransPort_set : 1;
unsigned int NATDPort_set : 1;
unsigned int ControlPort_set : 1;
More information about the tor-commits
mailing list