aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Merge branch 'bug11156_issue2_squashed'Nick Mathewson2014-04-23
|\
| * Slightly improve the documentation of src/or/transports.cGeorge Kadianakis2014-04-23
| | | | | | | | | | Make it clear that a SIGHUP is not the only action that can cause a config re-read.
| * Rename the got_hup element of managed proxies.George Kadianakis2014-04-23
| | | | | | | | | | Since we need to toggle that element in non-SIGHUP situations too where the config was re-read (like in SETCONF or RESETCONF).
| * Don't halt bootstrap to figure out if we should restart PT proxies.George Kadianakis2014-04-23
| | | | | | | | | | Instead, figure out if we should restart PT proxies _immediately_ after we re-read the config file.
* | Merge remote-tracking branch 'origin/maint-0.2.4'Nick Mathewson2014-04-23
|\ \ | | | | | | | | | This is an "ours" merge, to avoid taking the 0.2.4 version of the
| * \ Merge remote-tracking branch 'public/bug9229_024' into maint-0.2.4Nick Mathewson2014-04-23
| |\ \
| | * | Update ns downloads when we receive a bridge descriptorNick Mathewson2014-03-10
| | | | | | | | | | | | | | | | | | | | | | | | This prevents long stalls when we're starting with a state file but with no bridge descriptors. Fixes bug 9229. I believe this bug has been present since 0.2.0.3-alpha.
* | | | Merge remote-tracking branch 'public/bug9229_025'Nick Mathewson2014-04-23
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | Conflicts: src/or/entrynodes.c
| * | | | Make num_bridges_usable work properly.Nick Mathewson2014-04-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | My first implementation was broken, since it returned "whether there is one bridge" rather than "how many bridges." Also, the implementation for the n_options_out feature in choose_random_entry_impl was completely broken due to a missing *.
| * | | | Fix our check for the "first" bridge descriptor.Nick Mathewson2014-03-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is meant to be a better bug 9229 fix -- or at least, one more in tune with the intent of the original code, which calls router_retry_directory_downloads() only on the first bridge descriptor.
* | | | | Merge remote-tracking branch 'public/bug9963_v2_024'Nick Mathewson2014-04-18
|\ \ \ \ \
| * | | | | Log descriptor-download bootstrapping messages less verboselyNick Mathewson2014-03-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a fix for 9963. I say this is a feature, but if it's a bugfix, it's a bugfix on 0.2.4.18-rc. Old behavior: Mar 27 11:02:19.000 [notice] Bootstrapped 50%: Loading relay descriptors. Mar 27 11:02:20.000 [notice] Bootstrapped 51%: Loading relay descriptors. Mar 27 11:02:20.000 [notice] Bootstrapped 52%: Loading relay descriptors. ... [Many lines omitted] ... Mar 27 11:02:29.000 [notice] Bootstrapped 78%: Loading relay descriptors. Mar 27 11:02:33.000 [notice] We now have enough directory information to build circuits. New behavior: Mar 27 11:16:17.000 [notice] Bootstrapped 50%: Loading relay descriptors Mar 27 11:16:19.000 [notice] Bootstrapped 55%: Loading relay descriptors Mar 27 11:16:21.000 [notice] Bootstrapped 60%: Loading relay descriptors Mar 27 11:16:21.000 [notice] Bootstrapped 65%: Loading relay descriptors Mar 27 11:16:21.000 [notice] Bootstrapped 70%: Loading relay descriptors Mar 27 11:16:21.000 [notice] Bootstrapped 75%: Loading relay descriptors Mar 27 11:16:21.000 [notice] We now have enough directory information to build circuits.
* | | | | | Improved message when running sandbox on Linux without libseccompNick Mathewson2014-04-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously we said "Sandbox is not implemented on this platform" on Linux boxes without libseccomp. Now we say that you need to build Tor built with libseccomp. Fixes bug 11543; bugfix on 0.2.5.1-alpha.
* | | | | | Merge remote-tracking branch 'public/ticket11528_024'Nick Mathewson2014-04-17
|\ \ \ \ \ \
| * | | | | | Elevate server TLS cipher preferences over clientNick Mathewson2014-04-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The server cipher list is (thanks to #11513) chosen systematically to put the best choices for Tor first. The client cipher list is chosen to resemble a browser. So let's set SSL_OP_CIPHER_SERVER_PREFERENCE to have the servers pick according to their own preference order.
* | | | | | | Remove spurious libevent include in sandbox.cNick Mathewson2014-04-17
| | | | | | |
* | | | | | | Fix uninitialized-ram free in unit testsNick Mathewson2014-04-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix on fb595922; bug not in any released Tor. Found with --enable-expensive-hardening.
* | | | | | | Merge more changes files (verbatim) into the changelogNick Mathewson2014-04-17
| | | | | | |
* | | | | | | Merge remote-tracking branch 'public/sandbox_fixes_rebased_2'Nick Mathewson2014-04-16
|\ \ \ \ \ \ \
| * | | | | | | add a changes file for the sandbox fixes seriesNick Mathewson2014-04-16
| | | | | | | |
| * | | | | | | Log the name of the failing syscall on failureNick Mathewson2014-04-16
| | | | | | | |
| * | | | | | | Block certain option transitions while sandbox enabledNick Mathewson2014-04-16
| | | | | | | |
| * | | | | | | Sandbox: permit O_NONBLOCK and O_NOCTTY for files we refuseNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL needs this, or RAND_poll() will kill the process. Also, refuse with EACCESS, not errno==-1 (!).
| * | | | | | | Don't reload logs or rewrite pidfile while sandbox is activeNick Mathewson2014-04-16
| | | | | | | |
| * | | | | | | Don't allow change to ConnLimit while sandbox is activeNick Mathewson2014-04-16
| | | | | | | |
| * | | | | | | Allow reloading torrc and writing to router-stabilityNick Mathewson2014-04-16
| | | | | | | |
| * | | | | | | Use SCMP_CMP_MASKED_EQ to allow flags, not force themNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Older versions of Libevent are happy to open SOCK_DGRAM sockets non-cloexec and non-nonblocking, and then set those flags afterwards. It's nice to be able to allow a flag to be on or off in the sandbox without having to enumerate all its values. Also, permit PF_INET6 sockets. (D'oh!)
| * | | | | | | Add a couple of missing renames so the server sandbox works againNick Mathewson2014-04-16
| | | | | | | |
| * | | | | | | Get Libevent's PRNG functioning under the linux sandboxNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Libevent uses an arc4random implementation (I know, I know) to generate DNS transaction IDs and capitalization. But it liked to initialize it either with opening /dev/urandom (which won't work under the sandbox if it doesn't use the right pointer), or with sysctl({CTL_KERN,KERN_RANDOM,RANDOM_UUIC}). To make _that_ work, we were permitting sysctl unconditionally. That's not such a great idea. Instead, we try to initialize the libevent PRNG _before_ installing the sandbox, and make sysctl always fail with EPERM under the sandbox.
| * | | | | | | Make sure everything using an interned string is preceded by a logNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (It's nice to know what we were about to rename before we died from renaming it.)
| * | | | | | | Introduce arg-counting macros to wrap seccomp_rule_add()Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The compiler doesn't warn about this code: rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), 1, SCMP_CMP(0, SCMP_CMP_EQ, AT_FDCWD), SCMP_CMP(1, SCMP_CMP_EQ, param->value), SCMP_CMP(2, SCMP_CMP_EQ, O_RDONLY|...)); but note that the arg_cnt argument above is only 1. This means that only the first filter (argument 0 == AT_FDCWD) is actually checked! This patch also fixes the above error in the openat() filter. Earlier I fixed corresponding errors in filters for rename() and mprotect().
| * | | | | | | Fix sandbox protection for renameNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (We were only checking the first parameter of each rename call.)
| * | | | | | | Upgrade warning about missing interned string for sandboxNick Mathewson2014-04-16
| | | | | | | |
| * | | | | | | Have sandbox string protection include multi-valued parmeters.Nick Mathewson2014-04-16
| | | | | | | |
| * | | | | | | Clean up sandbox structures a bitNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Drop pindex,pindex2 as unused. Admit a type to avoid using a void*
| * | | | | | | Add missing rename function for non-linux platformsNick Mathewson2014-04-16
| | | | | | | |
| * | | | | | | Drop 'fr' parameter from sandbox code.Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Appearently, the majority of the filenames we pass to sandbox_cfg_allow() functions are "freeable right after". So, consider _all_ of them safe-to-steal, and add a tor_strdup() in the few cases that aren't. (Maybe buggy; revise when I can test.)
| * | | | | | | Remove nonsensical exec permission from sandbox code.Nick Mathewson2014-04-16
| | | | | | | |
| * | | | | | | Add 'rename' to the sandboxed syscallsNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (If we don't restrict rename, there's not much point in restricting open, since an attacker could always use rename to make us open whatever they want.)
| * | | | | | | Only intern one copy of each magic string for the sandboxNick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we intern two copies of a string, later calls to sandbox_intern_string will give the wrong one sometimes.
| * | | | | | | Fix some initial sandbox issues.Nick Mathewson2014-04-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow files that weren't in the list; Allow the _sysctl syscall; allow accept4 with CLOEXEC and NONBLOCK.
* | | | | | | | Attribute 13304 and 13306 to 0.2.4.4-alpha.Nick Mathewson2014-04-16
| | | | | | | |
* | | | | | | | Merge remote-tracking branch 'andrea/bug11304'Nick Mathewson2014-04-16
|\ \ \ \ \ \ \ \
| * | | | | | | | Call connection_or_close_for_error() properly if write_to_buf() ever fails ↵Andrea Shepard2014-04-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | on an orconn
* | | | | | | | | Merge remote-tracking branch 'andrea/bug11306'Nick Mathewson2014-04-16
|\ \ \ \ \ \ \ \ \
| * | | | | | | | | Avoid redundant calls to connection_mark_for_close() on listeners when ↵Andrea Shepard2014-04-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | setting DisableNetwork to 1
| * | | | | | | | | Close orconns correctly through channels when setting DisableNetwork to 1Andrea Shepard2014-04-15
| |/ / / / / / / /
* | | | | | | | | Merge remote-tracking branch 'public/bug11477'Nick Mathewson2014-04-16
|\ \ \ \ \ \ \ \ \
| * | | | | | | | | New --enable-expensive-hardening optionNick Mathewson2014-04-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It turns on -fsanitize=address and -fsanitize=ubsan if they work. Most relays won't want this. Some clients may. Ticket 11477.
* | | | | | | | | | Merge branch '10267_plus_10896_rebased_twice'Nick Mathewson2014-04-16
|\ \ \ \ \ \ \ \ \ \ | |_|_|/ / / / / / / |/| | | | | | | | |
generated by cgit v1.2.3 (git 2.25.4) at 2024-09-27 04:30:37 +0000